PC-Routinekontrolle (Sabina...)

#1 Hallo Sabina

Mir ist nichts Unübliches aufgefallen bei der Arbeit mit meinem PC. Trotzdem möchte ich ihn gerne wieder einmal quer-checken lassen. Kannst du mir diesen Gefallen tun? Ich wäre froh darum.
Hier die üblichen Logs:

Combofix Log

"Main-Account" - 2007-05-27 23:15:02 Service Pack 2
ComboFix 07-05.27.V - Running from: "C:\Dokumente und Einstellungen\Main-Account\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\WINDOWS\system32\taskmgr.com"
"C:\install.log"
"C:\WINDOWS\regedit.com"
"C:\WINDOWS\system32\lsp.dll"


((((((((((((((((((((((((((((((( Files Created from 2007-04-27 to 2007-05-27 ))))))))))))))))))))))))))))))))))


2007-05-18 22:46 129,824 --a------ C:\WINDOWS\system32\lvci1051.dll
2007-05-18 22:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Logitech
2007-05-18 22:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Logishrd


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 20:13:23 -------- d-----w C:\Programme\Eraser
2007-05-27 20:08:48 -------- d-----w C:\Programme\ZKB Onba
2007-05-18 21:03:16 -------- d-----w C:\Programme\Gemeinsame Dateien\LogiShrd
2007-05-18 20:44:59 -------- d-----w C:\Programme\Logitech
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-04-27 12:52:11 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
2007-04-18 16:13:24 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-08 19:15:41 65,692 ----a-w C:\WINDOWS\system32\perfc007.dat
2007-04-08 19:15:41 395,990 ----a-w C:\WINDOWS\system32\perfh007.dat
2007-04-08 18:42:32 -------- d-----w C:\DOKUME~1\MAIN-A~1\ANWEND~1\DataLayer
2007-03-17 13:44:25 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 23:02:26 42,648 ----a-w C:\WINDOWS\zllsputility_loc0407.dll
2007-03-08 23:02:24 54,936 ----a-w C:\WINDOWS\system32\vsutil_loc0407.dll
2007-03-08 23:02:20 22,168 ----a-w C:\WINDOWS\system32\imsinstall_loc0407.dll
2007-03-08 23:02:20 18,072 ----a-w C:\WINDOWS\system32\imslsp_install_loc0407.dll
2007-03-08 23:02:00 75,512 ----a-w C:\WINDOWS\zllsputility.exe
2007-03-08 23:01:42 1,087,216 ----a-w C:\WINDOWS\system32\zpeng24.dll
2007-03-08 15:36:30 579,072 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:30 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:30 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:32:24 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
2007-03-05 11:34:28 676,224 ----a-w C:\WINDOWS\system32\OGACheckControl.DLL
2007-03-01 17:02:36 28,747 ----a-w C:\WINDOWS\hpoins03.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 06:12]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Programme\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Programme\Synaptics\SynTP\SynTPLpr.exe" [2003-04-24 16:51]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2003-04-24 16:44]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2002-12-02 10:22]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2003-01-09 10:41]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2002-10-23 17:18]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2003-01-09 09:57]
"AGRSMMSG"="AGRSMMSG.exe" []
"InCD"="C:\Programme\Ahead\InCD\InCD.exe" [2003-07-31 18:17]
"Microsoft Works Update Detection"="C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-24 20:43]
"HP Component Manager"="C:\Programme\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54]
"Acronis True Image Monitor"="C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe" [2005-07-12 10:13]
"Acronis Scheduler2 Service"="C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2005-07-12 10:13]
"PCSuiteTrayApplication"="C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 10:39]
"DataLayer"="C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 10:30]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 09:58 C:\WINDOWS\system32\bthprops.cpl]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2006-05-20 08:21]
"UserFaultCheck"="%systemroot%\system32\dumprep 0 -u" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"HP Software Update"="C:\Programme\HP\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-02-16 11:54]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2007-03-14 20:05]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
"LogitechCommunicationsManager"="C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12]
"LogitechQuickCamRibbon"="C:\Programme\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13]
"LVCOMSX"="C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe" [2007-02-06 17:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ

*Newly Created Service* -PROCEXP90


~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20060515-225309-672
O16 - DPF: {AFAB176A-0D25-436A-8555-286F6D7AA388} (CRegFreezeScanModule Object) - http://www.actualresearch.com/de/files/rfscanax.cab

?????????????????????????????????????????????

backup-20060106-161752-833
O17 - HKLM\System\CCS\Services\Tcpip\..\{A525E3DB-0052-49B2-9359-04A9D4EAAEE9}: NameServer = 85.255.115.102,85.255.112.5

backup-20060106-161752-900
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB8DAEEA-3585-4648-8262-949198442C04}: NameServer = 85.255.115.102,85.255.112.5

backup-20060106-161752-167
O17 - HKLM\System\CCS\Services\Tcpip\..\{D142DDE0-6D28-4327-9911-E13A102316C1}: NameServer = 85.255.115.102,85.255.112.5

backup-20060106-161752-986
O17 - HKLM\System\CCS\Services\Tcpip\..\{22DE1219-3252-408E-9DB0-35547388DBA4}: NameServer = 85.255.115.102,85.255.112.5

backup-20060106-161752-297
O17 - HKLM\System\CCS\Services\Tcpip\..\{8100A7A3-96FC-4482-9136-D757FE666C3C}: NameServer = 85.255.115.102,85.255.112.5
Contents of the 'Scheduled Tasks' folder
2007-05-01 17:45:01 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 23:19:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

cmd.exe [3792]


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acronis True Image Monitor"="\"C:\\Programme\\Acronis\\TrueImage\\TrueImageMonitor.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00000001-0000-1000-8000-0002ee000002}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001101-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]


Completion time: 2007-05-27 23:20:32
C:\ComboFix-quarantined-files.txt ... 2007-05-27 23:20

--- E O F ---



HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 23:36:59, on 27.05.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\Programme\HP\HP Software Update\HPWuSchd.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programme\Logitech\QuickCam10\QuickCam10.exe
C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Dokumente und Einstellungen\Main-Account\Desktop\Antispyware\HJT\HJT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


datfind Log

system32
Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\WINDOWS\system32

27.05.2007 23:26 1'158 wpa.dbl
27.05.2007 22:32 55'146 vsconfig.xml
25.05.2007 16:28 3'002 CONFIG.NT
18.05.2007 23:03 8'702 lvcoinst.log
30.04.2007 17:46 745'600 aswBoot.exe
30.04.2007 17:35 95'872 AVASTSS.scr
27.04.2007 22:45 14'970'328 MRT.exe
27.04.2007 14:59 4'254 jupdate-1.6.0_01-b06.log
27.04.2007 14:52 4'212 zllictbl.dat
18.04.2007 18:13 2'854'400 msi.dll
08.04.2007 21:15 384'930 perfh009.dat
08.04.2007 21:15 54'614 perfc009.dat
08.04.2007 21:15 395'990 perfh007.dat
08.04.2007 21:15 65'692 perfc007.dat
08.04.2007 21:15 910'304 PerfStringBackup.INI
08.04.2007 20:34 254'272 FNTCACHE.DAT
03.04.2007 16:28 383'488 ieapfltr.dll
03.04.2007 06:36 2'453'952 ieapfltr.dat
02.04.2007 14:21 428'032 swreg.exe
17.03.2007 15:44 293'376 winsrv.dll
14.03.2007 02:04 139'264 javaws.exe
14.03.2007 02:04 69'632 javacpl.cpl
14.03.2007 00:31 135'168 javaw.exe
14.03.2007 00:31 135'168 java.exe
09.03.2007 13:51 270'336 xpsp3res.dll
09.03.2007 01:02 54'936 vsutil_loc0407.dll
09.03.2007 01:02 18'072 imslsp_install_loc0407.dll
09.03.2007 01:02 22'168 imsinstall_loc0407.dll
09.03.2007 01:02 394'192 vsdatant.sys
09.03.2007 01:01 1'087'216 zpeng24.dll
09.03.2007 01:01 71'408 zlcommdb.dll
09.03.2007 01:01 46'832 vswmi.dll
09.03.2007 01:01 83'696 zlcomm.dll
09.03.2007 01:01 100'080 vsxml.dll
09.03.2007 01:01 472'816 vsutil.dll
09.03.2007 01:01 276'208 vspubapi.dll
09.03.2007 01:01 71'408 vsregexp.dll
09.03.2007 01:01 104'176 vsmonapi.dll
09.03.2007 01:01 157'424 vsinit.dll
09.03.2007 01:01 83'696 vsdata.dll
09.03.2007 01:01 796'312 libeay32_0.9.6l.dll
08.03.2007 17:36 40'960 mf3216.dll
08.03.2007 17:36 579'072 user32.dll
08.03.2007 17:36 281'600 gdi32.dll
08.03.2007 17:32 1'843'712 win32k.sys
07.03.2007 19:40 822'784 wininet.dll
07.03.2007 19:40 232'960 webcheck.dll
07.03.2007 19:40 1'150'464 urlmon.dll
07.03.2007 19:40 105'984 url.dll
07.03.2007 19:40 670'720 mstime.dll
07.03.2007 19:40 102'400 occache.dll
07.03.2007 19:40 477'696 mshtmled.dll
07.03.2007 19:40 193'024 msrating.dll
07.03.2007 19:40 3'581'952 mshtml.dll
07.03.2007 19:40 458'752 msfeeds.dll
07.03.2007 19:40 1'823'744 inetcpl.cpl
07.03.2007 19:40 51'712 msfeedsbs.dll
07.03.2007 19:40 27'136 jsproxy.dll
07.03.2007 19:40 266'752 iertutil.dll
07.03.2007 19:40 44'544 iernonce.dll
07.03.2007 19:40 6'054'400 ieframe.dll
07.03.2007 19:40 132'608 extmgr.dll
07.03.2007 19:40 153'088 ieakeng.dll
07.03.2007 19:40 230'400 ieaksie.dll
07.03.2007 19:40 384'000 iedkcs32.dll
07.03.2007 19:40 124'928 advpack.dll
07.03.2007 10:27 56'832 ie4uinit.exe
05.03.2007 13:34 676'224 OGACheckControl.DLL
28.02.2007 18:02 2'182'656 ntoskrnl.exe


systemp

Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\DOKUME~1\MAIN-A~1\LOKALE~1\Temp

27.05.2007 23:31 173 jusched.log
27.05.2007 23:30 1'040 LVCOMSX.LOG
27.05.2007 23:27 766 callingapps.xml
3 Datei(en) 1'979 Bytes
0 Verzeichnis(se), 11'119'906'816 Bytes frei


windows

Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\WINDOWS

27.05.2007 23:06 60 setupact.log
27.05.2007 22:32 3'834 ModemLog_Agere Systems AC'97 Modem.txt
27.05.2007 22:32 159 wiadebug.log
27.05.2007 22:32 1'101'769 WindowsUpdate.log
27.05.2007 22:32 50 wiaservc.log
27.05.2007 22:31 0 0.log
27.05.2007 22:31 2'048 bootstat.dat
27.05.2007 22:30 32'606 SchedLgU.Txt
27.05.2007 22:27 18'872 tsoc.log
27.05.2007 22:27 9'945 ntdtcsetup.log
27.05.2007 22:27 16'401 comsetup.log
27.05.2007 22:27 7'927 iis6.log
27.05.2007 22:27 2'736 ocmsn.log
27.05.2007 22:27 1'374 imsins.log
27.05.2007 22:27 7'698 KB927891.log
27.05.2007 22:27 23'328 ocgen.log
27.05.2007 22:27 2'472 msgsocm.log
27.05.2007 22:27 49'271 FaxSetup.log
27.05.2007 22:27 80'002 setupapi.log
27.05.2007 22:27 7'419 updspapi.log
22.05.2007 19:37 87'040 catchme.exe
18.05.2007 22:54 1'374 imsins.BAK
18.05.2007 22:54 19'690 KB931768-IE7.log
18.05.2007 22:53 12'368 KB930916.log
18.05.2007 22:38 620 KB916089.log
27.04.2007 15:06 14'769 KB932168.log
27.04.2007 15:06 10'868 KB931261.log
27.04.2007 15:06 11'120 KB930178.log
27.04.2007 15:06 12'480 KB931784.log
08.04.2007 20:32 12'569 KB925902.log
08.04.2007 18:27 0 setuperr.log
09.03.2007 01:02 42'648 zllsputility_loc0407.dll
09.03.2007 01:02 75'512 zllsputility.exe
01.03.2007 19:02 28'747 hpoins03.dat
01.03.2007 19:02 887 win.ini
26.02.2007 15:35 7'907 cdplayer.ini


temp

Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\WINDOWS\Temp

27.05.2007 23:27 409 WGANotify.settings
27.05.2007 23:26 43 WGAErrLog.txt
27.05.2007 22:32 16'384 Perflib_Perfdata_740.dat
27.05.2007 22:31 256 ZLT079cf.TMP
27.05.2007 22:31 256 ZLT04f96.TMP
5 Datei(en) 17'348 Bytes
0 Verzeichnis(se), 11'119'898'624 Bytes frei


down

Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\WINDOWS\Downloaded Program Files

28.02.2007 20:24 361 OGAControl.inf


c

Datentr„ger in Laufwerk C: ist 65_01_31
Volumeseriennummer: ECAE-D346

Verzeichnis von C:\

27.05.2007 23:41 0 sys.txt
27.05.2007 23:41 685 down.txt
27.05.2007 23:40 491 tmp.txt
27.05.2007 23:40 7'472 system.txt
27.05.2007 23:39 392 systemtemp.txt
27.05.2007 23:39 112'874 system32.txt
27.05.2007 23:23 9'587 ComboFix.txt
27.05.2007 23:20 766 ComboFix-quarantined-files.txt
27.05.2007 22:31 792'723'456 pagefile.sys

Mfg

Maravilha