Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI

OTL logfile created on: 07.06.2012 17:50:12 - Run 1
OTL by OldTimer - Version 3.2.46.2     Folder = C:\Dokumente und Einstellungen\XXXXX\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 474,67 Mb Available Physical Memory | 46,38% Memory free
3,83 Gb Paging File | 3,12 Gb Available in Paging File | 81,46% Paging File free
Paging file location(s): C:\pagefile.sys 3000 4000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 117,19 Gb Total Space | 39,00 Gb Free Space | 33,28% Space Free | Partition Type: NTFS
Drive D: | 107,42 Gb Total Space | 75,65 Gb Free Space | 70,42% Space Free | Partition Type: NTFS
Drive E: | 8,27 Gb Total Space | 2,17 Gb Free Space | 26,22% Space Free | Partition Type: FAT32
 
Computer Name: YYYYY | User Name: XXXXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.07 17:49:35 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXXXX\Desktop\OTL.exe
PRC - [2012.05.21 22:38:02 | 003,905,920 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2012.05.09 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 14:59:47 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 14:59:47 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 14:59:47 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2010.10.12 13:56:40 | 000,979,328 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Programme\EPSON Software\Event Manager\EEventManager.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
PRC - [2009.03.27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Programme\LSI SoftModem\agrsmsvc.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.11.03 19:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2006.11.03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MsMpEng.exe
PRC - [2004.02.03 17:15:54 | 005,794,816 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.07 17:02:32 | 000,117,760 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2012.06.07 17:02:32 | 000,065,024 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012.06.07 17:02:32 | 000,052,736 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2012.06.07 17:02:32 | 000,052,224 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2012.05.09 14:59:48 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2003.06.16 17:42:20 | 000,049,152 | ---- | M] () -- C:\WINDOWS\CNYUSB.dll
MOD - [2003.05.27 17:13:02 | 000,024,576 | ---- | M] () -- C:\WINDOWS\HKCYDLL.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (DTGuardService)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.09 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 14:59:47 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.03.21 13:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.08.20 22:08:46 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0)
SRV - [2009.03.27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Programme\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 04:22:38 | 000,033,280 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\clipsrv.exe -- (ClipSrv)
SRV - [2008.04.14 04:22:31 | 000,186,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\upnphost.dll -- (upnphost)
SRV - [2008.04.14 04:22:30 | 000,071,680 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\ssdpsrv.dll -- (SSDPSRV)
SRV - [2008.04.14 04:22:16 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 04:22:15 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 04:22:07 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2006.11.03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2005.11.14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005.07.20 14:17:40 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Service\Software Jukebox v2.0 Service File.exe -- (Software Jukebox v2.0 Service)
SRV - [2005.04.21 16:57:38 | 000,110,672 | ---- | M] () [Auto | Stopped] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005.04.21 16:57:22 | 000,221,266 | ---- | M] () [Auto | Stopped] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
SRV - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand | Stopped] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (XDva288)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV561AV.SYS -- (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | Boot | Stopped] --  -- (PDDSLHND)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PDDSLADP.SYS -- (PDDSLADP)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\lvusbsta.sys -- (LVUSBSta)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\iiusbisp.sys -- (IIUSBISP)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | Auto | Stopped] --  -- (dtgntdd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (cpuz132)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.26 21:54:41 | 000,099,856 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtihdXP3.sys -- (AtiHDAudioService)
DRV - [2012.05.26 21:53:20 | 007,746,048 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2012.05.09 14:59:49 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 14:59:49 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.14 14:47:15 | 000,076,800 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SSHDRV84.sys -- (SSHDRV84)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.12.02 15:13:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.12.02 15:13:28 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.12.02 15:13:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.12.02 15:13:22 | 000,018,304 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010.08.20 22:08:46 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2010.08.02 18:43:41 | 000,017,408 | ---- | M] (ICSI Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBCRFT.SYS -- (CardReaderFilter)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.01.27 04:09:02 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (npf)
DRV - [2009.11.19 01:24:26 | 000,095,232 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009.08.26 11:44:00 | 001,025,920 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\3xHybrid.sys -- (3xHybrid)
DRV - [2009.08.13 15:07:12 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.06.10 00:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.04.14 04:02:16 | 000,120,576 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia)
DRV - [2008.04.14 03:58:18 | 000,154,112 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmio.sys -- (dmio)
DRV - [2008.04.14 03:58:13 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.13 20:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008.04.13 20:32:36 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.01.10 19:49:34 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ACEDRV05.sys -- (ACEDRV05)
DRV - [2007.04.10 23:46:53 | 001,966,312 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VX1000.sys -- (VX1000)
DRV - [2005.05.12 14:39:56 | 001,287,296 | ---- | M] (C-Media Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cmudax.sys -- (cmudax)
DRV - [2004.03.17 14:10:40 | 000,113,664 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HdAudio.sys -- (HdAudAddService)
DRV - [2004.01.16 10:31:56 | 000,380,736 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00)
DRV - [2003.12.19 17:13:30 | 000,011,672 | ---- | M] (Chicony) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\UKBFLT.sys -- (UKBFLT)
DRV - [2003.12.05 18:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2002.08.29 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2002.08.29 14:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC)
DRV - [2002.08.29 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\ws2ifsl.sys -- (WS2IFSL)
DRV - [2002.08.29 14:00:00 | 000,005,888 | ---- | M] (Microsoft Corp., Veritas Software.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmload.sys -- (dmload)
DRV - [2002.05.21 10:50:00 | 000,068,886 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFlt2.sys -- (LMouFlt2)
DRV - [2002.05.21 10:50:00 | 000,023,270 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFlt2.sys -- (LHidFlt2)
DRV - [2002.05.21 10:50:00 | 000,005,846 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LKbdFlt2.sys -- (LKbdFlt2)
DRV - [2001.11.14 18:07:42 | 000,010,761 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\x10uif.sys -- (X10UIF)
DRV - [2001.08.17 13:46:40 | 000,006,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\enum1394.sys -- (ENUM1394)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Wikipedia
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 61 9C CD B1 80 CA 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {E1E7A3A8-BCEF-4ED4-A21C-AD9A3ECC9D0D}
IE - HKCU\..\SearchScopes\{13E17ECC-8D46-4FE1-8475-9A5B4FD71A96}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKCU\..\SearchScopes\{33771CA0-1A3B-430C-BD9E-4E642A03E046}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{801A71E8-974E-4E2A-8384-19DA191C096A}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{C2D9B31A-B0FC-4A2A-9F04-2AFE9BA5D6DC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{E1E7A3A8-BCEF-4ED4-A21C-AD9A3ECC9D0D}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz=1I7DVXE_de
IE - HKCU\..\SearchScopes\{EAD5DF1B-1509-41DA-A163-EBB3464F081F}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://de.wikipedia.org/wiki/Hauptseite"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Picasa 3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2012.06.07 16:37:20 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\vitzo.com/VDownloader: C:\Programme\VDownloader\Addons\npVDownloader.dll (Vitzo)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@vdownloader.com: C:\Programme\VDownloader\Addons\FireFox [2012.05.06 20:30:08 | 000,000,000 | ---D | M]
 
[2011.06.05 00:53:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Extensions
[2011.06.05 00:53:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2011.07.25 19:44:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\tu386rha.default\extensions
[2008.04.19 12:25:18 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\tu386rha.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.12 12:59:53 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\tu386rha.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.06.05 00:53:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Sunbird\Profiles\jud41i4b.default\extensions
[2008.06.18 18:08:09 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\tu386rha.default\searchplugins\icqplugin.xml
 
O1 HOSTS File: ([2010.06.13 12:57:43 | 000,404,451 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	全讯网,å�šå½©ä¼˜æƒ*,皇å†*æ*£ç½‘cr67com,皇å†*比分,皇å†*å�³æ—¶æŒ‡æ•°,太阳城代ç�†112scg,tt娱ä¹�城8bc8,网上真钱娱
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	²©²Êͨ,²©²ÊÍø,½ð±¦²©188,²©²ÊͨÆÀ¼¶,°Ù¼ÒÀÖ,°ÂÃî°Ù¼ÒÀÖ
O1 - Hosts: 127.0.0.1	100sexlinks.com - Informationen zum Thema Sex links. Diese Website steht zum Verkauf!
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	Wips.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 13983 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe (Chicony)
O4 - HKLM..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd File not found
O4 - HKLM..\Run: [EEventManager] C:\Programme\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [StartCCC] c:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = FF 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:  = 
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Programme\4shared Desktop\down_all.htm File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} hxxp://www.lizardtech.com/download/files/win/djvuplugin/de_DE/DjVuControl_de_DE.cab (Reg Error: Key error.)
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab (Macromedia Authorware Web Player Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} https://signup.msn.com/pages/MsnInstC.cab (InstallerBehaviorFactory Class)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} hxxp://musicmix.messenger.msn.com/Medialogic.CAB (CMediaMix Object)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} hxxp://software-dl.real.com/23ea10ffae3267990f05/netzip/RdxIE601_de.cab (Reg Error: Key error.)
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} hxxp://www.ca.com/us/securityadvisor/pestscan/pestscan.cab (PSFormX Control)
O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} https://stream.web.de/mail/activex/mail_upload_11213.cab (Attachment Upload Control)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187955729468 (WUWebControl Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} hxxp://www.acclaim.com/cabs/acclaim_v4.cab (GameLauncher Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187955695140 (MUWebControl Class)
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} hxxp://www.ca.com/de/securityadvisor/virusinfo/webscan.cab (WScanCtl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab (Microsoft Download Manager ActiveX control)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1208886004 (Image Uploader Control)
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} hxxp://messenger.zone.msn.com/binary/Bankshot.cab57213.cab (CBreakshotControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab (CTAdjust Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{599A69C9-087F-4D6D-9556-71BBACF9DB25}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe) - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Programme\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - No CLSID value found.
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\Eigene Bilder\(Abstract - X Ray) - Wallpapers4Desktop.com 023.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\Eigene Bilder\(Abstract - X Ray) - Wallpapers4Desktop.com 023.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.06.22 17:43:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{65533088-6ab3-11d9-9a71-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\explorer.exe -- [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{de79ffbb-49f0-11d9-af23-000c76adb999}\Shell\AutoRun\command - "" = C:\WINDOWS\explorer.exe -- [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.07 17:49:35 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXXXX\Desktop\OTL.exe
[2012.06.07 17:01:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\SUPERAntiSpyware.com
[2012.06.07 17:01:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2012.06.07 17:01:04 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2012.06.07 16:54:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\ElevatedDiagnostics
[2012.06.07 16:15:40 | 000,000,000 | ---D | C] -- C:\Programme\Windows Defender
[2012.06.07 16:10:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\My Downloads
[2012.06.07 16:10:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Download Manager
[2012.06.07 16:10:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Download Manager
[2012.06.07 15:40:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime
[2012.06.07 15:17:45 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\XXXXX\Recent
[2012.06.07 14:59:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Anwendungsdaten\Secunia PSI
[2012.06.07 14:58:36 | 000,000,000 | ---D | C] -- C:\Programme\Secunia_PSI
[2012.06.07 14:57:56 | 001,754,456 | ---- | C] (Secunia) -- C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\PSISetup.exe
[2012.06.02 21:09:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Startmenü\Programme\Valve
[2012.06.01 23:08:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\Backup HTC
[2012.05.28 17:06:27 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Doktorarbeit
[2012.05.26 23:28:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\Tomb Raider - Legend
[2012.05.26 22:58:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ATI
[2012.05.26 22:02:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Catalyst Control Center
[2012.05.21 15:42:01 | 000,000,000 | ---D | C] -- C:\temp
[2012.05.21 15:40:14 | 000,000,000 | ---D | C] -- C:\Programme\ElsterFormular
[2012.05.21 14:42:03 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Bewerbungsvorlage Famulatur
[2012.05.13 23:58:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\.pdfsam
[2012.05.13 23:54:16 | 000,000,000 | ---D | C] -- C:\Programme\PDF-Merging
[2012.05.13 23:54:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDF Split And Merge
[2012.05.13 23:46:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\com.essexreddevelopment.mergepdfmac
[2011.06.06 01:27:18 | 000,143,240 | ---- | C] (Ask.com) -- C:\Programme\Gemeinsame Dateien\ApnStub.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.07 18:02:00 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{AF956C0B-8C67-475F-A1E3-FAE2CFD0BBC1}.job
[2012.06.07 17:58:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{3F92B61E-D798-494B-8489-ED4055E7ED66}.job
[2012.06.07 17:49:35 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXXXX\Desktop\OTL.exe
[2012.06.07 17:48:21 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\defogger_reenable
[2012.06.07 17:47:32 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Defogger.exe
[2012.06.07 17:01:10 | 000,001,654 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.07 16:39:32 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.06.07 16:38:01 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.07 16:36:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.07 16:36:06 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.07 15:53:02 | 000,000,402 | -H-- | M] () -- C:\WINDOWS\tasks\{B67FBE90-FF18-4999-A349-B8CB6BDEFD6B}_YYYYY_XXXXX.job
[2012.06.07 15:22:49 | 000,000,430 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{2EF742D4-4E03-411D-969D-2209FE511C80}.job
[2012.06.07 14:57:59 | 001,754,456 | ---- | M] (Secunia) -- C:\Dokumente und Einstellungen\XXXXX\Eigene Dateien\PSISetup.exe
[2012.06.07 14:41:58 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.06.06 18:03:20 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{EE91F686-F3D1-4728-A322-42076A29379D}.job
[2012.06.05 22:48:45 | 000,007,204 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Stellenausschreibung_Stud_Juli_2012.pdf
[2012.06.03 12:25:10 | 000,012,007 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Lebenslauf.pdf
[2012.05.29 23:40:46 | 000,079,444 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\OSCE-Guide.pdf
[2012.05.28 17:21:53 | 000,000,830 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\VPN - Charité.lnk
[2012.05.26 21:55:14 | 000,038,159 | ---- | M] () -- C:\WINDOWS\atiogl.xml
[2012.05.26 21:54:54 | 000,000,003 | ---- | M] () -- C:\WINDOWS\System32\ativva5x.dat
[2012.05.26 21:53:59 | 000,887,724 | ---- | M] () -- C:\WINDOWS\System32\ativva6x.dat
[2012.05.26 21:53:44 | 002,664,704 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012.05.26 21:53:04 | 000,601,728 | ---- | M] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012.05.26 21:53:04 | 000,245,896 | ---- | M] () -- C:\WINDOWS\System32\atiapfxx.blb
[2012.05.11 21:15:43 | 000,258,050 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\einstein.jpg
[2012.05.11 14:06:43 | 000,486,704 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.11 00:04:47 | 000,501,604 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.11 00:04:47 | 000,095,236 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.11 00:04:47 | 000,079,640 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.11 00:04:47 | 000,076,348 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 14:59:49 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.09 14:59:49 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.07 17:48:21 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\defogger_reenable
[2012.06.07 17:47:31 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Defogger.exe
[2012.06.07 17:01:10 | 000,001,654 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.07 16:18:58 | 000,000,322 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.06.07 16:15:47 | 000,001,097 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Defender.lnk
[2012.06.07 15:37:35 | 000,002,375 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office PowerPoint Viewer 2007.lnk
[2012.06.05 22:48:45 | 000,007,204 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Stellenausschreibung_Stud_Juli_2012.pdf
[2012.06.03 12:25:08 | 000,012,007 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\Lebenslauf_XXXXX.pdf
[2012.05.29 23:40:46 | 000,079,444 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Desktop\OSCE-Guide.pdf
[2012.05.26 22:56:51 | 000,265,472 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.05.11 21:15:43 | 000,258,050 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\einstein.jpg
[2012.04.23 08:24:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI
[2012.04.14 14:47:42 | 000,000,180 | ---- | C] () -- C:\WINDOWS\UFHISTO.INI
[2012.04.14 14:47:15 | 000,076,800 | ---- | C] () -- C:\WINDOWS\System32\drivers\SSHDRV84.sys
[2011.11.09 23:39:44 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.11.09 23:39:32 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2011.11.06 11:11:12 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.07.27 22:43:46 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2011.07.27 22:43:46 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2011.06.09 22:55:47 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011.06.05 12:03:58 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\$_hpcst$.hpc
[2011.01.26 00:59:31 | 000,444,283 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\WinPcapNmap.exe
[2011.01.21 14:11:44 | 000,000,305 | ---- | C] () -- C:\WINDOWS\game.ini
[2010.10.17 02:35:18 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2010.10.06 22:13:45 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\PnkBstrK.sys
[2010.08.14 20:12:11 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll
[2010.08.01 13:08:13 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\GkSui16.EXE
[2010.07.30 01:11:47 | 000,000,004 | ---- | C] () -- C:\Programme\CS 1.dat
[2010.06.15 13:19:09 | 000,004,096 | -H-- | C] () -- C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Anwendungsdaten\keyfile3.drm
[2010.06.14 23:27:17 | 000,083,968 | ---- | C] () -- C:\WINDOWS\UnGins.exe
[2010.06.12 11:21:10 | 000,018,435 | ---- | C] () -- C:\WINDOWS\System32\ms8664.sys
 
========== LOP Check ==========
 
[2010.12.21 22:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2010.06.07 12:52:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CDRWIN 8
[2011.08.09 00:25:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2011.05.02 23:28:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\drivertools
[2012.04.21 18:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2010.10.14 15:35:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\espionServerData
[2010.10.02 12:44:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Innovative Solutions
[2011.01.25 21:58:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010.06.20 17:04:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit
[2009.04.30 00:28:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010.11.18 17:44:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mediDOK
[2011.09.26 12:29:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
[2006.01.27 22:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MSScanAppDataDir
[2009.08.29 15:46:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MyHeritage
[2008.03.02 18:30:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2011.06.05 14:07:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaAccount
[2011.05.09 22:38:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2010.08.16 15:14:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2008.03.02 18:38:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2009.01.11 01:24:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\pixelStorm
[2011.09.09 21:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2006.07.15 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Quark
[2010.08.14 13:17:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QuickMediaConverter
[2010.10.14 15:36:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2011.07.27 22:47:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SafeNet Sentinel
[2010.08.30 18:31:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2010.06.12 11:21:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Software4u
[2010.11.25 02:39:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.12.19 11:45:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2012.04.21 17:37:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2010.12.03 23:30:14 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011.12.19 11:43:30 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2011.07.26 22:09:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2010.07.20 01:02:08 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2011.12.24 15:05:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\1&1 Mail & Media GmbH
[2010.08.20 15:45:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\AliceHilfe
[2010.12.21 22:26:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Ashampoo
[2012.05.06 20:31:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Auslogics
[2010.10.05 00:37:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\BabylonToolbar
[2011.01.11 16:11:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\BitTorrent
[2007.02.20 21:40:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Canon
[2010.08.14 13:17:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\CocoonSoftware
[2012.05.13 23:46:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\com.essexreddevelopment.mergepdfmac
[2011.08.09 00:38:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\DAEMON Tools Lite
[2010.10.02 12:50:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\DriverFinder
[2010.10.02 04:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Easeware
[2012.06.07 16:54:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\ElevatedDiagnostics
[2012.05.13 22:18:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Epson
[2010.05.13 16:44:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\FreeFLVConverter
[2011.07.28 13:08:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\GetRightToGo
[2010.07.11 13:58:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\gtk-2.0
[2009.01.18 01:22:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\ICQ
[2008.04.19 12:29:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\ICQ Toolbar
[2011.02.14 16:23:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\inkscape
[2010.06.20 17:08:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\IObit
[2006.02.22 17:25:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\MSNInstaller
[2005.04.04 13:26:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Musicmatch
[2009.08.29 15:34:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\MyHeritage
[2012.04.08 14:27:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\MyPhoneExplorer
[2010.10.10 19:36:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Need for Speed World
[2008.05.02 13:42:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\NesterSoft
[2011.06.05 14:07:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Nokia
[2008.06.01 12:05:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Nokia Multimedia Player
[2011.06.05 14:07:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Nokia Ovi Suite
[2008.06.01 12:05:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\NSeries
[2010.03.08 23:42:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\OpenOffice.org
[2012.05.13 20:16:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Opera
[2011.06.05 00:40:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Outlook
[2009.01.25 01:02:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\PC Suite
[2012.05.06 20:13:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\pdfforge
[2010.11.07 03:24:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\PriceGong
[2006.07.15 15:36:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Quark
[2010.10.15 01:56:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Registry Mechanic
[2009.04.26 18:45:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Scilab
[2008.03.16 00:58:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Screenshot Sender
[2010.06.16 19:16:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Software4u
[2007.01.28 23:09:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Sudeki
[2011.10.16 20:21:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Synthesia
[2009.09.23 21:23:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\TeamViewer
[2005.11.22 18:36:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Template
[2009.09.13 01:10:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Thinstall
[2010.10.06 21:50:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\tigo-IT
[2011.12.21 14:02:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\TuneUp Software
[2012.06.07 15:05:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Uniblue
[2011.01.26 01:00:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\VDownloader
[2008.10.25 21:40:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\WEBDE
[2008.12.16 02:26:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Windows Live Writer
[2010.04.17 23:35:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXX\Anwendungsdaten\Windows Search
[2012.06.07 16:39:32 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2012.06.07 15:22:49 | 000,000,430 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{2EF742D4-4E03-411D-969D-2209FE511C80}.job
[2012.06.07 17:58:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{3F92B61E-D798-494B-8489-ED4055E7ED66}.job
[2012.06.07 18:02:00 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{AF956C0B-8C67-475F-A1E3-FAE2CFD0BBC1}.job
[2012.06.06 18:03:20 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{EE91F686-F3D1-4728-A322-42076A29379D}.job
[2012.06.07 15:53:02 | 000,000,402 | -H-- | M] () -- C:\WINDOWS\Tasks\{B67FBE90-FF18-4999-A349-B8CB6BDEFD6B}_YYYYY_XXXXX.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 88 bytes -> C:\Dokumente und Einstellungen\XXXXX\Desktop\Jam.FM Radiostream.wpl:SummaryInformation
@Alternate Data Stream - 489 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF
@Alternate Data Stream - 104 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1

< End of report >
         

OTL Extras logfile created on: 07.06.2012 17:50:12 - Run 1
OTL by OldTimer - Version 3.2.46.2     Folder = C:\Dokumente und Einstellungen\XXXXX\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 474,67 Mb Available Physical Memory | 46,38% Memory free
3,83 Gb Paging File | 3,12 Gb Available in Paging File | 81,46% Paging File free
Paging file location(s): C:\pagefile.sys 3000 4000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 117,19 Gb Total Space | 39,00 Gb Free Space | 33,28% Space Free | Partition Type: NTFS
Drive D: | 107,42 Gb Total Space | 75,65 Gb Free Space | 70,42% Space Free | Partition Type: NTFS
Drive E: | 8,27 Gb Total Space | 2,17 Gb Free Space | 26,22% Space Free | Partition Type: FAT32
 
Computer Name: YYYYY | User Name: XXXXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Programme\Opera\opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03D4C700-2BFE-43E0-A0B4-9512B43C5B9F}" = Catalyst Control Center - Branding
"{047B0DA4-742C-84AA-1D7A-2BBCA713AD8B}" = Batch PDF Merger
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06C43FAA-7226-41EF-A05E-9AE0AA849FFE}" = IBM SPSS Statistics 19
"{07AC654E-38B1-410A-E655-7C7D975F9986}" = Catalyst Control Center InstallProxy
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1962E9F3-7870-DA54-3A18-2669DF9DE216}" = ccc-utility
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{25CFEF55-A945-41FC-86ED-76469F31DF37}" = Nokia Connectivity Cable Driver
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = PowerCinema 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 26
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{2D21ECE3-8EC1-4315-AE4E-1970FB3AF17A}" = Nokia Nseries Video Manager
"{30C10EE3-EFB3-4B7A-9CDC-50790C2B5200}" = CA Licensing
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D1A6B70-3E02-49BC-88B0-916C80274632}" = Informationen über Ihren PC
"{3DECEA7E-BC27-5B1D-10CE-CB1BBA0DD4CA}" = Catalyst Control Center Graphics Previews Common
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{3F262ADC-5AD2-48E5-A586-44315E04A9E2}" = Microsoft Picture It!-Bibliothek 10
"{41E340F0-0BD6-4A87-AF29-E9E584471756}" = VideoMate T , M , P Series  Driver
"{42756145-9997-4D28-809B-8756BFD00106}" = Microsoft Picture It! Foto Premium 10
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{45EB96EE-AC25-5797-FAC5-78025043708F}" = Catalyst Control Center
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28C077-9958-45F1-8BB4-CBF90A69AD4E}" = PC Connectivity Solution
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{654977DB-0001-0002-0001-EABD228DDE8B}" = Microsoft Download Manager
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69F90670-C53E-4E84-AE0A-3D390FB7B88C}" = FormsForWeb® Filler 3.1
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7239A06F-235B-43B1-970D-7A411FD95683}" = Nokia Software Updater
"{76DAEC83-AF7B-333C-8A53-83D7C7D39199}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows-Sicherungsprogramm
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{863B903C-4D08-4A9C-9081-EF6A9F7E705E}" = Client für die Windows-Rechteverwaltung mit Service Pack 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A0BD487-D185-4316-92CE-9E415C3AC6DB}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8E87B944-4815-3C5E-947F-5035C9F64362}" = Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU
"{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}" = Epson Event Manager
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007F-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1" = VDownloader 3.9.1195
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AB49B509-8FCA-45E6-9FB9-9E4AEEB8F148}" = System Requirements Lab CYRI
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B1FDCD51-DCC5-403A-810A-CC5A746588D1}" = WinFunktion Mathematik plus 14
"{B26E3B0D-C2FA-4370-B068-7C476766F029}" = Microsoft Works
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBBEDBF2-0095-A8BD-891E-E3245D388F90}" = CCC Help German
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D158588C-B6A4-636B-2A24-38C15EAD2D5C}" = Catalyst Control Center Localization All
"{D1955A3A-EA24-4682-8641-43B5B688B09A}" = USB Wireless Keyboard Driver
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D67107F9-3DFB-9D54-434B-028CA4F1ADF2}" = AMD Catalyst Install Manager
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E728441A-7820-4B1C-87C9-DE7BE37B2953}" = Download Navigator
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E94603CA-2996-4154-8EE2-A5FCD4BFB500}" = Nokia Lifeblog 2.5
"{EA1CB7AC-E221-4822-A789-0ADB051DC498}" = Generic USB CardReader 2.0
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Rückwärtskompatibilität des Clients für die Windows-Rechteverwaltung SP2
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFF841F3-9A15-4F61-BD16-C19F132E5A27}" = Epson Easy Photo Print 2
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Windows-Treiberpaket - Nokia Modem  (10/07/2010 4.6)
"7-Zip" = 7-Zip 9.20
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Age of Empires 2.0" = Microsoft Age of Empires II
"AliceHilfe 1.0.0.1" = AliceHilfe
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bock-Wittkowski Histologie" = Bock-Wittkowski Histologie
"CCleaner" = CCleaner
"C-Media Audio Driver" = C-Media High Definition Audio Driver
"com.essexreddevelopment.mergepdfmac" = Batch PDF Merger
"conduitEngine" = Conduit Engine 
"Creatix V.92 Data Fax Modem" = Creatix V.92 Data Fax Modem
"DjVu" = Lizardtech DjVu Control (autoinstall)
"E5372C32E8562C76C24DBA6525002B1031495F34" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.8)
"EAX Unified" = EAX Unified
"EPSON Scanner" = EPSON Scan
"EPSON SX440 Series" = EPSON SX440 Series Printer Uninstall
"EPSON SX440 Series Bog" = Benutzerhandbuch - Grundlagen EPSON SX440 Series
"EPSON SX440 Series Netg" = Netzwerkhandbuch EPSON SX440 Series
"EPSON SX440 Series Useg" = Benutzerhandbuch EPSON SX440 Series
"FLV Player" = FLV Player 2.0 (build 25)
"Half-Life: Opposing Force Demo" = Half-Life: Opposing Force Demo
"ie8" = Windows Internet Explorer 8
"KWorld TV713X BDA Driver_is1" = KWorld TV713X BDA Driver
"LSI Soft Modem" = LSI PCI Soft Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MPE" = MyPhoneExplorer
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Nokia PC Suite" = Nokia PC Suite
"OpenVPN" = OpenVPN 2.1.3
"Opera 11.64.1403" = Opera 11.64
"pdfsam" = pdfsam
"Picasa 3" = Picasa 3
"PictureItPrem_v10" = Microsoft Picture It! Foto Premium 10
"Shockwave" = Shockwave
"TeamViewer 5" = TeamViewer 5
"TextMaker Viewer" = TextMaker Viewer
"VLC media player" = VLC media player 2.0.1
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.1
"XiphQT" = Xiph QuickTime Components
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 11.05.2012 08:09:15 | Computer Name = YYYYY | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown 
 
Error - 13.05.2012 17:42:54 | Computer Name = YYYYY | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.8345.0, stamp 4f3c32b8,
 faulting module winword.exe, version 11.0.8345.0, stamp 4f3c32b8, debug? 0, fault
 address 0x0032f549.
 
Error - 15.05.2012 14:18:17 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul msvbvm60.dll, Version 6.0.98.2, Fehleradresse 0x0005d2a4.
 
Error - 29.05.2012 17:00:49 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001cccf2.
 
Error - 29.05.2012 17:00:51 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x45b0fa00.
 
Error - 29.05.2012 17:14:33 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001ccc60.
 
Error - 29.05.2012 17:14:36 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x50000100.
 
Error - 01.06.2012 17:12:54 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x00002caf.
 
Error - 01.06.2012 17:19:15 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x00002caf.
 
Error - 02.06.2012 05:47:06 | Computer Name = YYYYY | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung myphoneexplorer.exe, Version 1.8.0.2, fehlgeschlagenes
 Modul kernel32.dll, Version 5.1.2600.5781, Fehleradresse 0x00012afb.
 
[ System Events ]
Error - 07.06.2012 05:49:47 | Computer Name = YYYYY | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "upnphost"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {204810B9-73B2-11D4-BF42-00B0D0118B56}
 
Error - 07.06.2012 09:06:00 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7034
Description = Dienst "CyberLink Background Capture Service (CBCS)" wurde unerwartet
 beendet. Dies ist bereits 1 Mal passiert.
 
Error - 07.06.2012 09:06:01 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7034
Description = Dienst "CyberLink Task Scheduler (CTS)" wurde unerwartet beendet. 
Dies ist bereits 1 Mal passiert.
 
Error - 07.06.2012 10:37:49 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7000
Description = Der Dienst "dtgntdd" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 07.06.2012 10:37:49 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DTGuardService" ist vom Dienst "dtgntdd" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%2
 
Error - 07.06.2012 10:37:49 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 07.06.2012 10:37:49 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   PDDSLHND
 
Error - 07.06.2012 10:37:49 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" ist vom Dienst
 "Universeller Plug & Play-Gerätehost" abhängig, der aufgrund folgenden Fehlers 
nicht gestartet wurde:   %%1058
 
Error - 07.06.2012 11:31:39 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7034
Description = Dienst "CyberLink Background Capture Service (CBCS)" wurde unerwartet
 beendet. Dies ist bereits 1 Mal passiert.
 
Error - 07.06.2012 11:31:39 | Computer Name = YYYYY | Source = Service Control Manager | ID = 7034
Description = Dienst "CyberLink Task Scheduler (CTS)" wurde unerwartet beendet. 
Dies ist bereits 1 Mal passiert.
 
 
< End of report >
         

GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2012-06-07 21:55:36
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 ST3250823AS rev.3.03
Running: tg92972u.exe; Driver: C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\axldqpob.sys


---- System - GMER 1.0.15 ----

SSDT            F7EE8D34                                                                                                                                                                                                                                                                                               ZwCreateThread
SSDT            F7EE8D20                                                                                                                                                                                                                                                                                               ZwOpenProcess
SSDT            F7EE8D25                                                                                                                                                                                                                                                                                               ZwOpenThread
SSDT            \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com)                                                                                                                                                                                              ZwTerminateProcess [0xAA4BE640]

---- Kernel code sections - GMER 1.0.15 ----

?               cwlxwqnb.sys                                                                                                                                                                                                                                                                                           Das System kann die angegebene Datei nicht finden. !
.text           C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                                                                                                                                                                                                               section is writeable [0xF6497000, 0x2DC7EC, 0xE8000020]
.text           C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                                                                                                                                                                                               section is writeable [0xAE601000, 0x30A4A, 0xE8000020]
.pklstb         C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                                                                                                                                                                                               entry point in ".pklstb" section [0xAE643000]
.relo2          C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                                                                                                                                                                                               unknown last section [0xAE65E000, 0x8E, 0x42000040]
.text           C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                                                                                                                                                                                               section is writeable [0xAE5B7000, 0x233D4, 0xE8000020]
.pklstb         C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                                                                                                                                                                                               entry point in ".pklstb" section [0xAE5E9000]
.relo2          C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                                                                                                                                                                                               unknown last section [0xAE5FF000, 0x8E, 0x42000040]
init            C:\WINDOWS\system32\DRIVERS\UKBFLT.sys                                                                                                                                                                                                                                                                 entry point in "init" section [0xF7D2A2E0]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                                                                                                                                                                               fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                                                                                                                                                                               fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Processes - GMER 1.0.15 ----

Library         c:\windows\system32\n (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1380]                                                                                                                                                                                                                       0x45670000                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                                                                                                                                                                                                  
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOCC7.00.00.01PROSTATION                                                                                                                                                                                                                         B70BA71050CBE6555599D7B8D06722F91F0BB71505D13583F7E4AD8F3E50369CA0A40403DE036B732005227389588BE33E08E22DE53A1FF910DF6823F522DB3591969424726725AC4F1404E2C16E8BF7A1EF98C2F81FE46E770C1F86ED2B752F2F89F8BC5C2BA2028309D9879482BC0205B79AB23E1BD31AA1B5159331EB9E5146BF9142CFD270E701B5C79A7BBDBEC2C2E8EC921C1EBC2B25394EDE2EB87AD6448B86E4E23A214530053684599E36705E205628DCEC73C4B98914A8363B2EEDBDD2BF85928DCBF61B714EE5F1F84933FA0F63EFAB1DD1FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A2D97226D213B5558EDD5E5BE2F6E66769DEED448B2184F56066C35B5315DA0779BAF6AACE6802EB0BD11E76AA38A60E9405BA86851F0FD7A24A0FC2C63714C6927CB5C43C2B6D989B379D8F125AC2FAAB40BEC79C899B579204B386E127142583A093B6881CE553DB7CA90006B0C1BD4273EDCAA37CF5359290DBCCD7E968129ADC8EA4E549E05DA7B0358CD0F21E8961A5D016A7F83C357612C4FA916AF7821A8AB878B626A87D4E86C740763DA315850504F565E3E21F084BBFBEA875F66EB6A7B7DE9608D77B92D4FCE7AB0D771A9DE036F750832EBD84A5B188ED3C73D39B56474ACE2ADFA7A
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL                                                                                                                                                                                                                  0B38ED0C4AFDBEAF211E1EC6E633A215F47415BA4338707EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB345205C1E771DFB3D8D09933A6750C0B315ACB9CA90622C316ED5F34370551DE62FDF62AF74145F4EA2192258C3CF05E19B924052C3066241D6A317DE76C43392CD50701E487AA92CEB7F9783C5351843D493B45DAB114F2CFF0B8A57BAD27D27DCE9151AD644C77E98997FB6847233B04F66115B527F965B4106E66650DC4F19CB3D6F955EC8C21E3BD1354469A7FD41769C7FA441D0B421687AB4C1D4908F59502FB2DE42A6D2028AFFA790EC22536E17805548F195FE402CE31BB9B1180CC36EC0871E51A991AE76E40377A2BF55B95B193D22491AFBB4A0F23676009E27B135BE7A16AACDE4716BEB62D4F3077D1A95451F814705CCA05A4075B6D48069A8367EC6E04472CF5EB161ACD4FA5D33CD3D48123769568A98C22C9744ADCE65621DEC9574CC31787E42288E3C2D058D0945D4A7A625379037F4DB9E40144A4EECC469836DD6DD971C1428008F86AF85AABC7B502F8F15C173F1E0B31A0740437A7D15533D786503C0709E82CBEA149351DA6328DD7AA7E38F2C355B5BB54EB9A1A6D5ECF5EC4F9057B3E8A126C1983D5B33F92C6282FF14D041
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@RuntimeVersion                                                                                                                                                                                                       v1.1.4322
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Class                                                                                                                                                                                                                Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Assembly                                                                                                                                                                                                             Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0                                                                                                                                                                                                             
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@RuntimeVersion                                                                                                                                                                                              v1.1.4322
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Class                                                                                                                                                                                                       Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg             HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Assembly                                                                                                                                                                                                    Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ffwp\OpenWithProgids@Lucom GmbH.FormsForWeb\xae Filler 3.1                                                                                                                                                                           

---- Files - GMER 1.0.15 ----

File            C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Temp\Temporäres Verzeichnis 8 für Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011.zip\Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011\DHZB_Bewerbung Krankenpflegeprakt  24064 bytes
File            C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011.zip\Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011\DHZB_Lebenslauf Krankenpflegeprak  32256 bytes
File            C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011.zip\Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011\DHZB_Lebenslauf Krankenpflegeprak  32256 bytes
File            C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Temp\Temporäres Verzeichnis 3 für Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011.zip\Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011\DHZB_Lebenslauf Krankenpflegeprak  32256 bytes
File            C:\Dokumente und Einstellungen\XXXXX\Lokale Einstellungen\Temp\Temporäres Verzeichnis 4 für Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011.zip\Bewerbung Krankenpflegepraktikum im Deutschen Herzzentrum Berlin - Sommer 2011 - 2\DHZB_Bewerbung_KPP.doc         24064 bytes

---- EOF - GMER 1.0.15 ----