EXP/Pidief.def und insb. TR/Crypt.ZPACK.Gen8 Befall

OTL logfile created on: 26.06.2012 17:36:30 - Run 1
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Downloads\Virenbekämpfung
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 74,39% Memory free
3,85 Gb Paging File | 3,35 Gb Available in Paging File | 86,99% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 143,44 Gb Total Space | 2,24 Gb Free Space | 1,56% Space Free | Partition Type: NTFS
 
Computer Name: ROBNB | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.26 16:19:26 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Downloads\Virenbekämpfung\OTL.exe
PRC - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.08.05 12:29:56 | 000,057,056 | ---- | M] (Microsoft Corporation) -- c:\Programme\Zune\ZuneBusEnum.exe
PRC - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2009.05.21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtcmd.exe
PRC - [2008.08.13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtsvc.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.06.06 16:28:18 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2007.05.14 15:23:32 | 001,191,936 | ---- | M] (Dell Inc) -- C:\Programme\DELL\QuickSet\quickset.exe
PRC - [2007.05.09 11:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\OEM02Mon.exe
PRC - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\VPN Client\cvpnd.exe
PRC - [2007.03.15 13:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Programme\DellSupport\DSAgnt.exe
PRC - [2007.02.21 12:19:40 | 000,294,912 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2006.11.02 15:05:50 | 000,282,624 | ---- | M] (Knowles Acoustics) -- C:\WINDOWS\system32\KADxMain.exe
PRC - [2006.10.03 12:37:04 | 000,081,920 | ---- | M] (Macrovision Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
PRC - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.10 00:16:31 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
MOD - [2012.05.10 00:14:38 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
MOD - [2012.05.10 00:14:17 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012.04.16 23:11:02 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2010.11.04 08:51:44 | 000,555,624 | ---- | M] () -- C:\Programme\NVIDIA Corporation\nView\nvShell.dll
MOD - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
MOD - [2009.02.27 17:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2007.05.14 15:24:00 | 000,098,304 | ---- | M] () -- C:\Programme\DELL\QuickSet\dadkeyb.dll
MOD - [2007.04.03 16:18:26 | 000,197,672 | ---- | M] () -- C:\WINDOWS\system32\vpnapi.dll
MOD - [2007.02.21 12:13:02 | 000,118,784 | ---- | M] () -- C:\Programme\Intel\Wireless\Bin\iWMSProv.dll
MOD - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.06.19 16:59:45 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.08.05 12:30:02 | 000,444,640 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2011.08.05 12:30:02 | 000,268,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Zune\WMZuneComm.exe -- (WMZuneComm)
SRV - [2011.08.05 12:29:56 | 006,363,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2011.08.05 12:29:56 | 000,057,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Zune\ZuneBusEnum.exe -- (ZuneBusEnum)
SRV - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.29 04:19:42 | 000,602,624 | ---- | M] (Hauppauge Computer Works) [Disabled | Stopped] -- C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2009.10.27 10:26:36 | 000,657,408 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.08.13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Programme\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008.04.14 04:22:23 | 000,105,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\p2pgasvc.dll -- (p2pgasvc)
SRV - [2008.04.14 04:22:12 | 000,036,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\iprip.dll -- (Iprip)
SRV - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2007.03.19 13:44:44 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007.02.21 12:19:40 | 000,294,912 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
SRV - [2004.10.22 04:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\vsdatant.sys -- (vsdatant)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\VcommMgr.sys -- (VcommMgr)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VComm.sys -- (VComm)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Robert\LOKALE~1\Temp\FKX1D3.tmp -- (GarenaPEngine)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\vbtenum.sys -- (BTHidEnum)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\btcusb.sys -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btnetdrv.sys -- (BT)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\blueletaudio.sys -- (BlueletAudio)
DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.07.09 13:18:54 | 000,020,328 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cpuz134_x32.sys -- (cpuz134)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.11.06 14:11:08 | 000,051,072 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw17bda.sys -- (hcw17bda)
DRV - [2009.10.06 12:52:50 | 000,007,936 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009.10.06 12:52:34 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009.10.06 12:52:34 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.10.06 12:52:34 | 000,007,936 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009.10.02 10:59:17 | 000,489,952 | R--- | M] (ITETech                  ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AF15BDA.sys -- (AF15BDA)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.05.15 16:03:20 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008.03.17 03:19:59 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2007.11.29 03:18:12 | 000,028,432 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2007.11.29 03:17:56 | 000,036,368 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007.11.29 03:17:48 | 000,035,088 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.06.06 16:28:16 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2007.05.09 11:01:00 | 000,235,584 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007.05.09 00:05:36 | 002,203,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)
DRV - [2007.05.08 22:49:02 | 000,045,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2007.04.23 22:15:46 | 000,989,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2007.04.23 22:15:46 | 000,730,112 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2007.04.23 22:15:44 | 000,209,152 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2007.04.03 16:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007.03.05 04:45:00 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007.02.25 13:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007.02.21 12:16:12 | 000,012,416 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007.01.31 13:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.11.15 00:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006.11.14 19:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006.11.02 13:31:38 | 000,103,168 | ---- | M] (Knowles Acoustics) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dxec02.sys -- (DXEC02)
DRV - [2006.11.02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006.10.05 18:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Programme\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006.05.24 19:07:18 | 000,328,237 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006.05.24 19:05:26 | 000,023,271 | ---- | M] (Broadcom Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\btserial.sys -- (BTSERIAL)
DRV - [2006.05.24 19:04:04 | 000,851,434 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006.05.24 19:01:34 | 000,030,427 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006.05.24 19:01:22 | 000,030,285 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2006.05.24 19:00:50 | 000,066,488 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006.05.24 18:58:18 | 000,148,900 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2006.05.24 18:57:00 | 000,045,683 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2006.03.10 12:45:32 | 000,220,544 | R--- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emBDA.sys -- (USB28xxBGA)
DRV - [2006.03.10 12:45:20 | 000,017,792 | R--- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emOEM.sys -- (USB28xxOEM)
DRV - [2005.08.12 18:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\APPDRV.SYS -- (APPDRV)
DRV - [2004.07.09 05:26:38 | 000,015,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2004.06.03 13:10:00 | 000,071,596 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PfModNT.sys -- (PfModNT)
DRV - [2004.05.18 02:25:00 | 000,016,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=1071009
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=1071009
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {6527796B-D920-46D3-A3C1-4EE009F582DB}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{6527796B-D920-46D3-A3C1-4EE009F582DB}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {A5C87640-F7CF-11DA-974D-0800200C9A66}:0.3.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.6.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Programme\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.02.09 00:14:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.19 16:59:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.05.28 13:59:24 | 000,000,000 | ---D | M]
 
[2009.01.07 20:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Extensions
[2012.03.29 18:10:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions
[2011.01.08 23:02:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.05.18 12:57:04 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011.11.11 12:32:48 | 000,000,000 | ---D | M] (Mobile Barcoder) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\{A5C87640-F7CF-11DA-974D-0800200C9A66}
[2012.02.18 13:50:39 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.29 18:10:14 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.03.22 09:00:56 | 000,000,000 | ---D | M] (Ghostery) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\firefox@ghostery.com
[2010.01.06 13:33:48 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\extensions\moveplayer@movenetworks.com
[2011.03.03 11:52:04 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\88xg4le6.default\searchplugins\conduit.xml
[2012.06.19 16:59:56 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.25 18:40:47 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.01.16 23:05:17 | 000,634,964 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ROBERT\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\88XG4LE6.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.01.22 21:27:38 | 000,138,614 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ROBERT\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\88XG4LE6.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
[2012.06.19 16:59:46 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2007.11.09 16:10:22 | 000,079,440 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\CgpCore.dll
[2007.11.09 16:10:24 | 000,075,344 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\confmgr.dll
[2007.11.09 16:10:50 | 000,034,384 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\logging.dll
[2012.03.28 10:49:01 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2007.11.09 16:11:08 | 000,333,392 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\npicaN.dll
[2007.11.09 16:11:38 | 000,030,288 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\TcpPServ.dll
[2012.06.19 16:59:43 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.19 16:59:43 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.19 16:59:43 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.19 16:59:43 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.19 16:59:43 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.19 16:59:43 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.02.06 19:48:29 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\DELL\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe ()
O4 - HKLM..\Run: [Dell QuickSet] C:\Programme\DELL\QuickSet\quickset.exe (Dell Inc)
O4 - HKLM..\Run: [DellSupportCenter] C:\Programme\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Programme\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe (Knowles Acoustics)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [OEM02Mon.exe] C:\WINDOWS\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKCU..\Run: [DellSupport] C:\Programme\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Programme\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [KeApplet] C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Media Player Classic\{022CADA5-B8C1-4423-A1FE-D4F495C5D2EA}\UpgradeHelper.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - C:\Dokumente und Einstellungen\Robert\Eigene Dateien\Eigene Bilder\Wallpaper Chip\Reise\Shara Full HD Apple Summer Desktop.jpg
O24 - Desktop Components:1 () - C:\Dokumente und Einstellungen\Robert\Eigene Dateien\Eigene Bilder\Wallpaper Chip\wallpaper_abstrakt\original style hd wallpapers 3.jpg
O24 - Desktop Components:2 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Robert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Robert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.13 13:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.19 17:21:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Avira
[2012.06.19 17:16:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.06.19 17:16:06 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.06.19 17:16:06 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.06.19 17:15:56 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2012.06.19 17:15:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2012.06.19 16:59:57 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.06.19 16:23:34 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012.06.19 15:58:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Obud
[2012.06.19 15:58:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Diiqor
[2012.06.17 18:25:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\HandBrake
[2012.06.17 18:25:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Startmenü\Programme\Handbrake
[2012.06.17 18:18:27 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET
[2012.06.17 18:15:01 | 000,000,000 | ---D | C] -- C:\Programme\Handbrake
[2012.06.09 10:44:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Robert\Eigene Dateien\Rechnungen L337
[6 C:\Dokumente und Einstellungen\Robert\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Robert\Eigene Dateien\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.26 16:48:49 | 001,175,982 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Bescheinigung Praktika.pdf
[2012.06.26 16:45:11 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.26 16:44:23 | 000,148,085 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2012.06.26 16:27:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.26 16:27:22 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.26 16:27:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.26 16:27:00 | 2145,579,008 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.26 16:24:34 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\defogger_reenable
[2012.06.26 12:24:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2012.06.26 11:35:35 | 000,148,085 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2012.06.21 00:12:52 | 000,000,432 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2012.06.19 17:16:23 | 000,001,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.06.19 16:22:35 | 000,530,022 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.06.19 16:22:35 | 000,504,114 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.06.19 16:22:35 | 000,088,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.06.19 16:22:34 | 000,107,070 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.06.19 11:46:02 | 000,023,926 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside mit loch von fb.jpg
[2012.06.19 00:08:41 | 000,044,195 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\ax pulli.JPG
[2012.06.19 00:05:30 | 000,011,716 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\ax klein.jpg
[2012.06.18 23:20:42 | 000,021,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southpark sackkarre.JPG
[2012.06.18 16:13:10 | 000,080,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside 63x20.jpg
[2012.06.18 16:07:33 | 000,016,398 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside2.JPG
[2012.06.18 16:01:04 | 000,137,684 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside.JPG
[2012.06.17 18:43:58 | 000,001,054 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\waschstr.mp4
[2012.06.17 18:36:04 | 000,004,611 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Laden26.mkv
[2012.06.17 18:34:45 | 000,001,054 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Laden26.3
[2012.06.17 18:25:37 | 000,000,666 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Handbrake.lnk
[2012.06.14 15:47:45 | 000,188,200 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.14 15:26:25 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.06.12 08:11:52 | 000,099,616 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\studbesch_1369EC894ABF94C5F7CA32DF96ACCA22.node025.pdf
[2012.06.09 12:50:52 | 006,641,341 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside-outfield-2012.pdf
[2012.06.09 12:50:51 | 010,406,526 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside-infield-2012.pdf
[2012.06.09 09:27:54 | 116,209,952 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Waschstr.26.3..mpg
[2012.06.01 20:04:36 | 000,253,604 | ---- | M] () -- C:\Dokumente und Einstellungen\Robert\Desktop\timetable southside bäm.jpg
[2012.05.28 13:59:24 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[6 C:\Dokumente und Einstellungen\Robert\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Robert\Eigene Dateien\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.26 16:48:49 | 001,175,982 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Bescheinigung Praktika.pdf
[2012.06.26 16:24:12 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\defogger_reenable
[2012.06.19 17:16:23 | 000,001,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.06.19 16:45:13 | 2145,579,008 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.19 11:46:01 | 000,023,926 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside mit loch von fb.jpg
[2012.06.19 00:08:41 | 000,044,195 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\ax pulli.JPG
[2012.06.19 00:05:30 | 000,011,716 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\ax klein.jpg
[2012.06.18 23:20:42 | 000,021,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southpark sackkarre.JPG
[2012.06.18 16:13:10 | 000,080,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside 63x20.jpg
[2012.06.18 16:07:33 | 000,016,398 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside2.JPG
[2012.06.18 16:01:03 | 000,137,684 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside.JPG
[2012.06.17 18:43:57 | 000,001,054 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\waschstr.mp4
[2012.06.17 18:41:56 | 116,209,952 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Waschstr.26.3..mpg
[2012.06.17 18:36:04 | 000,004,611 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Laden26.mkv
[2012.06.17 18:27:37 | 000,001,054 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Laden26.3
[2012.06.17 18:25:37 | 000,000,666 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\Handbrake.lnk
[2012.06.12 08:11:51 | 000,099,616 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\studbesch_1369EC894ABF94C5F7CA32DF96ACCA22.node025.pdf
[2012.06.09 12:50:41 | 006,641,341 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside-outfield-2012.pdf
[2012.06.09 12:50:33 | 010,406,526 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\southside-infield-2012.pdf
[2012.06.01 20:04:35 | 000,253,604 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Desktop\timetable southside bäm.jpg
[2012.05.28 13:59:24 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 9.lnk
[2012.05.28 13:59:24 | 000,001,709 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2012.04.01 13:48:08 | 000,252,080 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012.04.01 13:48:05 | 000,252,080 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012.04.01 13:48:05 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012.04.01 13:47:25 | 002,292,678 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2012.03.04 21:29:44 | 000,000,356 | R--- | C] () -- C:\WINDOWS\System32\AF15IrTbl.bin
[2011.09.01 18:57:11 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2011.02.06 17:28:46 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.02.06 17:28:46 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.02.06 17:28:46 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.02.06 17:28:46 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.02.06 17:28:46 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.11.28 17:43:10 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\GkSui18.EXE
[2010.10.29 20:53:21 | 000,000,399 | ---- | C] () -- C:\WINDOWS\vtplus32.ini
[2010.10.29 20:53:07 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\dmcrypto.dll
[2010.10.29 20:52:26 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\hcwChDB.dll
[2010.10.29 20:50:27 | 000,040,960 | R--- | C] () -- C:\WINDOWS\System32\bdadll.dll
[2009.03.17 12:15:35 | 000,000,850 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol
[2009.03.17 12:15:23 | 000,000,488 | RHS- | C] () -- C:\Dokumente und Einstellungen\Robert\ntuser.pol
[2009.03.05 22:37:28 | 000,017,518 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\mixxxtrack.xml
[2009.03.05 22:37:28 | 000,000,614 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\mixxxbpmschemes.xml
[2009.03.05 22:36:56 | 000,001,508 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\mixxx.cfg
[2009.02.16 12:58:43 | 000,000,080 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\govello20.properties
[2008.08.06 18:32:13 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\.recently-used.xbel
[2008.08.06 17:56:57 | 000,000,086 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\.gtk-bookmarks
[2008.05.24 17:32:31 | 000,000,210 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\usermarker_search_earth.mrk
[2008.03.20 02:39:25 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat
[2007.11.24 18:04:00 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2007.10.14 17:54:07 | 000,006,956 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\wklnhst.dat
[2007.10.13 13:13:48 | 000,245,760 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.10.13 12:31:43 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Robert\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== LOP Check ==========
 
[2009.02.01 16:12:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
[2011.09.01 18:57:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2011.02.06 22:31:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FileOpen
[2010.02.09 00:13:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2008.02.05 18:16:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2010.02.09 00:03:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010.12.10 18:44:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2008.04.12 21:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir
[2008.04.12 21:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard
[2007.12.11 20:46:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SupportSoft
[2012.03.04 21:34:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TerraTec
[2011.03.27 23:47:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VideoConverter
[2011.09.01 18:57:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Canneverbe Limited
[2008.04.12 21:37:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Canon
[2007.11.29 21:25:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Claviscom
[2010.11.26 22:42:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Clonk
[2010.11.13 16:42:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Clonk Rage
[2007.10.14 01:28:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
[2008.05.15 16:03:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\DAEMON Tools
[2012.06.19 15:58:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Diiqor
[2012.04.01 22:06:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\DVDVideoSoft
[2012.04.01 22:05:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.07.28 22:01:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\EFSoftware
[2009.01.06 01:32:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\FAlterSoft
[2011.02.06 22:31:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\FileOpen
[2012.06.09 00:41:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\foobar2000
[2008.08.06 18:29:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\gtk-2.0
[2012.06.17 18:43:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\HandBrake
[2008.12.23 16:26:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\HCM Updater
[2008.07.22 20:04:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\ICAClient
[2008.08.06 17:19:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Inkscape
[2009.02.16 13:00:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\JExpress
[2010.12.09 23:46:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Nokia
[2012.06.19 16:03:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Obud
[2010.07.27 21:47:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Octoshape
[2011.03.12 15:46:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\PC Remote
[2010.02.09 00:31:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\PC Suite
[2008.04.12 21:28:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\ScanSoft
[2012.03.28 10:57:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Spotify
[2009.03.15 22:04:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Synthesia
[2009.02.23 12:24:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\TeamViewer
[2007.10.14 17:54:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Template
[2012.03.04 21:32:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\TerraTec
[2007.10.13 13:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\tmp
[2012.03.11 18:24:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\trAAAde
[2007.11.30 23:17:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Xilisoft Corporation
[2011.03.28 00:23:22 | 000,000,280 | ---- | M] () -- C:\WINDOWS\Tasks\videopadSevenDaysInit.job
[2011.03.28 00:33:22 | 000,000,274 | ---- | M] () -- C:\WINDOWS\Tasks\videopadShakeIcon.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Robert\Eigene Dateien\bremsen.wav:Roxio EMC Stream

< End of report >
         

OTL Extras logfile created on: 26.06.2012 17:36:30 - Run 1
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Downloads\Virenbekämpfung
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 74,39% Memory free
3,85 Gb Paging File | 3,35 Gb Available in Paging File | 86,99% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 143,44 Gb Total Space | 2,24 Gb Free Space | 1,56% Space Free | Partition Type: NTFS
 
Computer Name: ROBNB | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-zu-Peer-Gruppierung
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution-Protokoll (PNRP)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-zu-Peer-Gruppierung
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution-Protokoll (PNRP)
"6112:TCP" = 6112:TCP:*:Enabled:WC3
"6112:UDP" = 6112:UDP:*:Enabled:Warcraft2
"61313:TCP" = 61313:TCP:*:Enabled:PC Remote Server XP
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\DELL\MediaDirect\PCMService.exe" = C:\Programme\DELL\MediaDirect\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)
"C:\Programme\QIP\qip.exe" = C:\Programme\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Programme\QIP 8070\qip.exe" = C:\Programme\QIP 8070\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Games\Warcraft III\Frozen Throne.exe" = C:\Games\Warcraft III\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne -- (Blizzard Entertainment)
"C:\Games\Warcraft III\Warcraft III.exe" = C:\Games\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"C:\Programme\Garena\Garena.exe" = C:\Programme\Garena\Garena.exe:*:Enabled:Garena -- (Garena Interactive PTE LTD)
"C:\Programme\Look@LAN\LookAtLan.exe" = C:\Programme\Look@LAN\LookAtLan.exe:*:Enabled:Look@LAN -- (Carlo Medas)
"C:\Programme\QIP 8071\qip_2005_build_8071\qip.exe" = C:\Programme\QIP 8071\qip_2005_build_8071\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Programme\QIP Infium\infium.exe" = C:\Programme\QIP Infium\infium.exe:*:Enabled:QIP Infium -- (QIP)
"C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil_.exe" = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil_.exe:*:Enabled:BlueSoleil -- (IVT Corporation.)
"C:\Programme\QIP 8081\qip.exe" = C:\Programme\QIP 8081\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Programme\QIP 8092\qip.exe" = C:\Programme\QIP 8092\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Games\Counter-Strike 1.5\cstrike.exe" = C:\Games\Counter-Strike 1.5\cstrike.exe:*:Enabled:CounterStrike Launcher -- (Valve, L.L.C.)
"C:\Games\UnrealTournament an robert\System\UnrealTournament.exe" = C:\Games\UnrealTournament an robert\System\UnrealTournament.exe:*:Enabled:UnrealTournament -- ()
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process  -- (Nokia Corporation)
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation)
"C:\Programme\WinTV\WinTV7\WinTV7.exe" = C:\Programme\WinTV\WinTV7\WinTV7.exe:*:Enabled:WinTV7 -- (Hauppauge Computer Works, Inc.)
"C:\Games\Age of Empries 2\age2_x1\age2_x1.icd" = C:\Games\Age of Empries 2\age2_x1\age2_x1.icd:*:Enabled:Age of Empires II Expansion -- (Microsoft Corporation)
"C:\Games\Steam\SteamApps\...\counter-strike source\hl2.exe" = C:\Games\Steam\SteamApps\...\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source -- ()
"C:\Games\StarCraft II\StarCraft II.exe" = C:\Games\StarCraft II\StarCraft II.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
"C:\Games\StarCraft II\Versions\Base15405\SC2.exe" = C:\Games\StarCraft II\Versions\Base15405\SC2.exe:*:Enabled:StarCraft II -- (Blizzard Entertainment, Inc.)
"C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" = C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client -- (Octoshape ApS)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\QIP 2010\qip.exe" = C:\Programme\QIP 2010\qip.exe:*:Enabled:QIP 2010 -- (QIP)
"C:\Games\Clonk Endeavour\Clonk.exe" = C:\Games\Clonk Endeavour\Clonk.exe:*:Enabled:Clonk Endeavour Engine -- (RedWolf Design GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe:*:Enabled:TerraTec Home Cinema Basic (Setup) -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe:*:Enabled:TerraTec Home Cinema Basic (tvtv Setup) -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe:*:Enabled:TerraTec Home Cinema Basic -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe:*:Enabled:TerraTec Home Cinema Basic (Auto Update) -- (TerraTec Electronic GmbH)
"C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Spotify\spotify.exe" = C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Spotify\spotify.exe:*:Enabled:Spotify -- (Spotify Ltd)
"C:\Games\Steam\SteamApps\...\counter-strike\hl.exe" = C:\Games\Steam\SteamApps\...\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{1103112B-513D-4DEF-96B4-9889774E0118}" = Creative Zen Touch
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{1C27C64B-D5CF-4881-A310-0BD2A0D21927}" = ElsterFormular 2005/2006
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar
"{2227E1FA-01F5-483C-AB0E-2A308E900B3D}" = InterVideo FilterSDK for Hauppauge
"{23E8D2D6-F7C8-4A35-816C-6C914EE0A601}" = Citrix Presentation Server Client - Nur Web
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS)
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL)
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}" = Nokia Software Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS)
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
"{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR)
"{5ED20FB0-678F-41EE-9211-DC9C670FD193}" = Battlefield 1942 Multiplayer Demo
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
"{67BBD00E-02E0-40C3-A0BC-DA52BD6C51AF}" = LEXsoft Professional 3.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution
"{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE)
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL)
"{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}" = OmniPage SE 2.0
"{7AB536FD-001A-4FA9-B1ED-786E250213DC}" = PC Remote
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN)
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C22A3CC-E018-4A94-ACA5-213A40AECD94}_is1" = trAAAde Version 1.0
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND)
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT)
"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP
"{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AD6ACA58-30FE-4336-A5B0-461FD60AF727}" = FileOpen Client
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.50
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN)
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C50EF365-2898-489A-B6C7-30DAA466E9A2}" = Nokia Connectivity Cable Driver
"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
"{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN)
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = Canon CanoScan Toolbox 4.9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1B5E9C8-4CCF-44E3-87D6-7C00D7DA5370}" = IntelliSonic Speech Enhancement
"{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN)
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E89B484C-B913-49A0-959B-89E836001658}" = GEAR 32bit Driver Installer
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem-Diagnose-Tool
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)
"4569969E1360D2854474C661EF9B4D54F143EB16" = Windows-Treiberpaket - Ricoh Company (rimsptsk) hdc  (11/14/2006 6.00.01.04)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"CCleaner" = CCleaner
"Clonk Endeavour" = Clonk Endeavour 4.95.5
"Clonk Planet" = Clonk Planet
"Clonk Rage" = Clonk Rage
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"Command and Conquer Renegade" = Command and Conquer Renegade
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Creative Jukebox Driver" = Creative Jukebox Driver
"Creative OEM002" = Laptop Integrated Webcam Driver (1.02.01.0612)  
"DELL Webcam Center" = DELL Webcam Center
"DELL Webcam Manager" = DELL Webcam Manager
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Flick_is1" = DVD Flick 1.3.0.6
"EF System Monitor" = EF System Monitor
"foobar2000" = foobar2000 v0.9.6.3
"Free YouTube Download_is1" = Free YouTube Download version 3.1.22.319
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"Freez FLV to MP3 Converter V1.2_is1" = Freez FLV to MP3 Converter
"Garena" = Garena
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"GXTranscoder v2" = GXTranscoder v2
"Hamachi" = Hamachi 1.0.2.5
"HandBrake" = HandBrake 0.9.6
"Hauppauge TvTv Sync" = Hauppauge TvTv Sync
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"Hauppauge WinTV Scheduler" = Hauppauge WinTV Scheduler
"Hauppauge WinTV Soft PVR" = Hauppauge WinTV Soft PVR
"Hauppauge WinTV2000" = Hauppauge WinTV2000
"HideOE" = HideOE v1.1 (build 6)
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"Inkscape" = Inkscape 0.46
"InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"IPIX Netscape Plugin Viewer" = IPIX Netscape Plugin Viewer
"IrfanView" = IrfanView (remove only)
"Island Wars_is1" = Island Wars v1.20
"Look@LAN_1.0" = Look@LAN 2.50 Build 35
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"MIDI Klavier_is1" = MIDI Klavier 1.0.1
"MIKSOFT Mobile AMR converter_is1" = MIKSOFT Mobile AMR converter
"Mixxx" = Mixxx
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Native Instruments Beatport Sync" = Native Instruments Beatport Sync
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Online Manuals for WinTV (English)" = Online Manuals for WinTV (English)
"ProInst" = Intel(R) PROSet/Wireless Software
"QIP 2005_is1" = QIP 2005 8081
"QIP Infium_is1" = QIP Infium 2.0.9020 RC3
"QIP2005" = QIP 2005 Uninstall
"SearchAssist" = SearchAssist
"Starcraft" = Starcraft
"StarCraft II" = StarCraft II
"SUPER ©" = SUPER © Version 2008.bld.30 (Mar 22, 2008)
"SynTPDeinstKey" = Dell Touchpad
"SysInfo" = Creative-Systeminformationen
"tento.XT_is1" = tento.XT v1.1
"VideoPad" = VideoPad Video Editor
"VLC media player" = VLC media player 1.1.11
"VTPlus32 for WinTV (English)" = VTPlus32 for WinTV (English)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XNotar" = XNotar
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Zune" = Zune
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Octoshape Streaming Services" = Octoshape Streaming Services
"QIP 2005" = QIP 2005 8092
"QIP 2010" = QIP 2010 3.1.5248
"Spotify" = Spotify
"Warcraft III" = Warcraft III: All Products
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst ServiceModelService 4.0.0.0 (ServiceModelService 4.0.0.0). Der Fehlercode
 ist das erste DWORD im Datenbereich.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst SMSvcHost 4.0.0.0 (SMSvcHost 4.0.0.0). Der Fehlercode ist das erste DWORD
 im Datenbereich.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3001
Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung
ist
 falsch formatiert. Die ungültige Zeichenfolge ist 18344 und der ungültige  Indexwert
 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die
 zweiten und dritten DWORD im Datenbereich sind.
 
Error - 20.06.2012 08:33:17 | Computer Name = ROBNB | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst MSDTC Bridge 4.0.0.0 (MSDTC Bridge 4.0.0.0). Der Fehlercode ist das erste
 DWORD im Datenbereich.
 
Error - 20.06.2012 18:07:17 | Computer Name = ROBNB | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung winword.exe, Version 9.0.0.2823, fehlgeschlagenes
 Modul mso9.dll, Version 9.0.0.2812, Fehleradresse 0x00020367.
 
[ System Events ]
Error - 19.06.2012 14:02:13 | Computer Name = ROBNB | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.29 für die Netzwerkkarte mit der Netzwerkadresse
 001B77D1EE55 wurde durch  den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat 
eine DHCPNACK-Meldung gesendet).
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = \DEVICE\{7319860C-8166-4607-8F55-64C0DDC7F464} : Fehlfunktion des 
Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:30 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5002
Description = Intel(R) PRO/Wireless 3945ABG Network Connection : Fehlfunktion des
 Adapters wurde ermittelt.
 
Error - 26.06.2012 09:18:32 | Computer Name = ROBNB | Source = NETw4x32 | ID = 5005
Description = \DEVICE\{7319860C-8166-4607-8F55-64C0DDC7F464} : Interner Fehler aufgetreten.
 
 
< End of report >
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-26 21:45:28
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST9160823AS rev.3.ADB
Running: konp4fzx.exe; Driver: C:\DOKUME~1\Robert\LOKALE~1\Temp\kxtdrpob.sys


---- System - GMER 1.0.15 ----

SSDT            B86D106C                                                                                                             ZwClose
SSDT            B86D1026                                                                                                             ZwCreateKey
SSDT            B86D1076                                                                                                             ZwCreateSection
SSDT            B86D101C                                                                                                             ZwCreateThread
SSDT            B86D102B                                                                                                             ZwDeleteKey
SSDT            B86D1035                                                                                                             ZwDeleteValueKey
SSDT            B86D1067                                                                                                             ZwDuplicateObject
SSDT            B86D103A                                                                                                             ZwLoadKey
SSDT            B86D1008                                                                                                             ZwOpenProcess
SSDT            B86D100D                                                                                                             ZwOpenThread
SSDT            B86D108F                                                                                                             ZwQueryValueKey
SSDT            B86D1044                                                                                                             ZwReplaceKey
SSDT            B86D1080                                                                                                             ZwRequestWaitReplyPort
SSDT            B86D103F                                                                                                             ZwRestoreKey
SSDT            B86D107B                                                                                                             ZwSetContextThread
SSDT            B86D1085                                                                                                             ZwSetSecurityObject
SSDT            B86D1030                                                                                                             ZwSetValueKey
SSDT            B86D108A                                                                                                             ZwSystemDebugControl
SSDT            B86D1017                                                                                                             ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                             section is writeable [0xB69B23A0, 0x5FE082, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Services - GMER 1.0.15 ----

Service         C:\Programme\Dell (*** hidden *** )                                                                                  [AUTO] sprtsvc_dellsupportcenter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x21 0x20 0xC9 0x2F ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xFC 0x6A 0xEA 0x33 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x34 0x8E 0xE9 0x93 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x21 0x20 0xC9 0x2F ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xFC 0x6A 0xEA 0x33 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x34 0x8E 0xE9 0x93 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x21 0x20 0xC9 0x2F ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xFC 0x6A 0xEA 0x33 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x34 0x8E 0xE9 0x93 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE02.00.00.01MSWINDOWS                                58BDEFC58806C68760D54CAA33AC54EDD02FFE8BFA92FEBB61F223DB4457651B73DC6954E5E11D6C1C9BF96474ED138B3E81E0DA24DD89F638078B72C1EA14B29998D7A2AB153A0BF0B9B245EF75159CA670C70B624C0934E30EBF3F5AF28C7991B68BDEEB0DFC6E6149C678C0948736E30C2664F8341D36B92C71489A6AFC014B1098EC1A87441512FACCDD66719BE3F5F630650E3F69B4B1981849742199CDD59257E4911975EFCE0F1C0C418187A47EE8623E2EE912DCE5A2EFAD3BB71B5866BE63128DA9F865055DD24A1A15846C452C79D6C786C34E9827F61CA827BB0E56A91EF332743C4F45CED194994B50A135A0F7C62FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933BA7FD869164D67945D575E7D6A3B9808FEBC9E127BECC74CF87A9C16CA4B2A86F0B1A4438BF13253523E4E3353276FE316AEF92A32201C9194C86E068088149A89F125D40E73120371A56B03A45AA6852EF7C81754AE999A82B143751AEF8606D5F1E2C04BE2D37BD168944457CCF8534B9AD5EBD83E0EC6F439ACCE78FA34CAEB067C4B18DA4C6B91CE97B156D774C0AFEE387EE18EE274F46832A013E587CF3C8904DBE13A7FDEA1A2352DA51BDCA772507EC6241DB864DDCCCB1C72339ADE0458027C2621A54C48B220B7D5FAA7C2FC1EA

---- EOF - GMER 1.0.15 ----