Hallo Liebe Helfer im Trojaner-Board.
Nachdem mir vor einigen Wochen t´john bei der entfernung eines Trojaners super beigestanden hat habe ich nun einen Hilferuf meines Kollegen. (kleine Bürogemeinschaft) erhalten.

Ich beschreib mal was so in etwa passiert ist. Nicht ganz einfach für mich das zu rekonstruieren.

1. Programm gelöscht mit Winows Softwaredingens (Win XP, SP3)
2. Fehlermeldungen das dll´s fehlen, Darstellung von Winows-Fenstern war fehlerhaft. Keine Symbole kein Text.
3. Wiederherstellung von gelöschten Dateien mit PC-Tolls Perfonance (?)
4. Darstellung war wieder in Ordnung
5. Probleme bei Netzwerkfreigabe in PC-Tools Internet Security
6. Deinstallieren von PC-Tools Internet Security
7. Wärend des Löschvorgangs ist der Bluescreen aufgetreten.
8. Kein starten mehr möglich, kommt immer wieder der Bluescreen

Inhalt des Bluescreen:
Es wurde ein Problem festgestellt. Windows wurde heruntergefahren, damit der Computer nicht beschädigt wird..........

Technische Information:
*** stop: 0x0000007B (0xF7A59524,0xC0000034,0x0000000,0x00000000)

So nun habe ich ein wenig bei euch herumgelesen und schonmal folgendes gemacht:

OTLPENet.exe von OldTimer mit ISOBurner auf CD gebrannt.
Rechner mit dieser CD gebootet, hat geklappt
Run Scan ausgeführt
Ergebniss eine OTL.txt Datei die ich unten poste, eine Extra.txt gabs nicht.

Ich hoffe ihr könnt meinem Kollegen weiterhelfen.
Lieben Gruß Nangijala

Inhalt der OTL.txt (100kb)

OTL logfile created on: 9/18/2012 3:26:57 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,014.00 Mb Total Physical Memory | 757.00 Mb Available Physical Memory | 75.00% Memory free
902.00 Mb Paging File | 818.00 Mb Available in Paging File | 91.00% Paging File free
Paging file location(s): D:\pagefile.sys 1521 2524 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58.60 Gb Total Space | 34.62 Gb Free Space | 59.08% Space Free | Partition Type: NTFS
Drive D: | 90.32 Gb Total Space | 64.99 Gb Free Space | 71.95% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - (ThreatFire) --  File not found
SRV - (sdCoreService) --  File not found
SRV - (sdAuxService) --  File not found
SRV - (ImapiService) --  File not found
SRV - (HotSpotFSvc) --  File not found
SRV - (Browser Defender Update Service) --  File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (PCToolsSSDMonitorSvc) -- C:\Programme\Gemeinsame Dateien\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (DMRepairService) -- C:\Programme\PC Tools Utilities\Tools\Repair\DMRepairSrv.exe (PC Tools)
SRV - (DMDefragService) -- C:\Programme\PC Tools Utilities\Tools\Defrag\DMDefragSrv.exe (PC Tools)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Boonty Games) -- C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe (BOONTY)
SRV - (iked) -- C:\Programme\VPN-24\iked.exe ()
SRV - (dtpd) -- C:\Programme\VPN-24\dtpd.exe ()
SRV - (ipsecd) -- C:\Programme\VPN-24\ipsecd.exe ()
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Iap) -- C:\Programme\Dell\OpenManage\Client\Iap.exe (Dell Inc)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (TSMPacket) --  File not found
DRV - (TfSysMon) --  File not found
DRV - (TfNetMon) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCTSD) --  File not found
DRV - (pctplsg) --  File not found
DRV - (pctplfw) --  File not found
DRV - (pctNdisMP) --  File not found
DRV - (pctNdis) --  File not found
DRV - (pctgntdi) --  File not found
DRV - (PCTFW-PacketFilter) --  File not found
DRV - (pctEFA) --  File not found
DRV - (pctDS) --  File not found
DRV - (PCTCore) --  File not found
DRV - (PCTBD) --  File not found
DRV - (PCTAppEvent) --  File not found
DRV - (PCIDump) --  File not found
DRV - (PCANDIS5) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (dsltestSp5) --  File not found
DRV - (Changer) --  File not found
DRV - (PCTDSMon) -- C:\WINDOWS\system32\drivers\PCTDSMon.sys (PC Tools)
DRV - (PCTDMDefrag) -- C:\WINDOWS\system32\drivers\PCTDMDefrag.sys (PC Tools)
DRV - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\WINDOWS\system32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (DumpDrv) -- C:\WINDOWS\System32\drivers\dumpdrv.sys (Microsoft Corporation)
DRV - (pflt) -- C:\WINDOWS\system32\drivers\vfilter.sys (Shrew Soft Inc)
DRV - (vnet) -- C:\WINDOWS\system32\drivers\virtualnet.sys (Shrew Soft Inc)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_XP) -- C:\WINDOWS\System32\drivers\cdr4_XP.sys (Sonic Solutions)
DRV - (FIXUSTOR) -- C:\WINDOWS\system32\drivers\fixustor.sys (Genesys Logic)
DRV - (MRVW245) Marvell TOPDOG 802.11n WLAN Driver for Windows XP (USB8x) -- C:\WINDOWS\system32\drivers\WN121TXP.sys (Marvell Semiconductor, Inc)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (senfilt) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (omci) -- C:\WINDOWS\system32\drivers\omci.sys (Dell Inc)
DRV - (Wdm1) -- C:\WINDOWS\system32\drivers\usbbc.sys ()
DRV - (Aspi32) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (USBHSB) -- C:\WINDOWS\system32\drivers\usbhsb.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.euro.dell.com
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Gast_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Gast_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Herbert_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\Herbert_ON_C\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} -  File not found
IE - HKU\Herbert_ON_C\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
IE - HKU\Herbert_ON_C\..\URLSearchHook: {F4F10C1D-87C7-404A-B4B3-000000000000} - Reg Error: Value error. File not found
IE - HKU\Herbert_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Herbert_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
IE - HKU\Herbert-Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Herbert-Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\npctrl.1.0.30716.0.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=11: C:\Programme\Google\Google Updater\2.2.1070.1219\npCIDetect11.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@thrixxx.com/WebLaunch:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6c: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Programme\Spyware Doctor\BDT\Firefox\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/09/11 05:52:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/09/11 05:51:43 | 000,000,000 | ---D | M]
 
[2012/09/11 05:51:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/09/11 05:51:09 | 000,000,000 | ---D | M] (Talkback) -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla(2).org
[2012/09/11 05:52:12 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010/07/16 23:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2006/08/09 06:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npWebLaunch.dll
[2012/06/28 03:59:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/09/06 03:37:56 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/06/28 03:59:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/06/28 03:59:36 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/28 03:59:36 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/06/28 03:59:36 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004/08/04 10:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} -  File not found
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (PCTools Site Guard) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - Reg Error: Value error. File not found
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Programme\LastPass\LPBar.dll (LastPass)
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - No CLSID value found.
O2 - BHO: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} -  File not found
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Programme\LastPass\LPBar.dll (LastPass)
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
O3 - HKU\Herbert_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} -  File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ISTray]  File not found
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Nektra OEAPI]  File not found
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\Herbert_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Herbert_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Install LastPass FF RunOnce.lnk = C:\Programme\Gemeinsame Dateien\lpuninstall.exe (LastPass)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Install LastPass IE RunOnce.lnk = C:\Programme\Gemeinsame Dateien\lpuninstall.exe (LastPass)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\windata 8 Zahlungserinnerung.lnk = D:\windata\professional 8\windataZahlungserinnerung.exe (windata GmbH & Co.KG)
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Gast\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Herbert-Admin\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Gast_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKU\Herbert-Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - Reg Error: Key error. File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Programme\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Programme\LastPass\LPBar.dll (LastPass)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 -  File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/13 08:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe /wait_usb_drive \??\C:) - C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe (PC Tools)
O34 - HKLM BootExecute: (autocheck autochk /k:\??\C: *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe) - C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe (PC Tools)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/17 09:20:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2012/09/16 05:08:11 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\LocalService\Recent
[2012/09/11 05:51:08 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011/03/06 16:04:55 | 010,809,376 | ---- | C] (LastPass) -- C:\Programme\Gemeinsame Dateien\lpuninstall.exe
[2010/10/23 09:22:17 | 001,370,512 | ---- | C] (                                                            ) -- C:\WINDOWS\pcfix-v204-de.exe
[2010/10/15 09:23:24 | 000,098,816 | ---- | C] (Martin Klinzmann) -- C:\Programme\LicenseCrawler.exe
[2009/01/14 11:52:06 | 000,387,584 | ---- | C] (Gabest) -- C:\Programme\Gemeinsame Dateien\MpegSplitter.ax
[2008/05/05 08:54:50 | 000,873,888 | ---- | C] (CyberLink Corp.) -- C:\Programme\Gemeinsame Dateien\CLVSD.ax
[2007/01/23 13:31:06 | 000,794,112 | R--- | C] (Fred's Software) -- C:\Programme\PRINTKEY2000.EXE
[1998/08/24 04:31:44 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL
[2 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/09/17 09:23:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/09/17 09:23:05 | 000,502,048 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/09/17 09:23:05 | 000,324,774 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012/09/17 09:19:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/17 09:09:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/09/17 09:06:48 | 000,000,202 | ---- | M] () -- C:\WINDOWS\System32\PSLOG
[2012/09/17 09:06:32 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/17 09:06:32 | 000,000,252 | ---- | M] () -- C:\WINDOWS\tasks\SpeedOptimizer Startup.job
[2012/09/17 08:55:23 | 000,665,173 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2012/09/17 08:49:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/17 03:45:38 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/09/15 14:09:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ScanSoft OmniPage SE 4
[2012/09/15 13:00:27 | 000,000,248 | ---- | M] () -- C:\WINDOWS\tasks\RMSchedule.job
[2012/09/15 13:00:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\tasks\PTSchedule.job
[2012/09/13 11:00:43 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Microsoft Office Word.lnk
[2012/09/13 10:17:52 | 000,000,562 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\KNEITINGER.lnk
[2012/09/13 07:19:41 | 000,000,404 | ---- | M] () -- C:\WINDOWS\MAXLINK.INI
[2012/09/13 06:15:03 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
[2012/09/13 02:16:09 | 000,000,210 | -HS- | M] () -- C:\boot.ini
[2012/08/31 05:18:48 | 000,041,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/27 15:05:41 | 000,002,537 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Microsoft Office Excel.lnk
[2012/08/25 07:14:39 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/25 07:14:38 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/09/13 10:17:52 | 000,000,562 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\KNEITINGER.lnk
[2012/07/28 02:08:53 | 000,502,048 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/07/26 07:27:31 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert-Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012/07/26 05:15:26 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012/02/15 08:20:13 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/10 07:52:53 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/02/01 12:23:42 | 000,562,422 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-2315547285-3498848152-998849217-1005-0.dat
[2012/02/01 12:23:38 | 000,324,774 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011/11/23 11:17:31 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2011/10/31 06:22:42 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/10/24 04:07:36 | 000,638,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\s-1-5-21-2315547285-3498848152-998849217-500.rrr
[2011/10/19 10:10:06 | 000,000,575 | ---- | C] () -- C:\Programme\Verknüpfung mit PRINTKEY2000.lnk
[2011/10/18 04:52:02 | 000,000,645 | R--- | C] () -- C:\WINDOWS\System32\hppapr14.dat
[2011/06/07 05:13:38 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/06/07 05:13:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/06/07 05:13:38 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/06/07 05:13:38 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/12/13 04:08:20 | 000,037,344 | ---- | C] () -- C:\WINDOWS\System32\CleanMFT32.exe
[2010/10/25 05:30:44 | 000,056,638 | ---- | C] () -- C:\WINDOWS\System32\axpdfvw.bin
[2010/10/15 09:21:20 | 000,002,548 | ---- | C] () -- C:\Programme\English.lc
[2010/10/15 09:21:16 | 000,002,815 | ---- | C] () -- C:\Programme\German.lc
[2010/04/12 16:52:50 | 000,051,020 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/02/24 04:05:47 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll0815.old
[2010/02/24 04:05:47 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll0100.old
[2010/02/18 05:45:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\gaebKONVERT.INI
[2009/11/18 13:53:20 | 000,000,028 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\confuse44.cab
[2009/11/06 06:38:08 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\ustor.dll
[2009/11/06 06:38:08 | 000,001,376 | ---- | C] () -- C:\WINDOWS\System32\IconCfg0.ini
[2009/10/28 07:10:13 | 000,007,256 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2009/10/26 13:49:58 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2009/10/20 07:13:23 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\moyocore.dll
[2009/10/20 07:12:05 | 000,315,444 | ---- | C] () -- C:\WINDOWS\System32\isdnapi32.dll
[2009/10/20 07:12:04 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\AuerUsbJNINative.dll
[2009/10/20 07:12:03 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\AuerCapiJNINative.dll
[2009/10/20 04:16:11 | 000,020,531 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\R49LW
[2009/10/20 03:22:41 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2009/10/20 03:20:41 | 000,000,404 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/10/06 09:08:31 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2009/01/10 09:35:22 | 000,107,008 | ---- | C] () -- C:\WINDOWS\System32\UnCasino5.exe
[2008/12/20 13:57:47 | 000,000,006 | ---- | C] () -- C:\WINDOWS\System32\b517_256.dll
[2008/12/18 08:02:58 | 000,003,927 | R--- | C] () -- C:\WINDOWS\System32\MXCDRIVE.DLL
[2008/12/18 08:02:58 | 000,003,927 | -H-- | C] () -- C:\WINDOWS\ARDRIVE.SYS
[2008/11/03 12:01:51 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2008/11/03 12:01:29 | 000,009,391 | ---- | C] () -- C:\WINDOWS\System32\dymourl.ini
[2008/11/03 12:00:12 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2008/11/03 12:00:12 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\lmmonres.dll
[2008/07/28 15:30:52 | 000,233,472 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\s-1-5-20.rrr
[2008/07/18 09:46:53 | 000,000,178 | ---- | C] () -- C:\WINDOWS\PhEdit.INI
[2008/07/17 13:15:10 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008/07/17 13:15:09 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2008/07/17 13:15:09 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2008/07/17 13:15:09 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2008/07/17 13:15:09 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2008/07/17 13:15:09 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2008/07/17 13:15:09 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2008/07/17 13:15:09 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2008/07/17 13:15:09 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2008/07/17 13:15:09 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2008/07/17 13:15:09 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2008/07/17 13:15:09 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2008/07/17 13:15:09 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2008/07/17 13:15:09 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2008/07/17 13:15:09 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2008/07/17 13:15:09 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2008/07/17 13:15:09 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2008/07/17 13:15:09 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2008/07/17 13:15:09 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2008/06/10 20:07:20 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/05/22 18:18:54 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/04/12 05:03:20 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\vsmon1.dll
[2008/03/13 08:53:47 | 000,000,075 | ---- | C] () -- C:\WINDOWS\SHIP.INI
[2008/03/13 08:47:46 | 000,304,640 | ---- | C] () -- C:\WINDOWS\Uninstall Schiffe Versenken.exe
[2008/01/10 10:37:10 | 000,237,568 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\s-1-5-19.rrr
[2008/01/01 18:16:17 | 000,000,018 | ---- | C] () -- C:\WINDOWS\iensx.ini
[2008/01/01 18:15:32 | 000,000,313 | ---- | C] () -- C:\WINDOWS\MyNetIE.ini
[2007/12/27 15:07:18 | 000,000,052 | ---- | C] () -- C:\WINDOWS\cddabase.ini
[2007/12/27 14:02:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\check.INI
[2007/11/12 04:22:27 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpclj3600g.ini
[2007/11/12 04:19:36 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpclj3600m.ini
[2007/05/14 04:54:58 | 000,000,056 | ---- | C] () -- C:\WINDOWS\hpdj90.ini
[2007/02/06 15:30:30 | 000,041,984 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/06 12:21:43 | 000,001,753 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007/01/19 12:47:34 | 000,000,761 | ---- | C] () -- C:\WINDOWS\Setupwizard.ini
[2007/01/19 12:46:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
[2007/01/19 12:46:50 | 000,000,101 | ---- | C] () -- C:\WINDOWS\PSXLPR.INI
[2007/01/15 17:29:32 | 000,284,160 | ---- | C] () -- C:\WINDOWS\unin0407.exe
[2007/01/14 11:53:14 | 000,206,336 | ---- | C] () -- C:\WINDOWS\System32\Pcdlib32.dll
[2007/01/14 11:52:31 | 000,185,344 | ---- | C] () -- C:\WINDOWS\System32\Ltann62n.dll
[2007/01/14 11:52:31 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\Lffax62n.dll
[2007/01/14 11:52:31 | 000,158,720 | ---- | C] () -- C:\WINDOWS\System32\Lfcmp62n.dll
[2007/01/14 11:52:31 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\Lfpng62n.dll
[2007/01/14 11:52:31 | 000,078,336 | ---- | C] () -- C:\WINDOWS\System32\Ltimg62n.dll
[2007/01/14 11:52:31 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\Lftif62n.dll
[2007/01/14 11:52:31 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\Ltfil62n.dll
[2007/01/14 11:52:31 | 000,029,184 | ---- | C] () -- C:\WINDOWS\System32\Ltwnd62n.dll
[2007/01/14 11:52:31 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\Lflma62n.dll
[2007/01/14 11:52:31 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Lfica62n.dll
[2007/01/14 11:52:31 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\Lttwn62n.dll
[2007/01/14 11:52:31 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\Lfpcx62n.dll
[2007/01/14 11:52:31 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\Lflmb62n.dll
[2007/01/14 11:52:31 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\Lfeps62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfpct62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfgif62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfbmp62n.dll
[2007/01/14 11:52:31 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\Lfpsd62n.dll
[2007/01/14 11:52:31 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Lfwmf62n.dll
[2007/01/14 11:52:31 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Lftga62n.dll
[2007/01/14 11:52:31 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\Lfwpg62n.dll
[2007/01/14 11:52:31 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\Lfimg62n.dll
[2007/01/14 11:52:31 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\Lfras62n.dll
[2007/01/14 11:52:31 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\Lfmsp62n.dll
[2007/01/14 11:52:31 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\Lfmac62n.dll
[2007/01/14 11:52:31 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\Lfcal62n.dll
[2007/01/14 11:52:31 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\Lfwfx62n.dll
[2007/01/14 11:52:31 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\Lfpcd62n.dll
[2007/01/14 11:52:31 | 000,003,200 | ---- | C] () -- C:\WINDOWS\System32\Ltthk62w.dll
[2007/01/13 19:19:31 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\TXTUSER.EXE
[2007/01/10 09:15:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2007/01/09 05:40:21 | 000,018,690 | ---- | C] () -- C:\WINDOWS\System32\drivers\usbhsb.sys
[2007/01/09 05:19:36 | 000,015,576 | R--- | C] () -- C:\WINDOWS\System32\drivers\usbbc.sys
[2007/01/09 05:18:32 | 000,000,264 | ---- | C] () -- C:\WINDOWS\System32\winsusrm.dll
[2007/01/05 11:33:45 | 000,000,101 | ---- | C] () -- C:\WINDOWS\WinOnCD.ini
[2007/01/05 11:19:02 | 000,001,680 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007/01/05 10:30:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/12/06 05:18:24 | 001,683,456 | R--- | C] () -- C:\WINDOWS\System32\LTCLR13n.dll
[2006/10/23 13:12:40 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\cdlbzlib.dll
[2006/08/10 07:41:33 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/10 07:30:01 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/01/11 18:24:14 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/01/11 18:22:40 | 000,000,408 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/01/11 18:06:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/01/11 18:06:08 | 000,000,412 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/11 06:43:28 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\libssl32.dll
[2005/11/11 06:43:24 | 000,887,296 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/10/20 18:58:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\vspxvfw.dll
[2005/09/01 10:20:46 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\vspxcore.dll
[2005/05/04 14:59:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/13 09:04:30 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/13 09:02:49 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2004/08/13 08:59:38 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/13 08:52:23 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/13 08:47:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/13 08:46:51 | 003,612,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/13 08:40:53 | 000,456,220 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/13 08:40:53 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/13 08:40:53 | 000,088,058 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/13 08:40:53 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/13 08:40:41 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/13 08:40:39 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/13 08:40:39 | 000,115,362 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/13 08:40:39 | 000,032,908 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/13 08:40:39 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/13 08:40:37 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/13 08:40:36 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/13 08:40:35 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/13 08:40:30 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/13 08:40:30 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/13 08:40:22 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/13 08:40:14 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 22:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1998/08/21 08:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\U2LESBSE.DLL
[1998/08/21 08:00:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\U25STORE.DLL
[1998/08/21 08:00:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\U25TOTAL.DLL
[1998/08/21 08:00:00 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\U25DTS.DLL
[1998/08/21 08:00:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\U2LBAR.DLL
[1998/08/21 08:00:00 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\U2LDTS.DLL
[1998/08/21 08:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\U2LEXCH.DLL
[1998/08/21 08:00:00 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\p3s6ifde.dll
[1998/08/21 08:00:00 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\p3o6esde.dll
[1998/08/21 08:00:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\U2LSAMP1.DLL
[1998/08/21 08:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\U2LFINRA.DLL
[1998/08/21 08:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\X2F6SVde.dll
 
========== LOP Check ==========
 
[2011/02/15 03:51:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\PCToolsFirewallPlus
[2012/03/02 04:45:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Spam Monitor
[2011/04/03 12:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PCToolsFirewallPlus
[2011/04/03 12:42:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Registry Mechanic
[2011/04/03 12:29:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Spam Monitor
[2012/07/26 05:16:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gast\Anwendungsdaten\Spam Monitor
[2008/08/05 07:45:20 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\.#
[2009/03/31 07:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Byngo
[2011/11/10 08:55:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Canon
[2009/03/31 07:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\CCPublisher
[2012/02/02 06:42:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\com.adobe.downloadassistant.AdobeDownloadAssistant
[2007/01/09 12:18:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DataDesign
[2010/03/15 04:38:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DesktopMirror
[2009/07/01 03:10:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DriverCure
[2008/04/12 07:35:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\eXPert PDF 5
[2008/04/12 05:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\eXPert PDF Editor
[2007/07/09 09:16:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\GuthCAD
[2011/04/05 12:24:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\isoburnerdata
[2010/01/29 03:32:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\JGoodies
[2011/01/04 10:05:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Lasersoft Imaging
[2007/01/05 10:54:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Leadertech
[2009/10/06 09:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\MAGIX
[2009/10/23 09:44:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\NewSoft
[2010/02/18 05:44:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Nix & Keitel
[2008/07/17 13:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Panasonic
[2011/04/07 04:46:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\PCTools
[2012/01/11 10:41:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Product_PT
[2012/02/23 12:15:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Product_RM
[2007/01/09 05:20:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Proof
[2012/07/13 09:01:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Registry Mechanic
[2012/02/10 07:38:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Samsung
[2009/10/20 03:20:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\ScanSoft
[2010/11/16 08:11:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Screeny30
[2010/11/16 08:23:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Screeny3SE
[2012/02/03 08:41:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\STRATO
[2007/03/13 19:56:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-DSL Manager
[2007/01/05 10:36:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-DSL SpeedManager
[2007/10/10 02:15:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-Online
[2012/02/10 08:34:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Temp
[2012/01/05 06:54:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\TestApp
[2007/11/29 14:45:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\TomTom
[2012/01/23 06:01:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Uniblue
[2007/11/19 15:14:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\VSRevoGroup
[2011/11/10 06:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\www.rene-zeidler.de
[2010/10/23 15:39:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\XnView
[2012/07/26 07:28:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert-Admin\Anwendungsdaten\Spam Monitor
[2010/10/16 14:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOONTY
[2009/03/30 08:45:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CCPublisher
[2009/03/31 07:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CodedColor
[2009/07/01 03:13:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverCure
[2008/04/12 05:03:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF
[2008/04/12 05:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF 5
[2008/04/12 05:03:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF Jobs
[2007/03/13 19:28:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HotSpot Manager
[2011/11/23 11:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IM
[2011/11/23 11:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IncrediMail
[2010/10/17 12:46:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/02/18 05:16:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nix & Keitel
[2012/02/01 11:18:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Panasonic
[2009/07/01 03:10:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ParetoLogic
[2012/02/02 08:04:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2012/02/10 07:39:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2009/10/20 03:20:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2009/10/26 13:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SpeedBit
[2010/10/23 15:41:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL Manager
[2007/11/19 15:43:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2010/12/06 07:50:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2012/09/17 09:22:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011/11/10 06:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\www.rene-zeidler.de
[2010/05/20 02:49:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/30 07:23:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/20 06:08:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2012/09/15 13:00:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\Tasks\PTSchedule.job
[2012/09/15 13:00:27 | 000,000,248 | ---- | M] () -- C:\WINDOWS\Tasks\RMSchedule.job
[2012/09/17 09:06:32 | 000,000,252 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedOptimizer Startup.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 160 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:0D786AE3
@Alternate Data Stream - 150 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CD060F93
@Alternate Data Stream - 144 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\0þ:
@Û
pctlsp.log
@Alternate Data Stream - 140 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84
@Alternate Data Stream - 112 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5BB923A2
@Alternate Data Stream - 111 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:364682BC
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
@Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FB6501C
< End of report >
         

1. Programm gelöscht mit Winows Softwaredingens (Win XP, SP3)

Um welches Programm geht es hier genau bitte?

Nach dem OTLPE-Log sieht das System schon ganz schön verhunzt aus, mal sehen ob man das noch retten kann...

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
SRV - (ThreatFire) --  File not found
SRV - (sdCoreService) --  File not found
SRV - (sdAuxService) --  File not found
SRV - (ImapiService) --  File not found
SRV - (HotSpotFSvc) --  File not found
SRV - (Browser Defender Update Service) --  File not found
DRV - (TSMPacket) --  File not found
DRV - (TfSysMon) --  File not found
DRV - (TfNetMon) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCTSD) --  File not found
DRV - (pctplsg) --  File not found
DRV - (pctplfw) --  File not found
DRV - (pctNdisMP) --  File not found
DRV - (pctNdis) --  File not found
DRV - (pctgntdi) --  File not found
DRV - (PCTFW-PacketFilter) --  File not found
DRV - (pctEFA) --  File not found
DRV - (pctDS) --  File not found
DRV - (PCTCore) --  File not found
DRV - (PCTBD) --  File not found
DRV - (PCTAppEvent) --  File not found
DRV - (PCIDump) --  File not found
DRV - (PCANDIS5) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (dsltestSp5) --  File not found
DRV - (Changer) --  File not found
O4 - HKLM..\Run: [ISTray]  File not found
O4 - HKLM..\Run: [Nektra OEAPI]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Gast_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKU\Herbert-Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/13 08:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe /wait_usb_drive \??\C:) - C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe (PC Tools)
O34 - HKLM BootExecute: (autocheck autochk /k:\??\C: *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe) - C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe (PC Tools)
@Alternate Data Stream - 160 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:0D786AE3
@Alternate Data Stream - 150 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CD060F93
@Alternate Data Stream - 144 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 140 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84
@Alternate Data Stream - 112 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5BB923A2
@Alternate Data Stream - 111 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:364682BC
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
@Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FB6501C
:Files
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\R49LW
C:\Dokumente und Einstellungen\NetworkService\s-1-5-20.rrr
C:\WINDOWS\System32\0þ
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{*
C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Byngo
C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\.#
C:\Dokumente und Einstellungen\Administrator\s-1-5-21-2315547285-3498848152-998849217-500.rrr
:Commands
[purity]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Hallo cosinus. Danke das Du Dich dem Problem annimmst.

Zitat:
1. Programm gelöscht mit Winows Softwaredingens (Win XP, SP3)
Um welches Programm geht es hier genau bitte?

Tj, das wenn ich wüsste. Mein Kollege sagt er weiß es auch nicht mehr, irgendwas das er nicht gebraucht hat. (Meint wohl vom icon am Desktop)

Nach dem OTLPE-Log sieht das System schon ganz schön verhunzt aus, mal sehen ob man das noch retten kann...

das hatte ich befürchtet. Mal sehn.

OTL-FIX hab ich gemacht. Log-Datei untenstehend.

Aber: Windows startet noch immer nicht, nach wie vor der bluescreen

Kann ich den Quarantäneordner auch über Stick, von meinem Rechner hochladen? Nicht das ich mir auch was einfang?

Danke erstmal.

Hier das OTL-Log

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ThreatFire deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sdCoreService deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sdAuxService deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ImapiService deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HotSpotFSvc deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Browser Defender Update Service deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TSMPacket deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TfSysMon deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TfNetMon deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PDRFRAME deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PDRELI deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PDFRAME deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PDCOMP deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCTSD deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctplsg deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctplfw deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctNdisMP deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctNdis deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctgntdi deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCTFW-PacketFilter deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctEFA deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pctDS deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCTCore deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCTBD deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCTAppEvent deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCIDump deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCANDIS5 deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lbrtfdc deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dsltestSp5 deleted successfully.
File   File not found not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Changer deleted successfully.
File   File not found not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ISTray deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Nektra OEAPI deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoCDBurning deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoResolveTrack deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\CDRAutoRun deleted successfully.
Registry value HKEY_USERS\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\Gast_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_USERS\Herbert-Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe /wait_usb_drive \??\C: deleted successfully.
C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:autocheck autochk /k:\??\C: * deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session manager\\BootExecute:C:\PROGRA~1\PC Tools Utilities\Tools\Repair\aDSBatch.exe deleted successfully.
File C:\Programme\PC Tools Utilities\Tools\Repair\aDSBatch.exe not found.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:0D786AE3 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CD060F93 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5BB923A2 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:364682BC deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FB6501C deleted successfully.
========== FILES ==========
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\R49LW moved successfully.
C:\Dokumente und Einstellungen\NetworkService\s-1-5-20.rrr moved successfully.
C:\WINDOWS\System32\0þ moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\x86 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD} folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} folder moved successfully.
C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Byngo folder moved successfully.
C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\.# folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\s-1-5-21-2315547285-3498848152-998849217-500.rrr moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 09202012_124454
         

Mach mal bitte ein neues LOG mit OTLPE. Ich fürchte aber so können wir Windows nicht mehr retten. Evtl. noch über eine Reparaturinstallation.

Hallo Cosinus,
sieht übel aus, aber das dacht ich mir schon.

Nun, ich hab also nochmal ein LOG mit OTLEP gemacht.
Diesmal gabs neben der OTL.txt auch eine EXTRAS.txt

OTL.txt

OTL logfile created on: 9/21/2012 12:15:11 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,014.00 Mb Total Physical Memory | 798.00 Mb Available Physical Memory | 79.00% Memory free
902.00 Mb Paging File | 844.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): D:\pagefile.sys 1521 2524 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58.60 Gb Total Space | 34.62 Gb Free Space | 59.08% Space Free | Partition Type: NTFS
Drive D: | 90.32 Gb Total Space | 64.99 Gb Free Space | 71.95% Space Free | Partition Type: NTFS
Drive E: | 7.44 Gb Total Space | 7.44 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/09/11 05:52:10 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/08/25 07:14:59 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/12/12 09:07:00 | 000,793,048 | ---- | M] (PC Tools) [Auto] -- C:\Programme\Gemeinsame Dateien\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2011/12/12 07:17:04 | 001,030,112 | ---- | M] (PC Tools) [Auto] -- C:\Programme\PC Tools Utilities\Tools\Repair\DMRepairSrv.exe -- (DMRepairService)
SRV - [2011/12/12 07:16:54 | 001,038,304 | ---- | M] (PC Tools) [On_Demand] -- C:\Programme\PC Tools Utilities\Tools\Defrag\DMDefragSrv.exe -- (DMDefragService)
SRV - [2011/02/18 11:37:16 | 000,037,664 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/10/16 14:10:23 | 000,069,120 | ---- | M] (BOONTY) [Auto] -- C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe -- (Boonty Games)
SRV - [2009/07/14 00:34:14 | 000,716,800 | ---- | M] () [Auto] -- C:\Programme\VPN-24\iked.exe -- (iked)
SRV - [2009/07/12 18:55:04 | 000,049,152 | ---- | M] () [Auto] -- C:\Programme\VPN-24\dtpd.exe -- (dtpd)
SRV - [2009/07/12 18:51:24 | 000,536,576 | ---- | M] () [Auto] -- C:\Programme\VPN-24\ipsecd.exe -- (ipsecd)
SRV - [2007/10/11 02:45:56 | 000,051,712 | ---- | M] (ArcSoft) [On_Demand] -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2005/04/03 19:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/02/13 06:47:02 | 000,155,648 | ---- | M] (Dell Inc) [Auto] -- C:\Programme\Dell\OpenManage\Client\Iap.exe -- (Iap)
SRV - [2003/07/28 06:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - [2011/12/12 07:17:34 | 000,128,120 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PCTDSMon.sys -- (PCTDSMon)
DRV - [2011/12/12 07:17:28 | 000,108,864 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PCTDMDefrag.sys -- (PCTDMDefrag)
DRV - [2011/10/26 21:25:54 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011/10/26 21:25:54 | 000,078,136 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2011/01/07 19:22:22 | 000,025,984 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2010/02/11 07:36:50 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009/07/16 11:19:32 | 000,009,472 | ---- | M] (Microsoft Corporation) [Kernel | System] -- C:\WINDOWS\System32\drivers\dumpdrv.sys -- (DumpDrv)
DRV - [2009/02/22 20:02:44 | 000,043,776 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vfilter.sys -- (pflt)
DRV - [2009/01/05 23:51:02 | 000,006,912 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\virtualnet.sys -- (vnet)
DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2007/08/15 18:33:12 | 000,009,464 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2007/08/15 18:33:12 | 000,009,336 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdr4_XP.sys -- (Cdr4_XP)
DRV - [2007/06/11 05:27:20 | 000,012,416 | ---- | M] (Genesys Logic) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fixustor.sys -- (FIXUSTOR)
DRV - [2006/09/28 18:57:04 | 000,489,216 | ---- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WN121TXP.sys -- (MRVW245) Marvell TOPDOG 802.11n WLAN Driver for Windows XP (USB8x)
DRV - [2005/04/01 12:52:46 | 000,132,608 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2005/02/23 08:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2004/08/04 10:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004/08/04 10:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004/02/13 06:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
DRV - [2003/07/28 07:01:38 | 000,015,576 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbbc.sys -- (Wdm1)
DRV - [2002/07/17 02:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2001/12/17 12:42:30 | 000,018,690 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\usbhsb.sys -- (USBHSB)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.euro.dell.com
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Gast_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Gast_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Herbert_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\Herbert_ON_C\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} -  File not found
IE - HKU\Herbert_ON_C\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
IE - HKU\Herbert_ON_C\..\URLSearchHook: {F4F10C1D-87C7-404A-B4B3-000000000000} - Reg Error: Value error. File not found
IE - HKU\Herbert_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Herbert_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
IE - HKU\Herbert-Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.euro.dell.com
IE - HKU\Herbert-Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\npctrl.1.0.30716.0.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=11: C:\Programme\Google\Google Updater\2.2.1070.1219\npCIDetect11.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@thrixxx.com/WebLaunch:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6c: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Programme\Spyware Doctor\BDT\Firefox\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/09/11 05:52:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/09/11 05:51:43 | 000,000,000 | ---D | M]
 
[2012/09/11 05:51:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/09/11 05:51:09 | 000,000,000 | ---D | M] (Talkback) -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla(2).org
[2012/09/11 05:52:12 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010/07/16 23:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2006/08/09 06:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npWebLaunch.dll
[2012/06/28 03:59:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/09/06 03:37:56 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/06/28 03:59:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/06/28 03:59:36 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/28 03:59:36 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/06/28 03:59:36 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012/09/20 12:45:04 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} -  File not found
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (PCTools Site Guard) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - Reg Error: Value error. File not found
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Programme\LastPass\LPBar.dll (LastPass)
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - No CLSID value found.
O2 - BHO: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} -  File not found
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Programme\LastPass\LPBar.dll (LastPass)
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Value error. File not found
O3 - HKU\Herbert_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} -  File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\Herbert_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Herbert_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Install LastPass FF RunOnce.lnk = C:\Programme\Gemeinsame Dateien\lpuninstall.exe (LastPass)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Install LastPass IE RunOnce.lnk = C:\Programme\Gemeinsame Dateien\lpuninstall.exe (LastPass)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\windata 8 Zahlungserinnerung.lnk = D:\windata\professional 8\windataZahlungserinnerung.exe (windata GmbH & Co.KG)
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Gast\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Herbert-Admin\Startmenü\Programme\Autostart\DSL-Manager.lnk =  File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Programme\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Programme\LastPass\LPBar.dll (LastPass)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 -  File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/20 12:44:54 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/09/17 09:20:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2012/09/16 05:08:11 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\LocalService\Recent
[2012/09/11 05:51:08 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011/03/06 16:04:55 | 010,809,376 | ---- | C] (LastPass) -- C:\Programme\Gemeinsame Dateien\lpuninstall.exe
[2010/10/23 09:22:17 | 001,370,512 | ---- | C] (                                                            ) -- C:\WINDOWS\pcfix-v204-de.exe
[2010/10/15 09:23:24 | 000,098,816 | ---- | C] (Martin Klinzmann) -- C:\Programme\LicenseCrawler.exe
[2009/01/14 11:52:06 | 000,387,584 | ---- | C] (Gabest) -- C:\Programme\Gemeinsame Dateien\MpegSplitter.ax
[2008/05/05 08:54:50 | 000,873,888 | ---- | C] (CyberLink Corp.) -- C:\Programme\Gemeinsame Dateien\CLVSD.ax
[2007/01/23 13:31:06 | 000,794,112 | R--- | C] (Fred's Software) -- C:\Programme\PRINTKEY2000.EXE
[1998/08/24 04:31:44 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL
[2 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/09/17 09:23:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/09/17 09:23:05 | 000,502,048 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/09/17 09:23:05 | 000,324,774 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012/09/17 09:19:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/17 09:09:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/09/17 09:06:48 | 000,000,202 | ---- | M] () -- C:\WINDOWS\System32\PSLOG
[2012/09/17 09:06:32 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/17 09:06:32 | 000,000,252 | ---- | M] () -- C:\WINDOWS\tasks\SpeedOptimizer Startup.job
[2012/09/17 08:55:23 | 000,665,173 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2012/09/17 08:49:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/17 03:45:38 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/09/15 14:09:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ScanSoft OmniPage SE 4
[2012/09/15 13:00:27 | 000,000,248 | ---- | M] () -- C:\WINDOWS\tasks\RMSchedule.job
[2012/09/15 13:00:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\tasks\PTSchedule.job
[2012/09/13 11:00:43 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Microsoft Office Word.lnk
[2012/09/13 10:17:52 | 000,000,562 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\KNEITINGER.lnk
[2012/09/13 07:19:41 | 000,000,404 | ---- | M] () -- C:\WINDOWS\MAXLINK.INI
[2012/09/13 06:15:03 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
[2012/09/13 02:16:09 | 000,000,210 | -HS- | M] () -- C:\boot.ini
[2012/08/31 05:18:48 | 000,041,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/27 15:05:41 | 000,002,537 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Microsoft Office Excel.lnk
[2012/08/25 07:14:39 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/25 07:14:38 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/09/13 10:17:52 | 000,000,562 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\KNEITINGER.lnk
[2012/07/28 02:08:53 | 000,502,048 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/07/26 07:27:31 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert-Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012/07/26 05:15:26 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012/02/15 08:20:13 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/10 07:52:53 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/02/01 12:23:42 | 000,562,422 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-2315547285-3498848152-998849217-1005-0.dat
[2012/02/01 12:23:38 | 000,324,774 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011/11/23 11:17:31 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2011/10/31 06:22:42 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/10/19 10:10:06 | 000,000,575 | ---- | C] () -- C:\Programme\Verknüpfung mit PRINTKEY2000.lnk
[2011/10/18 04:52:02 | 000,000,645 | R--- | C] () -- C:\WINDOWS\System32\hppapr14.dat
[2011/06/07 05:13:38 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/06/07 05:13:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/06/07 05:13:38 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/06/07 05:13:38 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/12/13 04:08:20 | 000,037,344 | ---- | C] () -- C:\WINDOWS\System32\CleanMFT32.exe
[2010/10/25 05:30:44 | 000,056,638 | ---- | C] () -- C:\WINDOWS\System32\axpdfvw.bin
[2010/10/15 09:21:20 | 000,002,548 | ---- | C] () -- C:\Programme\English.lc
[2010/10/15 09:21:16 | 000,002,815 | ---- | C] () -- C:\Programme\German.lc
[2010/04/12 16:52:50 | 000,051,020 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/02/24 04:05:47 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll0815.old
[2010/02/24 04:05:47 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll0100.old
[2010/02/18 05:45:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\gaebKONVERT.INI
[2009/11/18 13:53:20 | 000,000,028 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\confuse44.cab
[2009/11/06 06:38:08 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\ustor.dll
[2009/11/06 06:38:08 | 000,001,376 | ---- | C] () -- C:\WINDOWS\System32\IconCfg0.ini
[2009/10/28 07:10:13 | 000,007,256 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2009/10/26 13:49:58 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2009/10/20 07:13:23 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\moyocore.dll
[2009/10/20 07:12:05 | 000,315,444 | ---- | C] () -- C:\WINDOWS\System32\isdnapi32.dll
[2009/10/20 07:12:04 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\AuerUsbJNINative.dll
[2009/10/20 07:12:03 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\AuerCapiJNINative.dll
[2009/10/20 03:22:41 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2009/10/20 03:20:41 | 000,000,404 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/10/06 09:08:31 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2009/01/10 09:35:22 | 000,107,008 | ---- | C] () -- C:\WINDOWS\System32\UnCasino5.exe
[2008/12/20 13:57:47 | 000,000,006 | ---- | C] () -- C:\WINDOWS\System32\b517_256.dll
[2008/12/18 08:02:58 | 000,003,927 | R--- | C] () -- C:\WINDOWS\System32\MXCDRIVE.DLL
[2008/12/18 08:02:58 | 000,003,927 | -H-- | C] () -- C:\WINDOWS\ARDRIVE.SYS
[2008/11/03 12:01:51 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2008/11/03 12:01:29 | 000,009,391 | ---- | C] () -- C:\WINDOWS\System32\dymourl.ini
[2008/11/03 12:00:12 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2008/11/03 12:00:12 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\lmmonres.dll
[2008/07/18 09:46:53 | 000,000,178 | ---- | C] () -- C:\WINDOWS\PhEdit.INI
[2008/07/17 13:15:10 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008/07/17 13:15:09 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2008/07/17 13:15:09 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2008/07/17 13:15:09 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2008/07/17 13:15:09 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2008/07/17 13:15:09 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2008/07/17 13:15:09 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2008/07/17 13:15:09 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2008/07/17 13:15:09 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2008/07/17 13:15:09 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2008/07/17 13:15:09 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2008/07/17 13:15:09 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2008/07/17 13:15:09 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2008/07/17 13:15:09 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2008/07/17 13:15:09 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2008/07/17 13:15:09 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2008/07/17 13:15:09 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2008/07/17 13:15:09 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2008/07/17 13:15:09 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2008/06/10 20:07:20 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/05/22 18:18:54 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/04/12 05:03:20 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\vsmon1.dll
[2008/03/13 08:53:47 | 000,000,075 | ---- | C] () -- C:\WINDOWS\SHIP.INI
[2008/03/13 08:47:46 | 000,304,640 | ---- | C] () -- C:\WINDOWS\Uninstall Schiffe Versenken.exe
[2008/01/10 10:37:10 | 000,237,568 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\s-1-5-19.rrr
[2008/01/01 18:16:17 | 000,000,018 | ---- | C] () -- C:\WINDOWS\iensx.ini
[2008/01/01 18:15:32 | 000,000,313 | ---- | C] () -- C:\WINDOWS\MyNetIE.ini
[2007/12/27 15:07:18 | 000,000,052 | ---- | C] () -- C:\WINDOWS\cddabase.ini
[2007/12/27 14:02:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\check.INI
[2007/11/12 04:22:27 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpclj3600g.ini
[2007/11/12 04:19:36 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpclj3600m.ini
[2007/05/14 04:54:58 | 000,000,056 | ---- | C] () -- C:\WINDOWS\hpdj90.ini
[2007/02/06 15:30:30 | 000,041,984 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/06 12:21:43 | 000,001,753 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007/01/19 12:47:34 | 000,000,761 | ---- | C] () -- C:\WINDOWS\Setupwizard.ini
[2007/01/19 12:46:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
[2007/01/19 12:46:50 | 000,000,101 | ---- | C] () -- C:\WINDOWS\PSXLPR.INI
[2007/01/15 17:29:32 | 000,284,160 | ---- | C] () -- C:\WINDOWS\unin0407.exe
[2007/01/14 11:53:14 | 000,206,336 | ---- | C] () -- C:\WINDOWS\System32\Pcdlib32.dll
[2007/01/14 11:52:31 | 000,185,344 | ---- | C] () -- C:\WINDOWS\System32\Ltann62n.dll
[2007/01/14 11:52:31 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\Lffax62n.dll
[2007/01/14 11:52:31 | 000,158,720 | ---- | C] () -- C:\WINDOWS\System32\Lfcmp62n.dll
[2007/01/14 11:52:31 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\Lfpng62n.dll
[2007/01/14 11:52:31 | 000,078,336 | ---- | C] () -- C:\WINDOWS\System32\Ltimg62n.dll
[2007/01/14 11:52:31 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\Lftif62n.dll
[2007/01/14 11:52:31 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\Ltfil62n.dll
[2007/01/14 11:52:31 | 000,029,184 | ---- | C] () -- C:\WINDOWS\System32\Ltwnd62n.dll
[2007/01/14 11:52:31 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\Lflma62n.dll
[2007/01/14 11:52:31 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Lfica62n.dll
[2007/01/14 11:52:31 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\Lttwn62n.dll
[2007/01/14 11:52:31 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\Lfpcx62n.dll
[2007/01/14 11:52:31 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\Lflmb62n.dll
[2007/01/14 11:52:31 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\Lfeps62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfpct62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfgif62n.dll
[2007/01/14 11:52:31 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Lfbmp62n.dll
[2007/01/14 11:52:31 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\Lfpsd62n.dll
[2007/01/14 11:52:31 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Lfwmf62n.dll
[2007/01/14 11:52:31 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Lftga62n.dll
[2007/01/14 11:52:31 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\Lfwpg62n.dll
[2007/01/14 11:52:31 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\Lfimg62n.dll
[2007/01/14 11:52:31 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\Lfras62n.dll
[2007/01/14 11:52:31 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\Lfmsp62n.dll
[2007/01/14 11:52:31 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\Lfmac62n.dll
[2007/01/14 11:52:31 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\Lfcal62n.dll
[2007/01/14 11:52:31 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\Lfwfx62n.dll
[2007/01/14 11:52:31 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\Lfpcd62n.dll
[2007/01/14 11:52:31 | 000,003,200 | ---- | C] () -- C:\WINDOWS\System32\Ltthk62w.dll
[2007/01/13 19:19:31 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\TXTUSER.EXE
[2007/01/10 09:15:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2007/01/09 05:40:21 | 000,018,690 | ---- | C] () -- C:\WINDOWS\System32\drivers\usbhsb.sys
[2007/01/09 05:19:36 | 000,015,576 | R--- | C] () -- C:\WINDOWS\System32\drivers\usbbc.sys
[2007/01/09 05:18:32 | 000,000,264 | ---- | C] () -- C:\WINDOWS\System32\winsusrm.dll
[2007/01/05 11:33:45 | 000,000,101 | ---- | C] () -- C:\WINDOWS\WinOnCD.ini
[2007/01/05 11:19:02 | 000,001,680 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007/01/05 10:30:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/12/06 05:18:24 | 001,683,456 | R--- | C] () -- C:\WINDOWS\System32\LTCLR13n.dll
[2006/10/23 13:12:40 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\cdlbzlib.dll
[2006/08/10 07:41:33 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/10 07:30:01 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/01/11 18:24:14 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/01/11 18:22:40 | 000,000,408 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/01/11 18:06:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/01/11 18:06:08 | 000,000,412 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/11 06:43:28 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\libssl32.dll
[2005/11/11 06:43:24 | 000,887,296 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/10/20 18:58:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\vspxvfw.dll
[2005/09/01 10:20:46 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\vspxcore.dll
[2005/05/04 14:59:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/13 09:04:30 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/13 09:02:49 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2004/08/13 08:59:38 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/13 08:52:23 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/13 08:47:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/13 08:46:51 | 003,612,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/13 08:40:53 | 000,456,220 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/13 08:40:53 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/13 08:40:53 | 000,088,058 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/13 08:40:53 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/13 08:40:41 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/13 08:40:39 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/13 08:40:39 | 000,115,362 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/13 08:40:39 | 000,032,908 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/13 08:40:39 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/13 08:40:37 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/13 08:40:36 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/13 08:40:35 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/13 08:40:30 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/13 08:40:30 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/13 08:40:22 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/13 08:40:14 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 22:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1998/08/21 08:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\U2LESBSE.DLL
[1998/08/21 08:00:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\U25STORE.DLL
[1998/08/21 08:00:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\U25TOTAL.DLL
[1998/08/21 08:00:00 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\U25DTS.DLL
[1998/08/21 08:00:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\U2LBAR.DLL
[1998/08/21 08:00:00 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\U2LDTS.DLL
[1998/08/21 08:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\U2LEXCH.DLL
[1998/08/21 08:00:00 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\p3s6ifde.dll
[1998/08/21 08:00:00 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\p3o6esde.dll
[1998/08/21 08:00:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\U2LSAMP1.DLL
[1998/08/21 08:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\U2LFINRA.DLL
[1998/08/21 08:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\X2F6SVde.dll
 
========== LOP Check ==========
 
[2011/02/15 03:51:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\PCToolsFirewallPlus
[2012/03/02 04:45:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Spam Monitor
[2011/04/03 12:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PCToolsFirewallPlus
[2011/04/03 12:42:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Registry Mechanic
[2011/04/03 12:29:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Spam Monitor
[2012/07/26 05:16:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gast\Anwendungsdaten\Spam Monitor
[2011/11/10 08:55:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Canon
[2009/03/31 07:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\CCPublisher
[2012/02/02 06:42:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\com.adobe.downloadassistant.AdobeDownloadAssistant
[2007/01/09 12:18:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DataDesign
[2010/03/15 04:38:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DesktopMirror
[2009/07/01 03:10:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\DriverCure
[2008/04/12 07:35:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\eXPert PDF 5
[2008/04/12 05:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\eXPert PDF Editor
[2007/07/09 09:16:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\GuthCAD
[2011/04/05 12:24:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\isoburnerdata
[2010/01/29 03:32:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\JGoodies
[2011/01/04 10:05:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Lasersoft Imaging
[2007/01/05 10:54:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Leadertech
[2009/10/06 09:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\MAGIX
[2009/10/23 09:44:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\NewSoft
[2010/02/18 05:44:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Nix & Keitel
[2008/07/17 13:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Panasonic
[2011/04/07 04:46:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\PCTools
[2012/01/11 10:41:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Product_PT
[2012/02/23 12:15:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Product_RM
[2007/01/09 05:20:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Proof
[2012/07/13 09:01:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Registry Mechanic
[2012/02/10 07:38:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Samsung
[2009/10/20 03:20:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\ScanSoft
[2010/11/16 08:11:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Screeny30
[2010/11/16 08:23:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Screeny3SE
[2012/02/03 08:41:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\STRATO
[2007/03/13 19:56:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-DSL Manager
[2007/01/05 10:36:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-DSL SpeedManager
[2007/10/10 02:15:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\T-Online
[2012/02/10 08:34:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Temp
[2012/01/05 06:54:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\TestApp
[2007/11/29 14:45:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\TomTom
[2012/01/23 06:01:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Uniblue
[2007/11/19 15:14:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\VSRevoGroup
[2011/11/10 06:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\www.rene-zeidler.de
[2010/10/23 15:39:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\XnView
[2012/07/26 07:28:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Herbert-Admin\Anwendungsdaten\Spam Monitor
[2010/10/16 14:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOONTY
[2009/03/30 08:45:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CCPublisher
[2009/03/31 07:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CodedColor
[2009/07/01 03:13:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverCure
[2008/04/12 05:03:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF
[2008/04/12 05:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF 5
[2008/04/12 05:03:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF Jobs
[2007/03/13 19:28:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HotSpot Manager
[2011/11/23 11:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IM
[2011/11/23 11:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IncrediMail
[2010/10/17 12:46:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/02/18 05:16:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nix & Keitel
[2012/02/01 11:18:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Panasonic
[2009/07/01 03:10:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ParetoLogic
[2012/02/02 08:04:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2012/02/10 07:39:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2009/10/20 03:20:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2009/10/26 13:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SpeedBit
[2010/10/23 15:41:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL Manager
[2007/11/19 15:43:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2010/12/06 07:50:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2012/09/17 09:22:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011/11/10 06:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\www.rene-zeidler.de
[2012/09/15 13:00:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\Tasks\PTSchedule.job
[2012/09/15 13:00:27 | 000,000,248 | ---- | M] () -- C:\WINDOWS\Tasks\RMSchedule.job
[2012/09/17 09:06:32 | 000,000,252 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedOptimizer Startup.job
 
========== Purity Check ==========
 
 
< End of report >
         

EXTRAS.txt

OTL Extras logfile created on: 9/21/2012 12:15:11 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,014.00 Mb Total Physical Memory | 798.00 Mb Available Physical Memory | 79.00% Memory free
902.00 Mb Paging File | 844.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): D:\pagefile.sys 1521 2524 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58.60 Gb Total Space | 34.62 Gb Free Space | 59.08% Space Free | Partition Type: NTFS
Drive D: | 90.32 Gb Total Space | 64.99 Gb Free Space | 71.95% Space Free | Partition Type: NTFS
Drive E: | 7.44 Gb Total Space | 7.44 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sr]
"Start" = 4
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Programme\Spyware Doctor\pctsGui.exe" = C:\Programme\Spyware Doctor\pctsGui.exe:*:Enabled:PC Tools Internet Security
"C:\Programme\Samsung\Kies\Kies.exe" = C:\Programme\Samsung\Kies\Kies.exe:*:Enabled:Samsung Kies -- (Samsung)
"C:\Programme\Registry Mechanic\RegMech.exe" = C:\Programme\Registry Mechanic\RegMech.exe:*:Enabled:Registry Mechanic -- (PC Tools)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox -- (Mozilla Corporation)
"C:\Programme\Mozilla Sunbird\sunbird.exe" = C:\Programme\Mozilla Sunbird\sunbird.exe:*:Enabled:Mozilla Sunbird -- (Mozilla)
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Programme\NETGEAR\WN121T\wn121t.exe" = C:\Programme\NETGEAR\WN121T\wn121t.exe:*:Enabled:NETGEAR WN121T Smart Wizard -- ()
"D:\windata\professional 8\windata8.exe" = D:\windata\professional 8\windata8.exe:*:Enabled:windata professional 8 -- (windata GmbH & Co.KG)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{058B32E2-6310-4359-B2D4-1988390C3B83}" = Broadcom Advanced Control Suite
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4805" = CanoScan 8800F
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 21
"{2A17F4DB-C3B7-4E45-AECC-7F9FF6909C4B}" = NETGEAR WN121T wireless USB 2.0 adapter
"{2A54DAE1-1B74-40BC-8A31-2624D60E6644}" = DirectCAD 10
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{345112D9-0930-4A68-AB71-A831BA5DE7AA}" = Microsoft IntelliType Pro 6.2
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C50B9F9-32EB-4426-B65E-AC323D647BA9}" = hppHelpNavCP5220
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{497A1721-088F-41EF-8876-B43C9DA5528B}" = ArcSoft Software Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54971F17-9D16-4D43-95D6-3A86E3D20EDB}" = Office-Bibliothek 4.1
"{54BB95D5-9952-405F-86D0-DA966EF3284D}" = Auerswald COMfortel Set 2.5.0
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6527051E-8939-4639-9690-800B3442E610}" = PC Tools Anti-Spam Toolbar
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{73F1BDB7-11E1-11D5-9DC6-00C04F2FC33B}" = OMCI
"{750DB4C4-0E63-4672-9387-280C8CF82458}" = hppQFolderCP5220
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E653036-DE31-4BFD-96BB-421CC72E06FC}" = PHOTOfunSTUDIO 6.1 HD Lite Edition
"{80E9F5C1-4F6D-494C-A8D3-0B0879EA368D}" = DDBAC
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C5FAD77-F678-4758-A296-C12F08D179E0}" = Microsoft IntelliPoint 6.2
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90AF0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{91130407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{959B7F35-2819-40C5-A0CD-3C53B5FCC935}" = FCR-HS219-1 media reader
"{95A5E960-2EB5-4175-8ABC-D602DB2F8625}" = windata Systemkomponenten
"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2
"{A6E92CAB-9E63-46DC-8ABF-0CAFF7B7CD02}" = eXPert PDF 5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC589470-884E-4E15-96D8-437780F8185D}" = Super LoiLoScope WebShortcut
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B256C380-AC47-4681-8342-7F42E4F0F434}" = JRE 1.6.1
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4E96960-5F6B-48B9-A5BD-6A5A9BB4F027}" = Avery Wizard 3.1
"{B6751A10-2389-4AEF-870A-4DD925F48733}" = Transfer MyPC
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE7A5C3F-BB37-4E9A-B2A5-6D498A8EE30A}" = VeWap  V4.1
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C9A6D63E-2EA9-4226-9D5D-1A481B36EA64}" = itwh KOSTRA-DWD 1.0
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD30B3B7-D2B2-4CB2-8A1D-75DC5A0D0C73}" = VeWap-DB V4.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D01653EF-9F9F-41D6-B879-654A6BF5892C}" = Digital Locker-Assistent
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D18FAED1-BAB5-4E24-95F0-F0AD94E78FE4}" = HP Color LaserJet CP5220 Series 1.0
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D323C27E-5DB7-4EE6-B75D-35C0F4D3FABD}" = Stora Desktop Applications
"{D37150BF-37BB-43B7-BABD-B87E1CADE2BF}" = Duden Korrektor PLUS
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC88820C-64CB-40E9-AA77-E2ECC34368B3}" = Roxio WinOnCD 5 Power Edition
"{DD066C5F-A5C6-4A2B-8A08-7E3395B72C24}" = CIG
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{EFF5012B-5D6F-452C-A9E2-4ECBD2619A36}" = CamMobile View Voraussetzungen
"{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = PhotoStitch
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FA709188-8816-46CC-B7E6-A24743523212}" = windata 8
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2
"Browser Defender_is1" = Browser Guard 4.0
"CAD Viewer 5.0" = CAD Viewer 5.0
"CanonSolutionMenu" = Canon Utilities Solution Menu
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"conduitEngine" = Conduit Engine
"Fotosizer" = Fotosizer 1.27
"Google Updater" = Google Updater
"IncrediMail" = IncrediMail 2.0
"IncrediMail_MediaBar_2 Toolbar" = IncrediMail MediaBar 2 Toolbar
"InstallShield_{2A17F4DB-C3B7-4E45-AECC-7F9FF6909C4B}" = NETGEAR WN121T wireless USB 2.0 adapter
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{DD066C5F-A5C6-4A2B-8A08-7E3395B72C24}" = Canon Internet Library for ZoomBrowser EX
"InstallShield_{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = Canon Utilities PhotoStitch 3.1
"JDiskReport 1.3.2" = JGoodies JDiskReport 1.3.2
"LastPass" = LastPass (nur deinstallieren)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Mozilla Sunbird_is1" = Mozilla Sunbird 0.2
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PC Tools Utilities_is1" = PC Tools Performance Toolkit 2.0
"PDF-XChange 3_is1" = PDF-XChange 3
"PrintServer Utilities" = PrintServer Utilities
"RealPlayer 12.0" = RealPlayer
"Registry Mechanic_is1" = PC Tools Registry Mechanic 11.0
"Revo Uninstaller" = Revo Uninstaller 1.80
"Shrew Soft VPN Client" = Shrew Soft VPN Client
"SilverFast CanonSDK-SE" = SilverFast CanonSDK-SE 6.5.5r2
"Spyware Doctor" = PC Tools Internet-Security 9.0
"Updaterollup" = Updaterollup für Windows XP
"USB File Transfer 1.11A" = USB File Transfer 1.11A
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WildSnake Arcade: Invasion Waves_is1" = WildSnake Arcade: Invasion Waves version 1.41
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinSchafkopf XP" = WinSchafkopf XP
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World Series of Poker TOC" = World Series of Poker: TOC
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XnView_is1" = XnView 1.92
"XPSP3UPPACK" = Sereby's XP SP3 Updatepack Version 3.10.1.1
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\Herbert_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
< End of report >
         

Ich seh dort so keine Ursache mehr für den nicht startende Windows.
Am besten wäre jetzt eine Datensicherung und Reparaturinstallation. Am saubersten wäre eine Neuinstallation von Windows.

Dank Dir Cosinus,
Bluescreen..
hm

Am besten wäre jetzt eine Datensicherung und Reparaturinstallation. Am saubersten wäre eine Neuinstallation von Windows.

Hatte ich erwähnt das ich blond bin?

Also, wir haben hier die org. Win. XP prof. SP 1
Neuinstallation, war ziemlich klar. Is wegen der Datensicherung. Ich möcht ned noch mehr verbocken. Kannst mir kurze Anleitung geben?

Starten mit org. CD
Reparaturdingens anklicken?
was kann dann? was soll ich?

Vielen Dank, und entschuldige das ich Dich mit so profanem Zeug "einfach geschrottet" belaber. Ich habs befürchtet. Kannst mal GAAANZ LAUT sagen. "nix an der registry machen, auch ned mid tollen programmen, wen ma keine ahnung hat" ??

"nix an der registry machen, auch ned mid tollen programmen, wen ma keine ahnung hat" ??

Ich würde ja niemals an der Registry rumfummeln und erst recht nicht, wenn man keine Backups vorher macht

Is wegen der Datensicherung. Ich möcht ned noch mehr verbocken. Kannst mir kurze Anleitung geben?

Zum Thema Datensicherung von infizierten Systemen; mach das über ne Live-CD wie Knoppix, Ubuntu (zweiter Link in meiner Signatur) oder über PartedMagic. Grund: Bei einem Live-System sind keine Schädlinge des infizierten Windows-Systems aktiv, damit ist dann auch eine negative Beeinflussung des Backups durch Schädlinge ausgeschlossen.

Du brauchst natürlich auch ein Sicherungsmedium, am besten dürfte eine externe Platte sein. Sofern du nicht allzuviel sichern musst, kann auch ein USB-Stick ausreichen.

Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipell so aber fast genauso mit allen anderen Live-Systemen auch.

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist



4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken
5. Mounte die Partitionen wo Windows installiert ist, meistens isses /dev/sda1 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind)
6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!
7. Wenn fertig, starte den Rechner neu, schalte die ext. Platte ab und boote von der Windows-DVD zur Neuinstallation (Anleitung beachten)

Lieben Dank, Cosinus.

Da hab ich was zu tun.
Die Hausaufgaben mach i dann ab Montag. ich kann nimma

Danke, darf ich mich melden, wenns wo hakt?
LG Nangijala

Du darfst immer