Mal wieder: TR/ATRAPS.Gen2 und TR/Sirefef.AG.10 Meldung alle paar Minuten

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.03.01.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Manfred :: XXL-5A9180720B [Administrator]

07.05.2013 17:55:41
MBAM-log-2013-05-07 (17-56-33).txt

Art des Suchlaufs: Benutzerdefinierter Suchlauf (C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004|)
Aktivierte Suchlaufeinstellungen: Dateisystem | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Heuristiks/Extra | P2P
Durchsuchte Objekte: 9
Laufzeit: 9 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\n (Trojan.0Access) -> Keine Aktion durchgeführt.
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U\00000004.@ (Trojan.0Access) -> Keine Aktion durchgeführt.
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U\00000008.@ (Trojan.0Access) -> Keine Aktion durchgeführt.
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U\000000cb.@ (Trojan.0Access) -> Keine Aktion durchgeführt.
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U\80000000.@ (Trojan.0Access) -> Keine Aktion durchgeführt.
C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U\80000032.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

(Ende)
         

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.07.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Manfred :: XXL-5A9180720B [Administrator]

07.05.2013 18:08:19
mbam-log-2013-05-07 (18-08-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 390524
Laufzeit: 1 Stunde(n), 32 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Zoek.exe Version 4.0.0.2 Updated 06-May-2013
Tool run by XXM on 07.05.2013 at 21:41:13,93.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} deleted successfully

==== Deleting CLSID Registry Values ======================


==== FireFox Fix ======================

ProfilePath: C:\Dokumente und Einstellungen\XXL\Anwendungsdaten\Mozilla\Firefox\Profiles\oco7rim9.default

user.js not found
---- Lines CT2625848 removed from prefs.js ----


---- Lines CT2625848 modified from prefs.js ----


---- Lines conduit removed from prefs.js ----


---- Lines conduit modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines smartbar removed from prefs.js ----


---- Lines smartbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ---- 

prefs__2145_.backup

ProfilePath: C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default

user.js not found
---- Lines CT2625848 removed from prefs.js ----

user_pref("CT2625848.1000082.isDisplayHidden", "true");
user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzY3OTQ5NjMzODM1LCJ1cGRhdGVSZXNwVGltZSI6MTM2Nzk0OTYzNDM2NiwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3N0b3JhZ2UuY29uZHVpdC5jb20vNDgvMjYyL0NUMjYyNTg0OC9pbWFnZXMvNjM0ODA1MzkxMTcwNjMzOTU0XzI0UFgucG5nIiwiY29tcG9uZW50SWQiOiIxMjk4OTQwMjM2MTEyNDA1MTEiLCJ0ZW1wbGF0ZUlkIjoiYjRiNjI3OTgtYzBmZS00ZTg2LWJmMDMtYWRhNzk2ODg5ZDFlIn0sImNvbnRlbnQiOnsicHJvZmlsZU5hbWUiOnsiaWQiOiJwcm9maWxlTmFtZSIsInR5cGUiOiJ0ZXh0Ym94IiwiZGF0YSI6eyJ2YWx1ZSI6Imh0dHA6Ly93d3cuZmFjZWJvb2suY29tL0RWRFZpZGVvU29mdC5kZSJ9fSwiZGlzcGxheUZCSWNvbiI6eyJpZCI6ImRpc3BsYXlGQkljb24iLCJ0eXBlIjoiY2hlY2tib3giLCJkYXRhIjp7InZhbHVlIjpmYWxzZX19fX19");
user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2625848.FirstTime", "true");
user_pref("CT2625848.FirstTimeFF3", "true");
user_pref("CT2625848.SearchAppState.enc", "Mw==");
user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
user_pref("CT2625848.UserID", "UN71866388753224455");
user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
user_pref("CT2625848.autoDisableScopes", -1);
user_pref("CT2625848.defaultSearch", "false");
user_pref("CT2625848.enableAlerts", "false");
user_pref("CT2625848.enableSearchFromAddressBar", "true");
user_pref("CT2625848.firstTimeDialogOpened", "true");
user_pref("CT2625848.fixPageNotFoundError", "true");
user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
user_pref("CT2625848.fixUrls", true);
user_pref("CT2625848.installId", "conduitnsisintegration");
user_pref("CT2625848.installType", "conduitnsisintegration");
user_pref("CT2625848.isCheckedStartAsHidden", true);
user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
user_pref("CT2625848.isNewTabEnabled", false);
user_pref("CT2625848.isPerformedSmartBarTransition", "true");
user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiIxM2RhYWE2YS02NzYwLTQ0NDAtOTJhMy1hYmEwNzliNzI4ZjAiLCJkb21haW5zIjpbImJvb2tpbmcuY29tIiwiZXhwZWRpYSIsImhvdGVscy5jb20iLCJwcmljZWxpbmUuY29tIiwib3JiaXR6LmNvbSJdLCJkb21haW5zRXhjZXB0aW9uIjpbIiJdfV19LHsiaWQiOiJQcmljZUdvbmciLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJjYTg5MzZjNS1iZDQ3LTRlYTgtOWIzOC1kOWNhZmFlMjg2MmYiLCJkb21haW5zIjpbIioiXSwiZG9tYWluc0V4Y2VwdGlvbiI6WyIiXX1dfSx7ImlkIjoiV2luZG93U2hvcHBlciIsImNyaXRlcmlhcyI6W3siY3JpdGVyaWFJZCI6ImM5ODcxODYxLTFmZDAtNGRjZC1iY2YxLWExNTI0ZGVmOWRmZiIsImRvbWFpbnMiOlsiKiJdLCJkb21haW5zRXhjZXB0aW9uIjpbIiJdfV19LHsiaWQiOiJDb3Vwb25CdWRkeSIsImNyaXRlcmlhcyI6W3siY3JpdGVyaWFJZCI6IjM3NmFlMTkzLTY4MDktNGFjYS04MTAyLTVjNWFlNDU1ODBkYSIsImRvbWFpbnMiOlsiKiJdLCJkb21haW5zRXhjZXB0aW9uIjpudWxsfV19LHsiaWQiOiJFYXN5dG9ib29rIiwiY3JpdGVyaWFzIjpbeyJjcml0ZXJpYUlkIjoiOWFkNzA0MzUtMmEzYy00MzJlLWIzZmMtMDQ3OTRkMTg5MWM0IiwiZG9tYWlucyI6WyJib29raW5nLmNvbSIsImV4cGVkaWEiLCJob3RlbHMuY29tIiwicHJpY2VsaW5lLmNvbSIsIm9yYml0ei5jb20iXSwiZG9tYWluc0V4Y2VwdGlvbiI6WyIiXX1dfV0sIlN0YXR1cyI6InN1Y2NlZWRlZCIsImxhc3RVcGRhdGVUaW1lIjoxMzY3OTQ5NjM1NzU4fQ==");
user_pref("CT2625848.mam_gk_currentVersion.enc", "MS40LjQuNg==");
user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsdCI6dHJ1ZSwiSGFkUEciOmZhbHNlLCJuZXdBcHBzRXhwZXJpZW5jZSI6ZmFsc2UsInRyYWNraW5nIjp7ImdhIjp0cnVlLCJkYiI6dHJ1ZX0sInNlcnZpY2VzIjpbeyJuYW1lIjoiY29uZmlndXJhdGlvbiIsInVybCI6Imh0dHA6Ly9jbGllbnRzZXJ2aWNlLm1hbS5jb25kdWl0LXNlcnZpY2VzLmNvbS9jb25maWd1cmF0aW9uP2N0aWQ9Q1QyNjI1ODQ4JnN0YW1wPTYxXy0xJmNvdW50cnk9REUmYnJvd3Nlcj1FQkJST1dTRVImYnJvd3NlcnZlcnNpb249RUJCUk9XU0VSVkVSU0lPTiIsImludGVydmFsIjoyNDB9LHsibmFtZSI6ImFwcHNEYXRhIiwidXJsIjoiaHR0cDovL2NsaWVudHNlcnZpY2UubWFtLmNvbmR1aXQtc2VydmljZXMuY29tL2FwcHNkYXRhP2N0aWQ9Q1QyNjI1ODQ4JnN0YW1wPTYxXy0xJmNvdW50cnk9REUmYnJvd3Nlcj1FQkJST1dTRVImYnJvd3NlcnZlcnNpb249RUJCUk9XU0VSVkVSU0lPTiYmbG9jYWw9RUJMT0NBTEUiLCJpbnRlcnZhbCI6MjQwfSx7Im5hbWUiOiJsb2NhbGl6YXRpb24iLCJ1cmwiOiJodHRwOi8vbG9jYWxpemF0aW9uc2VydmljZS5tYW0uY29uZHVpdC5jb20vZ2V0cHJvZHVjdHRyYW5zbGF0aW9uP3A9bWFtJmw9RUJMT0NBTEUiLCJpbnRlcnZhbCI6MTQ0MH0seyJuYW1lIjoibG9naW4iLCJ1cmwiOiJodHRwOi8vbWFtLWFsaXZlLW1zZy5jb25kdWl0LWRhdGEuY29tIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoidXNhZ2UiLCJ1cmwiOiJodHRwOi8vbWFtLXVzYWdlLmNvbmR1aXQtZGF0YS5jb20vIiwiaW50ZXJ2YWwiOjI0MH1dfSwibGFzdFVwZGF0ZVRpbWUiOjEzNjc5NDk2MzU2NjJ9");
user_pref("CT2625848.migrateAppsAndComponents", true);
user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"http%3A%2F%2Fwww.search.ask.com%2F%3Fl%3Ddis%26o%3DAPN10023%26gct%3Dhp\",\"EB_MAIN_FRAME_TITLE\":\"Ask.com%20\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com/\",\"EB_TOOLBAR_ID\":\"CT2625848\",\"EB_TOOLBAR_VERSION\":\"10.13.1.89\",\"EB_ORIGINAL_CTID\":\"CT2625848\",\"EB_DOWNLOAD_PAGE\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com/\",\"EB_TOOLBAR_NAME\":\"DVDVideoSoftTB DE\"}");
user_pref("CT2625848.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
user_pref("CT2625848.openThankYouPage", "false");
user_pref("CT2625848.openUninstallPage", "true");
user_pref("CT2625848.search.searchAppId", "129181467799155027");
user_pref("CT2625848.search.searchCount", "0");
user_pref("CT2625848.searchInNewTabEnabled", "false");
user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1367941738645");
user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1367941618603");
user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1367941738505");
user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1367941618735");
user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1351020212942");
user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1367941738539");
user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1367941738460");
user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1367941618291");
user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1367941738473");
user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1367949892377");
user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1367941618997");
user_pref("CT2625848.settingsINI", true);
user_pref("CT2625848.shouldFirstTimeDialog", "false");
user_pref("CT2625848.smartbar.CTID", "CT2625848");
user_pref("CT2625848.smartbar.Uninstall", "0");
user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
user_pref("CT2625848.startPage", "userChanged");
user_pref("CT2625848.toolbarBornServerTime", "19-10-2012");
user_pref("CT2625848.toolbarCurrentServerTime", "7-5-2013");
user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1367955124342,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");

---- Lines CT2625848 modified from prefs.js ----


---- Lines conduit removed from prefs.js ----


---- Lines conduit modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines smartbar removed from prefs.js ----


---- Lines smartbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ---- 

prefs__2145_.backup

==== Deleting Files \ Folders ======================

"C:\RECYCLER\S-1-5-18\$312bea325aa251e2ebcd6a3f29ec5ca7" not found 
"C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job" not found 
"C:\END" deleted
"C:\Dokumente und Einstellungen\XXL\Anwendungsdaten\Mozilla\Firefox\Profiles\oco7rim9.default\searchplugins\winamp-search.xml" deleted
"C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\@" deleted
"C:\Programme\Ask.com\Updater\Updater.exe" deleted
"C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7" deleted
"C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\L" deleted
"C:\RECYCLER\S-1-5-21-746137067-1229272821-839522115-1004\$312bea325aa251e2ebcd6a3f29ec5ca7\U" deleted
"C:\Programme\Ask.com" not deleted
"C:\Programme\Conduit" deleted
"C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\PriceGong" deleted
"C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\CT2625848" deleted
"C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}" deleted
"C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\CT2625848" deleted
"C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\smartbar" deleted
"C:\Programme\Ask.com\Updater" not deleted

==== Registry Search Results for "$312bea325aa251e2ebcd6a3f29ec5ca7" ======================

No instances of string "$312bea325aa251e2ebcd6a3f29ec5ca7" found.

==== Files Recently Created / Modified ======================

====== C:\WINDOWS ====
====== C:\DOKUME~1\XXM\LOKALE~1\Temp ====
====== C:\WINDOWS\system32 =====
2013-05-07 18:49:35	D0F47BFDDE810912F65E079B5956D6C7	94112	----a-w-	C:\WINDOWS\System32\WindowsAccessBridge.dll
2013-05-07 16:03:19	1FBCCC1C540ACC4EB3F718B659ED63CA	693976	----a-w-	C:\WINDOWS\System32\FlashPlayerApp.exe
====== C:\WINDOWS\system32\drivers =====
====== C:\WINDOWS\Tasks ======
2013-05-07 16:03:20	B951E972B2AEFA370C897D9362237FF6	884	----a-w-	C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
====== C:\WINDOWS\Temp ======
======= C:\Programme =====
2013-05-07 18:43:34	--------	d-----w-	C:\Programme\URE
2013-05-07 18:43:34	--------	d-----w-	C:\Programme\readmes
2013-05-07 18:43:33	--------	d-----w-	C:\Programme\share
2013-05-07 18:43:33	--------	d-----w-	C:\Programme\program
2013-05-07 18:43:33	--------	d-----w-	C:\Programme\Basis
2013-05-07 18:37:17	--------	d-----w-	C:\Programme\QuickTime
2013-05-07 18:02:29	--------	d-----w-	C:\Programme\Mozilla Maintenance Service
======= C: =====
====== C:\Dokumente und Einstellungen\XXM\Anwendungsdaten ======
2013-05-07 18:58:43	--------	d-----w-	C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Anwendungsdaten\Sun
2013-05-07 18:44:20	--------	d-s---w-	C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Office\OpenOffice.org 3.4.1
2013-05-07 18:37:16	--------	d-----w-	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2013-05-07 18:16:45	--------	d-----w-	C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Skype
2013-05-07 18:02:29	--------	d-----w-	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
====== C:\Dokumente und Einstellungen\XXM ======
2013-05-07 19:28:55	--------	d--h--r-	C:\Dokumente und Einstellungen\XXM\Recent

====== C: exe-files ==
=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe -atboottime"
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe"
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe"
"Persistence"="C:\WINDOWS\system32\igfxpers.exe"
"SigmatelSysTrayApp"="sttray.exe"
"CanonMyPrinter"="C:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon"
"CanonSolutionMenu"="C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon"
"TkBellExe"="C:\programme\real\realplayer\update\realsched.exe  -osboot"
"Adobe ARM"="C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="C:\Programme\Ask.com\Updater\Updater.exe"
"avgnt"="C:\Programme\Avira\AntiVir Desktop\avgnt.exe /min"
"APSDaemon"="C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe"
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe -atboottime"
"SunJavaUpdateSched"="C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
" Malwarebytes Anti-Malware "="C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe -atboottime"
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QuickTime Task"
"hkey"="HKLM"
"command"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="swg"
"hkey"="HKCU"
"command"="\"C:\\Programme\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TkBellExe"
"hkey"="HKLM"
"command"="\"C:\\programme\\real\\realplayer\\update\\realsched.exe\"  -osboot"


==== Task Scheduler Jobs ======================

C:\WINDOWS\tasks\Adobe Flash Player Updater.job --a------ C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [07.05.2013 19:03]
C:\WINDOWS\tasks\AppleSoftwareUpdate.job --a------ C:\Programme\Apple Software Update\SoftwareUpdate.exe [01.06.2011 18:57]
C:\WINDOWS\tasks\Google Software Updater.job --a------ [Undertermined Task]
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Programme\Google\Update\GoogleUpdate.exe [01.01.2010 15:19]
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Programme\Google\Update\GoogleUpdate.exe [01.01.2010 15:19]
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-1229272821-839522115-1004.job --a------ C:\Programme\Real\RealUpgrade\realupgrade.exe [24.01.2011 15:25]
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-1229272821-839522115-1006.job --a------ C:\Programme\Real\RealUpgrade\realupgrade.exe [24.01.2011 15:25]
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-1229272821-839522115-1004.job --a------ C:\Programme\Real\RealUpgrade\realupgrade.exe [24.01.2011 15:25]
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-1229272821-839522115-1006.job --a------ C:.C:\Programme\Real\RealUpgrade\realupgrade.exe []

==== Firefox Extensions ======================

ProfilePath: C:\Dokumente und Einstellungen\XXL\Anwendungsdaten\Mozilla\Firefox\Profiles\oco7rim9.default
- Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
- Winamp Toolbar - %ProfilePath%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

ProfilePath: C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default
- DVDVideoSoftTB DE - %ProfilePath%\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
- Free YouTube Download Free Studio Menu - %ProfilePath%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

==== Firefox Plugins ======================

Profilepath: C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default
8F24103AB984847AA2939F58F19CCC98	- C:\Programme\Java\jre7\bin\plugin2\npjp2.dll -	Java(TM) Platform SE 7 U21
ADC539F67D3198679F480974EE203678	- C:\WINDOWS\system32\npDeployJava1.dll -	Java Deployment Toolkit 7.0.210.11
79015395CD86C12A7BF696F14C04191C	- C:\Programme\QuickTime\Plugins\npqtplugin6.dll -	QuickTime Plug-in 7.7.3
24B57188208F9326F2AF8B2EAD6967A7	- C:\Programme\QuickTime\Plugins\npqtplugin7.dll -	QuickTime Plug-in 7.7.3
79015395CD86C12A7BF696F14C04191C	- C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll -	QuickTime Plug-in 7.7.3
24B57188208F9326F2AF8B2EAD6967A7	- C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll -	QuickTime Plug-in 7.7.3
6E7690D2EE4E530DAC8C562CF8CCE70B	- C:\Programme\QuickTime\Plugins\npqtplugin5.dll -	QuickTime Plug-in 7.7.3
6E7690D2EE4E530DAC8C562CF8CCE70B	- C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll -	QuickTime Plug-in 7.7.3
D2E4BDDD297B6A481BAC612C25A1F10A	- C:\Programme\QuickTime\Plugins\npqtplugin4.dll -	QuickTime Plug-in 7.7.3
D2E4BDDD297B6A481BAC612C25A1F10A	- C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll -	QuickTime Plug-in 7.7.3
7A14B17E24CE74BBB603B824EDA79A72	- C:\Programme\QuickTime\Plugins\npqtplugin3.dll -	QuickTime Plug-in 7.7.3
7A14B17E24CE74BBB603B824EDA79A72	- C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll -	QuickTime Plug-in 7.7.3
2A92F41DCBB5832872D8B0E941746112	- C:\Programme\QuickTime\Plugins\npqtplugin2.dll -	QuickTime Plug-in 7.7.3
2A92F41DCBB5832872D8B0E941746112	- C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll -	QuickTime Plug-in 7.7.3
C1FD5EE5FD1F65CE223A5C3AE846DDF6	- C:\Programme\QuickTime\Plugins\npqtplugin.dll -	QuickTime Plug-in 7.7.3
C1FD5EE5FD1F65CE223A5C3AE846DDF6	- C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll -	QuickTime Plug-in 7.7.3
F7E72D3A281F922BACEC1A71A826D4C2	- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll -	Shockwave Flash
3D928B3FE97C403A33F803B3D1A260C9	- C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll -	Google Update
66640A55AEFF3819C94E0A8D40D7E0AD	- C:\WINDOWS\system32\Adobe\Director\np32dsw_1202122.dll -	Shockwave for Director / Shockwave for Director
E971E06DDE68684CB3957C5D0E133CB0	- C:\Programme\Google\Google Earth\plugin\npgeplugin.dll -	Google Earth Plugin
F647D0BEA553C1D0C251CE07DA6A5511	- C:\Programme\Adobe\Reader 10.0\Reader\browser\nppdf32.dll -	Adobe Acrobat
F647D0BEA553C1D0C251CE07DA6A5511	- C:\Programme\Mozilla Firefox\plugins\nppdf32.dll -	Adobe Acrobat
DB988B4550DB9BCE86F9199D961057FC	- C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll -	Adobe Acrobat
358878E398AB0FB8B1EE176C2E3EDF48	- C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll -	Google Updater
4F026FFD7C1577767566FD8153858D51	- c:\programme\real\realplayer\Netscape6\nprjplug.dll -	RealJukebox NS Plugin
4F026FFD7C1577767566FD8153858D51	- C:\Programme\Mozilla Firefox\plugins\nprjplug.dll -	RealJukebox NS Plugin
B1BDEF36C5F53D0158E56B74148674B4	- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll -	RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)
1A0FB18FE23A0265F84C6954B6AB64D3	- c:\programme\real\realplayer\Netscape6\nppl3260.dll -	RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
1A0FB18FE23A0265F84C6954B6AB64D3	- C:\Programme\Mozilla Firefox\plugins\nppl3260.dll -	RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
6A717DF6573038773EA8E5CDA02E8B4A	- c:\programme\real\realplayer\Netscape6\nprpjplug.dll -	RealPlayer Version Plugin
6A717DF6573038773EA8E5CDA02E8B4A	- C:\Programme\Mozilla Firefox\plugins\nprpjplug.dll -	RealPlayer Version Plugin
24E990B1E6D55428001843CF7217DD81	- C:\Programme\Microsoft\Office Live\npOLW.dll -	Microsoft Office Live Plug-in for Firefox / Microsoft Office Live Plug-in for Firefox
CE252B04FB9F4F773A7DB5338BFEEA5B	- C:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL -	CANON iMAGE GATEWAY Album Plugin Utility
AB87EEFFD18F2BAAFC274E7075EA6C67	- c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll -	Windows Presentation Foundation / Windows Presentation Foundation
38A1E65626558B8776C3546BE4491993	- C:\Programme\Windows Media Player\npdrmv2.dll -	Microsoft® DRM
AE3A029E3DC4EEB5EF5A4C2C997F78F8	- C:\Programme\Windows Media Player\npdsplay.dll -	Windows Media Player Plug-in Dynamic Link Library
1D187905079ACC40C420E7C8BD167731	- C:\Programme\Windows Media Player\npwmsdrm.dll -	Microsoft® DRM
9A6101F29E2E9D41B99CBCC8F106E8FE	- C:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL -	2007 Microsoft Office system
8B07628E389E72B83473383914333AD6	- C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL -	Microsoft Office 2003
F630B4A9D9C1AAF6BBABBB41E9BD45B5	- C:\WINDOWS\system32\npptools.dll -	Betriebssystem Microsoft® Windows®


==== Deleting Files \ Folders ======================

"C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}" deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
jfmjfhklogoienhpfnppmbcbjfjnkonk - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx[11.02.2011 23:23]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.de/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com/ie"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.de/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Unknown  Url="hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

==== Empty IE Cache ======================

C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\XXL\Lokale Einstellungen\temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\XXL\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Dokumente und Einstellungen\XXL\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\oco7rim9.default\Cache emptied successfully
C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

After Reboot

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\DOKUME~1\XXM\LOKALE~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Programme\Ask.com"  not found
         

OTL logfile created on: 07.05.2013 22:03:27 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\XXM\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,46 Gb Available Physical Memory | 73,17% Memory free
3,84 Gb Paging File | 3,39 Gb Available in Paging File | 88,13% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 33,48 Gb Free Space | 44,92% Space Free | Partition Type: NTFS
 
Computer Name: XXL-5A9180720B | User Name: XXM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\XXM\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Programme\SigmaTel\C-Major Audio\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\WINDOWS\sttray.exe (SigmaTel, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
 
 
========== Services (SafeList) ==========
 
SRV - (Iomega Activity Disk2) --  File not found
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe File not found
SRV - (JavaQuickStarterService) -- C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
SRV - (STacSV) -- C:\Programme\SigmaTel\C-Major Audio\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) -- C:\Programme\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
SRV - (Iomega App Services) -- C:\Programme\Iomega\System32\AppServices.exe (Iomega Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (catchme) -- C:\test\catchme.sys File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (giveio) -- C:\WINDOWS\system32\giveio.sys ()
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (iomdisk) -- C:\WINDOWS\system32\drivers\IomDisk.sys (Iomega Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 68 1A B7 FE CA CB 01  [binary data]
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVD0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7GPEA_de
IE - HKU\S-1-5-21-746137067-1229272821-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.633: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.633: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.633: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.633: c:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.02.11 23:23:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.05.07 20:37:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.05.07 20:49:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.20\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2013.05.07 20:37:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.20\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2013.05.07 20:38:10 | 000,000,000 | ---D | M]
 
[2011.03.02 21:03:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Extensions
[2011.03.02 21:03:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013.05.07 21:50:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\extensions
[2012.10.19 12:28:11 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Mozilla\Firefox\Profiles\jw2rwm7g.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.07 19:48:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.05.07 20:07:44 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2013.05.07 20:07:40 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.05.07 20:07:40 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2013.05.07 20:07:40 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2013.05.07 20:07:40 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.05.07 20:07:40 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.05.07 20:07:40 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.02.10 16:02:37 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVD0.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..\Toolbar\WebBrowser: (DVDVideoSoftTB DE Toolbar) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVD0.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] "C:\Programme\Ask.com\Updater\Updater.exe" File not found
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O15 - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKU\S-1-5-21-746137067-1229272821-839522115-1006\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1367949138484 (MUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{416283D3-918B-423B-BBC0-F053E45205A2}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.30 15:09:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.07 21:52:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2013.05.07 21:29:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXM\Eigene Dateien\CC
[2013.05.07 21:28:55 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\XXM\Recent
[2013.05.07 20:58:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Anwendungsdaten\Sun
[2013.05.07 20:49:38 | 000,866,720 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll
[2013.05.07 20:49:38 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013.05.07 20:49:38 | 000,144,896 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013.05.07 20:49:35 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013.05.07 20:49:35 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013.05.07 20:49:35 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013.05.07 20:45:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\sun
[2013.05.07 20:43:34 | 000,000,000 | ---D | C] -- C:\Programme\URE
[2013.05.07 20:43:34 | 000,000,000 | ---D | C] -- C:\Programme\readmes
[2013.05.07 20:43:33 | 000,000,000 | ---D | C] -- C:\Programme\share
[2013.05.07 20:43:33 | 000,000,000 | ---D | C] -- C:\Programme\program
[2013.05.07 20:43:33 | 000,000,000 | ---D | C] -- C:\Programme\Basis
[2013.05.07 20:39:45 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.07 20:37:17 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2013.05.07 20:37:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
[2013.05.07 20:16:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXM\Anwendungsdaten\Skype
[2013.05.07 20:02:29 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2013.05.07 20:02:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2013.05.07 18:03:19 | 000,693,976 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.07 22:02:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.05.07 21:54:54 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-1229272821-839522115-1006.job
[2013.05.07 21:54:12 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.05.07 21:54:12 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.07 21:54:12 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-1229272821-839522115-1004.job
[2013.05.07 21:53:36 | 000,330,688 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.05.07 21:41:10 | 000,024,064 | ---- | M] () -- C:\WINDOWS\zoek-delete.exe
[2013.05.07 21:37:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.07 20:49:22 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013.05.07 20:49:21 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll
[2013.05.07 20:49:21 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2013.05.07 20:49:21 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013.05.07 20:49:21 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013.05.07 20:49:21 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013.05.07 20:49:21 | 000,144,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013.05.07 20:44:20 | 000,000,753 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.4.1.lnk
[2013.05.07 20:16:42 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2013.05.07 19:58:05 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-1229272821-839522115-1006.job
[2013.05.07 19:03:31 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013.05.07 19:03:31 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013.05.07 18:05:24 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.06 08:32:49 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-1229272821-839522115-1004.job
[2013.05.05 20:14:57 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013.05.05 13:21:01 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2013.05.02 15:58:20 | 000,000,022 | ---- | M] () -- C:\WINDOWS\OP70.INI
 
========== Files Created - No Company Name ==========
 
[2013.05.07 21:52:22 | 000,024,064 | ---- | C] () -- C:\WINDOWS\zoek-delete.exe
[2013.05.07 20:44:20 | 000,000,753 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.4.1.lnk
[2013.05.07 18:03:20 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.08.13 11:08:08 | 000,014,217 | ---- | C] () -- C:\Programme\readme.html
[2012.05.08 14:15:36 | 000,000,005 | ---- | C] () -- C:\Programme\basis-link
[2012.03.25 19:56:32 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\XXM\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.15 10:40:45 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2009.10.12 18:48:35 | 000,000,281 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Archiv (L).lnk
[2007.12.20 20:46:23 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007.12.16 20:47:18 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat
[2007.12.01 19:05:52 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2007.11.30 17:35:32 | 000,000,187 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Extern Stick (K).lnk
 
========== ZeroAccess Check ==========
 
[2010.10.13 10:55:53 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 08:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 08:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
         

OTL Extras logfile created on: 07.05.2013 22:03:27 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\XXM\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,46 Gb Available Physical Memory | 73,17% Memory free
3,84 Gb Paging File | 3,39 Gb Available in Paging File | 88,13% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 33,48 Gb Free Space | 44,92% Space Free | Partition Type: NTFS
 
Computer Name: XXL-5A9180720B | User Name: XXM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.reg [@ = Regedit.Document] -- Reg Error: Key error. File not found
 
[HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung 
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend) 
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Programme\Real\RealPlayer\realplay.exe" = C:\Programme\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\Winamp\winamp.exe" = C:\Programme\Winamp\winamp.exe:*:Disabled:Winamp -- (Nullsoft, Inc.)
"D:\fsetup.exe" = D:\fsetup.exe:*:Enabled:AVM FSetup Application
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer -- (Microsoft Corporation)
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03440014-3975-4267-9F39-1DC4745090B7}" = Microsoft Encarta Enzyklopädie 2003
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{108A39BF-4ED1-4293-B11A-06BD521FB8F7}" = FreeOCR 3.0
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series" = Canon iP4700 series Printer Driver
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{369B36BE-3D64-4641-9AEA-808D436FE132}" = Microsoft Picture It! Foto 7.0
"{37C39957-B0B3-40DC-8BA4-2363241159ED}" = LightScribe  1.4.44.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5DA7BC15-18D3-41A0-9F59-838DA3EAEF17}" = EPSON Easy Photo Print
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{6C5D7191-140A-11D6-B5A0-0050DA208A93}" = ArcSoft PhotoImpression
"{76EA55BD-535F-4AB4-AD80-A8CA331F4E6F}" = Windows Messenger 5.1
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7CDBE27D-87EC-434E-AFE4-D0116AE876BB}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{81D62C32-0984-11D3-86CD-00105AD33021}" = Caere Scan Manager 5.1
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90170407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A3EABC0-CA06-11D4-BF77-00104B130C19}" = EPSON TWAIN 5
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7F2DC0A-C22E-49AD-AD37-797309A54E7B}" = Microsoft AutoRoute 2002
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FD04987D-96A6-4FE1-813B-82B77B8B809C}" = EPSON PRINT Image Framer Tool
"{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}" = EPSON Print CD
"Active Disk" = Active Disk
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"Canon iP4700 series Benutzerregistrierung" = Canon iP4700 series Benutzerregistrierung
"CANONIJPLM100" = Inkjet Printer/Scanner Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"Corel Uninstaller" = Corel Uninstaller
"Das große Horoskop" = Das große Horoskop
"Das große Schriften-Paket" = DATA BECKER Das große Schriften-Paket
"DVDVideoSoftTB_DE Toolbar" = DVDVideoSoftTB DE Toolbar
"EasyCleaner" = EasyCleaner
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"eMusic Promotion" = 50 FREE MP3s +1 Free Audiobook!
"EPSON Photo Print" = EPSON Photo Print
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"ESPR320 Ref. Handbuch" = ESPR320 Ref. Handbuch
"Free YouTube Download_is1" = Free YouTube Download version 3.1.39.1015
"Google Updater" = Google Updater
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"Mozilla Thunderbird (3.1.20)" = Mozilla Thunderbird (3.1.20)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero BurnRights!UninstallKey" = Nero BurnRights
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OmniPagePro9.0DeinstKey" = OmniPage Pro 9.0
"RealPlayer 12.0" = RealPlayer
"Shockwave" = Shockwave
"SimpleOCR 3.1" = SimpleOCR 3.1
"SSC Service Utility_is1" = SSC Service Utility v4.30
"TopOCR" = TopOCR 3.1
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2003Setup" = Microsoft Works 2003-Setup-Start
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-746137067-1229272821-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 03.05.2013 03:35:07 | Computer Name = XXL-5A9180720B | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung soffice.bin, Version 3.2.9476.500, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 03.05.2013 03:40:04 | Computer Name = XXL-5A9180720B | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung soffice.bin, Version 3.2.9476.500, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 04.05.2013 02:35:01 | Computer Name = XXL-5A9180720B | Source = MsiInstaller | ID = 11730
Description = Product: Java Auto Updater -- Error 1730.You must be an Administrator
 to remove this application. To remove this application, you can log on as an Administrator,
 or contact your technical support group for assistance.
 
Error - 04.05.2013 02:35:07 | Computer Name = XXL-5A9180720B | Source = MsiInstaller | ID = 11730
Description = Produkt: Java(TM) 6 Update 18 -- Fehler 1730. Sie müssen über Administratorrechte
 verfügen, um diese Anwendung entfernen zu können. Melden Sie sich als Administrator
 an oder wenden Sie sich an den technischen Support, um Unterstützung zu erhalten.
 
Error - 04.05.2013 02:35:10 | Computer Name = XXL-5A9180720B | Source = MsiInstaller | ID = 10005
Description = Produkt: Java 7 Update 21 -- Die Rechte dieses Benutzerkontos reichen
 nicht aus, um Java zu installieren. Melden Sie sich bei einem Benutzerkonto mit
 Administratorrechten an.
 
Error - 05.05.2013 13:52:08 | Computer Name = XXL-5A9180720B | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x800708ca" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 05.05.2013 14:26:55 | Computer Name = XXL-5A9180720B | Source = VSS | ID = 12305
Description = Volumeschattenkopie-Dienstfehler: Volume bzw. Datenträger ist nicht
 richtig angeschlossen oder wurde nicht gefunden.  Fehlerkontext: CreateFileW(\\?\Volume{72f520ce-45fb-11de-b87b-00192137c893},0xc0000000,0x00000003,...).
 
Error - 05.05.2013 14:26:55 | Computer Name = XXL-5A9180720B | Source = VSS | ID = 12305
Description = Volumeschattenkopie-Dienstfehler: Volume bzw. Datenträger ist nicht
 richtig angeschlossen oder wurde nicht gefunden.  Fehlerkontext: CreateFileW(\\?\Volume{72f520cf-45fb-11de-b87b-00192137c893},0xc0000000,0x00000003,...).
 
Error - 05.05.2013 14:26:56 | Computer Name = XXL-5A9180720B | Source = VSS | ID = 12289
Description = Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(00000200,0x0053c008,00039D28,0,00038D20,4096,[0])".
 hr = 0x80070021.
 
Error - 07.05.2013 13:57:51 | Computer Name = XXL-5A9180720B | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul oleaut32.dll, Version 5.1.2600.6341, Fehleradresse 0x00004975.
 
[ OSession Events ]
Error - 17.04.2009 12:56:57 | Computer Name = XXL-5A9180720B | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 12
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 13:48:35 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 07.05.2013 15:53:47 | Computer Name = XXL-5A9180720B | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Acronis Scheduler2 Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%3
 
 
< End of report >