System Care Antivirus schüttelt mich durch

andreastt

Während gestriger Internet-Aktivitäten meldete meine Frau plötzlich " VIRUS AN BORD".
Es handelt sich um diesen vermeintlichen Virenscanner System care antivirus.
Ich habe mir fogger gedownloaded und OTL gestartet.
Folgende txt.Dateien wurden erstellt.

OTL logfile created on: 27.05.2013 16:44:27 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andreas\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,25 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 80,89% Memory free
6,74 Gb Paging File | 6,25 Gb Available in Paging File | 92,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,51 Gb Total Space | 685,38 Gb Free Space | 75,19% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 8,33 Gb Free Space | 41,65% Space Free | Partition Type: FAT32

Computer Name: ANDREAS-PC | User Name: Andreas | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.05.27 16:43:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andreas\Desktop\OTL.exe
PRC - [2013.04.05 00:47:49 | 000,757,360 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - [2013.05.14 20:54:50 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.03.22 06:07:18 | 000,093,072 | ---- | M] (TomTom) [Auto | Stopped] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010.12.13 15:37:46 | 000,135,536 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010.05.31 14:28:10 | 000,344,064 | ---- | M] () [Auto | Stopped] -- C:\Programme\Polar\Daemon\polard.exe -- (Polar Daemon)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2010.12.25 19:05:03 | 000,278,728 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.12.25 19:05:03 | 000,025,416 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.12.13 15:37:46 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2010.04.03 22:55:32 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.09.25 15:28:06 | 001,332,576 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NxpCap.sys -- (NxpCap)
DRV - [2008.08.21 11:57:22 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2008.01.21 04:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2006.11.30 15:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2006.11.10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006.11.02 10:27:22 | 001,083,520 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{013F7E15-E8D9-4EFB-B29A-4142148DE803}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.10.18 15:45:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.10.18 15:45:29 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParam eter}
CHR - homepage: hxxp://www.google.com/
CHR - Extension: Docs = C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Corel Photo Downloader] "C:\Program Files\Corel\Corel MediaOne\Corel PhotoDownloader.exe" -startup File not found
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSTray] C:\Programme\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [EADM] C:\Program Files\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [60192E1F129FD5FB00006018CE0CDC93] C:\ProgramData\60192E1F129FD5FB00006018CE0CDC93\60192E1F129FD5FB00006018CE0CDC93.exe ()
O4 - Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0669B42A-BD55-4C71-B269-11FDDF88F2AE}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{27A5F783-2569-43B3-8057-19592FA6DFB5}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Andreas\Pictures\wislander.jpg
O24 - Desktop BackupWallPaper: C:\Users\Andreas\Pictures\wislander.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e68960a9-293f-11e0-a6e7-002185c6e5f8}\Shell - "" = AutoRun
O33 - MountPoints2\{e68960a9-293f-11e0-a6e7-002185c6e5f8}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.05.27 16:43:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Andreas\Desktop\OTL.exe
[2013.05.26 18:54:44 | 000,000,000 | ---D | C] -- C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Care Antivirus
[2013.05.26 18:46:52 | 000,000,000 | ---D | C] -- C:\ProgramData\60192E1F129FD5FB00006018CE0CDC93
[2013.05.07 10:59:00 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.05.07 10:18:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
[2013.04.30 19:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Andreas\Documents\*.tmp files -> C:\Users\Andreas\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.05.27 16:43:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andreas\Desktop\OTL.exe
[2013.05.27 16:41:38 | 000,000,000 | ---- | M] () -- C:\Users\Andreas\defogger_reenable
[2013.05.27 16:38:38 | 000,050,477 | ---- | M] () -- C:\Users\Andreas\Desktop\Defogger.exe
[2013.05.27 16:17:31 | 000,008,592 | ---- | M] () -- C:\Users\Andreas\AppData\Local\d3d9caps.dat
[2013.05.27 15:57:45 | 000,670,448 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.27 15:57:45 | 000,631,514 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.27 15:57:45 | 000,143,986 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.27 15:57:45 | 000,118,140 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.27 15:49:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.27 15:48:41 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.27 15:48:41 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.27 15:48:03 | 000,129,193 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013.05.27 15:48:03 | 000,129,193 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.05.27 15:37:36 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.26 19:00:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.26 18:25:59 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.25 12:26:44 | 000,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.05.16 16:24:51 | 000,325,128 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.15 21:14:07 | 000,141,312 | ---- | M] () -- C:\Users\Andreas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.05.13 19:51:12 | 000,444,286 | ---- | M] () -- C:\Users\Andreas\Documents\E_Highlights.pds
[2013.05.13 19:35:38 | 000,444,054 | ---- | M] () -- C:\Users\Andreas\Documents\E_Highlights.pds.bak
[2013.05.13 19:26:20 | 000,001,832 | ---- | M] () -- C:\Users\Andreas\Desktop\CyberLink PowerDirector.lnk
[2013.05.07 10:58:55 | 251,245,778 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.05.05 19:06:21 | 003,686,454 | ---- | M] () -- C:\Users\Andreas\Documents\SnapShot(0).bmp
[2013.05.05 18:40:49 | 003,686,454 | ---- | M] () -- C:\Users\Andreas\Documents\SnapShot.bmp
[2013.05.04 09:24:56 | 000,020,480 | ---- | M] () -- C:\Users\Andreas\Documents\Urkunde2.wps
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Andreas\Documents\*.tmp files -> C:\Users\Andreas\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.05.27 16:41:38 | 000,000,000 | ---- | C] () -- C:\Users\Andreas\defogger_reenable
[2013.05.27 16:38:38 | 000,050,477 | ---- | C] () -- C:\Users\Andreas\Desktop\Defogger.exe
[2013.05.10 21:35:34 | 000,444,286 | ---- | C] () -- C:\Users\Andreas\Documents\E_Highlights.pds
[2013.05.10 21:35:34 | 000,444,054 | ---- | C] () -- C:\Users\Andreas\Documents\E_Highlights.pds.bak
[2013.05.07 10:58:55 | 251,245,778 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.05.05 19:06:21 | 003,686,454 | ---- | C] () -- C:\Users\Andreas\Documents\SnapShot(0).bmp
[2013.05.05 18:40:49 | 003,686,454 | ---- | C] () -- C:\Users\Andreas\Documents\SnapShot.bmp
[2013.05.04 09:24:56 | 000,020,480 | ---- | C] () -- C:\Users\Andreas\Documents\Urkunde2.wps
[2013.04.30 19:50:51 | 000,001,975 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.04.30 19:50:33 | 000,001,100 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.30 19:50:32 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.30 19:50:08 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2010.10.17 23:10:17 | 000,141,312 | ---- | C] () -- C:\Users\Andreas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.17 22:41:14 | 000,129,193 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.10.17 22:40:58 | 000,129,193 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.10.17 22:33:12 | 000,008,592 | ---- | C] () -- C:\Users\Andreas\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========


========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Andreas\Documents\Fledermaus_Auftritt.mpg:TOC.WMV

< End of report >

außerdem folgende extra.txt

OTL Extras logfile created on: 27.05.2013 16:44:27 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andreas\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,25 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 80,89% Memory free
6,74 Gb Paging File | 6,25 Gb Available in Paging File | 92,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,51 Gb Total Space | 685,38 Gb Free Space | 75,19% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 8,33 Gb Free Space | 41,65% Space Free | Partition Type: FAT32

Computer Name: ANDREAS-PC | User Name: Andreas | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{042A98AA-D3F4-4B87-A147-163E2EB7CBE6}" = lport=10243 | protocol=6 | dir=in | app=system |
"{0FBE9FAD-1097-458B-88C2-1D4534EB6BCF}" = lport=445 | protocol=6 | dir=in | app=system |
"{1C949FD2-ABCA-47CB-B4DD-F97773DB5811}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{22B2A228-54D5-41EB-B38C-C611A6DB8B64}" = rport=139 | protocol=6 | dir=out | app=system |
"{37641E01-ECB7-42A5-ADCA-76A134743C9B}" = rport=445 | protocol=6 | dir=out | app=system |
"{3A1E7245-C8FC-427C-AFE4-124214C4C6B8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{484038B4-5E00-4F5E-B38B-6BFDA2C0DACB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5942A027-3881-4B0D-8B63-EF86EB79114A}" = rport=137 | protocol=17 | dir=out | app=system |
"{5C2095BB-D571-4DDB-8075-C49215201882}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5EB17D99-E292-456E-BB29-6C59373D12B6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{640C30C9-E36E-45D6-B377-DCD52308B314}" = lport=139 | protocol=6 | dir=in | app=system |
"{70FEB61F-E2DD-4D3A-A7BD-900FA473473D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{76ABECAE-4700-4A56-89BE-3D18A7A4F242}" = lport=137 | protocol=17 | dir=in | app=system |
"{8FE5736E-C71E-46C5-9572-F536A0274CDF}" = lport=138 | protocol=17 | dir=in | app=system |
"{9EE6C041-BC51-424B-A87D-E353D35A69C4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A4E1DB24-303D-48DA-BC34-97A517EE50A3}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B0F40E96-E49F-4BC8-991F-10E27CD8BAAF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B386431C-4B96-4CEA-84FC-C4976DAD676E}" = rport=138 | protocol=17 | dir=out | app=system |
"{DF837076-2092-4919-89D2-AF889540885A}" = rport=10243 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08E029BE-2FAF-42AF-A204-6C7DDC42A2D0}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{0A7E913E-7A8D-4E03-894A-A41C1337F4D8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{0AD87089-F91B-4FBD-93BD-2311CB1748D8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0D617475-3608-4FC6-B7A5-1DC5C89C48BD}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{10591441-D5F8-4F32-8214-342BFC852AB0}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{162263AC-5771-400D-B93C-D48E8F22AA1B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{17D5F4FA-33D3-436F-A9CE-DC3A35774F8B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{23FB429B-8050-4971-ACB4-D05B9582140E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{2954B56D-4788-4EE3-81C5-E7EF59268BA7}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{2B14B1A5-138B-40DC-A531-09E1CE535C9E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{31ADE0D6-83F0-4219-94EC-2284692E9E24}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{39F311A9-989E-42D2-97C4-0E35A477B174}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{42319843-01C0-486D-AAFF-BD8D9D914FF7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{42E220E7-4DED-4016-9CD3-5484BE3FC458}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{4B25F580-45A1-4C13-89C8-AF2F9A7A0113}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{54595CBC-9637-4A74-9D51-CCBDA49B1430}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{56C7FE17-782D-431A-A230-73AC47007645}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{572E5BA2-A827-46F7-A830-9E606C326895}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{5951C788-A426-462B-A7DC-EC783091F012}" = protocol=6 | dir=out | app=system |
"{5C11A37A-ED1D-4D96-848B-05F8492DC7CB}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{6995FA24-4E39-4A48-B21B-42E6E06B713F}" = protocol=17 | dir=in | app=c:\program files\sega\beijing 2008\beijing.exe |
"{6BF5B3A2-7EDE-4729-953A-9DA3A65B5C53}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{7A1275E6-38D7-4BC8-AE5B-D2F490BF08AE}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{7ED18561-EEAF-4DBB-876F-6D6AE8072188}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{829ADEC3-30AB-4469-9C95-2FF2D50A7AFB}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{82AC1D6F-A6CA-4000-99CD-CE9F163DF23C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{873C0E77-AEED-4D9B-9B39-8C6215C36DEF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{8CB801CA-7D45-458B-8C39-8BFC861DA8F6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{8EE67BEA-D2B1-4645-92A4-CBA72CD65AE2}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{959785AE-1200-429F-B09F-CFEB6F9AF22E}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{97FB91BA-0521-47BE-9A7C-117C15AFDAD2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9A68031F-5763-461E-9573-D72F13A2342A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9C44A0A3-4047-4FE2-BF22-2066AA16457F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AAD86F24-EB68-4363-A9F3-DD5C3B21201E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AEB89276-BD10-4642-88AB-EBE71CAB06CC}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{B59C9918-43A5-4360-BF2B-0C8386E37C8A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C30CCBF1-6E36-41DA-86A8-28F593D6AF57}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CC9C5763-B6D0-4498-9020-09EF4877A0E7}" = protocol=6 | dir=in | app=c:\program files\sega\beijing 2008\beijing.exe |
"{D5248CCC-2BBE-4664-9F00-0A0DB42A0D08}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DB364B1D-1F08-4089-BEA1-420B8D541B74}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EE6AB43C-134A-469F-AA38-5E80017E0ADB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{EEE190AD-6F64-4614-AB82-E9980F0B2E75}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{F89D173A-AE2C-4A6A-98A7-17AD66B18C4C}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{FB2DC8FE-A94D-4594-8D63-663A73D9E605}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"TCP Query User{8B236CCC-EFC4-45C1-B1BB-75F7C89DE17F}C:\program files\konami\pro evolution soccer 2009\pes2009.exe" = protocol=6 | dir=in | app=c:\program files\konami\pro evolution soccer 2009\pes2009.exe |
"UDP Query User{D874B388-89B8-4891-8A9A-9E3E0F6B6BF6}C:\program files\konami\pro evolution soccer 2009\pes2009.exe" = protocol=17 | dir=in | app=c:\program files\konami\pro evolution soccer 2009\pes2009.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{00170407-78E1-11D2-B60F-006097C998E7}" = Microsoft Word 2000
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012D762-5DCA-455A-B5FE-EDF79BC93E18}" = HP Photosmart C4700 All-In-One Driver Software 13.0 Rel .6
"{2076B142-10FA-4536-B488-3FDCBB1013D3}" = Beijing 2008
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{35E91536-A913-4F1F-89ED-7C3CA3E49ACB}" = MEDION GoPal Assistant
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 12 DEMO
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4CCA10F5-40E2-439E-9D82-67F70A292CCC}" = Polar WebSync
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{588D9F5F-8C62-4421-BAE9-CCAA57D4E4EE}" = TVsweeper 3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65F8E0A6-A290-4D47-B391-D6353D756854}" = Pro Evolution Soccer 2013 DEMO
"{6844E55F-37A1-42BC-B316-326B48C49ADC}" = Pro Evolution Soccer 2012 DEMO
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9EC9754D-CA34-4293-B5DB-3BD245A88A43}" = ArcSoft MediaImpression
"{9F3E3C1B-6964-48D6-84C8-925C9A5A8229}" = Polar Daemon
"{A062A15F-9CAC-4B88-98DF-87628A0BD721}" = Corel MediaOne
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A55F4F9F-CCA8-4732-AA1F-0390A4A50947}" = C4700
"{A8DB611A-D80E-450D-85F6-3ACDD164BE31}" = Pro Evolution Soccer 2009
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC5B2524-34DD-4B66-B294-69DF1B865869}_is1" = Handball Challenge Trainingscamp
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.4 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{BD71B413-9FEE-49BB-A6D1-2C0BFB99BDFE}" = Microsoft LifeCam
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax
"{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = Samsung Media Studio 5
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5D5054-34F7-4A22-3594-29FF1D025029}_is1" = IHF Handball Challenge 12
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D7E7EC5E-4349-4E40-B37C-4342188B86EC}" = Monopoly
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
"{E36F3199-C282-47CA-BAC7-2B77D247E760}" = PS_AIO_06_C4700_SW_Min
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{EC5F4C1B-F838-4CB7-8561-8F809296428B}" = TomTom HOME
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ElsterFormular 12.2.2.6665k" = ElsterFormular-Upgrade
"FUSSBALL MANAGER 10" = FUSSBALL MANAGER 10
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"Micky auf Ganovenjagd" = Micky auf Ganovenjagd
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Moorhuhn" = Moorhuhn
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Origin" = Origin
"Picasa 3" = Picasa 3
"Rossmann Fotowelt Software" = Rossmann Fotowelt Software 4.9
"RTL Biathlon 2008" = RTL Biathlon 2008
"Shop for HP Supplies" = Shop for HP Supplies
"Shrek" = Shreks schräge Partyspiele™
"Ski Racing 2005" = Ski Racing 2005 featuring Hermann Maier

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 30.08.2012 10:36:23 | Computer Name = Andreas-PC | Source = WinMgmt | ID = 10
Description =

Error - 30.08.2012 10:57:57 | Computer Name = Andreas-PC | Source = System Restore | ID = 8193
Description =

Error - 30.08.2012 11:13:52 | Computer Name = Andreas-PC | Source = WinMgmt | ID = 10
Description =

Error - 30.08.2012 11:14:13 | Computer Name = Andreas-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c,
fehlerhaftes Modul fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c, Ausnahmecode
0xc0000005, Fehleroffset 0x011e387c, Prozess-ID 0xf50, Anwendungsstartzeit 01cd86c2174f00a9.

Error - 30.08.2012 11:15:15 | Computer Name = Andreas-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c,
fehlerhaftes Modul fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c, Ausnahmecode
0xc0000005, Fehleroffset 0x011e387c, Prozess-ID 0x13dc, Anwendungsstartzeit 01cd86c23da2e469.

Error - 30.08.2012 11:15:51 | Computer Name = Andreas-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c,
fehlerhaftes Modul fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c, Ausnahmecode
0xc0000005, Fehleroffset 0x011e387c, Prozess-ID 0x1500, Anwendungsstartzeit 01cd86c253675749.

Error - 30.08.2012 11:16:39 | Computer Name = Andreas-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c,
fehlerhaftes Modul fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c, Ausnahmecode
0xc0000005, Fehleroffset 0x011e387c, Prozess-ID 0x1474, Anwendungsstartzeit 01cd86c27030f849.

Error - 30.08.2012 11:17:11 | Computer Name = Andreas-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c,
fehlerhaftes Modul fifa.exe, Version 1.0.0.0, Zeitstempel 0x4e50268c, Ausnahmecode
0xc0000005, Fehleroffset 0x011e387c, Prozess-ID 0xfa0, Anwendungsstartzeit 01cd86c282c9b649.

Error - 30.08.2012 23:33:36 | Computer Name = Andreas-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.08.2012 12:28:57 | Computer Name = Andreas-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 26.05.2013 04:43:11 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 12:58:52 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 12:59:01 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 13:09:48 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 13:09:55 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 13:20:13 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 26.05.2013 13:20:20 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 27.05.2013 09:33:36 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 27.05.2013 09:33:42 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

Error - 27.05.2013 09:38:15 | Computer Name = Andreas-PC | Source = ehRecvr | ID = 4
Description =

[ System Events ]
Error - 27.05.2013 09:50:07 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 09:50:14 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 09:50:15 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 09:50:18 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 09:50:19 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 09:51:26 | Computer Name = Andreas-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 27.05.2013 09:51:26 | Computer Name = Andreas-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 27.05.2013 10:00:41 | Computer Name = Andreas-PC | Source = PlugPlayManager | ID = 12
Description = Das Gerät "ST3640323AS ATA Device" (IDE\DiskST3640323AS_____________________________SD33____\5&8084830&0&2.0.0)
wurde ohne vorbereitende Maßnahmen vom System entfernt.

Error - 27.05.2013 10:12:24 | Computer Name = Andreas-PC | Source = DCOM | ID = 10005
Description =

Error - 27.05.2013 10:25:04 | Computer Name = Andreas-PC | Source = PlugPlayManager | ID = 12
Description = Das Gerät "ST3640323AS ATA Device" (IDE\DiskST3640323AS_____________________________SD33____\5&8084830&0&2.0.0)
wurde ohne vorbereitende Maßnahmen vom System entfernt.


< End of report >


Ich wäre total glücklich, wenn ihr uns helfen könnt.
Leider bin ich kein echter PC-Experte. Welche weiteren Schritte müssen durchgeführt werden?
Danke
Andreas