Trojaner TR/Kazy.mekml1

OTL logfile created on: 17.04.2011 19:58:35 - Run 2
OTL by OldTimer - Version 3.2.9.1     Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 89,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 186,30 Gb Total Space | 156,69 Gb Free Space | 84,10% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ABC
Current User Name: Elke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - F:\OTL.exe File not found
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BRcrbSmEXhdOhE.exe (BitSprx)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Lexmark\Monitor\ACJ\LMabMON.exe ()
PRC - C:\Programme\Lexmark\ErrorApp\LMab1err.EXE ( )
PRC - C:\WINDOWS\system32\lmabcoms.exe ( )
PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe ()
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
PRC - C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
PRC - C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - c:\jetsuite\JSDAEMON.EXE (JetFax, Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (stllssvr) -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (lmab_device) -- C:\WINDOWS\System32\LMabcoms.exe ( )
SRV - (NMSAccessU) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (jsdaemon) -- c:\jetsuite\JSDAEMON.EXE (JetFax, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (RTL8187B) -- C:\WINDOWS\system32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation                           )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (SampleScanner) -- C:\WINDOWS\system32\drivers\ArtecGT.sys (   )
DRV - (jsmux) -- C:\WINDOWS\system32\drivers\JSMUX.SYS (JetFax, Inc.)
DRV - (jsfax) -- C:\WINDOWS\system32\drivers\JSFAX.SYS (JetFax, Inc.)
DRV - (jsscan) -- C:\WINDOWS\system32\drivers\JSSCAN.SYS (JetFax, Inc.)
DRV - (jsdbg) -- C:\WINDOWS\system32\drivers\JSDBG.SYS (JetFax, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = 
IE - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1214440339-706699826-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1214440339-706699826-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O2 - BHO: (Adobe PDF Reader Link Helper) - {F22C37FD-2BCB-40b6-A12E-77DDA1FBDD88} - C:\WINDOWS\System32\AcroIEHelpe.dll File not found
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O4 - HKLM..\Run: [0 - wtm] C:\WINDOWS\wtmkernel.exe (TSS-Productions)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [LexwareInfoService] C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [LMPSSDMON] C:\Programme\Lexmark\Monitor\ACJ\LMabMON.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-1214440339-706699826-839522115-1004..\Run: [BRcrbSmEXhdOhE] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BRcrbSmEXhdOhE.exe (BitSprx)
O4 - HKU\S-1-5-21-1214440339-706699826-839522115-1004..\Run: [LMab1err] C:\Programme\Lexmark\ErrorApp\LMab1err.EXE ( )
O4 - HKU\S-1-5-21-1214440339-706699826-839522115-1004..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\HP LaserJet 3150-Status.lnk = C:\jetsuite\JETSTAT.EXE (eFax.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Live Menu.lnk = C:\Programme\Gemeinsame Dateien\efax\dllcmd32.exe (eFax.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\phase6_18_erinnerung.lnk = C:\Programme\phase6\phase6_18\WinStart\WinStart.exe (phase6)
O4 - Startup: C:\Dokumente und Einstellungen\Elke\Startmenü\Programme\Autostart\Seagate 2GH1S1LH Registrierungen.lnk = C:\Dokumente und Einstellungen\Elke\Anwendungsdaten\Leadertech\PowerRegister\Seagate 2GH1S1LH Registrierungen.exe (Leader Technologies/Seagate)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileUrl = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetworkConnections = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: A = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: B = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: C = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: D = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: E = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: F = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: G = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: H = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: I = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: J = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: K = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: L = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: M = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: N = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: O = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: P = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: Q = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: R = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: S = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: T = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: U = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: V = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: W = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: X = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: Y = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Hide: Z = 0
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun: 0 = wtmkernel.exe (TSS-Productions)
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun: 1 = wtmstatus.exe (TSS-Productions)
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun: 2 = wtmbrx.exe
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun: 3 = winhelp.exe (Microsoft Corporation)
O7 - HKU\S-1-5-21-1214440339-706699826-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
         

OTL Extras logfile created on: 17.04.2011 19:58:35 - Run 2
OTL by OldTimer - Version 3.2.9.1     Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 89,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 186,30 Gb Total Space | 156,69 Gb Free Space | 84,10% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ABC
Current User Name: Elke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Zattoo\zattood.exe" = C:\Programme\Zattoo\zattood.exe:*:Disabled:zattood -- File not found
"C:\WINDOWS\system32\lmabcoms.exe" = C:\WINDOWS\system32\lmabcoms.exe:*:Enabled:Lexmark Enhanced TCP/IP -- ( )
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02FD32B8-3F7F-F57B-7C65-A922211B539E}" = ccc-utility
"{03ED6584-5A5A-4CA3-B61D-741618E510DF}" = Steuer 2008
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08AEE1E0-20C4-AD0E-0342-170960727C0B}" = Catalyst Control Center Graphics Full Existing
"{0C01AADF-0827-30F9-3F6D-E9DB920931B2}" = Catalyst Control Center Localization Chinese Traditional
"{0D4B35DB-2B77-89AD-88EC-C9BF9609EFE1}" = Catalyst Control Center Localization Korean
"{0E194CFB-7FB4-F5B5-94F4-01D65F8D4494}" = Catalyst Control Center Graphics Full New
"{0E55AF2F-595A-6BDD-124C-F22EBA89F902}" = Catalyst Control Center Localization Chinese Standard
"{12661A78-6C54-B106-E9B9-C91012CBA2AA}" = CCC Help Thai
"{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service
"{1AD75B44-F9AE-78E4-B79D-534739A3E215}" = CCC Help Greek
"{1DE24E25-7D36-7E94-7B0E-691219B6C9E8}" = CCC Help Portuguese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20C3DEAF-801D-4C3E-9826-E62EE16DB7AB}" = phase6_18
"{2187F4F6-4011-8904-8500-D60822AA7626}" = Skins
"{22543949-70E8-45D0-A938-F38143EB8BF8}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{29B22401-5F1B-8277-1B8E-2D04B2909427}" = Catalyst Control Center Localization Japanese
"{2A232B31-2BF2-1E40-A05C-F6E533EE62EA}" = Catalyst Control Center Localization Polish
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B7458C7-3F03-4415-AC39-D51EDEACDCCC}" = Steuer 2007
"{3C34B0D0-064B-57F2-83CA-321C248032A0}" = CCC Help Hungarian
"{406A89D6-09E6-4550-B370-8D376DDB56BE}" = Adobe Flash Player 10 ActiveX
"{410AB9BC-B057-4D39-9260-660EE1B4BED2}" = Steuer 2009
"{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}" = Acronis*True*Image*Home
"{437306A8-313F-F70F-DBA1-A81F8F9DB0C9}" = Catalyst Control Center Localization Norwegian
"{43D3CB03-B85F-DE7A-11B9-E759940C6993}" = CCC Help Turkish
"{47BAE500-B56A-E32A-2E80-1E7C192853A5}" = CCC Help Russian
"{4B526075-AF27-47A2-860D-3DA92928A051}" = Steuer 2010
"{4C6028C5-2EB3-CEF2-22E5-ACF3D1AAF4ED}" = CCC Help Italian
"{4CA7F010-9561-7688-E0CD-AAF1292F9090}" = CCC Help Polish
"{4DB93D06-CE1A-B7E0-A701-3E81A2F184EE}" = Catalyst Control Center Localization Spanish
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{595E9201-522A-A823-A2EC-9F1676C7C2B0}" = Catalyst Control Center Localization Dutch
"{5E8C42DD-7E43-462C-84CC-99E5BBE3E101}" = Steuer 2007
"{600A9225-4E51-BCDD-4277-4B2B8956EE8E}" = ccc-core-static
"{6181E138-C21C-471C-9238-F2F59C314C6C}" = Steuer 2008
"{67DABCB4-239C-4E02-805E-DEA0DDCB1926}" = Steuer Hilfesammlung
"{689EF96A-6984-6269-0307-23295D67036D}" = Catalyst Control Center Core Implementation
"{6ADA8FD6-810D-3E2F-CF24-0F0936E55AA4}" = Catalyst Control Center Localization Finnish
"{6CCD5CD2-2C94-20FE-ED6B-61A338C20FFD}" = CCC Help Chinese Traditional
"{7095FD27-37F0-4750-9DE8-D37DC0043706}" = REALTEK RTL8187B Wireless LAN Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72CD4C5F-AB0B-4814-8780-9A4F26A2086B}" = Presto! PageManager 7.12.31
"{742F3559-6BFD-6660-329D-8E8CF6C1FCEA}" = CCC Help German
"{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747}" = Ad-Aware SE Personal
"{7E05DB3E-6CDD-4116-962F-16BC3DE41A68}" = Steuer Update 14.01
"{7E092D91-B074-CFBE-FD2E-972652ADE785}" = CCC Help French
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{8AD22528-C6FC-7A5F-8DB7-721C0E04FC78}" = CCC Help Norwegian
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{94C8F73A-D337-C7C5-46A7-8229433B16C1}" = Catalyst Control Center Localization Turkish
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1F5692-9B61-42E0-0EAE-B75ED8F84CD4}" = Catalyst Control Center Localization Czech
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4E46644-984C-F411-0949-19AA3E37FD1A}" = Catalyst Control Center Localization German
"{A8231944-DA75-2993-359D-3FB44AB196E5}" = CCC Help Czech
"{A9B2784F-15F2-4A4D-6761-3BB4F03113D8}" = Catalyst Control Center Localization Italian
"{AB4F5387-46C9-9022-5279-10ABA788A270}" = Catalyst Control Center Localization Portuguese
"{AC76BA86-7AD7-1031-7B44-A70900000002}" = Adobe Reader 7.0.9 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AE666A5A-8759-29B7-C9E8-98EA1E7F8565}" = Catalyst Control Center Localization French
"{AE756B8A-54F9-588E-B1F9-3B0132647136}" = Catalyst Control Center Localization Hungarian
"{B3FF9271-1C6C-0E30-8CCB-8708CC33A8CB}" = ccc-core-preinstall
"{B4E0B4B8-027A-D78E-0D96-201B634CE4C7}" = CCC Help English
"{B622BDB3-7A67-F509-AAEA-65BA9CF89001}" = Catalyst Control Center Localization Swedish
"{B754B683-E23C-4583-9312-50AD86836B42}" = Steuer Hilfesammlung
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1893EC1-836D-170C-8382-CA7ADB7D3EA7}" = CCC Help Chinese Standard
"{C1A545BA-E2F3-7DC9-45F7-0DE949A24A81}" = CCC Help Swedish
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CA6CE470-76E0-3EAE-62D5-5E7AB01B158A}" = CCC Help Korean
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D08DF594-B159-48BB-B64E-2221A05AB4A7}" = CCC Help Spanish
"{D2D7FBE2-5407-369D-18D6-ECA0B430A383}" = Catalyst Control Center Localization Danish
"{D5C8E140-6E6F-11DD-9AA9-0050560400B1}" = Haufe iDesk-Service
"{D6E0F772-8A27-8962-F258-40B434726D13}" = CCC Help Danish
"{DFFFF14F-BE57-98C0-3698-33E57E7C9C42}" = CCC Help Dutch
"{E13A3B1E-53C6-4697-AB0E-AE9AC6184499}" = Lexmark Scan Center
"{E990C0BD-E3BC-47F1-B124-4F33D81B0BC3}" = Ultima2000 e+
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EF6735B9-2EC3-D203-8BEF-6208CB39DD2A}" = Catalyst Control Center Graphics Light
"{EF91EDB8-7BFC-D470-EF9D-F90012D50DCF}" = CCC Help Finnish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F48AAE0F-52F4-11DD-B1F7-0050560400B1}" = Haufe iDesk-Browser
"{F5AFD604-C7A0-4FEC-F500-5F4B9514C591}" = Catalyst Control Center Localization Greek
"{F829ECA5-CC14-45C0-FA39-5A2C2F36E318}" = CCC Help Japanese
"{F876BF67-BD4D-DCF4-4429-486516A6FDFF}" = Catalyst Control Center Localization Thai
"{FFF9A193-90C1-C0D8-8DD0-4F2B645FB8AE}" = Catalyst Control Center Localization Russian
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"AudibleDownloadManager" = Audible Download Manager
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"JetSuite Pro for the HP LaserJet 3150" = JetSuite Pro for the HP LaserJet 3150
"Lexmark_HostCD" = Lexmark Software deinstallieren
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"PDFCreator Toolbar" = PDFCreator Toolbar
"phase-6 Feeding Tool" = phase-6 Feeding Tool 1.0.1
"Picasa2" = Picasa 2
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"VLC media player" = VLC media player 1.0.5
"Windows XP Service Pack" = Windows XP Service Pack 3
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 17.04.2011 11:48:41 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 12:13:20 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 12:15:06 | Computer Name = ABC | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 6.0.2900.5512, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 17.04.2011 12:34:33 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 12:35:09 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 12:56:31 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 13:17:22 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 13:17:44 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 13:39:01 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 17.04.2011 13:39:17 | Computer Name = ABC | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 466032b1, P4 mscorlib,
 P5 2.0.0.0, P6 4d352e63, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
[ System Events ]
Error - 17.04.2011 11:48:21 | Computer Name = ABC | Source = System Error | ID = 1003
Description = Fehlercode 1000008e, 1. Parameter c0000005, 2. Parameter 805e184d,
 3. Parameter aa089a44, 4. Parameter 00000000.
 
 
< End of report >