hier kommen die OTL-files. Vielen Dank schon einmal vorab für die Hilfe!
LG
Andreas extras.txt:
OTL Logfile: Code:
OTL Extras logfile created on: 07.07.2010 16:18:47 - Run 1
OTL by OldTimer - Version 3.2.7.1 Folder = C:\Dokumente und Einstellungen\Andreas\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 54,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 73,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 768 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 50,00 Gb Total Space | 36,69 Gb Free Space | 73,38% Space Free | Partition Type: NTFS
Drive D: | 99,04 Gb Total Space | 61,28 Gb Free Space | 61,87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 27,12 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive P: | 3,61 Gb Total Space | 3,60 Gb Free Space | 99,63% Space Free | Partition Type: FAT32
Computer Name: ANDREAS-
Current User Name: Andreas
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"135:TCP" = 135:TCP:*:Enabled:Public ShareFolder - DCOM Access
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"135:TCP" = 135:TCP:*:Enabled:Public ShareFolder - DCOM Access
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"9352:TCP" = 9352:TCP:*:Enabled:coeunvhz
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\pol32evt.exe" = %windir%\system32\pol32evt.exe:*:Enabled:Public ShareFolder - Client -- ()
"C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" = C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE:*:Enabled:Microsoft Outlook -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\pol32evt.exe" = %windir%\system32\pol32evt.exe:*:Enabled:Public ShareFolder - Client -- ()
"C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" = C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE:*:Enabled:Microsoft Outlook -- (Microsoft Corporation)
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0000C5E1-B640-4fbe-B926-0E3FA9BFEE74}" = EDIUS4 Settings
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator 0.8.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07F58BB0-50D4-4477-B491-A97B2AD059B6}" = TOSHIBA Hotkey Utility
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP100_series" = Canon iP100 series
"{1E16A5B2-6E2E-4B05-96C3-9635D483E41C}" = Canopus GXF SpeedEncoder 1.3
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{44AFDB86-1509-4CDC-9B2E-1C73B2DEE5F0}" = Mobile Broadband Drivers
"{61B84435-7A82-4F5C-87EC-1071EC28D72D}" = TOSHIBA Utilities
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{98B6FB8A-8638-4037-AD44-CF7D0EEAB875}_is1" = TypingMaster Pro
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A899DA1F-D626-401C-8651-F2921E3B4CB3}" = T-Mobile web'n'walk Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC4600DB-4897-4EAF-B153-6335B9AA066D}" = GT HSDPA driver installer
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D438FA08-515F-41DD-BBDC-AC3428AE9754}" = Canopus ProCoder Express For EDIUS
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F28111F1-8DCC-4E3C-A6D4-5E1D05F28300}" = EDIUS4(SetupManager)
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = TOSHIBA Software Modem
"Browser Defender_is1" = Browser Defender 2.0.6.15
"Canon iP100 series Benutzerregistrierung" = Canon iP100 series Benutzerregistrierung
"CleanUp!" = CleanUp!
"Easy Stand Alone_is1" = Easy Stand Alone
"ENTTEC DMX USB PRO- Utility" = ENTTEC DMX USB PRO- Utility 1.36
"FTDICOMM" = FTDI USB Serial Converter Drivers
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Huawei Modems" = Huawei modem
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Michas Jingle-Player" = Michas Jingle-Player
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Novatel_700_800_PCCardInstaller" = Novatel 700/800 driver
"Novatel_V20051Installer" = Novatel driver package V2.00.51
"OptionHsxpa72_PCCardInstaller" = Option Globetrotter HSXPA 7.2 PC-Cards
"OptionPCCardInstaller_tmcc" = Option PC Cards driver package
"OptionPluss_PCCardInstaller" = Option GT HSDPA driver suit
"Public ShareFolder Client_is1" = Public ShareFolder Client 1.3
"sem_GCXX" = Sony Ericsson GCXX (75/79/82/83/85/89)
"SEMteam" = SEMteam
"SEMteam Update" = SEMteam Update
"SHOW!time 5 Net" = SHOW!time 5 Net
"SHOWTIME NET Update" = SHOWTIME NET Update
"Spyware Doctor" = Spyware Doctor 7.0
"Synology Assistant" = Synology Assistant (remove only)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 5" = TeamViewer 5
"TypingMaster Pro" = TypingMaster Pro
"VLC media player" = VideoLAN VLC media player 0.8.6
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 06.07.2010 13:28:58 | Computer Name = ANDREAS- | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 78015
Error - 06.07.2010 19:25:52 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 06.07.2010 19:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 06.07.2010 20:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 06.07.2010 21:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 06.07.2010 22:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 06.07.2010 23:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 07.07.2010 00:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 07.07.2010 01:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
Error - 07.07.2010 02:55:05 | Computer Name = ANDREAS- | Source = Google Update | ID = 20
Description =
[ System Events ]
Error - 06.07.2010 14:37:14 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 06.07.2010 14:37:14 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 06.07.2010 14:37:15 | Computer Name = ANDREAS- | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SIUDI OUT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058
Error - 06.07.2010 14:37:15 | Computer Name = ANDREAS- | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Shell Driver" wurde mit folgendem Fehler beendet: %%126
Error - 06.07.2010 14:37:50 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 06.07.2010 14:37:50 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 06.07.2010 16:55:00 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 07.07.2010 08:51:22 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 07.07.2010 08:51:22 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
Error - 07.07.2010 08:51:22 | Computer Name = ANDREAS- | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {4991D34B-80A1-4291-83B6-3328366B9097}
< End of report > --- --- --- und OTL.txt:
OTL Logfile: Code:
OTL logfile created on: 07.07.2010 16:18:47 - Run 1
OTL by OldTimer - Version 3.2.7.1 Folder = C:\Dokumente und Einstellungen\Andreas\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 54,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 73,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 768 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 50,00 Gb Total Space | 36,69 Gb Free Space | 73,38% Space Free | Partition Type: NTFS
Drive D: | 99,04 Gb Total Space | 61,28 Gb Free Space | 61,87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 27,12 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive P: | 3,61 Gb Total Space | 3,60 Gb Free Space | 99,63% Space Free | Partition Type: FAT32
Computer Name: ANDREAS-
Current User Name: Andreas
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Huawei Modems\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Programme\TOSHIBA\TOSHIBA Applet\THotkey.exe (TOSHIBA)
PRC - C:\Programme\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe (TOSHIBA Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\GtFlashSwitch\GtFlashSwitch.exe (OptionNV)
PRC - C:\WINDOWS\system32\Gtdetectsc.exe (OptionNV)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)
PRC - C:\WINDOWS\system32\BRSS01A.EXE (brother Industries Ltd)
========== Modules (SafeList) ==========
MOD - C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (sdCoreService) -- C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) -- C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (Browser Defender Update Service) -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
SRV - (TAPPSRV) -- C:\Programme\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe (TOSHIBA Corp.)
SRV - (GtFlashSwitch) -- C:\Programme\Gemeinsame Dateien\GtFlashSwitch\GtFlashSwitch.exe (OptionNV)
SRV - (gtdetectsc) -- C:\WINDOWS\system32\Gtdetectsc.exe (OptionNV)
SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (Brother XP spl Service) -- C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)
========== Driver Services (SafeList) ==========
DRV - (PCASp50) -- C:\WINDOWS\System32\drivers\PCASp50.sys File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (KLFLTDEV) -- C:\WINDOWS\system32\drivers\klfltdev.sys (Kaspersky Lab)
DRV - (cdrblock) -- C:\WINDOWS\system32\drivers\cdrblock.sys (Canopus Co,. Ltd.)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (mdvdrv) -- C:\WINDOWS\system32\drivers\mdvdrv.sys ()
DRV - (mdvrmng) -- C:\WINDOWS\system32\drivers\mdvrmng.sys ()
DRV - (FwLnk) -- C:\WINDOWS\system32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (NWADI) -- C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (Hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (aksusb) -- C:\WINDOWS\system32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (akshasp) -- C:\WINDOWS\system32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (FTSER2K) -- C:\WINDOWS\system32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FTDIBUS) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (odysseyIM4) -- C:\WINDOWS\system32\drivers\odysseyIM4.sys (Funk Software, Inc.)
DRV - (cdrport) -- C:\WINDOWS\system32\drivers\cdrport.sys (Canopus Co,. Ltd.)
DRV - (AX88172) -- C:\WINDOWS\system32\drivers\ax88172.sys (ASIX Electronics Corp.)
DRV - (SUNLITE) -- C:\WINDOWS\system32\drivers\siudi.sys (Digital Art System)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.06.30 09:55:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.06.30 09:55:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\THBExt [2009.03.28 14:37:08 | 000,000,000 | ---D | M]
[2009.03.29 23:31:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Extensions
[2010.07.06 20:55:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\zry0kxrw.default\extensions
[2010.06.17 17:39:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\zry0kxrw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.03.29 22:48:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.10.17 22:09:14 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.10.17 22:09:14 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.10.17 22:09:14 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.10.17 22:09:14 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.10.17 22:09:14 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2010.07.06 20:21:06 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\Huawei Modems\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [LtMoh] C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [THotkey] C:\Programme\TOSHIBA\TOSHIBA Applet\THotkey.exe (TOSHIBA)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (Kaspersky Lab)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238241120453 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238241192453 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.03.28 12:11:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.11.21 17:29:34 | 000,110,592 | R--- | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.08.01 23:31:24 | 000,363,750 | R--- | M] () - F:\autorun.ico -- [ CDFS ]
O32 - AutoRun File - [2008.02.25 20:50:00 | 000,000,046 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{45152797-1bd8-11de-90cb-001e339eddb2}\Shell - "" = AutoRun
O33 - MountPoints2\{45152797-1bd8-11de-90cb-001e339eddb2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{45152797-1bd8-11de-90cb-001e339eddb2}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2007.11.21 17:29:34 | 000,110,592 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010.07.07 15:22:26 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe
[2010.07.07 14:58:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Malwarebytes
[2010.07.07 14:57:52 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.07.07 14:57:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.07.07 14:57:51 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.07.07 14:57:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.07.07 14:40:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010.07.07 14:39:47 | 006,153,648 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Andreas\Desktop\mbam-setup.exe
[2010.07.06 22:32:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Threat Expert
[2010.07.06 20:55:37 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.07.06 20:13:31 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.07.06 20:05:56 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.07.06 20:05:56 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.07.06 20:05:56 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.07.06 20:05:56 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.07.06 20:05:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.07.06 20:04:19 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.07.06 19:48:00 | 000,000,000 | ---D | C] -- C:\Programme\CleanUp!
[2010.07.06 19:00:48 | 000,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll
[2010.07.06 19:00:47 | 001,652,688 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll
[2010.07.06 19:00:47 | 000,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll
[2010.07.06 18:57:00 | 000,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010.07.06 18:56:55 | 000,218,592 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2010.07.06 18:56:55 | 000,088,040 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010.07.06 18:56:48 | 000,063,360 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2010.07.06 18:56:42 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Doctor
[2010.07.06 18:56:42 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\PC Tools
[2010.07.06 18:56:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\PC Tools
[2010.07.06 18:56:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools
[2010.07.06 18:56:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.07.06 18:53:27 | 036,598,544 | ---- | C] (PC Tools ) -- C:\Dokumente und Einstellungen\Andreas\Desktop\sdsetup.exe
[2010.07.04 10:57:50 | 000,000,000 | ---D | C] -- C:\test
[2010.07.04 02:53:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\test
[2010.07.04 02:53:42 | 000,000,000 | ---D | C] -- C:\Neuer Ordner
[2010.07.04 02:44:49 | 000,000,000 | ---D | C] -- C:\altes Iphone Backup
[2010.07.03 18:50:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\com.apple.Notes
[2010.07.03 18:50:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\com.apple.MailAccounts
[2010.07.03 18:50:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\com.apple.Contacts
[2010.07.03 18:50:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\com.apple.Calendars
[2010.07.03 18:50:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\com.apple.Bookmarks
[2010.06.30 10:39:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Neuer Ordner
[2010.06.30 09:57:05 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.06.30 09:57:00 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2010.06.30 09:57:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.06.30 09:55:18 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.06.30 09:52:46 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.06.18 18:47:47 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer
[2010.06.15 14:38:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\TeamViewer
[2010.06.15 14:38:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\temp
[2010.06.13 19:58:46 | 000,266,240 | ---- | C] (Dieter Otter, Tools & Components) -- C:\WINDOWS\System32\sevZip40.dll
[2010.06.13 15:07:28 | 000,438,272 | ---- | C] (Dart Communications) -- C:\WINDOWS\System32\DartMail.dll
[2010.06.13 15:07:28 | 000,221,184 | ---- | C] (Dart Communications) -- C:\WINDOWS\System32\DartSock.dll
[2010.06.13 15:07:27 | 000,147,456 | ---- | C] (Dart Communications) -- C:\WINDOWS\System32\DartUtil.dll
[2010.06.13 15:07:27 | 000,137,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Msinet.ocx
[2010.06.13 15:07:26 | 000,371,712 | ---- | C] (Tools & Components) -- C:\WINDOWS\System32\sevDataGrid2.ocx
[2010.06.13 15:07:25 | 001,589,248 | ---- | C] (Dirk Richter - Softwaredevelopment) -- C:\WINDOWS\System32\LibMyWitch.ocx
[2010.06.13 15:07:25 | 000,294,400 | ---- | C] (Tools & Components) -- C:\WINDOWS\System32\sevEin20.ocx
[2010.06.13 15:07:24 | 000,190,464 | ---- | C] (Tools & Components) -- C:\WINDOWS\System32\sevImLib.dll
[2010.06.13 15:07:24 | 000,141,824 | ---- | C] (Tools & Components) -- C:\WINDOWS\System32\sevCmd3.ocx
[2010.06.13 15:07:24 | 000,057,856 | ---- | C] (Tools & Components) -- C:\WINDOWS\System32\sevFTP10.dll
[2010.06.13 15:07:24 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Flxgdde.dll
[2010.06.13 15:07:23 | 000,529,656 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\llview13.exe
[2010.06.13 15:07:23 | 000,042,232 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13sx.dll
[2010.06.13 15:07:22 | 002,475,768 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13ht.llx
[2010.06.13 15:07:22 | 002,251,512 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmls13.dll
[2010.06.13 15:07:22 | 002,125,560 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmct13.dll
[2010.06.13 15:07:22 | 002,035,352 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13xl.dll
[2010.06.13 15:07:22 | 001,567,480 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmbr13.dll
[2010.06.13 15:07:22 | 000,905,464 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmmx02.dll
[2010.06.13 15:07:22 | 000,876,280 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmdw13.dll
[2010.06.13 15:07:22 | 000,771,320 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13ex.llx
[2010.06.13 15:07:22 | 000,644,264 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13eu.llx
[2010.06.13 15:07:22 | 000,637,160 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13bm.llx
[2010.06.13 15:07:22 | 000,482,040 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmut13.dll
[2010.06.13 15:07:22 | 000,471,288 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmpr13.dll
[2010.06.13 15:07:22 | 000,356,600 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13pw.llx
[2010.06.13 15:07:22 | 000,336,632 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13oc.llx
[2010.06.13 15:07:21 | 005,617,912 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13.dll
[2010.06.13 15:07:21 | 003,866,528 | ---- | C] (Adobe Systems, Inc.) -- C:\WINDOWS\System32\Flash10b.ocx
[2010.06.13 15:07:21 | 001,137,912 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll1300.lng
[2010.06.13 15:07:21 | 000,427,256 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13o.ocx
[2010.06.13 15:07:21 | 000,290,816 | ---- | C] (Software-Entwicklung & Vertrieb) -- C:\WINDOWS\System32\sevImCol.dll
[2010.06.13 15:07:21 | 000,234,744 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13fx.ocx
[2010.06.13 15:07:21 | 000,206,144 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13ox.ocx
[2010.06.13 15:07:21 | 000,201,976 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13v.ocx
[2010.06.13 15:07:21 | 000,165,112 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmll13r.ocx
[2010.06.13 15:07:21 | 000,082,168 | ---- | C] (combit GmbH) -- C:\WINDOWS\System32\cmls1300.lng
[2010.06.13 15:04:58 | 000,000,000 | ---D | C] -- C:\SEMteam
[2010.06.08 21:45:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Temp
[2009.03.30 10:20:50 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\DLLVGA.dll
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010.07.07 15:55:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.07 15:24:27 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe
[2010.07.07 14:57:54 | 000,000,682 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.07 14:52:49 | 006,153,648 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Andreas\Desktop\mbam-setup.exe
[2010.07.06 22:55:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.06 22:05:50 | 000,001,429 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteam Fernschulung.lnk
[2010.07.06 22:05:49 | 000,001,500 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SSEMteam ReportDesigner.lnk
[2010.07.06 22:05:49 | 000,001,405 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamUpdate.lnk
[2010.07.06 22:05:49 | 000,001,383 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamDBrep.lnk
[2010.07.06 22:05:49 | 000,001,376 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamText.lnk
[2010.07.06 22:05:49 | 000,001,346 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteam.lnk
[2010.07.06 21:39:31 | 000,018,432 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.06 20:37:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.06 20:37:12 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.06 20:37:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.06 20:36:11 | 002,200,608 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2010.07.06 20:36:11 | 000,483,360 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2010.07.06 20:36:11 | 000,020,368 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2010.07.06 20:36:11 | 000,003,780 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2010.07.06 20:36:08 | 004,194,304 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\NTUSER.DAT
[2010.07.06 20:36:08 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Andreas\ntuser.ini
[2010.07.06 20:21:32 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.07.06 20:21:06 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.06 20:13:35 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010.07.06 19:47:23 | 000,339,257 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\CleanUp452.exe
[2010.07.06 19:41:36 | 003,727,961 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\ComboFix.exe
[2010.07.06 18:55:14 | 036,598,544 | ---- | M] (PC Tools ) -- C:\Dokumente und Einstellungen\Andreas\Desktop\sdsetup.exe
[2010.06.30 14:26:03 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.06.30 09:57:44 | 000,001,804 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2010.06.29 22:15:31 | 000,065,536 | ---- | M] () -- C:\data.syncdb
[2010.06.13 15:11:50 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010.06.08 21:49:20 | 000,001,893 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010.07.07 14:57:54 | 000,000,682 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.06 20:13:35 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010.07.06 20:13:32 | 000,262,448 | ---- | C] () -- C:\cmldr
[2010.07.06 20:05:56 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.07.06 20:05:56 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.07.06 20:05:56 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.07.06 20:05:56 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.07.06 20:05:56 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.07.06 19:47:22 | 000,339,257 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\CleanUp452.exe
[2010.07.06 19:40:27 | 003,727,961 | R--- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\ComboFix.exe
[2010.07.06 19:00:48 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010.07.06 19:00:48 | 000,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml
[2010.07.06 19:00:48 | 000,000,879 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml
[2010.07.06 19:00:48 | 000,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip
[2010.07.06 19:00:47 | 001,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip
[2010.07.06 18:57:00 | 000,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010.07.06 18:56:55 | 000,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010.07.06 18:56:55 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2010.07.06 18:56:48 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2010.07.03 18:56:04 | 000,065,536 | ---- | C] () -- C:\data.syncdb
[2010.06.30 13:23:24 | 000,001,500 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SSEMteam ReportDesigner.lnk
[2010.06.30 13:23:24 | 000,001,429 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteam Fernschulung.lnk
[2010.06.30 13:23:24 | 000,001,405 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamUpdate.lnk
[2010.06.30 13:23:24 | 000,001,383 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamDBrep.lnk
[2010.06.30 13:23:24 | 000,001,376 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteamText.lnk
[2010.06.30 13:23:24 | 000,001,346 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\SEMteam.lnk
[2010.06.30 09:57:44 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2010.06.13 19:58:47 | 000,000,279 | ---- | C] () -- C:\WINDOWS\System32\sevISDN.dep
[2010.06.13 19:58:46 | 000,544,256 | ---- | C] () -- C:\WINDOWS\System32\jangraphics.dll
[2010.06.13 19:58:45 | 000,120,472 | ---- | C] () -- C:\WINDOWS\System32\VSVPort7.ocx
[2010.06.13 15:07:24 | 001,069,056 | ---- | C] () -- C:\WINDOWS\System32\libmySQL.dll
[2010.06.13 15:07:24 | 000,072,192 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2010.06.13 15:07:23 | 002,127,345 | ---- | C] () -- C:\WINDOWS\System32\cmLL1300.chm
[2010.06.13 15:07:23 | 000,188,371 | ---- | C] () -- C:\WINDOWS\System32\cmll1300.inf
[2010.06.13 15:07:21 | 000,581,368 | ---- | C] () -- C:\WINDOWS\System32\cmmx0200.lng
[2010.06.13 15:07:21 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\Flash10b.oca
[2010.06.13 15:07:21 | 000,008,277 | ---- | C] () -- C:\WINDOWS\System32\cmll13si.chm
[2010.06.08 21:49:20 | 000,001,893 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[2009.12.27 20:52:16 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2009.11.19 16:02:22 | 000,000,133 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2009.10.08 17:39:15 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_8420.ini
[2009.10.08 17:39:15 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009.10.08 17:39:14 | 000,000,442 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009.10.08 17:39:14 | 000,000,026 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009.06.15 21:50:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\canopus.ini
[2009.06.15 21:33:16 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\pavedius4db.dll
[2009.06.15 21:01:36 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\pavedius.dll
[2009.03.30 10:20:50 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\TCtrlIO.dll
[2009.03.29 22:23:13 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\SHTDLL32.DLL
[2009.03.29 22:23:13 | 000,000,478 | ---- | C] () -- C:\WINDOWS\System32\ic32.ini
[2009.03.29 22:23:12 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll
[2009.03.28 22:38:27 | 000,115,200 | ---- | C] () -- C:\WINDOWS\System32\drivers\mdvdrv.sys
[2009.03.28 22:28:45 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\mdvrmng.sys
[2009.03.28 18:55:03 | 000,000,057 | ---- | C] () -- C:\WINDOWS\init.ini
[2009.03.28 18:27:26 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.03.28 12:40:20 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2009.03.28 12:40:20 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2009.03.28 12:40:20 | 000,010,150 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2009.03.28 12:40:20 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2007.10.22 08:53:12 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\RemoveDevice.dll
[2007.10.22 08:53:12 | 000,466,944 | ---- | C] () -- C:\WINDOWS\RemoveDevice.dll
[2006.11.30 14:53:12 | 000,331,867 | ---- | C] () -- C:\WINDOWS\System32\pol32ps.dll
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001.10.28 18:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 163 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 122 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
< End of report > --- --- --- |