Hallo cosinus,
zunächst herzlichen Dank für Deine Antwort.
Also: ich habe mir die Anleitung: "Für alle Hilfesuchenden! Was muss ich vor der Öffnung eines Themas beachten?" ausgedruckt und die Schritt für Schritt abgearbeitet.
Da steht am Schluss: ...und poste den Inhalt von OTL usw.
Wenn ich mich richtig erinnere, gab es nach dem Erstellen des neuen Themas die Möglichkeit, Dateien hoch zu laden, die habe ich genutzt.
So steht das mehrfach in der Anleitung: z.B. "Logfiles als Anhang posten", oder "Zippe die EXTRAS.txt und Gmer.txt und poste diese als Anhang".
Offensichtlich abe ich da was nicht richtig verstanden? Das war mein erster Forenbeitrag, insofern bin ich also ein DAU!
Ich gelobe Besserung!
Viele Grüße
tatewa
p.s.: So viele Menschen es gibt, so viele Bilder der Welt gibt es (Laotse)
Hallo cosinus,
versuche jetzt mal Deine Anleitung umzusetzen: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:54 on 27/01/2013 (NBKSAdmin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
OTL logfile created on: 28.01.2013 11:42:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\NB**Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,77 Gb Available Physical Memory | 79,35% Memory free
6,81 Gb Paging File | 6,02 Gb Available in Paging File | 88,35% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 146,48 Gb Total Space | 123,77 Gb Free Space | 84,49% Space Free | Partition Type: NTFS
Drive D: | 143,05 Gb Total Space | 127,73 Gb Free Space | 89,29% Space Free | Partition Type: NTFS
Drive E: | 142,58 Gb Total Space | 137,55 Gb Free Space | 96,48% Space Free | Partition Type: NTFS
Drive F: | 164,06 Gb Total Space | 113,47 Gb Free Space | 69,16% Space Free | Partition Type: NTFS
Computer Name: NB** | User Name: NB**Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.01.27 23:18:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\OTL.exe
PRC - [2013.01.09 13:01:22 | 001,035,216 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe
PRC - [2012.12.16 13:39:32 | 001,414,520 | ---- | M] (Ilja Herlein) -- C:\Programme\NetSetMan\nsmservice.exe
PRC - [2012.11.30 05:08:20 | 001,584,624 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe
PRC - [2012.11.29 05:20:10 | 001,475,096 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
PRC - [2012.11.29 05:13:47 | 001,914,760 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe
PRC - [2012.11.29 04:49:49 | 001,548,312 | ---- | M] (G Data Software AG) -- C:\Programme\Gemeinsame Dateien\G Data\AVKProxy\AVKProxy.exe
PRC - [2012.11.29 04:47:08 | 000,469,016 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe
PRC - [2012.10.09 10:53:36 | 004,441,920 | ---- | M] (Akamai Technologies, Inc.) -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe
PRC - [2012.09.24 21:17:58 | 003,491,792 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe
PRC - [2012.06.28 19:49:22 | 001,173,712 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2012.06.28 19:48:10 | 005,924,712 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\SyncAgent\syncagentsrv.exe
PRC - [2012.06.28 19:47:22 | 000,821,584 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
PRC - [2012.06.28 19:47:12 | 000,403,688 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
PRC - [2012.06.28 19:46:30 | 005,993,216 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Programme\Gemeinsame Dateien\G Data\GDScan\GDScan.exe
PRC - [2011.10.14 07:01:50 | 000,994,360 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psia.exe
PRC - [2011.10.14 07:01:48 | 000,399,416 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\sua.exe
PRC - [2011.01.04 16:48:12 | 000,488,816 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\Apoint.exe
PRC - [2010.11.09 05:55:18 | 000,054,640 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApMsgFwd.exe
PRC - [2010.09.30 14:16:06 | 002,155,848 | ---- | M] () -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe
PRC - [2010.09.13 19:02:44 | 000,399,872 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\Programme\UPHClean\uphclean.exe
PRC - [2010.07.06 21:59:22 | 000,054,744 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\hidfind.exe
PRC - [2010.05.30 22:17:06 | 000,054,640 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApntEx.exe
PRC - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.03 20:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.01.28 16:18:36 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\OA001Mon.exe
PRC - [2009.12.08 06:14:28 | 005,241,448 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
PRC - [2009.04.02 16:33:16 | 000,128,232 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2008.11.11 15:35:22 | 000,020,840 | ---- | M] (Broadcom Corporation) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
PRC - [2008.11.11 15:35:20 | 000,808,296 | ---- | M] (Broadcom Corporation) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
PRC - [2008.08.15 07:51:34 | 000,604,776 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008.06.24 06:16:50 | 000,243,000 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\SecureUpgrade.exe
PRC - [2008.06.12 07:59:58 | 000,786,432 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
PRC - [2008.05.22 16:32:08 | 000,221,273 | ---- | M] (IDT, Inc.) -- c:\Programme\IDT\DellXPM09B_6017v022\WDM\stacsv.exe
PRC - [2008.05.14 16:42:16 | 000,105,472 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.09.11 03:40:32 | 000,218,032 | ---- | M] (Macrovision Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe
========== Modules (No Company Name) ==========
MOD - [2013.01.28 09:29:32 | 002,049,536 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\G Data\AVKScanP\Avast5\defs\13012800\algo.dll
MOD - [2013.01.26 08:50:55 | 000,170,496 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\4038934c72a4e48c80e283dd96d7eb94\IsdiInterop.ni.dll
MOD - [2013.01.26 08:50:52 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7a2248a76f0e94d56c92c5bf96f5175\System.Runtime.Remoting.ni.dll
MOD - [2013.01.26 08:50:50 | 000,453,120 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4a80de1d5c899d0b972227bec60b127f\IAStorUtil.ni.dll
MOD - [2013.01.26 08:50:49 | 000,176,128 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\f622e88d112892df8d9018c02e69c7c0\IAStorDataMgr.ni.dll
MOD - [2013.01.26 08:50:48 | 000,019,968 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\79b9f3b766996e0c2e44ba0e68a8e0ea\IAStorDataMgrSvc.ni.exe
MOD - [2013.01.21 21:39:40 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\33ff7d73f01be8329a95c6e03f1dd555\System.Web.ni.dll
MOD - [2013.01.21 21:39:30 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\f43e890d874ef521aba51f76f64cd97b\System.ServiceProcess.ni.dll
MOD - [2013.01.21 20:00:40 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\96b7a0136e9e72e8f4eb0230c20766d2\System.Configuration.ni.dll
MOD - [2013.01.21 19:55:48 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll
MOD - [2013.01.21 19:55:43 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\4c91371e83d124ecb39664613e7e0417\System.Windows.Forms.ni.dll
MOD - [2013.01.21 19:55:31 | 001,593,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7782f356a838c403b4a8e9c80df5a577\System.Drawing.ni.dll
MOD - [2013.01.21 19:53:35 | 003,325,440 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\4b889e41364baff1e456817b4777b610\WindowsBase.ni.dll
MOD - [2013.01.21 19:53:30 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll
MOD - [2013.01.21 19:53:24 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll
MOD - [2012.09.25 20:00:36 | 000,315,392 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2012.09.25 20:00:31 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll
MOD - [2012.06.28 19:46:10 | 013,005,184 | ---- | M] () -- C:\Programme\Acronis\TrueImageHome\Common\ti_managers.dll
MOD - [2012.06.28 16:34:28 | 000,018,816 | ---- | M] () -- C:\Programme\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
MOD - [2012.06.28 15:58:30 | 000,435,584 | ---- | M] () -- C:\Programme\Acronis\TrueImageHome\Common\ulxmlrpcpp.dll
MOD - [2011.03.23 16:59:54 | 000,075,040 | ---- | M] () -- C:\WINDOWS\system32\WIN2PDFM.DLL
MOD - [2010.09.30 14:16:06 | 002,155,848 | ---- | M] () -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe
MOD - [2010.05.12 12:06:54 | 001,612,392 | ---- | M] () -- C:\WINDOWS\system32\nview.dll
MOD - [2010.05.12 12:06:54 | 001,108,584 | ---- | M] () -- C:\WINDOWS\system32\nvwimg.dll
MOD - [2010.05.12 12:06:54 | 000,473,704 | ---- | M] () -- C:\WINDOWS\system32\nvshell.dll
MOD - [2010.03.03 20:08:58 | 000,058,880 | ---- | M] () -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
MOD - [2010.02.02 20:47:42 | 000,143,360 | ---- | M] () -- C:\WINDOWS\system32\preflib.dll
MOD - [2010.02.02 20:45:58 | 000,757,760 | ---- | M] () -- C:\WINDOWS\system32\bcm1xsup.dll
MOD - [2009.12.08 06:14:28 | 005,241,448 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
MOD - [2008.08.15 07:46:30 | 002,854,912 | ---- | M] () -- C:\WINDOWS\system32\btwicons.dll
MOD - [2008.08.15 07:43:46 | 000,040,960 | ---- | M] () -- C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2008.06.04 07:53:14 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\spd__l.dll
MOD - [2008.05.14 16:40:30 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\wxvault.dll
MOD - [2008.04.14 13:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2007.07.23 14:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\DLLShared\dlaapi_w.dll
========== Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- C:\Programme\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
SRV - [2013.01.21 20:13:47 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.21 20:10:39 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.21 19:32:06 | 004,539,712 | ---- | M] () [Auto | Running] -- c:\programme\gemeinsame dateien\akamai/netsession_win_ce5ba24.dll -- (Akamai)
SRV - [2012.12.16 13:39:32 | 001,414,520 | ---- | M] (Ilja Herlein) [Auto | Running] -- C:\Programme\NetSetMan\nsmservice.exe -- (nsmService)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.11.30 05:08:20 | 001,584,624 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe -- (AVKWCtl)
SRV - [2012.11.29 05:13:47 | 001,914,760 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe -- (GDFwSvc)
SRV - [2012.11.29 04:49:49 | 001,548,312 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2012.11.29 04:47:08 | 000,469,016 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe -- (AVKService)
SRV - [2012.09.24 21:17:58 | 003,491,792 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2012.06.28 19:48:10 | 005,924,712 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\SyncAgent\syncagentsrv.exe -- (syncagentsrv)
SRV - [2012.06.28 19:47:22 | 000,821,584 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2011.10.14 07:01:50 | 000,994,360 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\psia.exe -- (Secunia PSI Agent)
SRV - [2011.10.14 07:01:48 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2011.06.13 21:09:22 | 000,267,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Fix it Center\Matsvc.exe -- (MatSvc)
SRV - [2010.09.30 14:16:06 | 002,155,848 | ---- | M] () [Auto | Running] -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe -- (OS Selector)
SRV - [2010.09.13 19:02:44 | 000,399,872 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Auto | Running] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean)
SRV - [2010.08.09 03:04:02 | 000,131,888 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\WINDOWS\system32\SUPDSvc.exe -- (Samsung UPD Service)
SRV - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2009.12.08 06:14:28 | 005,241,448 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe -- (NVIDIA Performance Driver Service)
SRV - [2008.11.11 15:35:22 | 000,020,840 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage)
SRV - [2008.11.11 15:35:20 | 000,808,296 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service)
SRV - [2008.06.12 07:59:58 | 000,786,432 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe -- (TdmService)
SRV - [2008.05.22 16:32:08 | 000,221,273 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Programme\IDT\DellXPM09B_6017v022\WDM\stacsv.exe -- (STacSV)
SRV - [2007.07.11 08:33:28 | 000,069,632 | R--- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe -- (stllssvr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\SBREdrv.sys -- (SBRE)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | Boot | Stopped] -- -- (cerc6)
DRV - [2013.01.21 19:35:56 | 000,053,536 | ---- | M] (G Data Software AG) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys -- (GDTdiInterceptor)
DRV - [2013.01.21 19:35:55 | 000,093,600 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV - [2013.01.21 19:35:55 | 000,047,264 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\HookCentre.sys -- (HookCentre)
DRV - [2013.01.21 19:35:55 | 000,042,016 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\GDBehave.sys -- (GDBehave)
DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.09.24 21:17:59 | 000,234,752 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afcdp.sys -- (afcdp)
DRV - [2012.09.24 21:17:50 | 000,775,232 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\tdrpman.sys -- (tdrpman)
DRV - [2012.09.24 21:17:49 | 000,614,592 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2012.09.24 21:17:45 | 000,126,880 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vididr.sys -- (vididr)
DRV - [2012.09.24 21:17:44 | 000,086,496 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vsflt67.sys -- (vidsflt67)
DRV - [2012.09.24 21:17:42 | 000,177,600 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2012.09.24 21:17:41 | 000,080,416 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\fltsrv.sys -- (fltsrv)
DRV - [2012.09.24 18:00:03 | 000,069,552 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\GRD.sys -- (GRD)
DRV - [2012.09.24 17:39:09 | 000,030,200 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\GDNdisIc.sys -- (GDNdisIc)
DRV - [2011.03.23 16:00:10 | 000,241,880 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1y5132.sys -- (e1yexpress)
DRV - [2011.01.05 19:42:14 | 000,284,792 | R--- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010.09.01 09:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2010.02.02 20:47:32 | 002,696,448 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2010.01.28 16:20:32 | 000,281,472 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2009.05.28 09:48:20 | 000,134,144 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Afx.sys -- (OA001Afx)
DRV - [2009.03.06 14:30:08 | 000,133,632 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2008.11.11 15:32:10 | 000,032,808 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2008.11.11 15:32:08 | 000,035,880 | R--- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2008.11.11 15:32:08 | 000,012,840 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ccidflt.sys -- (CCIDFILTER)
DRV - [2008.11.05 22:20:24 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008.08.11 16:01:32 | 000,151,552 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\GenHC.sys -- (EST_Server)
DRV - [2008.08.11 16:01:14 | 000,027,648 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\GenBus.sys -- (EST_BusEnum)
DRV - [2008.08.08 00:42:48 | 000,991,016 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.08.04 05:35:28 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.06.24 06:16:52 | 000,172,344 | ---- | M] (Wave Systems Corp.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\WavxDMgr.sys -- (WavxDMgr)
DRV - [2008.06.04 12:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PBADRV.sys -- (PBADRV)
DRV - [2008.05.22 16:32:50 | 001,381,914 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2008.05.21 21:02:48 | 000,534,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2008.05.20 15:21:26 | 000,108,160 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2008.02.05 00:57:44 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2008.02.05 00:57:30 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2007.09.20 18:59:14 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007.07.23 14:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLADResM.SYS -- (DLADResM)
DRV - [2007.07.23 14:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2007.07.23 14:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2007.07.23 14:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2007.07.23 14:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2007.07.23 14:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2007.07.23 14:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2007.07.23 14:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2007.07.23 13:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007.07.23 13:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 04 53 D3 28 AA FB CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7B097d3191-e6fa-4728-9826-b533d755359d%7D:0.7.18
FF - prefs.js..extensions.enabledAddons: %7Bbb65e674-b194-4b6e-8033-5fa0afe3a198%7D:1.1
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.4.3
FF - prefs.js..extensions.enabledAddons: %7B906305f7-aafc-45e9-8bbd-941950a84dad%7D:1.1.11215.1124
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130116
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@autodesk.com/DWF: C:\Programme\Autodesk\Autodesk Design Review Browser Add-on v1.2\npADRdwf.dll (Autodesk)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.01.24 20:20:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2013.01.21 20:18:06 | 000,000,000 | ---D | M]
[2012.09.27 19:02:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Extensions
[2013.01.23 21:08:37 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\67a4m6rh.default\extensions
[2013.01.23 21:08:37 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\67a4m6rh.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.09.24 22:34:08 | 000,455,379 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\67a4m6rh.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2013.01.22 16:15:42 | 000,533,221 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\67a4m6rh.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.24 22:36:06 | 000,008,689 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\67a4m6rh.default\extensions\{bb65e674-b194-4b6e-8033-5fa0afe3a198}.xpi
[2013.01.24 20:20:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.01.22 15:36:42 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Programme\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}
[2012.09.23 16:14:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2013.01.16 21:10:14 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2013.01.17 01:11:04 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.17 01:11:04 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2013.01.17 01:11:04 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.17 01:11:04 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.17 01:11:04 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.17 01:11:04 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2013.01.28 00:23:47 | 000,000,934 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Gemeinsame Dateien\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Driver Genius] File not found
O4 - HKLM..\Run: [Everything] C:\Programme\Everything\Everything.exe ()
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [OA001Mon] C:\WINDOWS\OA001Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SecureUpgrade] C:\Programme\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [NetSetMan] C:\Programme\NetSetMan\netsetman.exe (Ilja Herlein)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Secunia PSI Tray.lnk = C:\Programme\Secunia\PSI\psi_tray.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 189
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKCU\..Trusted Domains: dell.com ([]* in Vertrauenswürdige Sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1348411210427 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1348411251145 (MUWebControl Class)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O30 - LSA: Authentication Packages - (wvauth) - C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2012.09.23 21:53:44 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2012.09.21 20:21:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.01.27 23:33:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Malwarebytes
[2013.01.27 23:33:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2013.01.27 23:33:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2013.01.27 23:33:03 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013.01.27 23:33:03 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2013.01.27 23:31:48 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\mbam-setup-1.70.0.1100.exe
[2013.01.27 23:30:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2013.01.27 16:00:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board-Dateien
[2013.01.27 15:58:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Trojaner-Board-Anleitung-Dateien
[2013.01.27 15:56:47 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\OTL.exe
[2013.01.27 13:20:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\HijackThis Logfileauswertung-Dateien
[2013.01.27 13:05:48 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\HiJackThis204.exe
[2013.01.26 08:54:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Intel Corporation
[2013.01.26 08:50:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Intel
[2013.01.26 05:43:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2013.01.26 05:43:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security Task Manager
[2013.01.26 05:43:02 | 000,000,000 | ---D | C] -- C:\Programme\Security Task Manager
[2013.01.25 11:11:36 | 000,000,000 | ---D | C] -- C:\Programme\Intel
[2013.01.24 22:01:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Logitech
[2013.01.24 21:59:59 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Logishrd
[2013.01.24 21:16:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Startmenü\Programme\Dell
[2013.01.24 21:15:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Deployment
[2013.01.24 21:02:04 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group
[2013.01.24 21:02:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Startmenü\Programme\Revo Uninstaller
[2013.01.23 21:56:36 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NB**Admin\Recent
[2013.01.22 22:17:27 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\2013-01-15_Lagune
[2013.01.22 22:09:39 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Virus auf NB**
[2013.01.22 22:05:40 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Virus auf NBAM
[2013.01.22 21:46:13 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Privat
[2013.01.22 21:46:13 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\EDV
[2013.01.22 21:46:05 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\s**
[2013.01.22 21:46:03 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfungen
[2013.01.22 15:36:41 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
========== Files - Modified Within 30 Days ==========
[2013.01.28 16:13:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.01.28 16:08:37 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{A482D0E4-3C0F-463E-95CE-458872791D32}.job
[2013.01.28 11:42:16 | 000,249,117 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2013.01.28 11:39:42 | 000,065,172 | ---- | M] () -- C:\WINDOWS\System32\NvwsApps.xml
[2013.01.28 11:37:02 | 000,527,864 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.01.28 11:37:02 | 000,502,740 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.01.28 11:37:02 | 000,106,118 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.01.28 11:37:02 | 000,088,646 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.01.28 11:33:12 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat
[2013.01.28 11:32:36 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.01.28 11:32:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.01.28 11:32:22 | 000,386,408 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.01.28 11:15:50 | 000,957,568 | ---- | M] () -- C:\WINDOWS\System32\sig.bin
[2013.01.28 11:15:50 | 000,051,375 | ---- | M] () -- C:\WINDOWS\System32\nmp.map
[2013.01.28 10:56:53 | 000,411,144 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\AVCleaner.exe
[2013.01.28 00:53:11 | 000,249,117 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2013.01.28 00:23:47 | 000,000,934 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013.01.27 23:33:25 | 000,000,764 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.27 23:31:48 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\mbam-setup-1.70.0.1100.exe
[2013.01.27 23:19:32 | 000,365,568 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\gmer-2.0.18444.exe
[2013.01.27 23:18:37 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Defogger.exe
[2013.01.27 23:18:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\OTL.exe
[2013.01.27 16:00:41 | 000,059,600 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.htm
[2013.01.27 16:00:17 | 000,054,716 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Trojaner-Board-Anleitung.htm
[2013.01.27 15:54:35 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\defogger_reenable
[2013.01.27 13:20:43 | 000,255,558 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\HijackThis Logfileauswertung.htm
[2013.01.27 13:05:51 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\HiJackThis204.exe
[2013.01.26 10:22:55 | 000,000,361 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit EDV-Desktop.lnk
[2013.01.26 10:22:47 | 000,000,370 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 003s**-Desktop.lnk
[2013.01.26 10:22:27 | 000,000,421 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 2_V.DesktopVerschoben2013-01-13.lnk
[2013.01.26 10:22:19 | 000,000,379 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 004privat-Desktop.lnk
[2013.01.26 09:22:44 | 000,000,400 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2013.01.26 05:41:40 | 002,357,800 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\SecurityTaskManager_Setup.exe
[2013.01.24 09:10:15 | 000,445,395 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130128-002347.backup
[2013.01.23 21:50:59 | 000,001,551 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Eingabeaufforderung.lnk
[2013.01.22 10:39:04 | 000,001,248 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Eigene Dateien\cc_20130122_103901.reg
[2013.01.21 20:25:57 | 000,004,412 | ---- | M] () -- C:\Dokumente und Einstellungen\NB**Admin\Eigene Dateien\cc_20130121_202554.reg
[2013.01.21 20:02:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.01.21 19:35:56 | 000,053,536 | ---- | M] (G Data Software AG) -- C:\WINDOWS\System32\drivers\GDTdiIcpt.sys
[2013.01.21 19:35:55 | 000,093,600 | ---- | M] (G Data Software AG) -- C:\WINDOWS\System32\drivers\MiniIcpt.sys
[2013.01.21 19:35:55 | 000,047,264 | ---- | M] (G Data Software AG) -- C:\WINDOWS\System32\drivers\HookCentre.sys
[2013.01.21 19:35:55 | 000,042,016 | ---- | M] (G Data Software AG) -- C:\WINDOWS\System32\drivers\GDBehave.sys
[2013.01.10 14:35:41 | 000,011,240 | ---- | M] (G Data Software AG) -- C:\WINDOWS\System32\GdScrSv.de.dll
========== Files Created - No Company Name ==========
[2013.01.28 10:56:53 | 000,411,144 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\AVCleaner.exe
[2013.01.27 23:33:25 | 000,000,764 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.27 23:19:32 | 000,365,568 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\gmer-2.0.18444.exe
[2013.01.27 16:00:40 | 000,059,600 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.htm
[2013.01.27 16:00:17 | 000,054,716 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Trojaner-Board-Anleitung.htm
[2013.01.27 15:54:35 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\defogger_reenable
[2013.01.27 15:51:31 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Defogger.exe
[2013.01.27 13:20:42 | 000,255,558 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\HijackThis Logfileauswertung.htm
[2013.01.26 10:22:55 | 000,000,361 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit EDV-Desktop.lnk
[2013.01.26 10:22:47 | 000,000,370 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 003s**-Desktop.lnk
[2013.01.26 10:22:27 | 000,000,421 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 2_V.DesktopVerschoben2013-01-13.lnk
[2013.01.26 10:22:19 | 000,000,379 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Verknüpfung mit 004privat-Desktop.lnk
[2013.01.26 10:18:04 | 000,221,048 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2013.01.26 05:41:39 | 002,357,800 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\SecurityTaskManager_Setup.exe
[2013.01.23 21:50:54 | 000,001,551 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Desktop\Eingabeaufforderung.lnk
[2013.01.22 10:39:03 | 000,001,248 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Eigene Dateien\cc_20130122_103901.reg
[2013.01.21 20:25:56 | 000,004,412 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Eigene Dateien\cc_20130121_202554.reg
[2012.10.02 20:09:53 | 000,259,888 | ---- | C] () -- C:\WINDOWS\SUPDRun.exe
[2012.10.02 20:09:52 | 000,283,136 | ---- | C] () -- C:\WINDOWS\System32\DscPnt.dll
[2012.10.02 20:09:52 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\spd__ci.exe
[2012.10.02 20:09:52 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\spd__l.dll
[2012.10.02 20:07:42 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\GenHC.sys
[2012.10.01 20:54:29 | 000,008,704 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.24 23:00:48 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\default_user_class.dat
[2012.09.24 21:32:58 | 000,957,568 | ---- | C] () -- C:\WINDOWS\System32\sig.bin
[2012.09.24 19:11:21 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll
[2012.09.24 18:43:05 | 000,000,002 | ---- | C] () -- C:\WINDOWS\1way.ini
[2012.09.24 09:31:57 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012.09.23 22:43:27 | 000,061,678 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\PFP120JPR.{PB
[2012.09.23 22:43:27 | 000,012,358 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\PFP120JCM.{PB
[2012.09.23 22:03:35 | 000,452,774 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-789336058-1292428093-1801674531-1003-0.dat
[2012.09.23 22:03:34 | 000,322,430 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.09.23 21:58:31 | 000,000,022 | -HS- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Windows1569_SettingsRepository.bin
[2012.09.23 21:58:31 | 000,000,022 | -HS- | C] () -- C:\WINDOWS\90C7D912BE2316.sys
[2012.09.23 19:58:30 | 000,000,456 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2012.09.23 15:49:09 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.09.23 14:51:09 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat
[2012.09.23 14:07:59 | 000,279,888 | ---- | C] () -- C:\WINDOWS\System32\brcmbsp.dll
[2012.09.23 14:05:26 | 000,080,368 | ---- | C] () -- C:\WINDOWS\System32\pbadrvdll.dll
[2012.09.23 13:40:46 | 000,000,142 | ---- | C] () -- C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012.09.23 12:39:48 | 000,249,117 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2012.09.23 12:37:27 | 001,589,414 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2012.09.21 21:14:24 | 000,004,335 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012.09.21 21:13:27 | 000,386,408 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.09.21 20:36:09 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2012.09.21 20:36:09 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2012.09.21 20:22:34 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012.09.21 20:18:59 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
========== ZeroAccess Check ==========
[2012.09.23 13:08:18 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2012.08.30 21:28:07 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 13:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2013.01.21 10:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2012.10.03 14:51:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ad-Aware Browsing Protection
[2012.09.27 10:52:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2012.09.25 21:14:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Borland
[2013.01.24 22:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverGenius
[2012.09.24 20:38:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FILEminimizer
[2012.09.24 17:58:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\G DATA
[2012.10.03 15:50:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GFI Software
[2013.01.28 00:44:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iolo
[2012.10.04 13:31:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PixelPlanet
[2013.01.26 06:03:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2012.09.23 19:59:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Uninstall
[2012.09.25 21:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Wave Systems Corp
[2012.09.24 21:19:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Acronis
[2012.09.27 10:52:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Autodesk
[2012.09.24 10:07:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\BatteryBar
[2012.09.23 22:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Daoisoft
[2012.10.02 18:43:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\ElevatedDiagnostics
[2012.09.28 19:41:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\iolo
[2012.10.04 13:29:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\PixelPlanet
[2012.09.24 19:36:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\TeamViewer
[2012.10.04 17:20:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Thunderbird
[2012.09.25 21:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NB**Admin\Anwendungsdaten\Wave Systems Corp
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\dllcache\msgina.dll:SummaryInformation
< End of report >
Code:
OTL Extras logfile created on: 28.01.2013 11:42:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\NB**Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,77 Gb Available Physical Memory | 79,35% Memory free
6,81 Gb Paging File | 6,02 Gb Available in Paging File | 88,35% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 146,48 Gb Total Space | 123,77 Gb Free Space | 84,49% Space Free | Partition Type: NTFS
Drive D: | 143,05 Gb Total Space | 127,73 Gb Free Space | 89,29% Space Free | Partition Type: NTFS
Drive E: | 142,58 Gb Total Space | 137,55 Gb Free Space | 96,48% Space Free | Partition Type: NTFS
Drive F: | 164,06 Gb Total Space | 113,47 Gb Free Space | 69,16% Space Free | Partition Type: NTFS
Computer Name: NB** | User Name: NB**Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe" = C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe:*:Enabled:Akamai NetSession Client -- (Akamai Technologies, Inc.)
"C:\Programme\TeamViewer\Version7\TeamViewer.exe" = C:\Programme\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Programme\Generic\Network Printer Wizard\NPWService.exe" = C:\Programme\Generic\Network Printer Wizard\NPWService.exe:*:Enabled:NPWService
"C:\WINDOWS\system32\SUPDSvc.exe" = C:\WINDOWS\system32\SUPDSvc.exe:*:Enabled:Samsung UPD Service -- (Samsung Electronics CO., LTD.)
"C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe" = C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate -- (PixelPlanet GmbH)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{00040407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Disc 2
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{054A5F46-6DCE-4D09-8BC0-170428A4ED56}" = Acronis*True*Image*Home 2012
"{054A5F46-6DCE-4D09-8BC0-170428A4ED56}Visible" = Acronis*True*Image*Home 2012
"{06E34C00-0446-4176-81C8-A5DAFE53CA36}" = Acronis*Disk*Director*11*Home
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{153DB567-6FF3-49AD-AC4F-86F8A3CCFDFB}" = Autodesk Design Review 2013
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23170F69-40C1-2701-0920-000001000000}" = 7-Zip 9.20
"{24A494F3-5B5F-4183-9F7D-9CE82812C1FC}" = tsp patch
"{27263813-8BDE-4CD2-84D3-02536743428A}_is1" = Attribute Changer 6.20
"{2B818257-E6C7-4841-8C29-C5C9A982BCE5}" = RICOH R5U241 / R5C847 Media Driver ver.2.04.01.00
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{437C19B3-7E20-4E39-B868-CA6BAA820E1C}" = Microsoft Rechner-Plus
"{4C0A8D65-4286-4B58-87FE-18AD24289285}" = NVIDIA Performance Drivers
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{5783F2D7-B028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2013
"{602A58C3-BDF2-4B8A-B9D3-B6D9BACA386A}" = Dir-It!
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{763DEB88-48E6-4648-9CE6-A0FFC6900BEB}" = COMPUTERBILD Problemlöser 2011
"{7D15B945-2725-4443-AB3F-D900556612FE}" = User Profile Hive Cleanup Service
"{82A282EA-0404-4090-8E1B-E1B8EBF00C5B}" = PdfGrabber 2.5
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{86107E2D-DFB9-46BC-99ED-07EACAEE0923}" = G Data InternetSecurity 2013
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9593C6E5-205E-45C3-B785-05CF146CA76A}" = biolsp patch
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A093D83F-429A-4AB2-A0CD-1F7E9C7B764A}" = Trusted Drive Manager
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B20179BA-2872-432F-8D88-B8F44AED359B}" = Broadcom USH Host Components
"{B37C842A-B624-46B8-A727-654E72F1C91A}" = Calculator Powertoy for Windows XP
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCC68887-6E07-4438-A035-7C22EFBDC15E}" = Intel(R) Network Connections 14.6.7.0
"{CD49E43B-88B1-48AD-A3AF-43FAAAB41CB8}" = Autodesk Design Review Browser Add-on v1.2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EEFFD502-E311-4949-B931-4C13F77F68A3}" = USB Server
"{EF05BA0F-AC15-4D12-AC5C-276225F5E751}" = Gemalto
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9D57DE505B6D8C710EF3B74BE638DBB936EED8A3" = Windows-Treiberpaket - Dell Inc. PBADRV System (01/07/2008 1.0.1.5)
"Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIDA32_is1" = AIDA32 v3.93
"Akamai" = Akamai NetSession Interface
"Autodesk Design Review 2013" = Autodesk Design Review 2013
"CCleaner" = CCleaner
"Creative OA001" = Integrated Webcam Driver (1.08.01.0129)
"Dienstprogramm für die DW WLAN-Karte" = Dienstprogramm für die DW WLAN-Karte
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DWG TrueView 2013" = DWG TrueView 2013
"Everything" = Everything 1.2.1.371
"FILEminimizer Suite_is1" = FILEminimizer Suite
"iColorFolder" = iColorFolder
"ie8" = Windows Internet Explorer 8
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"InstallShield_{EEFFD502-E311-4949-B931-4C13F77F68A3}" = USB Server
"jv16 PowerTools 2011" = jv16 PowerTools 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NetSetMan_is1" = NetSetMan 3.5.2
"NVIDIA Drivers" = NVIDIA Drivers
"Revo Uninstaller" = Revo Uninstaller 1.94
"Samsung Universal Print Driver" = Samsung Universal Print Driver
"Secunia PSI" = Secunia PSI (2.0.0.4003)
"Security Task Manager" = Security Task Manager 1.8f
"TeamViewer 7" = TeamViewer 7
"T-Online eMail Center Desktop-Startsymbole" = T-Online eMail Center Desktop-Startsymbole 1.0
"Tweak UI 2.10" = Tweak UI
"VLC media player" = VLC media player 2.0.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Win2PDF_is1" = Win2PDF 7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Winmail Opener" = Winmail Opener 1.4
"WinMerge_is1" = WinMerge 2.12.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"9204f5692a8faf3b" = Dell System Detect
"Akamai" = Akamai NetSession Interface
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 25.01.2013 04:50:06 | Computer Name = NB** | Source = MsiInstaller | ID = 1013
Description = Produkt: Intel(R) Netzwerkanschlüsse -- Die installierte Version von
Intel(R) Netzwerkanschlüssen unterstützt keine Aktualisierungen. Sie muss vor der
Installation dieser Version deinstalliert werden.
Error - 25.01.2013 04:53:55 | Computer Name = NB** | Source = MsiInstaller | ID = 1013
Description = Produkt: Intel(R) Netzwerkanschlüsse -- Die installierte Version von
Intel(R) Netzwerkanschlüssen unterstützt keine Aktualisierungen. Sie muss vor der
Installation dieser Version deinstalliert werden.
Error - 25.01.2013 05:00:14 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.5512, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 26.01.2013 00:07:12 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 00:07:25 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 00:17:41 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 03:51:18 | Computer Name = NB** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung , Version 0.0.0.0, fehlgeschlagenes Modul
unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 27.01.2013 16:28:09 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.69.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 27.01.2013 18:13:28 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.69.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 27.01.2013 19:02:43 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam.exe, Version 1.70.0.9, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
[ System Events ]
Error - 27.01.2013 19:45:00 | Computer Name = NB** | Source = DCOM | ID = 10010
Description = Der Server "{1EF75F33-893B-4E8F-9655-C3D602BA4897}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 27.01.2013 19:45:00 | Computer Name = NB** | Source = DCOM | ID = 10010
Description = Der Server "{1EF75F33-893B-4E8F-9655-C3D602BA4897}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 27.01.2013 19:46:18 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 27.01.2013 19:52:13 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 27.01.2013 19:57:58 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 05:35:42 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Intel(R)
Rapid Storage Technology.
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Intel(R) Rapid Storage Technology" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1053
Error - 28.01.2013 06:32:35 | Computer Name = NB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
< End of report >
Code:
OTL Extras logfile created on: 28.01.2013 11:42:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\NB**Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,77 Gb Available Physical Memory | 79,35% Memory free
6,81 Gb Paging File | 6,02 Gb Available in Paging File | 88,35% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 146,48 Gb Total Space | 123,77 Gb Free Space | 84,49% Space Free | Partition Type: NTFS
Drive D: | 143,05 Gb Total Space | 127,73 Gb Free Space | 89,29% Space Free | Partition Type: NTFS
Drive E: | 142,58 Gb Total Space | 137,55 Gb Free Space | 96,48% Space Free | Partition Type: NTFS
Drive F: | 164,06 Gb Total Space | 113,47 Gb Free Space | 69,16% Space Free | Partition Type: NTFS
Computer Name: NB** | User Name: NB**Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe" = C:\Dokumente und Einstellungen\NB**Admin\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe:*:Enabled:Akamai NetSession Client -- (Akamai Technologies, Inc.)
"C:\Programme\TeamViewer\Version7\TeamViewer.exe" = C:\Programme\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Programme\Generic\Network Printer Wizard\NPWService.exe" = C:\Programme\Generic\Network Printer Wizard\NPWService.exe:*:Enabled:NPWService
"C:\WINDOWS\system32\SUPDSvc.exe" = C:\WINDOWS\system32\SUPDSvc.exe:*:Enabled:Samsung UPD Service -- (Samsung Electronics CO., LTD.)
"C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe" = C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate -- (PixelPlanet GmbH)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{00040407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Disc 2
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{054A5F46-6DCE-4D09-8BC0-170428A4ED56}" = Acronis*True*Image*Home 2012
"{054A5F46-6DCE-4D09-8BC0-170428A4ED56}Visible" = Acronis*True*Image*Home 2012
"{06E34C00-0446-4176-81C8-A5DAFE53CA36}" = Acronis*Disk*Director*11*Home
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{153DB567-6FF3-49AD-AC4F-86F8A3CCFDFB}" = Autodesk Design Review 2013
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23170F69-40C1-2701-0920-000001000000}" = 7-Zip 9.20
"{24A494F3-5B5F-4183-9F7D-9CE82812C1FC}" = tsp patch
"{27263813-8BDE-4CD2-84D3-02536743428A}_is1" = Attribute Changer 6.20
"{2B818257-E6C7-4841-8C29-C5C9A982BCE5}" = RICOH R5U241 / R5C847 Media Driver ver.2.04.01.00
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{437C19B3-7E20-4E39-B868-CA6BAA820E1C}" = Microsoft Rechner-Plus
"{4C0A8D65-4286-4B58-87FE-18AD24289285}" = NVIDIA Performance Drivers
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{5783F2D7-B028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2013
"{602A58C3-BDF2-4B8A-B9D3-B6D9BACA386A}" = Dir-It!
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{763DEB88-48E6-4648-9CE6-A0FFC6900BEB}" = COMPUTERBILD Problemlöser 2011
"{7D15B945-2725-4443-AB3F-D900556612FE}" = User Profile Hive Cleanup Service
"{82A282EA-0404-4090-8E1B-E1B8EBF00C5B}" = PdfGrabber 2.5
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{86107E2D-DFB9-46BC-99ED-07EACAEE0923}" = G Data InternetSecurity 2013
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9593C6E5-205E-45C3-B785-05CF146CA76A}" = biolsp patch
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A093D83F-429A-4AB2-A0CD-1F7E9C7B764A}" = Trusted Drive Manager
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B20179BA-2872-432F-8D88-B8F44AED359B}" = Broadcom USH Host Components
"{B37C842A-B624-46B8-A727-654E72F1C91A}" = Calculator Powertoy for Windows XP
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCC68887-6E07-4438-A035-7C22EFBDC15E}" = Intel(R) Network Connections 14.6.7.0
"{CD49E43B-88B1-48AD-A3AF-43FAAAB41CB8}" = Autodesk Design Review Browser Add-on v1.2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EEFFD502-E311-4949-B931-4C13F77F68A3}" = USB Server
"{EF05BA0F-AC15-4D12-AC5C-276225F5E751}" = Gemalto
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9D57DE505B6D8C710EF3B74BE638DBB936EED8A3" = Windows-Treiberpaket - Dell Inc. PBADRV System (01/07/2008 1.0.1.5)
"Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIDA32_is1" = AIDA32 v3.93
"Akamai" = Akamai NetSession Interface
"Autodesk Design Review 2013" = Autodesk Design Review 2013
"CCleaner" = CCleaner
"Creative OA001" = Integrated Webcam Driver (1.08.01.0129)
"Dienstprogramm für die DW WLAN-Karte" = Dienstprogramm für die DW WLAN-Karte
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DWG TrueView 2013" = DWG TrueView 2013
"Everything" = Everything 1.2.1.371
"FILEminimizer Suite_is1" = FILEminimizer Suite
"iColorFolder" = iColorFolder
"ie8" = Windows Internet Explorer 8
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"InstallShield_{EEFFD502-E311-4949-B931-4C13F77F68A3}" = USB Server
"jv16 PowerTools 2011" = jv16 PowerTools 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NetSetMan_is1" = NetSetMan 3.5.2
"NVIDIA Drivers" = NVIDIA Drivers
"Revo Uninstaller" = Revo Uninstaller 1.94
"Samsung Universal Print Driver" = Samsung Universal Print Driver
"Secunia PSI" = Secunia PSI (2.0.0.4003)
"Security Task Manager" = Security Task Manager 1.8f
"TeamViewer 7" = TeamViewer 7
"T-Online eMail Center Desktop-Startsymbole" = T-Online eMail Center Desktop-Startsymbole 1.0
"Tweak UI 2.10" = Tweak UI
"VLC media player" = VLC media player 2.0.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Win2PDF_is1" = Win2PDF 7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Winmail Opener" = Winmail Opener 1.4
"WinMerge_is1" = WinMerge 2.12.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"9204f5692a8faf3b" = Dell System Detect
"Akamai" = Akamai NetSession Interface
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 25.01.2013 04:50:06 | Computer Name = NB** | Source = MsiInstaller | ID = 1013
Description = Produkt: Intel(R) Netzwerkanschlüsse -- Die installierte Version von
Intel(R) Netzwerkanschlüssen unterstützt keine Aktualisierungen. Sie muss vor der
Installation dieser Version deinstalliert werden.
Error - 25.01.2013 04:53:55 | Computer Name = NB** | Source = MsiInstaller | ID = 1013
Description = Produkt: Intel(R) Netzwerkanschlüsse -- Die installierte Version von
Intel(R) Netzwerkanschlüssen unterstützt keine Aktualisierungen. Sie muss vor der
Installation dieser Version deinstalliert werden.
Error - 25.01.2013 05:00:14 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.5512, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 26.01.2013 00:07:12 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 00:07:25 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 00:17:41 | Computer Name = NB** | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 26.01.2013 03:51:18 | Computer Name = NB** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung , Version 0.0.0.0, fehlgeschlagenes Modul
unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 27.01.2013 16:28:09 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.69.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 27.01.2013 18:13:28 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.69.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 27.01.2013 19:02:43 | Computer Name = NB** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam.exe, Version 1.70.0.9, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
[ System Events ]
Error - 27.01.2013 19:45:00 | Computer Name = NB** | Source = DCOM | ID = 10010
Description = Der Server "{1EF75F33-893B-4E8F-9655-C3D602BA4897}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 27.01.2013 19:45:00 | Computer Name = NB** | Source = DCOM | ID = 10010
Description = Der Server "{1EF75F33-893B-4E8F-9655-C3D602BA4897}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 27.01.2013 19:46:18 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 27.01.2013 19:52:13 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 27.01.2013 19:57:58 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 05:35:42 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Intel(R)
Rapid Storage Technology.
Error - 28.01.2013 06:23:06 | Computer Name = NB** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Intel(R) Rapid Storage Technology" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1053
Error - 28.01.2013 06:32:35 | Computer Name = NB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iolo System Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%3
< End of report >
Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-28 21:43:08
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AK1 596,17GB
Running: gmer-2.0.18444.exe; Driver: C:\DOKUME~1\NB**AD~1\LOKALE~1\Temp\pgtdqpog.sys
---- System - GMER 2.0 ----
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwCreateKey [0xB24148A6]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwDeleteKey [0xB2414BFA]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwDeleteValueKey [0xB2414C3A]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwOpenKey [0xB2414A4C]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwOpenProcess [0xB24134E4]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwSetValueKey [0xB2414B9E]
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0x9B9B575C]
---- Kernel code sections - GMER 2.0 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB5C22380, 0x3E6515, 0xE8000020]
init C:\WINDOWS\system32\Drivers\OA001Afx.sys entry point in "init" section [0xA5F93D50]
? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys Das System kann die angegebene Datei nicht finden. !
---- EOF - GMER 2.0 ----
Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-28 21:43:08
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AK1 596,17GB
Running: gmer-2.0.18444.exe; Driver: C:\DOKUME~1\NB**AD~1\LOKALE~1\Temp\pgtdqpog.sys
---- System - GMER 2.0 ----
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwCreateKey [0xB24148A6]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwDeleteKey [0xB2414BFA]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwDeleteValueKey [0xB2414C3A]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwOpenKey [0xB2414A4C]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwOpenProcess [0xB24134E4]
SSDT \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G Data Software AG) ZwSetValueKey [0xB2414B9E]
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0x9B9B575C]
---- Kernel code sections - GMER 2.0 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB5C22380, 0x3E6515, 0xE8000020]
init C:\WINDOWS\system32\Drivers\OA001Afx.sys entry point in "init" section [0xA5F93D50]
? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys Das System kann die angegebene Datei nicht finden. !
---- EOF - GMER 2.0 ----
Hallo cosinus,
der DAU hat sich bemüht - ich bitte um Nachsicht, leider ist OTL-Extra jetzt zweimal drin, habe es nicht wieder rausbekommen; sehe gerade, GMER auch zweimal - sch...lecht!
Kannst Du das evtl. jeweils einmal löschen?
Viele Grüße
tatewa
Hallo cosinus,
habe in Eurem Board mittlerweile viel gestöbert und eine Menge guter Ratschläge zum Absichern von Rechnern gefunden - großes Lob!
Da ich mein Notebook auch geschäftlich nutze (kleine Firma, 11 Leute, keine IT-Abteilung), habe ich jetzt mal was gespendet.
Viele grüße
tatewa
Hallo cosinus,
habe in Eurem Board mittlerweile viel gestöbert und eine Menge guter Ratschläge zum Absichern von Rechnern gefunden - großes Lob!
Da ich mein Notebook auch geschäftlich nutze (kleine Firma, 11 Leute, keine IT-Abteilung), habe ich jetzt mal was gespendet.
Viele grüße
tatewa |
Lesestoff: