Hier nun also der Rest:
Zu
14. Komplett-Systemcheck mit Eset Online Scanner (NOD 32) durchgeführt. Musste nach ca. 1 Std. leider abbrechen, da sich der PC aufgehängt hatte.
1. Hier erstes Ergebnis als Logfile: Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ae3da5c197b3e5479d76454d6f361be5
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-25 06:10:15
# local_time=2012-04-25 08:10:15 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 568 568 0 0
# compatibility_mode=8449 16775141 50 99 5434 34470008 0 0
# scanned=9404
# found=1
# cleaned=1
# scan_time=3675
C:\Dokumente und Einstellungen\Ottilein\Desktop\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok Hier 2. Scan als Logfile: Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ae3da5c197b3e5479d76454d6f361be5
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-25 06:10:15
# local_time=2012-04-25 08:10:15 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 568 568 0 0
# compatibility_mode=8449 16775141 50 99 5434 34470008 0 0
# scanned=9404
# found=1
# cleaned=1
# scan_time=3675
C:\Dokumente und Einstellungen\Ottilein\Desktop\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ae3da5c197b3e5479d76454d6f361be5
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-26 12:44:18
# local_time=2012-04-26 02:44:18 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 4944 4944 0 0
# compatibility_mode=8449 16775141 50 99 4268 34474384 0 0
# scanned=190240
# found=4
# cleaned=4
# scan_time=22939
H:\Desktop 2011-08-24 15;52;23\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
H:\Desktop 2011-12-27 19;32;47\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Desktop 2011-01-21 21;37;32\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Desktop 2011-04-29 19;54;55\downloads\Nero-9.4.12.3d_free.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
15. Bin danach Offline gegangen (ist das in Ordnung so?)und habe Scan mit OTL durchgeführt. Vom Entwickler ist eingestellt: Dateialter 30 Tage. Hab das so gelassen.
Hier die Logfiles:
OTL.Txt
OTL Logfile: Code:
OTL logfile created on: 26.04.2012 14:33:38 - Run 2
OTL by OldTimer - Version 3.2.41.0 Folder = C:\Dokumente und Einstellungen\Ottilein\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1022,80 Mb Total Physical Memory | 321,99 Mb Available Physical Memory | 31,48% Memory free
2,40 Gb Paging File | 1,70 Gb Available in Paging File | 70,91% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 57,25 Gb Total Space | 14,69 Gb Free Space | 25,66% Space Free | Partition Type: NTFS
Computer Name: DESKTOP | User Name: Ottilein | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.04.23 20:16:50 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\OTL.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.03.08 15:47:23 | 001,543,704 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012.03.07 23:27:25 | 003,905,920 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.03.23 21:13:56 | 000,230,640 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe
PRC - [2011.03.23 21:13:48 | 000,439,536 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe
PRC - [2011.03.23 21:10:01 | 000,097,520 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2011.03.23 21:09:23 | 000,163,056 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2010.08.05 15:48:52 | 000,933,888 | ---- | M] () -- C:\Programme\TeamBoard\TBUPDDWU.EXE
PRC - [2010.03.22 16:16:50 | 001,125,376 | ---- | M] (Luis Cobian, CobianSoft) -- C:\Programme\Cobian Backup 10\cbService.exe
PRC - [2009.07.14 00:18:12 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.09.12 16:13:26 | 001,527,808 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
PRC - [2007.08.09 15:48:40 | 000,528,384 | R--- | M] (VIA Technologies, Inc.) -- C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe
========== Modules (No Company Name) ==========
MOD - [2012.04.26 14:28:16 | 000,065,024 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012.04.26 14:28:16 | 000,052,736 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2012.04.24 17:19:44 | 000,117,760 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2012.04.24 17:19:43 | 000,052,224 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011.10.05 04:52:30 | 000,756,048 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSPTLS.DLL
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2010.08.05 15:48:52 | 000,933,888 | ---- | M] () -- C:\Programme\TeamBoard\TBUPDDWU.EXE
MOD - [2009.11.19 16:14:36 | 001,310,720 | ---- | M] () -- C:\Programme\TeamBoard\ACE_UPDD_5.6.2.DLL
MOD - [2009.07.14 00:18:12 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
MOD - [2007.09.14 11:27:14 | 000,024,576 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\CheckSessions.dll
MOD - [2007.09.12 16:13:26 | 001,527,808 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
MOD - [2006.12.15 12:30:38 | 000,966,765 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\acAuth.dll
MOD - [2006.05.16 19:35:00 | 000,049,152 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WlanDll.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.03.08 15:47:23 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.03.23 21:13:56 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2011.03.23 21:10:01 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2011.03.23 21:09:23 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010.08.05 15:48:52 | 000,933,888 | ---- | M] () [Auto | Running] -- C:\Programme\TeamBoard\TBUPDDWU.EXE -- (tbupddwu)
SRV - [2010.03.22 16:16:50 | 001,125,376 | ---- | M] (Luis Cobian, CobianSoft) [Auto | Running] -- C:\Programme\Cobian Backup 10\cbService.exe -- (CobianBackup10)
SRV - [2010.03.22 15:53:18 | 000,067,584 | ---- | M] (CobianSoft, Luis Cobian) [Auto | Stopped] -- C:\Programme\Cobian Backup 10\cbVSCService.exe -- (cbVSCService)
SRV - [2009.07.14 00:18:12 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011.03.23 21:11:03 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2011.03.23 21:10:25 | 000,023,928 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)
DRV - [2011.03.23 21:10:02 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2010.08.05 15:53:56 | 000,110,664 | ---- | M] (Touch-Base Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TBUPDDSU.SYS -- (tbupddsu)
DRV - [2010.08.05 09:34:04 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.02.13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2007.06.27 14:42:00 | 000,207,488 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)
DRV - [2007.04.23 15:11:54 | 000,224,896 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wg111v3.sys -- (RTL8187B)
DRV - [2004.08.03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2001.08.17 13:14:24 | 000,444,416 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fpcibase.sys -- (fpcibase)
DRV - [2001.08.17 13:13:48 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.68
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.1.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..extensions.enabledItems: {B0D70E72-2FC1-4b9f-A3D4-5921C854D906}:1.2
FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19.1
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..extensions.enabledItems: stealthyextension@gmail.com:2.0
FF - prefs.js..keyword.URL: "hxxp://startsear.ch/?aff=3&q="
FF - prefs.js..network.proxy.http: "72.64.146.136"
FF - prefs.js..network.proxy.http_port: 43
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 1
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.13 21:46:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.24 16:27:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.24 16:25:40 | 000,000,000 | ---D | M]
[2009.06.20 16:32:39 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Extensions
[2012.04.25 16:51:03 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions
[2012.04.24 16:33:48 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.04.25 16:51:04 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.04.24 16:33:48 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.04.24 16:33:49 | 000,000,000 | ---D | M] ("Biet-O-Matic Firefox Erweiterung") -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{B0D70E72-2FC1-4b9f-A3D4-5921C854D906}
[2012.04.24 16:33:49 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.04.24 16:33:50 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2012.04.24 16:33:50 | 000,000,000 | ---D | M] ("BetterPrivacy") -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2012.04.24 16:33:42 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2012.04.24 16:33:47 | 000,000,000 | ---D | M] (Stealthy) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\stealthyextension@gmail.com
[2012.04.24 16:33:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\stealthyextension@gmail.com\chrome
[2012.04.24 16:33:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\extensions\stealthyextension@gmail.com\components
[2010.05.14 16:01:30 | 000,002,441 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\searchplugins\ixquickde-https.xml
[2010.06.16 11:35:12 | 000,001,718 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mozilla\Firefox\Profiles\hsznmj7j.default\searchplugins\linguee-de-en.xml
[2012.04.24 16:26:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.19 11:15:50 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.04.24 15:37:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012.04.24 16:26:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2012.04.24 16:26:59 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.11.05 09:10:35 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.04.24 15:36:38 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 12:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Programme\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2011.11.05 05:38:54 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.05 05:32:18 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.11.05 05:38:54 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.05 05:38:54 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.05 05:38:54 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.05 05:38:54 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2012.04.22 19:45:27 | 000,442,912 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15218 more lines...
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WG111v3 Smart Wizard.lnk = C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181
O8 - Extra context menu item: &Download by Orbit - res://C:\Programme\Orbitdownloader\orbitmxt.dll/201 File not found
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Programme\Orbitdownloader\orbitmxt.dll/204 File not found
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Programme\Orbitdownloader\orbitmxt.dll/203 File not found
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Programme\Orbitdownloader\orbitmxt.dll/202 File not found
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3CBFAA1-42A9-4AF2-8F1C-70E54D5E0783}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Programme\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.20 16:01:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012.04.25 18:58:00 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\esetsmartinstaller_enu.exe
[2012.04.24 17:37:11 | 000,266,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TweakUI.exe
[2012.04.24 17:37:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Powertoys for Windows XP
[2012.04.24 17:19:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\SUPERAntiSpyware.com
[2012.04.24 17:16:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2012.04.24 17:16:55 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2012.04.24 16:52:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Ottilein\Recent
[2012.04.24 15:54:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MozBackup
[2012.04.24 15:37:47 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2012.04.24 15:37:14 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012.04.24 15:37:13 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012.04.24 15:37:13 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012.04.24 15:37:12 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012.04.24 15:36:27 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2012.04.24 14:54:25 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.04.23 20:16:48 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\OTL.exe
[2012.04.23 19:29:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Malwarebytes
[2012.04.23 19:28:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.04.23 19:28:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.04.23 19:28:54 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.04.23 19:28:53 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.04.23 19:11:15 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.23 16:44:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\7-Zip
[2012.04.22 20:25:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Desktop\LOGFILES
[2012.04.22 20:23:17 | 000,607,260 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\dds.com
[2012.04.22 13:53:43 | 000,335,504 | ---- | C] (BitDefender S.R.L.) -- C:\WINDOWS\System32\drivers\TrufosAlt.sys
[2012.04.22 13:48:40 | 007,396,728 | ---- | C] (BitDefender LLC) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\BDRemovalTool_sirefef_x86.exe
[2012.04.12 14:14:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Desktop\WGV
[2012.04.01 17:39:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\tor
[2012.04.01 17:28:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Vidalia
[2012.03.30 20:27:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Schulaufgaben
[1 C:\Dokumente und Einstellungen\Ottilein\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Ottilein\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.04.26 14:26:55 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.04.26 14:23:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.04.26 14:23:43 | 1072,549,888 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.25 18:59:04 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\esetsmartinstaller_enu.exe
[2012.04.24 17:17:13 | 000,001,642 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.04.24 16:03:53 | 003,219,930 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Firefox 3.6.28 (de) - 2012-04-24.pcv
[2012.04.24 15:54:05 | 000,000,674 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\MozBackup.lnk
[2012.04.24 15:36:38 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012.04.24 15:36:38 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012.04.24 15:36:38 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012.04.24 15:36:38 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012.04.24 15:36:37 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2012.04.23 20:16:50 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\OTL.exe
[2012.04.23 19:28:59 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.23 19:13:24 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.23 16:43:50 | 000,000,954 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Verknüpfung mit 7z920.lnk
[2012.04.23 15:56:57 | 000,335,504 | ---- | M] (BitDefender S.R.L.) -- C:\WINDOWS\System32\drivers\TrufosAlt.sys
[2012.04.22 20:38:31 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\w603ze0t.exe
[2012.04.22 20:23:22 | 000,607,260 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\dds.com
[2012.04.22 20:20:58 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\defogger_reenable
[2012.04.22 19:45:27 | 000,442,912 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012.04.22 16:34:25 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Defogger.exe
[2012.04.22 13:53:04 | 007,396,728 | ---- | M] (BitDefender LLC) -- C:\Dokumente und Einstellungen\Ottilein\Desktop\BDRemovalTool_sirefef_x86.exe
[2012.04.22 12:28:34 | 000,000,245 | -HS- | M] () -- C:\boot.ini
[2012.04.21 14:52:47 | 000,001,622 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Lokale Einstellungen\Anwendungsdaten\RecConfig.xml
[2012.04.12 11:29:43 | 000,477,158 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.04.12 11:29:43 | 000,435,688 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.04.12 11:29:43 | 000,091,336 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.04.12 11:29:43 | 000,068,584 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.04.12 11:21:16 | 000,005,152 | ---- | M] () -- C:\WINDOWS\ouwininit.exe
[2012.04.11 14:12:13 | 072,182,137 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Learn English Listening Skills.mp4
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.04.01 21:09:00 | 000,002,241 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.04.01 14:17:43 | 000,000,311 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\groovedown.settings
[2012.04.01 14:14:56 | 000,186,779 | ---- | M] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\gd.db
[2012.03.28 21:21:32 | 000,021,275 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2 C:\Dokumente und Einstellungen\Ottilein\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Ottilein\Desktop\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.04.24 17:37:10 | 000,160,217 | ---- | C] () -- C:\WINDOWS\System32\PowerToysLicense.rtf
[2012.04.24 17:17:13 | 000,001,642 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.04.24 16:27:07 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2012.04.24 16:03:42 | 003,219,930 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Firefox 3.6.28 (de) - 2012-04-24.pcv
[2012.04.24 15:54:05 | 000,000,674 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\MozBackup.lnk
[2012.04.23 19:28:59 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.23 16:43:50 | 000,000,954 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Verknüpfung mit 7z920.lnk
[2012.04.22 20:38:14 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\w603ze0t.exe
[2012.04.22 20:20:58 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\defogger_reenable
[2012.04.22 16:34:24 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Defogger.exe
[2012.04.11 14:05:23 | 072,182,137 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Desktop\Learn English Listening Skills.mp4
[2012.02.16 07:17:30 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.12.20 19:08:00 | 000,186,779 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\gd.db
[2011.12.20 19:08:00 | 000,000,311 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\groovedown.settings
[2011.12.02 16:46:59 | 000,015,873 | ---- | C] () -- C:\WINDOWS\System32\Inetde.dll
[2011.08.13 14:51:23 | 000,000,020 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2011.05.10 19:17:06 | 000,016,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\UPDDHF.SYS
[2011.05.10 19:17:04 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\TBINF.DLL
[2011.02.10 17:31:31 | 000,136,191 | ---- | C] () -- C:\WINDOWS\System32\flvstreamer-2.1c_win32.exe
[2010.12.31 13:36:34 | 000,028,672 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2010.09.15 15:12:16 | 000,009,330 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Kommagetrennte Werte (DOS).EML
[2010.05.02 11:41:29 | 000,001,622 | ---- | C] () -- C:\Dokumente und Einstellungen\Ottilein\Lokale Einstellungen\Anwendungsdaten\RecConfig.xml
========== LOP Check ==========
[2010.06.13 18:02:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
[2012.01.23 16:55:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2009.08.29 21:43:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2009.12.02 19:30:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2009.12.05 14:29:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2009.12.06 19:40:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2011.02.04 18:24:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverScanner
[2010.04.08 12:12:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Paragon
[2011.08.13 14:50:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PopCap Games
[2011.03.23 21:19:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.03.23 21:20:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence
[2009.06.21 14:14:14 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
[2009.06.21 11:22:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\beSoft
[2009.12.28 19:55:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Canneverbe Limited
[2011.03.07 12:13:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Canon
[2009.12.02 19:57:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\CD-LabelPrint
[2011.12.17 16:45:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\DVDVideoSoft
[2011.03.31 15:32:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.11.22 21:42:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\GrabPro
[2011.05.07 20:21:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\IObit
[2009.09.07 17:13:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\KeePass
[2011.12.20 19:08:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\lang
[2009.12.16 19:03:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Mp3tag
[2011.08.21 15:16:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\MyPhoneExplorer
[2011.05.07 17:36:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Orbit
[2011.05.07 13:17:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\ProgSense
[2009.06.21 14:14:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Uniblue
[2009.06.27 11:04:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Windows Desktop Search
[2009.06.27 11:05:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ottilein\Anwendungsdaten\Windows Search
========== Purity Check ==========
< End of report > --- --- ---
Extras.Txt
OTL Logfile: Code:
OTL Extras logfile created on: 26.04.2012 14:33:38 - Run 2
OTL by OldTimer - Version 3.2.41.0 Folder = C:\Dokumente und Einstellungen\Ottilein\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1022,80 Mb Total Physical Memory | 321,99 Mb Available Physical Memory | 31,48% Memory free
2,40 Gb Paging File | 1,70 Gb Available in Paging File | 70,91% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 57,25 Gb Total Space | 14,69 Gb Free Space | 25,66% Space Free | Partition Type: NTFS
Computer Name: DESKTOP | User Name: Ottilein | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Disabled:SopCast Adver
"C:\Programme\SopCast\SopCast.exe" = C:\Programme\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
"C:\Programme\Cobian Backup 10\cbManager.exe" = C:\Programme\Cobian Backup 10\cbManager.exe:*:Enabled:Cobian Backup 10 Remote Manager -- (Luis Cobian, CobianSoft)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\Orbitdownloader\orbitdm.exe" = C:\Programme\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit
"C:\Programme\Orbitdownloader\orbitnet.exe" = C:\Programme\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit
"C:\Programme\TeamBoard\Draw\drawsrv.exe" = C:\Programme\TeamBoard\Draw\drawsrv.exe:*:Enabled:drawsrv -- ()
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0673654C-5296-453B-9798-B61CD7E03FEB}" = SES Driver
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP640_series" = Canon MP640 series MP Drivers
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C427E746-4EC9-4E3C-AACB-C6BB1F714D7F}" = Uniblue DriverScanner 2009
"{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook-Sicherung für Persönliche Ordner
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F1CB76D8-ABF5-492F-8435-8239B228A2AE}" = Steuer-Spar-Erklärung Selbstständige 2010
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Audacity_is1" = Audacity 1.2.6
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"Canon MP640 series Benutzerregistrierung" = Canon MP640 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CCleaner" = CCleaner (remove only)
"CobBackup10" = Cobian Backup 10
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 4.0
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.08
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Mp3tag" = Mp3tag v2.46a
"MPE" = MyPhoneExplorer
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"nLite_is1" = nLite 1.4.9
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NotenManager Heimversion" = NotenManager Heimversion 3.0
"Revo Uninstaller" = Revo Uninstaller 1.93
"TBUPDDV4" = TeamBoard
"Toolbox English" = Toolbox English
"Tweak UI 2.10" = Tweak UI
"UBCD4Win_is1" = UBCD4Win 3.60
"Uniblue DriverScanner 2009" = Uniblue DriverScanner 2009
"Uninstall_is1" = Uninstall 1.0.0.1
"Update für Notenmanager Heimversion" = Update für Notenmanager Heimversion 3.0
"VLC media player" = VLC media player 1.1.11
"Windows XP Service Pack" = Windows XP Service Pack 3
"xp-AntiSpy" = xp-AntiSpy 3.97-3
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Zattoo4" = Zattoo4 4.0.5
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 14.04.2012 04:24:23 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
Error - 14.04.2012 04:53:13 | Computer Name = DESKTOP | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
erneut. Kontext: Anwendung, SystemIndex Katalog
Error - 17.04.2012 14:01:46 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
Error - 18.04.2012 11:04:41 | Computer Name = DESKTOP | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\OTTILEIN\RECENT\THE NOTTING
HILLBILLIES.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext:
Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)
Error - 18.04.2012 11:04:41 | Computer Name = DESKTOP | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\OTTILEIN\RECENT\THE NOTTING
HILLBILLIES.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext:
Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)
Error - 20.04.2012 12:23:01 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
Error - 22.04.2012 06:23:38 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
Error - 24.04.2012 00:09:43 | Computer Name = DESKTOP | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 24.04.2012 08:14:34 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office Outlook.
Error - 25.04.2012 11:33:45 | Computer Name = DESKTOP | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
[ Cobian Backup Boletus VSC Service Events ]
Error - 10.04.2010 07:41:00 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 09.10.2010 15:00:49 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 12.12.2010 09:59:46 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 21.01.2011 15:53:35 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 03.08.2011 11:16:56 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 04.08.2011 02:40:43 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 04.08.2011 08:39:36 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Deletion of snapshot failed: The requested object does not exist.
Error - 27.08.2011 08:53:00 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 29.10.2011 09:16:36 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Deletion of snapshot failed: The requested object does not exist.
Error - 06.01.2012 10:53:51 | Computer Name = DESKTOP | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Deletion of snapshot failed: The requested object does not exist.
[ OSession Events ]
Error - 28.05.2011 05:09:55 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 4079
seconds with 3420 seconds of active time. This session ended with a crash.
Error - 16.06.2011 04:06:24 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 10715
seconds with 7560 seconds of active time. This session ended with a crash.
Error - 09.08.2011 15:37:53 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 48739
seconds with 8160 seconds of active time. This session ended with a crash.
Error - 10.08.2011 09:21:29 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 19484
seconds with 15420 seconds of active time. This session ended with a crash.
Error - 13.08.2011 04:55:05 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 4476
seconds with 2040 seconds of active time. This session ended with a crash.
Error - 22.01.2012 11:15:38 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 349
seconds with 120 seconds of active time. This session ended with a crash.
Error - 20.02.2012 08:33:27 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 7121
seconds with 480 seconds of active time. This session ended with a crash.
Error - 23.02.2012 09:59:05 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 156
seconds with 0 seconds of active time. This session ended with a crash.
Error - 30.03.2012 14:39:18 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 681
seconds with 360 seconds of active time. This session ended with a crash.
Error - 14.04.2012 04:53:01 | Computer Name = DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1956
seconds with 540 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 24.04.2012 08:54:30 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 24.04.2012 08:54:31 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
Description = Dienst "NMSAccessU" wurde unerwartet beendet. Dies ist bereits 1 Mal
passiert.
Error - 24.04.2012 08:54:31 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
Description = Dienst "Sophos Anti-Virus Statusreporter" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 24.04.2012 08:54:31 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
Description = Dienst "Sophos AutoUpdate Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 25.04.2012 11:21:19 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Cobian
Backup 10 Volume Shadow Copy service.
Error - 25.04.2012 11:21:19 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Cobian Backup 10 Volume Shadow Copy service" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1053
Error - 25.04.2012 11:28:57 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Cobian
Backup 10 Volume Shadow Copy service.
Error - 25.04.2012 11:28:57 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Cobian Backup 10 Volume Shadow Copy service" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1053
Error - 26.04.2012 08:25:51 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Cobian
Backup 10 Volume Shadow Copy service.
Error - 26.04.2012 08:25:51 | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Cobian Backup 10 Volume Shadow Copy service" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1053
< End of report > --- --- ---
Was rätst du mir als nächstes? Kann ich wieder ins Internet, E-Mails verschicken oder sogar Onlinebanking machen, ohne mir Sorgen machen zu müssen oder muss ich die Festplatte doch neu formatieren (falls ja, weißt du mir dazu eine gute Anleitung; hab so etwas noch nie gemacht – WIN XP ohne Partitionierung installieren, weil das IMHO alles noch schwieriger macht; und, wie geht Datensicherung bei infiziertem System? usw.).
Kann ich den esetsmartinstaller_enu löschen bzw. deinstallieren? Welche der in den letzten Tagen für die Überprüfung installierten Programme soll ich überhaupt behalten und mit welcher Einstellung? Oder rätst du mir eher zu anderen Schutzprogrammen?
Hast du noch einen Tipp für mich: es läuft alles ziemlich langsam auf meinem PC (ca. 8-9 Jahre alt). Videos, z.B. von YouTube, ruckeln grundsätzlich seit etwa einem Jahr. Liegt das an der schwachen Grafikkarte? Hab halt im Lauf der Jahre auch einige Sachen installiert, die ich dann gar nicht oft verwendet habe oder von denen ich gar nicht mehr weiß, wozu sie gut sind. Da sind wohl einige Leichen dabei.
Der Umstieg auf das neueste Firefox hat das Laden der Internetseiten auch verlangsamt. Andererseits - muss mir wohl doch bald mal ein neues Gerät zulegen.
Nochmals vielen herzlichen Dank für die guten Anleitungen und die gründliche Suche nach Schädlingen! Ich finde es sehr bemerkenswert, wenn Menschen in ihrer Freizeit ihr Wissen mit anderen teilen.
Gruß
ottilie |