| elphie_11 | 24.07.2012 18:21 |
OTL Logfile: Code:
OTL Extras logfile created on: 24.07.2012 18:47:20 - Run 1
OTL by OldTimer - Version 3.2.54.1 Folder = C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,75 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 52,65% Memory free
3,60 Gb Paging File | 2,93 Gb Available in Paging File | 81,32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18,09 Gb Total Space | 0,38 Gb Free Space | 2,08% Space Free | Partition Type: NTFS
Drive D: | 58,59 Gb Total Space | 6,66 Gb Free Space | 11,37% Space Free | Partition Type: NTFS
Computer Name: LS-ZIMMER | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [SCHLECKER Foto Digital Service] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\SCHLECKER Foto Digital Service.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\AVG\AVG10\avgmfapx.exe" = C:\Programme\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG-Installationsprogramm -- (AVG Technologies CZ, s.r.o.)
"C:\Programme\AVG\AVG10\avgdiagex.exe" = C:\Programme\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnose 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Programme\AVG\AVG10\avgnsx.exe" = C:\Programme\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Programme\AVG\AVG10\avgemcx.exe" = C:\Programme\AVG\AVG10\avgemcx.exe:*:Enabled:Personal eMail-Scanner -- (AVG Technologies CZ, s.r.o.)
"C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{084709F7-38C5-4609-B55F-2417939315EB}" = Adobe Premiere Pro
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32
"{2792F12C-3515-4D69-8083-B557AF35F06F}" = LightScribe 1.4.89.1
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7240A69A-AC53-46A1-9039-1281DDBBE452}" = Cisco AnyConnect VPN Client
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11738453}" = Burger Shop 2
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUS_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_PROPLUS_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROPLUS_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92B94569-6683-4617-8C54-EB27A1B51B30}" = GTAIII
"{94118D5F-2D5D-4BF5-9F84-11FB8A97B566}" = 2d3 SteadyMove for Adobe Premiere Pro
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C8FC7066-4457-4365-9BDF-4E439BF703C8}" = AVG 2011
"{DA64E459-FBF3-4A9C-A3E8-FD0240C4E611}" = Dealio Toolbar v4.5
"{DB90FF25-9932-48F2-B643-1802F1864FAF}" = AVG 2011
"{E533E637-FB3E-4F28-8B18-449CC9AB7235}" = AVG 2011
"Activision_THPS2UninstallKey" = Tony Hawk's Pro Skater 2
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Any Video Converter Professional_is1" = Any Video Converter Professional 3.2.3
"ASRock IES_is1" = ASRock IES v2.0.69
"ASRock OC Tuner_is1" = ASRock OC Tuner v2.3.91
"AVG" = AVG 2011
"Burger Shop 2™" = Burger Shop 2™
"DivX Setup.divx.com" = DivX-Setup
"Free FLV Converter_is1" = Free FLV Converter V 6.93.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OJOsoft Total Video Converter_is1" = OJOsoft Total Video Converter
"Pharao" = Pharao
"PROPLUS" = Microsoft Office Professional Plus 2007
"RealPlayer 12.0" = RealPlayer
"SCHLECKER Foto Digital Service" = SCHLECKER Foto Digital Service
"Uptodown_EN Toolbar" = Uptodown EN Toolbar
"VLC media player" = VLC media player 1.1.5
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WinZip" = WinZip
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 03.07.2012 09:27:25 | Computer Name = LS-ZIMMER | Source = vpndownloader | ID = 67108866
Description =
Error - 17.07.2012 09:45:49 | Computer Name = LS-ZIMMER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4448,
fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
Error - 20.07.2012 07:55:30 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application outlook.exe, version 12.0.6661.5003, stamp 4fa2a9e1,
faulting module unknown, version 0.0.0.0, stamp 00000000, debug? 0, fault address
0x3be70b7b.
Error - 24.07.2012 07:53:20 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 7040
Description = Der Suchdienst hat beschädigte Datendateien im Index erkannt. Der
Dienst versucht, dieses Problem durch Neuerstellung des Index automatisch zu beheben.
Kontext:
Windows Anwendung, SystemIndex Katalog Details: 0xc0041801 (0xc0041801)
Error - 24.07.2012 07:53:21 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 3029
Description = Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext:
Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindex kann nicht gelesen
werden. (0xc0041800)
Error - 24.07.2012 07:53:21 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 3028
Description = Das Gatherer-Objekt kann nicht initialisiert werden. Kontext: Windows
Anwendung, SystemIndex Katalog Details: Der Inhaltsindex kann nicht gelesen werden.
(0xc0041800)
Error - 24.07.2012 07:53:21 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 3058
Description = Die Anwendung kann nicht initialisiert werden. Kontext: Windows Anwendung
Details:
Der
Inhaltsindex kann nicht gelesen werden. (0xc0041800)
Error - 24.07.2012 08:32:35 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
erneut. Kontext: Anwendung, SystemIndex Katalog
Error - 24.07.2012 08:38:49 | Computer Name = LS-ZIMMER | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
erneut. Kontext: Anwendung, SystemIndex Katalog
Error - 24.07.2012 12:26:03 | Computer Name = LS-ZIMMER | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.54.1, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
[ Cisco AnyConnect VPN Client Events ]
Error - 24.07.2012 11:25:06 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CChangeRouteHelper::SetRouteTable File: .\ChangeRouteHelper.cpp
Line:
225 Invoked Function: AddRouteChange Return Code: -33095667 (0xFE07000D) Description:
ROUTETABLE_ERROR_CREATEIPFORWARDENTRY_FAILED
Error - 24.07.2012 11:25:06 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CFilterXP2KImpl::EnableFilters File: .\FilterXP2KImpl.cpp
Line:
563 Invoked Function: PfBindInterfaceToIPAddress Return Code: 87 (0x00000057) Description:
Falscher Parameter.
Error - 24.07.2012 11:55:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTlsProtocol::OnSocketReadComplete File: .\TlsProtocol.cpp
Line:
698 Invoked Function: CSocketTransport::readSocket Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN
Error - 24.07.2012 11:55:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CCstpProtocol::OnTunnelReadComplete File: .\CstpProtocol.cpp
Line:
1103 Invoked Function: CSslProtocol::OnTunnelReadComplete Return Code: -31522800
(0xFE1F0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN
Error - 24.07.2012 11:55:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTunnelStateMgr::OnTunnelReadComplete File: .\TunnelStateMgr.cpp
Line:
1359 Invoked Function: ITunnelProtocol::readTunnel Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN callback
Error - 24.07.2012 11:55:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTlsTunnelMgr::OnTunnelReadComplete File: .\TunnelMgr.cpp
Line:
1118 Invoked Function: CTunnelStateMgr::readTunnel Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN callback
Error - 24.07.2012 12:25:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTlsProtocol::OnSocketReadComplete File: .\TlsProtocol.cpp
Line:
698 Invoked Function: CSocketTransport::readSocket Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN
Error - 24.07.2012 12:25:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CCstpProtocol::OnTunnelReadComplete File: .\CstpProtocol.cpp
Line:
1103 Invoked Function: CSslProtocol::OnTunnelReadComplete Return Code: -31522800
(0xFE1F0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN
Error - 24.07.2012 12:25:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTunnelStateMgr::OnTunnelReadComplete File: .\TunnelStateMgr.cpp
Line:
1359 Invoked Function: ITunnelProtocol::readTunnel Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN callback
Error - 24.07.2012 12:25:03 | Computer Name = LS-ZIMMER | Source = vpnagent | ID = 67108866
Description = Function: CTlsTunnelMgr::OnTunnelReadComplete File: .\TunnelMgr.cpp
Line:
1118 Invoked Function: CTunnelStateMgr::readTunnel Return Code: -31522800 (0xFE1F0010)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN callback
[ OSession Events ]
Error - 16.11.2010 11:56:15 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1040
seconds with 420 seconds of active time. This session ended with a crash.
Error - 16.11.2010 11:56:57 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 31
seconds with 0 seconds of active time. This session ended with a crash.
Error - 16.09.2011 15:42:22 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16715
seconds with 2880 seconds of active time. This session ended with a crash.
Error - 16.09.2011 15:42:32 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 0
seconds with 0 seconds of active time. This session ended with a crash.
Error - 16.09.2011 15:43:11 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 36
seconds with 0 seconds of active time. This session ended with a crash.
Error - 05.06.2012 14:08:17 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 5
seconds with 0 seconds of active time. This session ended with a crash.
Error - 17.07.2012 09:29:10 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6661.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 665
seconds with 120 seconds of active time. This session ended with a crash.
Error - 20.07.2012 07:55:20 | Computer Name = LS-ZIMMER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6661.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 21
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 24.07.2012 07:27:40 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DNS-Client" ist vom Dienst "TCP/IP-Protokolltreiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 24.07.2012 07:27:40 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "TCP/IP-NetBIOS-Hilfsprogramm" ist vom Dienst "AFD" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 24.07.2012 07:27:40 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Cisco AnyConnect VPN Agent" ist vom Dienst "TCP/IP-Protokolltreiber"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 24.07.2012 07:27:40 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "IPSEC-Dienste" ist vom Dienst "IPSEC-Treiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 24.07.2012 07:27:40 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD AmdPPM Avgldx86 Avgmfx86 Avgtdix Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
Error - 24.07.2012 07:32:58 | Computer Name = LS-ZIMMER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 24.07.2012 07:53:26 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
Fehler beendet: 2147749155 (0x80040D23).
Error - 24.07.2012 07:53:33 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Windows
Search.
Error - 24.07.2012 07:53:33 | Computer Name = LS-ZIMMER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1053" aufgetreten, als der Dienst "WSearch"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error - 24.07.2012 07:53:33 | Computer Name = LS-ZIMMER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
gestartet: %%1053
< End of report >
--- --- ---
OTL Logfile: Code:
OTL logfile created on: 24.07.2012 18:47:20 - Run 1
OTL by OldTimer - Version 3.2.54.1 Folder = C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,75 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 52,65% Memory free
3,60 Gb Paging File | 2,93 Gb Available in Paging File | 81,32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18,09 Gb Total Space | 0,38 Gb Free Space | 2,08% Space Free | Partition Type: NTFS
Drive D: | 58,59 Gb Total Space | 6,66 Gb Free Space | 11,37% Space Free | Partition Type: NTFS
Computer Name: LS-ZIMMER | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Programme\AVG Secure Search\vprot.exe ()
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnui.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Programme\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\ASRock Utility\IES\AsrIes.exe (ASRock Incorporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
========== Modules (No Company Name) ==========
MOD - C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
MOD - C:\Programme\AVG Secure Search\vprot.exe ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
========== Win32 Services (SafeList) ==========
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (vToolbarUpdater11.2.0) -- C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AVGIDSAgent) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVG Security Toolbar Service) -- C:\Programme\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (avgwd) -- C:\Programme\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (IesDrv) -- C:\WINDOWS\system32\Drivers\IesDrv.sys File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (vpnva) -- C:\WINDOWS\system32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\drivers\AVGIDSEH.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (VIAHdAudAddService) -- C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (AMBFilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (MonFilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (nvgts) -- C:\WINDOWS\system32\drivers\nvgts.sys (NVIDIA Corporation)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {CCC7A320-B3CA-4199-B1A6-9F516DD69829}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\URLSearchHook: {40f5f417-32bb-4296-9446-c1e0094e7d82} - C:\Programme\Uptodown_EN\prxtbUpt0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{42915917-EC85-4BC7-AA56-36FF601DBAA2}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=867034&p={searchTerms}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={A6D0305E-2281-4E95-B7CA-4E8E3E419B17}&mid=fcfc09f0276147d68bb9d16c64979b0f-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&pr=fr&d=2011-12-12 12:34:04&v=10.0.0.7&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "www.facebook.com"
FF - prefs.js..extensions.enabledItems: dealio@mybrowserbar.com:4.5
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.5
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1423
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {40f5f417-32bb-4296-9446-c1e0094e7d82}:3.3.3.2
FF - prefs.js..extensions.enabledItems: avg@toolbar:11.1.0.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}:6.0.32
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7Bba32a25d-0f30-4e01-8bf7-d7e8d5db2e2d%7D&mid=fcfc09f0276147d68bb9d16c64979b0f-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=11.1.0.12&lang=de&pr=fr&d=2011-12-12%2012%3A34%3A04&sap=ku&q="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666: c:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Programme\AVG\AVG10\Firefox4\ [2012.02.03 14:42:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.08.22 22:09:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\11.1.0.12\ [2012.07.10 11:29:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.03.21 19:05:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.05.05 22:13:24 | 000,000,000 | ---D | M]
[2010.11.16 11:59:25 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Mozilla\Extensions
[2012.07.24 13:07:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Mozilla\Firefox\Profiles\fn4l09vw.default\extensions
[2011.05.19 17:53:13 | 000,000,000 | ---D | M] (Uptodown EN Community Toolbar) -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Mozilla\Firefox\Profiles\fn4l09vw.default\extensions\{40f5f417-32bb-4296-9446-c1e0094e7d82}
[2011.05.19 17:53:12 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Mozilla\Firefox\Profiles\fn4l09vw.default\extensions\engine@conduit.com
[2012.07.24 11:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.04.01 18:11:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012.05.05 22:13:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}
[2012.07.10 11:29:11 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\ANWENDUNGSDATEN\AVG SECURE SEARCH\11.1.0.12
[2012.02.03 14:42:02 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAMME\AVG\AVG10\FIREFOX4
[2011.07.08 18:39:37 | 000,000,000 | ---D | M] (Dealio Toolbar) -- C:\PROGRAMME\DEALIO TOOLBAR\FF
[2011.07.08 18:39:36 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAMME\GEMEINSAME DATEIEN\SPIGOT\WTXPCOM
[2012.05.05 22:13:09 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.09.04 14:55:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.10 11:28:56 | 000,003,767 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\avg-secure-search.xml
[2011.09.04 14:55:24 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.04 14:55:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.04 14:55:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.04 14:55:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2001.08.18 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Uptodown EN Toolbar) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - C:\Programme\Uptodown_EN\prxtbUpt0.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Uptodown EN Toolbar) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - C:\Programme\Uptodown_EN\prxtbUpt0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Uptodown EN Toolbar) - {40F5F417-32BB-4296-9446-C1E0094E7D82} - C:\Programme\Uptodown_EN\prxtbUpt0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [ROC_roc_dec12] C:\Programme\AVG Secure Search\ROC_roc_dec12.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] C:\Programme\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [ASRockIES] C:\Programme\ASRock Utility\IES\AsrIes.exe (ASRock Incorporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Lisa\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8ADE2897-0440-4E9F-B8CA-10C1534510B3}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6328179-7F8F-46D3-AA3B-6B9EFDC719B0}: Domain = rrze.uni-erlangen.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6328179-7F8F-46D3-AA3B-6B9EFDC719B0}: NameServer = 131.188.0.10,131.188.0.11
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.11.16 09:03:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{646084a6-6294-11e0-a8d6-0025227372fc}\Shell - "" = AutoRun
O33 - MountPoints2\{646084a6-6294-11e0-a8d6-0025227372fc}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{646084a6-6294-11e0-a8d6-0025227372fc}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Lisa^Startmenü^Programme^Autostart^0.08080040199456462.exe.lnk - - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Lisa^Startmenü^Programme^Autostart^0.46830715126752076.exe.lnk - - File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012.07.24 14:01:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Malwarebytes
[2012.07.24 14:01:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.07.24 14:01:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.07.24 14:01:44 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.24 14:01:44 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.07.12 12:04:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.03 15:28:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Anwendungsdaten\Cisco
[2012.07.03 15:27:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Cisco
[2012.07.03 15:27:38 | 000,000,000 | ---D | C] -- C:\Programme\Cisco
[2012.07.03 15:27:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cisco
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.07.24 18:22:55 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Desktop\Microsoft Office Outlook 2007.lnk
[2012.07.24 17:01:59 | 000,212,641 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.07.24 17:01:44 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.24 17:01:40 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2000478354-838170752-839522115-1003.job
[2012.07.24 17:01:39 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2000478354-838170752-839522115-1004.job
[2012.07.24 17:01:17 | 000,002,048 | ---- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.24 14:01:46 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.24 13:35:34 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2000478354-838170752-839522115-1004.job
[2012.07.24 13:06:28 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.07.24 12:50:22 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\z7_0ytr.pad
[2012.07.24 12:49:24 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2000478354-838170752-839522115-1003.job
[2012.07.24 11:37:44 | 102,076,494 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012.07.23 15:43:21 | 000,474,940 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\xMinipizzax - Don't You Know_.pdf
[2012.07.23 15:41:17 | 000,311,597 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\heartskippedabeat13 - It's Always Today.pdf
[2012.07.22 17:51:52 | 000,096,059 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Airport City Liste.pdf
[2012.07.17 21:53:59 | 000,577,657 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Schlafstörungen.pdf
[2012.07.17 15:55:03 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.07.17 15:55:02 | 000,089,088 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.16 14:45:11 | 000,017,083 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2012.07.14 20:51:22 | 000,313,399 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\MsCharlieFabray - A Forbidden Temptation.pdf
[2012.07.12 17:59:32 | 000,265,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.07.12 12:05:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.07.05 13:31:52 | 000,287,405 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Zusatzfolien fur Interessierte.pdf
[2012.07.04 20:00:45 | 000,067,162 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\uetraeger_1AA7F5CD3C5EF8D22033CBB3F96E17D4.cit-prod-tomcat3.pdf
[2012.07.03 15:27:40 | 000,000,928 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Desktop\Cisco AnyConnect VPN Client.lnk
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.06.24 19:58:58 | 000,392,482 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\MsCharlieFabray - Do You Remember_.pdf
[2012.06.24 19:58:15 | 000,553,641 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\ChiaraAgron - Our Secret Garden.pdf
[2012.06.24 19:57:06 | 000,323,441 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\jomarch05 - Don't Ask, Don't Tell.pdf
[2012.06.24 19:56:17 | 000,348,076 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\dance-tilyou'redead - Fellow Pond Scum.pdf
[2012.06.24 19:54:39 | 000,537,699 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\ALittleLion - The World Through New Eyes.pdf
[2012.06.24 19:52:46 | 000,527,637 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\K'sChoiceofAFI - Someone I've Been Missing, The Better Half of Me.pdf
[2012.06.24 19:51:58 | 000,326,881 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\homosaurus-rex - When Everything's Made To Be Broken.pdf
[2012.06.24 19:51:09 | 000,462,186 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\carebear2211 - Strangers.pdf
[2012.06.24 19:50:01 | 000,768,721 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\KW05 - A Heart Within the Bad.pdf
[2012.06.24 19:48:38 | 000,479,414 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\K'sChoiceofAFI - Converge.pdf
[2012.06.24 19:46:35 | 000,301,815 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\overbiter - Give Em' Hell Kid.pdf
[2012.06.24 19:44:17 | 000,241,732 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\writting is love - Suddenly I See.pdf
[2012.06.24 19:42:52 | 000,268,374 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Faberry's-Knight - Lips of an Angel.pdf
[2012.06.24 19:41:23 | 000,578,923 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Whispering Molly - Leave the Cannoli, Take the Girl.pdf
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.07.24 14:01:46 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.24 12:45:57 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\z7_0ytr.pad
[2012.07.23 15:43:20 | 000,474,940 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\xMinipizzax - Don't You Know_.pdf
[2012.07.23 15:41:17 | 000,311,597 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\heartskippedabeat13 - It's Always Today.pdf
[2012.07.22 17:51:52 | 000,096,059 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Airport City Liste.pdf
[2012.07.17 21:52:03 | 000,577,657 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Schlafstörungen.pdf
[2012.07.14 20:51:21 | 000,313,399 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\MsCharlieFabray - A Forbidden Temptation.pdf
[2012.07.05 13:31:51 | 000,287,405 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Zusatzfolien fur Interessierte.pdf
[2012.07.04 20:00:45 | 000,067,162 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\uetraeger_1AA7F5CD3C5EF8D22033CBB3F96E17D4.cit-prod-tomcat3.pdf
[2012.07.03 15:50:09 | 000,000,928 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Desktop\Cisco AnyConnect VPN Client.lnk
[2012.06.24 19:58:58 | 000,392,482 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\MsCharlieFabray - Do You Remember_.pdf
[2012.06.24 19:58:14 | 000,553,641 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\ChiaraAgron - Our Secret Garden.pdf
[2012.06.24 19:57:06 | 000,323,441 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\jomarch05 - Don't Ask, Don't Tell.pdf
[2012.06.24 19:56:17 | 000,348,076 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\dance-tilyou'redead - Fellow Pond Scum.pdf
[2012.06.24 19:54:39 | 000,537,699 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\ALittleLion - The World Through New Eyes.pdf
[2012.06.24 19:52:45 | 000,527,637 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\K'sChoiceofAFI - Someone I've Been Missing, The Better Half of Me.pdf
[2012.06.24 19:51:58 | 000,326,881 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\homosaurus-rex - When Everything's Made To Be Broken.pdf
[2012.06.24 19:51:08 | 000,462,186 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\carebear2211 - Strangers.pdf
[2012.06.24 19:49:59 | 000,768,721 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\KW05 - A Heart Within the Bad.pdf
[2012.06.24 19:48:38 | 000,479,414 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\K'sChoiceofAFI - Converge.pdf
[2012.06.24 19:46:35 | 000,301,815 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\overbiter - Give Em' Hell Kid.pdf
[2012.06.24 19:44:16 | 000,241,732 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\writting is love - Suddenly I See.pdf
[2012.06.24 19:42:52 | 000,268,374 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Faberry's-Knight - Lips of an Angel.pdf
[2012.06.24 19:41:22 | 000,578,923 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Eigene Dateien\Whispering Molly - Leave the Cannoli, Take the Girl.pdf
[2012.06.11 14:26:46 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\PUTTY.RND
[2012.02.15 18:59:37 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.05.28 19:40:14 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.05.15 21:35:26 | 000,245,504 | ---- | C] () -- C:\WINDOWS\PI.EXE
[2011.03.06 18:02:19 | 000,000,020 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2011.01.31 16:49:57 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.01.30 18:51:58 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2010.11.29 19:58:44 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2010.11.29 19:58:44 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2010.11.29 19:58:44 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2010.11.29 19:44:43 | 000,000,300 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2010.11.16 21:01:44 | 000,017,083 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2010.11.16 18:30:53 | 000,000,127 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\default.pls
[2010.11.16 18:29:18 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.11.16 18:12:11 | 000,089,088 | ---- | C] () -- C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.16 12:19:18 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010.11.16 11:59:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.11.16 10:02:22 | 000,003,948 | ---- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin
[2010.11.16 09:05:00 | 000,002,048 | ---- | C] () -- C:\WINDOWS\bootstat.dat
[2010.11.16 09:00:57 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.11.16 08:55:07 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.11.16 08:54:07 | 000,265,416 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
========== LOP Check ==========
[2012.07.10 11:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search
[2010.11.16 11:22:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Security Toolbar
[2011.11.14 22:38:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG10
[2011.04.01 17:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.07.03 15:27:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cisco
[2010.11.16 11:19:48 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2012.04.23 19:18:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Farm Fishes
[2011.05.21 15:14:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
[2012.03.15 15:08:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2012.02.20 00:11:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2011.07.24 18:18:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Amazon
[2011.05.19 17:54:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\AnvSoft
[2012.01.02 20:25:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\AVG Secure Search
[2010.11.16 11:22:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\AVG10
[2011.04.01 17:57:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Babylon
[2011.11.14 22:38:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Byech
[2010.11.20 01:20:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dealio
[2012.07.24 17:03:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Dropbox
[2010.11.20 00:43:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\FreeFLVConverter
[2012.07.24 12:46:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\PriceGong
[2012.06.18 17:34:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\ratiopharm
[2011.11.14 16:22:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Riiv
[2010.11.16 15:51:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Windows Desktop Search
[2010.11.16 21:06:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Windows Search
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2010.11.16 14:47:08 | 000,000,000 | -H-D | M] -- C:\$AVG
[2011.10.30 19:32:24 | 000,000,000 | ---D | M] -- C:\BLUEBYTE
[2012.07.12 17:59:28 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2010.11.24 18:14:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2012.07.17 16:24:28 | 000,000,000 | ---D | M] -- C:\Download
[2012.05.07 18:02:50 | 000,000,000 | ---D | M] -- C:\Foto
[2012.05.09 22:06:59 | 000,000,000 | -HSD | M] -- C:\found.000
[2010.11.16 14:58:50 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2012.07.24 17:02:23 | 000,000,000 | R--D | M] -- C:\Programme
[2010.11.16 12:01:39 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011.10.29 18:21:42 | 000,000,000 | ---D | M] -- C:\SIEDLER2
[2010.11.29 19:45:04 | 000,000,000 | ---D | M] -- C:\Sierra
[2010.11.16 09:06:06 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.06.15 17:28:34 | 000,000,000 | ---D | M] -- C:\Temp
[2012.05.07 18:10:36 | 000,000,000 | ---D | M] -- C:\Uni
[2012.07.24 13:46:42 | 000,000,000 | ---D | M] -- C:\WINDOWS
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: LOCALAPPDATA
< %systemroot%\*. /mp /s >
< MD5 for: AGP440.SYS >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.11.16 12:18:58 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.11.16 12:18:58 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.11.16 12:18:58 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.11.16 12:18:58 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: EXPLORER.EXE >
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
< MD5 for: NETLOGON.DLL >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
< MD5 for: NVGTS.SYS >
[2008.08.18 19:54:24 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=EA98BFE4931BD13D747D647C1859796E -- C:\WINDOWS\system32\drivers\nvgts.sys
< MD5 for: SCECLI.DLL >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
< MD5 for: USER32.DLL >
[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
< MD5 for: USERINIT.EXE >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
< MD5 for: WINLOGON.EXE >
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2001.08.18 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.18 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
[2010.11.16 09:53:22 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.11.16 09:53:22 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.11.16 09:53:22 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< %USERPROFILE%\*.* >
[2012.06.12 18:52:12 | 000,000,127 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\default.pls
[2012.07.24 14:41:37 | 009,699,328 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\ntuser.dat
[2012.07.24 18:48:52 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\Lisa\ntuser.dat.LOG
[2012.07.21 18:26:11 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Lisa\ntuser.ini
[2012.06.11 14:36:51 | 000,000,600 | ---- | M] () -- C:\Dokumente und Einstellungen\Lisa\PUTTY.RND
< %USERPROFILE%\Local Settings\Temp\*.exe >
< %USERPROFILE%\Local Settings\Temp\*.dll >
< %USERPROFILE%\Application Data\*.exe >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2012.06.13 15:55:13 | 001,866,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
< >
========== Alternate Data Streams ==========
@Alternate Data Stream - 88 bytes -> C:\Dokumente und Einstellungen\Lisa\Desktop\Verknüpfung mit S2.EXE.pif:SummaryInformation
@Alternate Data Stream - 142 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:661DFA1C
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:74B502CB
@Alternate Data Stream - 118 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B55AADB5
< End of report >
--- --- ---
Vielen Dank |
