| leonardo8 | 24.03.2013 14:18 |
Das laden der Reparaturkonsole dauerte ziemlich lang, lief dann über Nacht.
Hier die gewünschten logs:
Log Combofix:
--------------------------------------------------------------------------------------------------------------Combofix Logfile: Code:
ComboFix 13-03-23.01 - ***** 23.03.2013 22:31:39.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2014.1330 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\*****\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\*****\GoToAssistDownloadHelper.exe
c:\windows\IsUn0407.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-02-23 bis 2013-03-23 ))))))))))))))))))))))))))))))
.
.
2013-03-23 09:09 . 2013-03-23 09:09 -------- d-----w- c:\dokumente und einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\DoNotTrackPlus
2013-03-23 09:09 . 2013-03-23 20:31 -------- d-----w- c:\dokumente und einstellungen\*****\Anwendungsdaten\CallingID
2013-03-23 09:09 . 2013-03-23 09:09 -------- d-----w- c:\dokumente und einstellungen\*****\Anwendungsdaten\AskToolbar
2013-03-23 08:53 . 2013-03-23 08:53 -------- d-----w- c:\dokumente und einstellungen\*****\Anwendungsdaten\Avira
2013-03-23 08:36 . 2013-03-23 08:36 -------- d-----w- C:\Firefox
2013-03-23 08:36 . 2013-03-23 08:37 -------- d-----w- c:\programme\Ask.com
2013-03-23 08:36 . 2013-03-23 20:50 -------- d-----w- c:\dokumente und einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\AskToolbar
2013-03-23 08:36 . 2013-03-23 08:36 -------- d-----w- c:\dokumente und einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\APN
2013-03-23 08:34 . 2013-03-23 08:02 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-23 08:34 . 2013-03-23 08:02 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-23 08:34 . 2013-03-23 08:02 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-23 08:33 . 2013-03-23 08:33 -------- d-----w- c:\programme\Avira
2013-03-23 08:33 . 2013-03-23 08:33 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira
2013-03-21 08:15 . 2013-02-12 00:32 12928 ------w- c:\windows\system32\dllcache\usb8023.sys
2013-03-21 08:15 . 2013-02-12 00:32 12928 ------w- c:\windows\system32\dllcache\usb8023x.sys
2013-03-16 17:42 . 2013-03-23 08:48 446016 ----a-w- c:\windows\system32\drivers\etc\hosts.tmp
2013-03-16 11:02 . 2013-03-16 11:23 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2013-03-16 11:02 . 2013-03-16 11:04 -------- d-----w- c:\programme\Spybot - Search & Destroy
2013-03-15 09:37 . 2013-03-15 09:37 -------- d-----w- c:\programme\LMPlus 3.0
2013-03-12 18:21 . 2013-03-12 18:21 98304 --sha-r- c:\windows\system32\wbdbasef.dll
2013-02-22 16:32 . 2013-03-15 08:44 -------- d-----w- c:\dokumente und einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\FreePDF_XP
2013-02-22 13:31 . 2013-02-22 13:33 -------- d-----w- C:\FreePDF
2013-02-22 12:56 . 2010-06-17 20:56 45056 ----a-w- c:\windows\system32\unredmon.exe
2013-02-22 12:55 . 2010-06-17 20:56 116224 ----a-w- c:\windows\system32\redmonnt.dll
2013-02-22 12:55 . 2013-02-22 12:55 -------- d-----w- c:\programme\FreePDF_XP
2013-02-22 12:55 . 2013-02-22 12:55 -------- d-----w- c:\dokumente und einstellungen\*****\Anwendungsdaten\FreePDF
2013-02-22 12:54 . 2013-02-22 12:54 -------- d-----w- c:\programme\gs
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-14 08:19 . 2012-04-13 07:43 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-14 08:19 . 2011-06-20 13:31 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-13 15:17 . 2013-02-13 15:17 53248 ----a-r- c:\dokumente und einstellungen\*****\Anwendungsdaten\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-02-13 15:16 . 2013-02-13 15:16 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2013-02-12 00:32 . 2008-09-27 16:24 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-20 19:07 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-05 19:56 . 2004-08-20 19:07 916480 ----a-w- c:\windows\system32\wininet.dll
2013-02-05 19:56 . 2004-08-20 19:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-02-05 19:56 . 2004-08-20 19:07 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-02-05 05:53 . 2004-08-20 19:07 385024 ----a-w- c:\windows\system32\html.iec
2013-01-26 03:55 . 2004-08-20 19:07 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-07 07:24 . 2004-08-20 19:07 2151424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:24 . 2004-08-04 00:50 2030080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2004-08-20 19:07 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2004-08-20 19:07 1297920 ----a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2004-08-20 19:07 148992 ----a-w- c:\windows\system32\mpg2splt.ax
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\programme\Ask.com\GenericAskToolbar.dll" [2013-03-10 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-26 8445952]
"nwiz"="nwiz.exe" [2007-04-26 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-26 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]
"type32"="c:\programme\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"IntelliPoint"="c:\programme\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-09 57393]
"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-09 40960]
"SetDefPrt"="c:\programme\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 49152]
"ControlCenter2.0"="c:\programme\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 864256]
"TrueImageMonitor.exe"="c:\programme\Acronis\TrueImageEchoServer\TrueImageMonitor.exe" [2007-11-12 1299240]
"AcronisTimounterMonitor"="c:\programme\Acronis\TrueImageEchoServer\TimounterMonitor.exe" [2007-11-12 886600]
"Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2007-11-12 136472]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\programme\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"EvtMgr6"="c:\programme\Logitech\SetPointP\SetPoint.exe" [2012-11-04 1851192]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"ApnUpdater"="c:\programme\Ask.com\Updater\Updater.exe" [2013-03-10 1644680]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2013-03-23 385248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"swg"="c:\programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-06-25 171448]
.
c:\dokumente und einstellungen\*****\Startmenü\Programme\Autostart\
CleanupNortelVPN.bat [2010-7-7 740]
LMplus Internetagent.lnk - c:\lmplus\LMIAGENT.EXE [2013-2-9 31680]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Privat-Prog Pro Printer.lnk - c:\programme\Privat-Prog\Pro Printer\autosrv.exe [2012-3-23 155648]
Lexware Info Service.lnk - c:\programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe [2007-1-30 2732584]
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe [2007-7-18 845584]
Windows Search.lnk - c:\programme\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2012-10-01 07:22 66360 ----a-w- c:\programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Privat-Prog\\Pro Printer\\AmaPrt.exe"=
"c:\\Programme\\Java\\jre1.6.0_06\\bin\\javaw.exe"=
"c:\\Programme\\Acronis\\TrueImageEchoServer\\TrueImage.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programme\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9876:TCP"= 9876:TCP:Privat-Prog pro Printer
"18245:TCP"= 18245:TCP:HST Remote Control Tool
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [23.03.2013 09:34 36552]
R2 Privat-ProgProPrinter;Privat-ProgProPrinter;c:\programme\Privat-Prog\Pro Printer\Mainsrv.exe [23.03.2012 17:09 454656]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [23.03.2013 09:34 86752]
R2 GenPort;GenPort;c:\windows\system32\drivers\genport.sys [10.08.2008 13:06 7104]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [13.02.2013 16:16 12216]
R3 ElgTaDrv;Funkwerk USB Device Driver;c:\windows\system32\drivers\ElgTaDrv.sys [22.06.2008 17:36 72704]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [16.06.2008 04:20 41216]
S3 glancedrv;glancedrv;c:\windows\system32\drivers\glancedrv.sys [16.04.2010 14:00 34080]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\3.0.318\McCHSvc.exe [05.02.2013 16:48 235216]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06.11.2007 21:22 34064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-03-14 08:41 1629648 ----a-w- c:\programme\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 08:19]
.
2013-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-07-24 16:56]
.
2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-07-24 16:56]
.
2013-03-23 c:\windows\Tasks\Jdmhejm.job
- c:\windows\system32\wbdbasef.dll [2013-03-12 18:21]
.
2013-03-23 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programme\Ask.com\UpdateTask.exe [2013-03-10 22:38]
.
2013-03-23 c:\windows\Tasks\User_Feed_Synchronization-{4021FA46-724E-46FE-AD04-08850B5AD25E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
uInternet Connection Wizard,ShellNext = hxxp://www.fujitsu-siemens.de/
IE: Nach Microsoft E&xel exportieren - c:\progra~1\Office\Office12\EXCEL.EXE/3000
Trusted Zone: *Privat-Progvista.de
Trusted Zone: Privat-Prog.com
Trusted Zone: Privat-Prog.com\diagnostic
Trusted Zone: Privat-Prog.net
Trusted Zone: Privat-Prog.net\sbc
Trusted Zone: Privat-Progcruise.com
Trusted Zone: Privat-Progcruise.com\*
Trusted Zone: Privat-Progferry.com
Trusted Zone: Privat-Progferry.com\*
Trusted Zone: Privat-Progproprinter.com
Trusted Zone: Privat-Progproweb.com
Trusted Zone: Privat-Progproweb.com\*
Trusted Zone: Privat-Progvista.com
Trusted Zone: Privat-Progvista.com\*
Trusted Zone: Privat-Progvista.de
Trusted Zone: Privat-Progvista.de\www
Trusted Zone: portevo.de
Trusted Zone: portevo.de\www
Trusted Zone: Privat-Prog.com
Trusted Zone: Privat-Prog.com\content
Trusted Zone: Privat-Prog.net\content.1a
Trusted Zone: Privat-Progproweb.com
Trusted Zone: Privat-Progvista.com
Trusted Zone: Privat-Progvista.com\Muc.http.farm6.software
Trusted Zone: Privat-Progvista.com\Muc.http.farm8.software
Trusted Zone: Privat-Progvista.com\Muc.https.farm11.software
Trusted Zone: Privat-Progvista.com\Muc.https.farm5.software
Trusted Zone: navitel.fr
Trusted Zone: sncm.fr
TCP: DhcpNameServer = 255.0.0.0
TCP: Interfaces\{B6070A5E-CC38-40D9-B4BF-B79B9796DF18}: NameServer = 192.168.2.1,194.25.2.129
DPF: {096AD7BA-BC58-423E-93BE-A7CC72077040} - hxxp://www.aerticket.de/topmenu/Lute/flxterminal.cab
DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} - hxxps://my.sabre.com/jars/TMinReqX.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2013-03-23 23:04
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(860)
c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'lsass.exe'(916)
c:\windows\system32\relog_ap.dll
.
Zeit der Fertigstellung: 2013-03-23 23:09:25
ComboFix-quarantined-files.txt 2013-03-23 22:09
.
Vor Suchlauf: 25 Verzeichnis(se), 124.590.784.512 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 126.132.523.008 Bytes frei
.
- - End Of File - - DBBCE89EBB3563F54AEDC7993F2E5D14
--- --- ---
------------------------------------------------------------------------------------------
Log OTL.txt
-------------------------------------------------------------------------------------------OTL Logfile: Code:
OTL logfile created on: 24.03.2013 13:29:59 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\*****\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 69,13% Memory free
3,81 Gb Paging File | 3,19 Gb Available in Paging File | 83,62% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,05 Gb Total Space | 117,53 Gb Free Space | 78,85% Space Free | Partition Type: NTFS
Computer Name: **---********** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.03.24 13:27:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\*****\Desktop\OTL.exe
PRC - [2013.03.23 09:02:17 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.03.23 09:01:44 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.03.23 09:01:38 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.03.23 09:01:36 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.03.10 23:38:48 | 001,644,680 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2013.02.05 16:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2012.11.04 18:43:30 | 001,851,192 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2012.10.01 08:23:54 | 000,150,328 | ---- | M] (Logitech, Inc.) -- C:\Programme\Gemeinsame Dateien\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2012.05.08 23:09:58 | 000,266,332 | ---- | M] (c't) -- C:\Dokumente und Einstellungen\*****\Desktop\Andreas.exe
PRC - [2011.12.19 15:02:54 | 000,226,216 | ---- | M] (Privat-Prog) -- C:\Programme\Automatic Update\AutoUpdate.exe
PRC - [2011.12.19 15:02:46 | 000,232,368 | ---- | M] (Privat-Prog) -- C:\Programme\Automatic Update\AutoUpdateGUI.exe
PRC - [2011.10.17 15:47:40 | 000,499,712 | ---- | M] (Privat-Prog) -- C:\Programme\Privat-Prog\Pro Printer\AmaPrt.exe
PRC - [2011.06.29 15:28:30 | 000,266,240 | ---- | M] (Privat-Prog) -- C:\Programme\Privat-Prog\Pro Printer\ComAdapt.exe
PRC - [2011.03.15 13:29:58 | 000,114,688 | ---- | M] () -- C:\LMPLUS\lmi_v129.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2010.07.20 11:45:24 | 001,531,904 | ---- | M] (Nokia) -- C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe
PRC - [2009.12.18 18:17:06 | 000,454,656 | ---- | M] (Privat-Prog) -- C:\Programme\Privat-Prog\Pro Printer\Mainsrv.exe
PRC - [2009.12.18 12:55:48 | 000,155,648 | ---- | M] (Privat-Prog Germany) -- C:\Programme\Privat-Prog\Pro Printer\autosrv.exe
PRC - [2009.10.13 06:43:46 | 000,262,144 | ---- | M] (Privat-Prog Germany GmbH) -- C:\Programme\Privat-Prog\Pro Printer\Panel.exe
PRC - [2009.09.08 16:25:52 | 000,096,334 | ---- | M] (Canon Inc.) -- C:\Programme\Canon\CAL\CALMAIN.exe
PRC - [2009.08.26 22:28:17 | 000,245,760 | ---- | M] (UltraVNC) -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Temp\7zS3F.tmp\winvnc.exe
PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.11.12 14:13:16 | 000,886,600 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEchoServer\TimounterMonitor.exe
PRC - [2007.11.12 11:29:58 | 000,136,472 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
PRC - [2007.11.12 11:29:54 | 000,423,192 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
PRC - [2007.11.12 11:28:02 | 001,299,240 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEchoServer\TrueImageMonitor.exe
PRC - [2007.01.25 11:34:16 | 000,237,568 | ---- | M] ( ) -- C:\WINDOWS\system32\SlpV24s.exe
PRC - [2005.01.07 16:30:56 | 000,864,256 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\ControlCenter2\brctrcen.exe
========== Modules (No Company Name) ==========
MOD - [2013.03.23 09:02:20 | 000,397,704 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2011.12.19 15:02:52 | 000,116,736 | ---- | M] () -- C:\Programme\Automatic Update\MapFile.dll
MOD - [2011.03.15 13:29:58 | 000,114,688 | ---- | M] () -- C:\LMPLUS\lmi_v129.exe
MOD - [2010.06.17 21:56:52 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll
MOD - [2007.11.12 10:09:54 | 001,336,600 | ---- | M] () -- C:\Programme\Acronis\TrueImageEchoServer\fox.dll
MOD - [2004.11.02 18:31:58 | 000,158,720 | ---- | M] () -- C:\LMPLUS\unrar.dll
========== Services (SafeList) ==========
SRV - [2013.03.23 09:02:17 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.03.23 09:01:38 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.03.14 09:19:43 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.05 16:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.10.01 08:22:06 | 000,295,224 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.12.19 15:02:54 | 000,226,216 | ---- | M] (Privat-Prog) [Auto | Running] -- C:\Programme\Automatic Update\AutoUpdate.exe -- (Privat-Prog Automatic Update)
SRV - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2009.12.18 18:17:06 | 000,454,656 | ---- | M] (Privat-Prog) [Auto | Running] -- C:\Programme\Privat-Prog\Pro Printer\Mainsrv.exe -- (Privat-ProgProPrinter)
SRV - [2009.09.08 16:25:52 | 000,096,334 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Programme\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2007.11.12 11:29:54 | 000,423,192 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007.11.06 21:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Programme\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2007.03.12 14:49:46 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.10.26 18:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\*****\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2013.03.23 09:02:36 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013.03.23 09:02:36 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2013.03.23 09:02:35 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.03.23 09:02:34 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.09.18 10:33:00 | 000,043,960 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2012.09.18 10:33:00 | 000,039,608 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2012.09.18 10:33:00 | 000,030,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2012.09.18 10:32:56 | 000,012,216 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2010.02.26 14:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.02.26 14:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.02.26 14:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.02.26 14:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.05.13 09:56:28 | 000,034,080 | ---- | M] (Glance Networks, Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\glancedrv.sys -- (glancedrv)
DRV - [2009.01.29 19:03:00 | 000,454,688 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2009.01.29 19:03:00 | 000,043,008 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2009.01.29 19:02:56 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.04.13 19:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007.11.19 08:50:42 | 000,072,704 | ---- | M] (Funkwerk Enterprise Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElgTaDrv.sys -- (ElgTaDrv)
DRV - [2007.11.06 21:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2007.06.14 15:41:58 | 004,429,312 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2007.05.11 18:00:14 | 000,045,056 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI)
DRV - [2007.04.04 18:16:20 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)
DRV - [2002.08.13 16:51:40 | 000,007,104 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\genport.sys -- (GenPort)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.fujitsu-siemens.de
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.fujitsu-siemens.de
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search Free: Avira Search Free powered by Ask.com
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\SearchScopes,DefaultScope = {2D3A3989-23D3-4565-BB12-D9144D01ACC9}
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\SearchScopes\{2D3A3989-23D3-4565-BB12-D9144D01ACC9}: "URL" = hxxp://www.benefind.de/web.php?q={searchTerms}
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\SearchScopes\{42F00BFE-5AC0-4DA6-BF93-7965C048A470}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\SearchScopes\{8FBEB077-B42A-414B-82A3-A8AB1452D9C1}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=54018217-4738-438f-9a48-6686cb29c877&apn_sauid=02386092-4C2C-427D-B3FC-F5E0DD5B0223
IE - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Programme\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.11.01 17:22:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.11.01 17:22:39 | 000,000,000 | ---D | M]
[2012.07.09 14:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
========== Chrome ==========
CHR - default_search_provider: benefind (Enabled)
CHR - default_search_provider: search_url = hxxp://www.benefind.de/web.php?q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://www.benefind.de/autocomplete/autocompletev.php?q={searchTerms}
CHR - homepage: Search Free: Avira Search Free powered by Ask.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.172\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.172\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.210.7 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U21 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: NPCIG.dll (Enabled) = C:\Programme\Canon\MyCamera Download Plugin\NPCIG.dll
CHR - plugin: Glance\u2122 (Enabled) = C:\Programme\Glance25\npglance.dll
CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
O1 HOSTS File: ([2013.03.23 23:04:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found
O3 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageEchoServer\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [EvtMgr6] C:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl04g\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageEchoServer\TrueImageMonitor.exe (Acronis)
O4 - HKU\.DEFAULT..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Privat-Prog Pro Printer.lnk = C:\Programme\Privat-Prog\Pro Printer\autosrv.exe (Privat-Prog Germany)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Lexware Info Service.lnk = C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe (Lexware GmbH & Co. KG)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office Outlook 2007.lnk = C:\WINDOWS\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\*****\Startmenü\Programme\Autostart\LMplus Internetagent.lnk = C:\LMPLUS\LMIAGENT.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: Privat-Prog.com ([]* in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Prog.com ([content] http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Prog.net ([content.1a] http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progproweb.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progvista.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progvista.com ([Muc.http.farm6.software] http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progvista.com ([Muc.http.farm8.software] http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progvista.com ([Muc.https.farm11.software] http in Trusted sites)
O15 - HKLM\..Trusted Domains: Privat-Progvista.com ([Muc.https.farm5.software] http in Trusted sites)
O15 - HKLM\..Trusted Domains: navitel.fr ([]* in Trusted sites)
O15 - HKLM\..Trusted Domains: sncm.fr ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: Privat-Prog.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\.DEFAULT\..Trusted Domains: navitel.fr ([]* in Vertrauenswürdige Sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sncm.fr ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-18\..Trusted Domains: Privat-Prog.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-18\..Trusted Domains: navitel.fr ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sncm.fr ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: *Privat-Progvista.de ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.com ([diagnostic] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.net ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.net ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Prog.net ([sbc] https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progcruise.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progcruise.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progcruise.com ([*] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progferry.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progferry.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progferry.com ([*] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progproprinter.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progproprinter.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progproweb.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progproweb.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progproweb.com ([*] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.com ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.com ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.com ([*] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.de ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.de ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: Privat-Progvista.de ([www] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: portevo.de ([]http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: portevo.de ([]https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: portevo.de ([www] * in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: portevo.de ([www] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-2596812046-4294920462-4173031915-1005\..Trusted Domains: portevo.de ([www] https in Vertrauenswürdige Sites)
O16 - DPF: {051FE707-9706-11D5-A836-000102A7C938} hxxp://certificates.Privat-Progvista.com/sgwadmin/common/AutoUpdateATL26P502.CAB (Privat-Prog Automatic Update)
O16 - DPF: {096AD7BA-BC58-423E-93BE-A7CC72077040} hxxp://www.aerticket.de/topmenu/Lute/flxterminal.cab (Commando Class)
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll (TMinReq Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA} Oracle Technology Network for Java Developers (Java Plug-in 1.4.2_10)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 255.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B6070A5E-CC38-40D9-B4BF-B79B9796DF18}: DhcpNameServer = 255.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B6070A5E-CC38-40D9-B4BF-B79B9796DF18}: NameServer = 192.168.2.1,194.25.2.129
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\FSC.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\FSC.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.20 20:33:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.03.24 13:27:19 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\*****\Desktop\OTL.exe
[2013.03.24 10:25:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Desktop\Privat-Prog
[2013.03.23 22:24:31 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2013.03.23 22:05:01 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2013.03.23 22:05:01 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2013.03.23 22:05:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2013.03.23 22:05:01 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013.03.23 21:57:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.23 21:57:27 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\*****\Startmenü\Programme\Verwaltung
[2013.03.23 21:56:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2013.03.23 21:54:23 | 005,043,510 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\*****\Desktop\ComboFix.exe
[2013.03.23 10:09:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\DoNotTrackPlus
[2013.03.23 10:09:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\CallingID
[2013.03.23 10:09:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\AskToolbar
[2013.03.23 09:53:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Avira
[2013.03.23 09:37:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2013.03.23 09:36:34 | 000,000,000 | ---D | C] -- C:\Firefox
[2013.03.23 09:36:30 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2013.03.23 09:36:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2013.03.23 09:36:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\APN
[2013.03.23 09:34:17 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2013.03.23 09:34:17 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2013.03.23 09:34:12 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2013.03.23 09:33:19 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2013.03.23 09:33:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2013.03.21 09:15:09 | 000,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usb8023.sys
[2013.03.21 09:15:05 | 000,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usb8023x.sys
[2013.03.16 12:02:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy
[2013.03.16 12:02:17 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2013.03.16 12:02:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2013.03.15 10:37:36 | 000,000,000 | ---D | C] -- C:\Programme\LMPlus 3.0
[2013.02.22 17:32:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\FreePDF_XP
[2013.02.22 14:31:42 | 000,000,000 | ---D | C] -- C:\FreePDF
[2013.02.22 13:55:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FreePDF
[2013.02.22 13:55:57 | 000,000,000 | ---D | C] -- C:\Programme\FreePDF_XP
[2013.02.22 13:55:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\FreePDF
[2013.02.22 13:54:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ghostscript
[2013.02.22 13:54:32 | 000,000,000 | ---D | C] -- C:\Programme\gs
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.03.24 13:37:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.03.24 13:27:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\*****\Desktop\OTL.exe
[2013.03.24 13:18:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.03.24 12:41:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.24 11:42:41 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4021FA46-724E-46FE-AD04-08850B5AD25E}.job
[2013.03.24 10:41:00 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.24 10:27:01 | 000,002,577 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office Outlook 2007.lnk
[2013.03.24 10:25:39 | 000,001,664 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Privat-Prog Pro Printer.lnk
[2013.03.24 10:23:05 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.03.24 10:18:21 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\Jdmhejm.job
[2013.03.24 10:18:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.03.24 10:18:06 | 2112,139,264 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.23 23:04:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013.03.23 22:24:57 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2013.03.23 21:55:38 | 005,043,510 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\*****\Desktop\ComboFix.exe
[2013.03.23 09:37:33 | 000,001,677 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.03.23 09:02:36 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2013.03.23 09:02:36 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013.03.23 09:02:35 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2013.03.23 09:02:34 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2013.03.22 09:41:12 | 000,000,234 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\Privat-Prog Germany 1202mf.url
[2013.03.21 22:18:54 | 000,377,856 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\9ikckdxt.exe
[2013.03.20 15:32:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013.03.17 17:26:02 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\Biport
[2013.03.16 12:02:24 | 000,000,911 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\Spybot - Search & Destroy.lnk
[2013.03.16 09:19:17 | 000,000,820 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130316-120415.backup
[2013.03.15 10:44:15 | 000,000,447 | ---- | M] () -- C:\WINDOWS\lmplus_u.ini
[2013.03.15 10:37:38 | 000,000,638 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\LMPlus 3.0.lnk
[2013.03.14 20:27:25 | 000,001,249 | ---- | M] () -- C:\WINDOWS\Brpfx04a.ini
[2013.03.14 14:38:07 | 000,000,348 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\airberlin.com.url
[2013.03.14 09:43:19 | 000,001,783 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2013.03.14 09:19:28 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013.03.14 09:19:26 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013.03.13 18:16:12 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.03.12 19:21:11 | 000,098,304 | RHS- | M] () -- C:\WINDOWS\System32\wbdbasef.dll
[2013.03.12 15:13:28 | 000,000,014 | ---- | M] () -- C:\WINDOWS\hpmssnpjt.ini
[2013.03.12 15:12:06 | 000,000,226 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\SunExpress Sport- & Sondergepäck buchen sunexpress.com.url
[2013.03.11 12:42:35 | 000,000,126 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\irisplus-iplusst.properties
[2013.03.08 15:28:11 | 000,000,254 | ---- | M] () -- C:\WINDOWS\buma.ini
[2013.03.01 03:28:11 | 006,011,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[1 C:\WINDOWS\System32\drivers\etc\*.tmp files -> C:\WINDOWS\System32\drivers\etc\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.03.24 10:25:39 | 000,001,664 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Privat-Prog Pro Printer.lnk
[2013.03.23 22:24:57 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2013.03.23 22:24:39 | 000,262,448 | RHS- | C] () -- C:\cmldr
[2013.03.23 22:05:01 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013.03.23 22:05:01 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013.03.23 22:05:01 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013.03.23 22:05:01 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013.03.23 22:05:01 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013.03.23 09:37:33 | 000,001,677 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.03.23 09:37:30 | 000,000,228 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.03.22 13:08:59 | 000,377,856 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\9ikckdxt.exe
[2013.03.16 12:02:24 | 000,000,911 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\Spybot - Search & Destroy.lnk
[2013.03.15 10:37:38 | 000,000,644 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\LMPlus 3.0.lnk
[2013.03.15 10:37:38 | 000,000,638 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\LMPlus 3.0.lnk
[2013.03.14 14:38:07 | 000,000,348 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\airberlin.com.url
[2013.03.12 19:21:12 | 000,000,318 | ---- | C] () -- C:\WINDOWS\tasks\Jdmhejm.job
[2013.03.12 19:21:11 | 000,098,304 | RHS- | C] () -- C:\WINDOWS\System32\wbdbasef.dll
[2013.03.12 15:13:28 | 000,000,014 | ---- | C] () -- C:\WINDOWS\hpmssnpjt.ini
[2013.03.12 15:12:06 | 000,000,226 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\SunExpress Sport- & Sondergepäck buchen sunexpress.com.url
[2013.02.22 13:56:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2013.02.22 13:55:59 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2013.02.09 16:51:44 | 000,000,254 | ---- | C] () -- C:\WINDOWS\buma.ini
[2013.02.09 16:50:58 | 000,000,447 | ---- | C] () -- C:\WINDOWS\lmplus_u.ini
[2012.06.27 15:31:38 | 000,125,952 | ---- | C] () -- C:\WINDOWS\System32\biucntxt.dll
[2012.02.16 08:56:04 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.04 15:46:00 | 000,000,034 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\irisplus-iplusdcs.properties
[2010.05.26 21:03:14 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\.recently-used.xbel
[2009.01.13 17:36:53 | 000,000,126 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\irisplus-iplusst.properties
[2008.08.16 15:47:02 | 000,000,013 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\usb1
[2008.07.07 15:41:26 | 000,000,059 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\MySabre.properties
[2008.07.05 13:35:53 | 000,007,680 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.06.27 11:29:17 | 000,035,278 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\screenshot.jpg
[2008.06.26 20:27:30 | 000,003,061 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\irisplus-user.properties
[2008.06.15 19:28:01 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
========== ZeroAccess Check ==========
[2004.08.20 20:42:11 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010.04.16 17:06:44 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== Custom Scans ==========
< reg query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0" /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI PORT 0
DMAEnabled REG_DWORD 0x0
Driver REG_SZ atapi
< reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}" /s /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}
Class REG_SZ hdc
<NO NAME> REG_SZ IDE ATA/ATAPI-Controller
Icon REG_SZ -9
Installer32 REG_SZ SysSetup.Dll,HdcClassInstaller
TroubleShooter-0 REG_SZ hcp://help/tshoot/tsdrive.htm
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0001
UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff
UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0002
UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff
UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0003
MasterOnMask REG_DWORD 0x80
MasterOnConfigOffset REG_DWORD 0x41
SlaveOnMask REG_DWORD 0x80
SlaveOnConfigOffset REG_DWORD 0x43
InfPath REG_SZ oem5.inf
InfSection REG_SZ pciide_Inst
ProviderName REG_SZ Intel
DriverDateData REG_BINARY 00402594B848C701
DriverDate REG_SZ 2-5-2007
DriverVersion REG_SZ 8.3.0.1011
MatchingDeviceId REG_SZ pci\ven_8086&dev_2920
DriverDesc REG_SZ Intel(R) ICH9 4 port Serial ATA Storage Controller 1 - 2920
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0004
MasterOnMask REG_DWORD 0x80
MasterOnConfigOffset REG_DWORD 0x41
SlaveOnMask REG_DWORD 0x80
SlaveOnConfigOffset REG_DWORD 0x43
InfPath REG_SZ oem5.inf
InfSection REG_SZ pciide_Inst
ProviderName REG_SZ Intel
DriverDateData REG_BINARY 00402594B848C701
DriverDate REG_SZ 2-5-2007
DriverVersion REG_SZ 8.3.0.1011
MatchingDeviceId REG_SZ pci\ven_8086&dev_2926
DriverDesc REG_SZ Intel(R) ICH9 2 port Serial ATA Storage Controller 2 - 2926
UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff
UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0005
InfPath REG_SZ mshdc.inf
InfSection REG_SZ pciide_Inst
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ pci\cc_0101
DriverDesc REG_SZ Standard-Zweikanal-PCI-IDE-Controller
UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff
UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0006
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_primary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ primary_ide_channel
DriverDesc REG_SZ Primärer IDE-Kanal
MasterDeviceType REG_DWORD 0x0
SlaveDeviceType REG_DWORD 0x0
MasterDeviceTimingMode REG_DWORD 0x0
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0007
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_secondary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ secondary_ide_channel
DriverDesc REG_SZ Sekundärer IDE-Kanal
MasterDeviceType REG_DWORD 0x0
SlaveDeviceType REG_DWORD 0x0
MasterDeviceTimingMode REG_DWORD 0x0
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0008
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_primary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ primary_ide_channel
DriverDesc REG_SZ Primärer IDE-Kanal
MasterDeviceType REG_DWORD 0x1
SlaveDeviceType REG_DWORD 0x0
SlaveDeviceDetectionTimeout REG_DWORD 0x1
MasterDeviceTimingMode REG_DWORD 0x10
MasterDeviceTimingModeAllowed REG_DWORD 0x1f
MasterIdDataCheckSum REG_DWORD 0x64ae
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0009
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_secondary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ secondary_ide_channel
DriverDesc REG_SZ Sekundärer IDE-Kanal
MasterDeviceType REG_DWORD 0x2
SlaveDeviceType REG_DWORD 0x0
SlaveDeviceDetectionTimeout REG_DWORD 0x1
MasterDeviceTimingMode REG_DWORD 0x10010
MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff
MasterIdDataCheckSum REG_DWORD 0x1b652
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0010
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_primary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ primary_ide_channel
DriverDesc REG_SZ Primärer IDE-Kanal
MasterDeviceType REG_DWORD 0x0
SlaveDeviceType REG_DWORD 0x0
MasterDeviceTimingMode REG_DWORD 0x0
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0011
EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst_secondary
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 008062C5C001C101
DriverDate REG_SZ 7-1-2001
DriverVersion REG_SZ 5.1.2600.2180
MatchingDeviceId REG_SZ secondary_ide_channel
DriverDesc REG_SZ Sekundärer IDE-Kanal
MasterDeviceType REG_DWORD 0x0
SlaveDeviceType REG_DWORD 0x0
MasterDeviceTimingMode REG_DWORD 0x0
SlaveDeviceTimingMode REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties
< End of report >
--- --- ---
-------------------------------------------------------------------------------------
und Extra.txt
----------------------------------------------------------------------------------------OTL Logfile: Code:
OTL Extras logfile created on: 24.03.2013 13:29:59 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\*****\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 69,13% Memory free
3,81 Gb Paging File | 3,19 Gb Available in Paging File | 83,62% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,05 Gb Total Space | 117,53 Gb Free Space | 78,85% Space Free | Partition Type: NTFS
Computer Name: **---********** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"9876:TCP" = 9876:TCP:*:Enabled:Privat-Prog pro Printer
"18245:TCP" = 18245:TCP:*:Enabled:HST Remote Control Tool
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Office\Office12\OUTLOOK.EXE" = C:\Programme\Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Privat-Prog\Pro Printer\AmaPrt.exe" = C:\Programme\Privat-Prog\Pro Printer\AmaPrt.exe:*:Enabled:Privat-ProgPro Printer Application -- (Privat-Prog)
"C:\Programme\Java\jre1.6.0_06\bin\javaw.exe" = C:\Programme\Java\jre1.6.0_06\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Acronis\TrueImageEchoServer\TrueImage.exe" = C:\Programme\Acronis\TrueImageEchoServer\TrueImage.exe:*:Enabled:Acronis True Image -- (Acronis)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" = C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe:*:Enabled:Nokia Ovi Suite 2 -- (Nokia)
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process -- (Nokia Corporation)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{081542FD-AE81-923A-10CD-78F2C279F2CC}" = LMPlus 3.0
"{0921D0A0-5A37-4318-9EDD-6B6EC12E6380}" = Lexware QuickBooks 2008
"{10DF6B41-D59D-4CCE-86BC-028DF8F9A061}" = Acronis*True*Image*Echo*Server
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{1A36B432-C523-4A39-9604-9536D62EDCAA}" = Privat-Prog Online Bestell Assistent
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{2EE66895-2912-4980-82FD-0AF03FB884DC}" = Lexware QuickBooks 2008
"{319786B7-D72F-43B3-99C1-E93724ED17D3}" = Lexware online banking 4.90
"{32148D5D-909F-4A7B-93EE-5C16B71F4A8C}" = funScreenScraping Client Version
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38EBEF35-18E3-4B74-A560-8F80685B9626}" = Lexware QuickBooks plus 2008
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5D5B9E6A-344C-4976-95AB-ABBDC648E5DA}" = Microsoft IntelliType Pro 5.2
"{64635543-70E7-436D-8D6D-4A721595029E}" = Microsoft IntelliPoint 5.2
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6FBABF2B-2355-4839-91BF-C86D9DB16934}" = Lexware Abschreibungsrechner 2008
"{7148F0A8-6813-11D6-A77B-00B0D0142100}" = Java 2 Runtime Environment, SE v1.4.2_10
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72BB5DC4-1C72-4306-9005-6B44190DF430}" = Lexware QuickBooks 2008
"{749A1EDD-16C2-4C63-B013-D38F0F953973}" = OviMPlatform
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7D9A486B-DD9E-4526-9B3A-B26B83179EAE}" = Lexware online banking 4.90
"{8112C6B3-91E1-4560-8AB9-876DADFA37C5}" = Ovi Desktop Sync Engine
"{8556B16D-AD7A-42A7-8A75-F7C532371031}" = Nero 7 Essentials
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{94BD98BF-A185-4B42-9310-6440F735559E}" = Privat-Prog Virtual Support Center
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A770DAE-BF29-4455-9C6F-20C2F5A940C1}" = funkwerk Phone TAPI V1.32
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AC849092-6F19-4395-8860-BC3B82CAFE51}" = funScreenScraping Microsoft Systemdateien
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6FA7BE5-6C3F-42AF-B3C1-C1F4536920C5}" = Lexware Abschreibungsrechner
"{B8B4446F-87E1-4423-A47A-16832C24A199}" = Nokia Ovi Suite
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{C019A4C7-C791-450C-A5CF-FF95826CD276}" = Lexware QuickBooks 2008
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC322D0B-CC8E-4351-90F2-19275DFFC134}" = Lexware QuickBooks 2008
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D83BD5E2-5AF4-49F6-B5C1-484A9760E73D}" = Brother MFL-Pro Suite
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EBB3C7CF-78BE-4C15-9E58-E069CF7D45C1}" = BistroPortal
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{EE5B5B24-EEFC-4C8B-BF8B-256D705BAD89}" = Nokia Ovi Suite Software Updater
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F7D91E6E-2B43-4498-BEE1-F13778B0B341}" = elmeg WIN-Tools V7.31
"{F7E345A5-F79B-44EE-BC4A-738899E756C0}" = Lexware online banking 4.90
"{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}" = Windows Resource Kit Tools
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Astro-Nex_is1" = Astro-Nex 1.2
"Avira AntiVir Desktop" = Avira Free Antivirus
"Back it up!" = Back it up!
"Bistro Portal 1.0" = Bistro Portal 1.0
"CAL" = Canon Camera Access Library
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowLauncher" = Canon Utilities CameraWindow Launcher
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"Freecom Backup Software_is1" = Freecom Backup Software 1.15
"FreePDF_XP" = FreePDF (Remove only)
"Google Chrome" = Google Chrome
"GPL Ghostscript 9.07" = GPL Ghostscript
"HP LaserJet P3010 Series PCL 6" = HP LaserJet P3010 Series PCL 6
"ie8" = Windows Internet Explorer 8
"InstallShield_{F7D91E6E-2B43-4498-BEE1-F13778B0B341}" = elmeg WIN-Tools V7.31
"LMPlusHybridAir" = LMPlus 3.0
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MovieUploaderForYouTube" = Canon Utilities Movie Uploader for YouTube
"MSNINST" = MSN
"MyCamera" = Canon Utilities MyCamera
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"Nokia Ovi Suite" = Nokia Ovi Suite
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoStitch" = Canon Utilities PhotoStitch
"PROHYBRIDR" = 2007 Microsoft Office system
"PROSet" = Intel(R) PRO Network Connections Drivers
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Shop for HP Supplies" = Shop for HP Supplies
"sp6" = Logitech SetPoint 6.51
"Totalcmd" = Total Commander (Remove or Repair)
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPcapInst" = WinPcap 4.0.2
"Wireshark" = Wireshark 1.0.0
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2596812046-4294920462-4173031915-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Sabre VPN" = Sabre VPN
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 16.03.2013 07:08:15 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung googletoolbarmanager_0531c63a913cc9d1.exe,
Version 5.0.2124.6042, fehlgeschlagenes Modul googletoolbarmanager_0531c63a913cc9d1.exe,
Version 5.0.2124.6042, Fehleradresse 0x000a5e43.
Error - 16.03.2013 07:09:31 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung googletoolbarmanager_0531c63a913cc9d1.exe,
Version 5.0.2124.6042, fehlgeschlagenes Modul googletoolbarmanager_0531c63a913cc9d1.exe,
Version 5.0.2124.6042, Fehleradresse 0x000a5e43.
Error - 16.03.2013 07:09:35 | Computer Name = **---********** | Source = Application Error | ID = 1001
Description = Fehlerhafter Speicherbereich 1038352009.
Error - 18.03.2013 11:44:28 | Computer Name = **---********** | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
erneut. Kontext: Anwendung, SystemIndex Katalog
Error - 18.03.2013 11:49:25 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung setpoint.exe, Version 6.51.8.0, fehlgeschlagenes
Modul macrocore.dll, Version 6.51.8.0, Fehleradresse 0x00003c78.
Error - 18.03.2013 11:49:30 | Computer Name = **---********** | Source = Application Error | ID = 1001
Description = Fehlerhafter Speicherbereich -1052542726.
Error - 19.03.2013 04:31:28 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung setpoint.exe, Version 6.51.8.0, fehlgeschlagenes
Modul macrocore.dll, Version 6.51.8.0, Fehleradresse 0x00003c78.
Error - 21.03.2013 09:36:51 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung setpoint.exe, Version 6.51.8.0, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00da1449.
Error - 23.03.2013 04:45:25 | Computer Name = **---********** | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 23.03.2013 05:32:03 | Computer Name = **---********** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung setpoint.exe, Version 6.51.8.0, fehlgeschlagenes
Modul macrocore.dll, Version 6.51.8.0, Fehleradresse 0x00003c78.
[ OSession Events ]
Error - 21.06.2008 14:52:39 | Computer Name = **---********** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1830
seconds with 840 seconds of active time. This session ended with a crash.
Error - 03.06.2009 12:59:56 | Computer Name = **---********** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3131
seconds with 2520 seconds of active time. This session ended with a crash.
Error - 29.06.2012 09:25:14 | Computer Name = **---********** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 23247
seconds with 1440 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 22.03.2013 17:24:17 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 22.03.2013 17:27:33 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 22.03.2013 17:28:45 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 22.03.2013 23:15:01 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 22.03.2013 23:15:05 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 22.03.2013 23:15:10 | Computer Name = **---********** | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort2 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 23.03.2013 04:38:39 | Computer Name = **---********** | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Avira
Planer.
Error - 23.03.2013 04:38:39 | Computer Name = **---********** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Planer" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error - 23.03.2013 04:45:56 | Computer Name = **---********** | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst WMI-Leistungsadapter.
Error - 23.03.2013 04:45:56 | Computer Name = **---********** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WMI-Leistungsadapter" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
< End of report >
--- --- ---
--------------------------------------------------------------------------------------------------------------------------
danke und Gruß Leonardo8 |
Hinweise zum Ablauf