Trojaner-Board - Mydirtyhobby.de Rechnung - Anhang geöffnet und ausgeführt

Hallo Zusammen,

Ich habe dummerweise den Anhang einer dieser ominösen Mydirtyhobby.de Rechnungen geöffnet und sogar die MS-Dos Anwendung ausgeführt. :headbang:

Es wurde ein Trojaner mit Antivir gefunden und in Quarantäne verschoben. Kann mir bitte jemand bei der Säuberung helfen?

Hier die OTL Files:

Code:

OTL logfile created on: 11.04.2013 20:11:02 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,11% Memory free

7,99 Gb Paging File | 6,28 Gb Available in Paging File | 78,58% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 284,56 Gb Total Space | 169,81 Gb Free Space | 59,67% Space Free | Partition Type: NTFS

Drive D: | 13,23 Gb Total Space | 2,20 Gb Free Space | 16,66% Space Free | Partition Type: NTFS

Drive E: | 99,34 Mb Total Space | 95,86 Mb Free Space | 96,50% Space Free | Partition Type: FAT32

Drive I: | 2,50 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

 

Computer Name: *** | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.04.11 19:53:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

PRC - [2013.04.11 11:38:00 | 000,159,744 | ---- | M] (Корпорация Майкрософт) -- C:\Users\***\AppData\Roaming\KB00869357.exe

PRC - [2013.04.06 16:10:39 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2013.04.06 16:10:24 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2013.04.06 16:10:23 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2013.02.27 01:00:01 | 001,133,392 | ---- | M] (BitTorrent Inc.) -- C:\Users\***\AppData\Roaming\BitTorrent\BitTorrent.exe

PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.08.03 21:52:33 | 000,685,048 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe

PRC - [2012.08.03 21:52:07 | 000,537,592 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.08.03 21:53:25 | 000,062,968 | ---- | M] () -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll

MOD - [2011.03.17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf

MOD - [2010.12.21 02:15:30 | 001,041,248 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2011.05.13 19:58:10 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)

SRV:64bit: - [2009.08.18 03:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2013.04.06 16:10:39 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2013.04.06 16:10:24 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2013.03.16 16:21:41 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.08.03 21:52:07 | 000,537,592 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)

SRV - [2012.07.09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.11.30 14:27:58 | 000,336,824 | ---- | M] (arvato digital services llc) [Auto | Running] -- c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2_x64)

SRV - [2010.01.30 01:40:16 | 001,043,584 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.04.06 16:10:43 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2013.04.06 16:10:43 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2013.04.06 16:10:43 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2013.02.23 19:58:53 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2012.08.03 21:38:55 | 000,027,048 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)

DRV:64bit: - [2012.08.03 21:38:05 | 000,107,432 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.05.13 19:58:16 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)

DRV:64bit: - [2011.05.13 19:57:58 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.08.18 04:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009.06.10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2007.04.25 13:50:04 | 000,036,864 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.faz.net/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6D 53 6C 5E 02 12 CE 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {F3169F4D-ECED-4474-8CE6-1F33DD1C7FD3}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{F3169F4D-ECED-4474-8CE6-1F33DD1C7FD3}: "URL" = http://www.google.de/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "faz.net"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_168.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\system32\npDeployJava1.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll ()

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013.03.08 16:49:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 16:21:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013.03.08 16:49:57 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 16:21:41 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2013.02.23 04:42:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2013.03.16 16:21:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2013.03.16 16:21:41 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2013.02.16 06:15:47 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2013.02.16 06:15:47 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2013.02.16 06:15:47 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2013.02.16 06:15:47 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2013.02.16 06:15:47 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2013.02.16 06:15:47 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft)

O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O3:64bit: - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft)

O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft)

O4:64bit: - HKLM..\Run: [Classic Start Menu] C:\Programme\Classic Shell\ClassicStartMenu.exe (IvoSoft)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)

O4 - HKCU..\Run: [BitTorrent] C:\Users\***\AppData\Roaming\BitTorrent\BitTorrent.exe (BitTorrent Inc.)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [KB00869357.exe] C:\Users\***\AppData\Roaming\KB00869357.exe (Корпорация Майкрософт)

O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4786D82-7F13-47B2-80C7-CAD9BFC1701C}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9438DF3-D57A-471D-B83C-437B61D9A16D}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.07.05 16:11:07 | 000,143,008 | R--- | M] () - I:\Autorun.exe -- [ UDF ]

O32 - AutoRun File - [2010.06.07 15:14:11 | 000,000,049 | R--- | M] () - I:\Autorun.inf -- [ UDF ]

O32 - AutoRun File - [2010.07.05 16:03:05 | 000,000,443 | R--- | M] () - I:\autorun.ini -- [ UDF ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.04.11 19:53:06 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2013.04.11 12:05:07 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.04.11 12:05:07 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2013.04.11 12:05:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2013.04.11 12:05:05 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2013.04.11 12:05:05 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2013.04.11 12:05:05 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.04.11 12:05:05 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2013.04.11 12:05:05 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2013.04.11 12:05:05 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2013.04.11 12:05:05 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2013.04.11 12:05:04 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2013.04.11 12:05:04 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.04.11 12:05:02 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2013.04.11 12:05:02 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2013.04.11 12:05:02 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2013.04.11 12:03:13 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2013.04.11 12:03:12 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2013.04.11 12:03:12 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2013.04.11 12:03:11 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe

[2013.04.11 12:03:11 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2013.04.11 12:03:11 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll

[2013.04.11 12:03:09 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2013.04.11 12:03:08 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll

[2013.04.11 12:03:07 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll

[2013.04.11 12:03:07 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll

[2013.04.11 12:03:07 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2013.04.11 12:03:07 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll

[2013.04.11 12:00:22 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys

[2013.04.10 08:23:14 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\1C8249E0

[2013.04.10 08:23:13 | 000,159,744 | ---- | C] (Корпорация Майкрософт) -- C:\Users\***\AppData\Roaming\KB00869357.exe

[2013.04.06 16:10:56 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys

[2013.04.06 16:10:56 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2013.04.06 16:10:56 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2013.04.05 17:46:51 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Bildverkleinerer

[2013.04.01 15:27:23 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information

[2013.04.01 15:18:53 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\2013-04 (Apr)

[2013.03.26 16:12:31 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Thomas Milchert - Christliche Wurzeln der Todesphilosophie Heideggers

[2013.03.25 17:14:19 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Digibib4

[2013.03.25 17:13:37 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Digitale Bibliothek 5

[2013.03.25 17:13:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Digitale Bibliothek 5

[2013.03.25 17:13:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Digitale Bibliothek 5

[2013.03.23 01:06:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Portable Programs

[2013.03.23 01:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Portable

[2013.03.23 00:10:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt

[2013.03.22 23:55:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero

[2013.03.22 23:55:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero

[2013.03.22 22:45:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\LightScribe

[2013.03.22 22:45:35 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll

[2013.03.22 22:45:17 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll

[2013.03.22 22:45:00 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll

[2013.03.22 22:44:41 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll

[2013.03.22 22:44:15 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll

[2013.03.21 16:43:34 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\djinn

[2013.03.20 20:17:12 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Korallen

[2013.03.20 19:44:33 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\My Palettes

[2013.03.20 19:39:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Protexis64

[2013.03.20 19:39:43 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Corel

[2013.03.20 18:16:48 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Corel

[2013.03.20 18:16:33 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Visual Studio 2008

[2013.03.20 18:15:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SDKs

[2013.03.20 18:15:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 9.0

[2013.03.20 18:14:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Corel

[2013.03.20 18:14:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Protexis

[2013.03.20 18:13:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Corel

[2013.03.20 18:12:30 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Corel

[2013.03.20 18:12:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)

[2013.03.20 18:11:46 | 000,000,000 | ---D | C] -- C:\Program Files\Corel

[2013.03.20 18:08:44 | 000,000,000 | ---D | C] -- C:\ProgramData\CorelDRAW Graphics Suite X6

[2013.03.16 16:21:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2013.03.14 14:21:01 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

[1 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.04.11 19:53:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2013.04.11 19:44:40 | 000,023,408 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.04.11 19:44:40 | 000,023,408 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.04.11 19:41:43 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.04.11 19:41:43 | 000,698,926 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.04.11 19:41:43 | 000,653,724 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.04.11 19:41:43 | 000,149,034 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.04.11 19:41:43 | 000,121,596 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.04.11 19:37:18 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job

[2013.04.11 19:37:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.04.11 19:37:05 | 3218,235,392 | -HS- | M] () -- C:\hiberfil.sys

[2013.04.11 16:42:47 | 001,022,573 | ---- | M] () -- C:\Users\***\Desktop\Edmund White_ Cy Twombly.pdf

[2013.04.11 12:30:12 | 000,496,040 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.04.11 12:08:34 | 000,000,118 | ---- | M] () -- C:\Windows\SysNative\MRT.INI

[2013.04.11 11:38:00 | 000,159,744 | ---- | M] (Корпорация Майкрософт) -- C:\Users\***\AppData\Roaming\KB00869357.exe

[2013.04.09 16:35:57 | 000,014,525 | ---- | M] () -- C:\Users\***\Desktop\longsleeve.jpg

[2013.04.06 16:35:55 | 000,000,898 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog

[2013.04.06 16:10:43 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys

[2013.04.06 16:10:43 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2013.04.06 16:10:43 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2013.04.05 17:49:24 | 001,508,089 | ---- | M] () -- C:\Users\***\Desktop\Schulleitergutachten II.PDF

[2013.04.05 17:44:57 | 001,142,016 | ---- | M] () -- C:\Users\***\Desktop\Der-grandiose-Bildverkleinerer-Setup.exe

[2013.04.05 17:30:27 | 000,154,151 | ---- | M] () -- C:\Users\***\Desktop\Tabellarischer Lebenslauf Lily Acosta.pdf

[2013.04.05 17:27:47 | 007,968,736 | ---- | M] () -- C:\Users\***\Desktop\Schulleitergutachten - Lily Acosta.PDF

[2013.03.27 22:08:18 | 000,268,741 | ---- | M] () -- C:\Users\***\Desktop\Depression.pdf

[2013.03.27 15:14:44 | 001,356,624 | ---- | M] () -- C:\Users\***\Desktop\Der Traum vom gelungenen Selbst.pdf

[2013.03.26 10:44:22 | 023,750,656 | ---- | M] () -- C:\Users\***\Desktop\Birte_Hewera-Jean_Amerys_zweite_geistige_Heimat_zwischen_Revolution_und_ewigem_Stillstand.mp3

[2013.03.26 10:44:09 | 026,718,302 | ---- | M] () -- C:\Users\***\Desktop\Bemerkungen_zur_poststrukturalistischen_Theoriemode_am_Beispiel_von_Gilles_Deleuze.mp3

[2013.03.26 10:43:55 | 060,510,117 | ---- | M] () -- C:\Users\***\Desktop\Gesa_Mayer-Christian_Schuetze-Poststrukturalismus-Intros.mp3

[2013.03.25 17:13:37 | 000,001,008 | ---- | M] () -- C:\Users\***\Desktop\Digitale Bibliothek 5.lnk

[2013.03.20 17:17:43 | 000,080,074 | ---- | M] () -- C:\Users\***\Desktop\ZwPhiluPaed11.pdf

[2013.03.19 08:04:06 | 005,550,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2013.03.19 07:46:56 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2013.03.19 07:04:13 | 003,968,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2013.03.19 07:04:10 | 003,913,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2013.03.19 06:47:50 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll

[2013.03.19 05:06:33 | 000,112,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe

[2013.03.16 22:06:10 | 000,801,525 | ---- | M] () -- C:\Users\***\Desktop\Im toten Winkel.pdf

[2013.03.14 22:55:19 | 000,125,469 | ---- | M] () -- C:\Users\***\Desktop\Kirsten Huxel - Das Phänomen Angst - Eine Studie zur theologischen Anthropologie.pdf

[2013.03.14 15:55:49 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2013.03.14 15:55:49 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2013.03.14 14:20:26 | 543,662,469 | ---- | M] () -- C:\Windows\MEMORY.DMP

[1 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.04.11 16:42:47 | 001,022,573 | ---- | C] () -- C:\Users\***\Desktop\Edmund White_ Cy Twombly.pdf

[2013.04.11 12:08:34 | 000,000,118 | ---- | C] () -- C:\Windows\SysNative\MRT.INI

[2013.04.09 16:36:21 | 000,014,525 | ---- | C] () -- C:\Users\***\Desktop\longsleeve.jpg

[2013.04.05 17:45:32 | 000,000,898 | ---- | C] () -- C:\Windows\SysWow64\InstallUtil.InstallLog

[2013.04.05 17:44:55 | 001,142,016 | ---- | C] () -- C:\Users\***\Desktop\Der-grandiose-Bildverkleinerer-Setup.exe

[2013.04.05 17:41:26 | 001,508,089 | ---- | C] () -- C:\Users\***\Desktop\Schulleitergutachten II.PDF

[2013.04.05 17:30:26 | 000,154,151 | ---- | C] () -- C:\Users\***\Desktop\Tabellarischer Lebenslauf Lily Acosta.pdf

[2013.04.05 17:27:47 | 007,968,736 | ---- | C] () -- C:\Users\***\Desktop\Schulleitergutachten - Lily Acosta.PDF

[2013.03.27 22:08:18 | 000,268,741 | ---- | C] () -- C:\Users\***\Desktop\Depression.pdf

[2013.03.27 15:14:43 | 001,356,624 | ---- | C] () -- C:\Users\***\Desktop\Der Traum vom gelungenen Selbst.pdf

[2013.03.26 10:44:14 | 023,750,656 | ---- | C] () -- C:\Users\***\Desktop\Birte_Hewera-Jean_Amerys_zweite_geistige_Heimat_zwischen_Revolution_und_ewigem_Stillstand.mp3

[2013.03.26 10:43:58 | 026,718,302 | ---- | C] () -- C:\Users\***\Desktop\Bemerkungen_zur_poststrukturalistischen_Theoriemode_am_Beispiel_von_Gilles_Deleuze.mp3

[2013.03.26 10:43:44 | 060,510,117 | ---- | C] () -- C:\Users\***\Desktop\Gesa_Mayer-Christian_Schuetze-Poststrukturalismus-Intros.mp3

[2013.03.25 17:13:37 | 000,001,008 | ---- | C] () -- C:\Users\***\Desktop\Digitale Bibliothek 5.lnk

[2013.03.20 17:17:43 | 000,080,074 | ---- | C] () -- C:\Users\***\Desktop\ZwPhiluPaed11.pdf

[2013.03.16 22:06:10 | 000,801,525 | ---- | C] () -- C:\Users\***\Desktop\Im toten Winkel.pdf

[2013.03.14 22:55:19 | 000,125,469 | ---- | C] () -- C:\Users\***\Desktop\Kirsten Huxel - Das Phänomen Angst - Eine Studie zur theologischen Anthropologie.pdf

[2013.03.14 21:56:26 | 028,135,936 | ---- | C] () -- C:\Users\***\Desktop\w7lxe.exe

[2013.03.14 14:20:26 | 543,662,469 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2013.03.13 17:51:05 | 000,124,728 | ---- | C] () -- C:\Users\***\Desktop\7. Die Sorge als Sein des Daseins (§§ 39–44).pdf

[2013.03.13 17:46:13 | 002,661,032 | ---- | C] () -- C:\Users\***\Desktop\Josef Meinertz - Das Sein und das Nichts, Die Angst, der Tod und die Zeit. Grundzüge des Existierens und Grundprobleme der Tiefenpsychologie.pdf

[2013.03.13 17:46:12 | 002,699,875 | ---- | C] () -- C:\Users\***\Desktop\Walther Schweidler - Die Angst und die Kehre. Zur strukturellen Verbindung Heideggers mit Kierkegaard.pdf

[2013.03.08 16:44:40 | 000,222,331 | ---- | C] () -- C:\Windows\hpoins39.dat

[2013.03.08 16:44:40 | 000,000,629 | ---- | C] () -- C:\Windows\hpomdl39.dat

[2013.03.02 21:01:58 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll

[2013.03.01 17:07:21 | 000,003,584 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013.02.23 22:06:37 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.02.23 22:06:37 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.02.23 22:06:37 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.02.23 22:06:37 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.02.23 22:06:37 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.02.23 21:12:26 | 001,592,784 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2013.02.23 03:48:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2013.04.11 20:08:16 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\1C8249E0

[2013.02.28 18:11:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ashampoo

[2013.04.05 17:46:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Bildverkleinerer

[2013.04.11 20:18:11 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BitTorrent

[2013.02.27 01:49:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2013.02.27 01:51:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Propellerhead Software

[2013.03.02 21:38:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Xilisoft

 
 ========== Purity Check ==========

 

 
 

< End of report >

Extra:

Code:

OTL Extras logfile created on: 11.04.2013 20:11:02 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,11% Memory free

7,99 Gb Paging File | 6,28 Gb Available in Paging File | 78,58% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 284,56 Gb Total Space | 169,81 Gb Free Space | 59,67% Space Free | Partition Type: NTFS

Drive D: | 13,23 Gb Total Space | 2,20 Gb Free Space | 16,66% Space Free | Partition Type: NTFS

Drive E: | 99,34 Mb Total Space | 95,86 Mb Free Space | 96,50% Space Free | Partition Type: FAT32

Drive I: | 2,50 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

 

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0B341840-A313-4F89-822F-9D5EC3B2056F}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{0B56723C-EDF8-4B26-828F-4769E2ACBF9F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 

"{19E68CEC-675B-46CF-B773-E83FA1524AAB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{2690D643-AC15-4621-9A18-288DE0E18515}" = rport=445 | protocol=6 | dir=out | app=system | 

"{35F57A76-E8F7-4C61-814B-099949CE620F}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{3B333035-5D06-4E23-8DAC-A1FFA21664F8}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{4353A1D9-B551-4E17-8981-02E377A68F82}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{4E7FF6E2-8604-4F6D-8906-607CF065D840}" = lport=137 | protocol=17 | dir=in | app=system | 

"{4E960F94-C2D8-4316-94F7-657F984EA2FB}" = rport=139 | protocol=6 | dir=out | app=system | 

"{5D791157-2AA5-4613-9C52-70BAD5A8BC5C}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{66CC282B-0597-400C-A672-9514E30ECAE3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{677A13AD-44CF-4BD4-BA75-22E56697B0F3}" = rport=137 | protocol=17 | dir=out | app=system | 

"{6EEB979E-4BA3-4A2B-A513-32D9AC04E8CD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{712925CE-2265-49B0-8E9B-96187E6F8520}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{90BCBDEB-ECDE-46E2-BB3E-797FC6CAC850}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{919BDF19-0AF5-44CC-8A71-2191EBDED3CA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{A8F55430-927D-45CD-823A-274DDE2C0764}" = rport=138 | protocol=17 | dir=out | app=system | 

"{C1E85F7D-E8AE-4EA6-BB83-F3454B529FE8}" = lport=138 | protocol=17 | dir=in | app=system | 

"{C53EEE10-D6B4-4ED9-802E-9E4490B67FBD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{C66550E8-5491-4AF3-AF21-35FC71F2424F}" = lport=445 | protocol=6 | dir=in | app=system | 

"{D0D2E6DD-C38E-4E84-88CD-D99966E1AD15}" = lport=139 | protocol=6 | dir=in | app=system | 

"{D1A0A6D7-F786-4AD0-B038-EB4A7AF1318C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{F57679A0-DCBA-4115-ABB2-5C848DA33036}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{FD9303EE-C883-4CCA-829C-9A1A03CC42EF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0A0E6316-B75D-44D4-9D09-A8AA4AE2495D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 

"{0EBF32A6-AE20-4132-B59A-3DF3F0DA1014}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{1081435F-B0A4-4DFE-8A9B-D1CC56FB438E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{1BD54DB0-A7FF-487C-A966-09AE5EC55176}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{1F9581D2-120E-4AF8-A1E5-FB19DAEA1180}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 

"{1FC5E5A5-B765-4C28-9429-B66E45D436EB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{220685ED-51AD-4E46-A9AC-285FCC5D2D9A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{3EA6C945-226A-4E6C-A902-8607A9A6208A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 

"{444CC8E2-FDB3-4D81-BA2C-AC12F1B26CC3}" = protocol=17 | dir=in | app=c:\users\***\appdata\roaming\bittorrent\bittorrent.exe | 

"{48237C05-5D9E-4FC6-8882-39D0C43F8052}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{49B136C4-BA68-42FE-8665-B58C010B263F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{52AD0815-8173-48E4-A70C-06BD785F8805}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{55126F6C-EEF8-48DF-A20E-9BC003E4771F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{5E9734D6-134B-4972-AECC-B55C2B6E306E}" = protocol=6 | dir=in | app=c:\users\***\appdata\roaming\bittorrent\bittorrent.exe | 

"{6C7AA1ED-51D0-4E7E-8DF9-E66749413BF5}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 

"{7B8A17A0-9729-4CBA-BB74-7F465E8EFCD2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{840EF89D-5C07-468F-B17F-30734E2F37B7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{8A5CAC85-A3F2-42FF-95BF-A64BA0FCFF92}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{8D2F05F7-DD11-4504-B828-702ED3710CE4}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 

"{8F063615-F675-4715-8162-B08FBAC00F6B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{94FCD0B6-377A-49BE-8F2C-70A75D1070C3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{95D19886-82C4-4134-8153-9509D9F51B3F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 

"{97AC9D4B-3D2A-4DA6-A148-4E903ED74A5D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 

"{9A9683D3-26D6-46B1-9ACE-035D921C8FF5}" = protocol=6 | dir=out | app=system | 

"{A15AF81A-419A-43E2-B696-8157BA8D7C39}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{A3A03D2E-4858-4AB8-9D0C-4EE03702431B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 

"{A81F58C2-8D87-4604-94A1-F916FA1BD89B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 

"{AECD2C8E-0723-4938-A600-9562897BE70E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 

"{B28D1BDA-9692-46EF-95CA-CCABBDCFA3CC}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 

"{B76221DE-8060-4300-A2E1-4E0CC62D4D8D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{B9F474D4-492F-41F5-99F1-B58E3A56A125}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{D060393B-DB0D-4AD5-B3A5-2B7D5A766663}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 

"{D34D9507-E726-44B0-9E49-31CD3D4AF73B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{DE9F52F8-EFD1-49DB-A022-526DB529EC23}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{E279AB83-AF7B-4B86-A542-BB728E440B16}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 

"{E654A19F-2473-40EA-9572-24B05B7BB823}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 

"{FD08BFE7-6E24-4B44-AB91-32D9346F7F70}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 

"{FF87606B-8B86-4AA9-9E4A-E2970268EB23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"TCP Query User{0A72BFE8-F758-4C06-B16A-67107E423453}C:\program files (x86)\jdownloader\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jdownloader\jre\bin\javaw.exe | 

"TCP Query User{83BF158C-F991-45A3-BBC9-0C3C13801C4E}C:\users\***\appdata\local\temp\rarsfx0\bie_kms.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rarsfx0\bie_kms.exe | 

"TCP Query User{D60CA37B-BC06-4938-959A-BEF4F3296A35}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=6 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | 

"UDP Query User{0C854057-D672-41E6-A52C-6B62D15E7A45}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=17 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | 

"UDP Query User{1CB780C2-BFE2-43A0-A17E-7635FABBD5AA}C:\program files (x86)\jdownloader\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jdownloader\jre\bin\javaw.exe | 

"UDP Query User{71E628E5-8EE5-49F3-B051-47C2C26B6635}C:\users\***\appdata\local\temp\rarsfx0\bie_kms.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rarsfx0\bie_kms.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"_{BDBFAC49-8877-472F-876B-75ADB7DBC955}" = CorelDRAW Graphics Suite X6 (64-Bit)

"_{EBDC2D0D-1E26-4EF2-BB48-C7E18F7800C6}" = Corel Graphics - Windows Shell Extension

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{10762393-1B90-4AC2-AF1A-4C0C04AE303F}" = CorelDRAW Graphics Suite X6 - VBA (x64)

"{1967EF95-E00B-4669-8B1C-A589BE8BF24F}" = CorelDRAW Graphics Suite X6 - Capture (x64)

"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{1E3A578C-0A7D-4820-990F-B7545C0B2303}" = CorelDRAW Graphics Suite X6 - VSTA (x64)

"{26A24AE4-039D-4CA4-87B4-2F86417015FF}" = Java 7 Update 15 (64-bit)

"{27AE72A4-B217-4CDC-B82B-3311E9D7460E}" = CorelDRAW Graphics Suite X6 - Draw (x64)

"{2C72B5E4-AA34-4F1A-8C7E-468530F9F6A3}" = CorelDRAW Graphics Suite X6 - Photozoom Plugin (x64)

"{35869A6C-BA31-4F23-B52D-BC1B1E41EC1B}" = CorelDRAW Graphics Suite X6 - Common (x64)

"{3933C06C-8239-432B-87FC-F2BDC5B49A10}" = CorelDRAW Graphics Suite X6 - FontNav (x64)

"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64

"{6099F026-0A98-4D40-9B3D-ED2123A8CBD0}" = CorelDRAW Graphics Suite X6 - Redist (x64)

"{7386B5FA-8715-481D-821F-7785110506DF}" = CorelDRAW Graphics Suite X6 - Custom Data (x64)

"{79899C6B-E315-4A3F-8904-02DEAB8D660D}" = Corel Graphics - Windows Shell Extension 32 Bit

"{79A72AAD-7ED4-49D8-872D-D1465061F9DB}" = HP Photosmart Wireless B109n-z All-in-One Driver Software 14.0 Rel. 6

"{7B79AE44-9B76-4815-84E5-ACAC3F0F0278}" = CorelDRAW Graphics Suite X6 - VideoBrowser (x64)

"{90120064-0070-0000-0000-4000000FF1CE}" = Microsoft Visual Basic for Applications 7.1 (x64)

"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010

"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010

"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010

"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

"{90F60409-7000-11D3-8CFE-0150048383C9}" = Microsoft Visual Basic for Applications 7.1 (x64) English

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5

"{96AAAB95-AEBE-437A-B7CA-37C7BE13FFE9}" = CorelDRAW Graphics Suite X6 - Connect (x64)

"{B6DF7031-2843-44FD-9CAB-DECAB4257456}" = CorelDRAW Graphics Suite X6 - IPM

"{BB65D262-3EBC-4F10-89D9-67A320E94EAA}" = CorelDRAW Graphics Suite X6 - EN (x64)

"{BDBFAC49-8877-472F-876B-75ADB7DBC955}" = CorelDRAW Graphics Suite X6 - Setup Files (x64)

"{BE930E38-7BB3-45B6-85B2-5251F374F844}" = 64 Bit HP CIO Components Installer

"{CB00799C-0E4F-4FD1-A046-BD24321BCDFF}" = Classic Shell

"{CCE7423E-1D84-4CD3-9E32-220EC9358D97}" = CorelDRAW Graphics Suite X6 (x64)

"{D7C2687D-924E-4485-B367-C7D95CBF8DDD}" = CorelDRAW Graphics Suite X6 - PHOTO-PAINT (x64)

"{DDE82E3D-20C4-48E1-AE1D-B1F10E42CA44}" = CorelDRAW Graphics Suite X6 - Writing Tools (x64)

"{E699230D-4B5E-411E-9F45-FF50789B18DD}" = CorelDRAW Graphics Suite X6 - Filters (x64)

"{EBDC2D0D-1E26-4EF2-BB48-C7E18F7800C6}" = Corel Graphics - Windows Shell Extension

"HP Imaging Device Functions" = HP Imaging Device Functions 14.0

"HP Smart Web Printing" = HP Smart Web Printing 4.60

"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0

"HPExtendedCapabilities" = HP Customer Participation Program 14.0

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Nero 11 v11.2.4.100 (x64)11.2.4.100" = Nero 11 v11.2.4.100 (x64)

"Shop for HP Supplies" = Shop for HP Supplies

"VLC media player" = VLC media player 2.0.5

"WinRAR archiver" = WinRAR 4.20 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan

"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery

"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant

"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox

"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime

"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status

"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter

"{601F2C04-4E0A-464F-B9FE-4FD140098E21}" = PS_AIO_06_B109n-z_SW_Min

"{628ED0F8-590B-49CF-A525-A1696BD79304}" = Cisco AnyConnect Secure Mobility Client

"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update

"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg

"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting

"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010

"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

"{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1" = Ashampoo Burning Studio 2013 v.11.0.6

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU

"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch

"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2

"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations

"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget

"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp

"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch

"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F428DC33-C0E4-40A8-BFC3-B59957F86FE0}" = B109n-z

"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"5513-1208-7298-9440" = JDownloader 0.9

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Avira AntiVir Desktop" = Avira Free Antivirus

"BitTorrent" = BitTorrent

"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client 

"DAEMON Tools Lite" = DAEMON Tools Lite

"Digitale Bibliothek 5" = Digitale Bibliothek 5

"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Office14.PROPLUS" = Microsoft Office Professional Plus 2010

"Reason5_is1" = Reason 5.0

"Xilisoft AVI to DVD Converter" = Xilisoft AVI to DVD Converter

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 05.04.2013 11:40:09 | Computer Name = ***-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\$RECYCLE.BIN\S-1-5-21-685492123-839081689-2851511556-1001\$REZ87ZT.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

 

Error - 06.04.2013 10:29:32 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NeroAudioRip.exe.Manifest".  Die abhängige Assemblierung

 "OnlineServices,version="11.0.0.0"" konnte nicht gefunden werden.  Verwenden Sie 

für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 06.04.2013 10:29:33 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NMDllHost.exe.Manifest".  Die abhängige Assemblierung

 "Startup,type="win32",version="11.1.0.0"" konnte nicht gefunden werden.  Verwenden

 Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 08.04.2013 06:21:30 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NeroAudioRip.exe.Manifest".  Die abhängige Assemblierung

 "OnlineServices,version="11.0.0.0"" konnte nicht gefunden werden.  Verwenden Sie 

für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 08.04.2013 06:21:30 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NMDllHost.exe.Manifest".  Die abhängige Assemblierung

 "Startup,type="win32",version="11.1.0.0"" konnte nicht gefunden werden.  Verwenden

 Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 10.04.2013 05:02:31 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NeroAudioRip.exe.Manifest".  Die abhängige Assemblierung

 "OnlineServices,version="11.0.0.0"" konnte nicht gefunden werden.  Verwenden Sie 

für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 10.04.2013 05:02:32 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NMDllHost.exe.Manifest".  Die abhängige Assemblierung

 "Startup,type="win32",version="11.1.0.0"" konnte nicht gefunden werden.  Verwenden

 Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 11.04.2013 06:38:25 | Computer Name = ***-PC | Source = Microsoft Office 14 | ID = 2001

Description = Microsoft Outlook: Rejected Safe Mode action : Outlook konnte zuletzt

 nicht korrekt gestartet werden. Das Starten von Outlook im abgesicherten Modus 

hilft Ihnen, ein Startproblem zu korrigieren oder zu isolieren, sodass Sie das Programm

 erfolgreich starten können. Einige Funktionen können in diesem Modus deaktiviert

 sein.  Möchten Sie Outlook im abgesicherten Modus starten?.

 

Error - 11.04.2013 08:50:51 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NeroAudioRip.exe.Manifest".  Die abhängige Assemblierung

 "OnlineServices,version="11.0.0.0"" konnte nicht gefunden werden.  Verwenden Sie 

für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

Error - 11.04.2013 08:50:51 | Computer Name = ***-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Portable\nero

 11 v11.2.4.100 (x64)\App\Nero\NMDllHost.exe.Manifest".  Die abhängige Assemblierung

 "Startup,type="win32",version="11.1.0.0"" konnte nicht gefunden werden.  Verwenden

 Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

 

[ Cisco AnyConnect Secure Mobility Client Events ]

Error - 30.03.2013 17:56:22 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 732 Invoked Function: CNetEnvironment::testDnsAccess Return Code: -29294576 (0xFE410010)

Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:27 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testDnsAccess File: .\NetEnvironment.cpp

Line:

 883 Invoked Function: DNSRequest::Query Return Code: -29294576 (0xFE410010) Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:27 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 732 Invoked Function: CNetEnvironment::testDnsAccess Return Code: -29294576 (0xFE410010)

Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:32 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testDnsAccess File: .\NetEnvironment.cpp

Line:

 883 Invoked Function: DNSRequest::Query Return Code: -29294576 (0xFE410010) Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:32 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 732 Invoked Function: CNetEnvironment::testDnsAccess Return Code: -29294576 (0xFE410010)

Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:54 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testDnsAccess File: .\NetEnvironment.cpp

Line:

 883 Invoked Function: DNSRequest::Query Return Code: -29294576 (0xFE410010) Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:54 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 732 Invoked Function: CNetEnvironment::testDnsAccess Return Code: -29294576 (0xFE410010)

Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:54 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:

 224 Invoked Function: CNetEnvironment::testNetwork Return Code: -29294576 (0xFE410010)

Description:

 DNSREQUEST_ERROR_NO_DNS_RESOLVERS 

 

Error - 30.03.2013 17:56:54 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp

Line:

 9241 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -28835824

 (0xFE480010) Description: HOSTCONFIGMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE 

 

Error - 30.03.2013 17:56:54 | Computer Name = ***-PC | Source = acvpnagent | ID = 67108866

Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 5038

Invoked

 Function: CMainThread::applyHostConfigForNoVpn Return Code: -28835824 (0xFE480010)

Description:

 HOSTCONFIGMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE 

 

[ System Events ]

Error - 11.04.2013 05:54:37 | Computer Name = ***-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 11.04.2013 05:54:37 | Computer Name = ***-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 11.04.2013 06:29:56 | Computer Name = ***-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 11.04.2013 06:29:56 | Computer Name = ***-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 11.04.2013 06:30:05 | Computer Name = ***-PC | Source = ACPI | ID = 327693

Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen

 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware

 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 

den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen

 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

 

Error - 11.04.2013 12:24:59 | Computer Name = ***-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 11.04.2013 12:32:09 | Computer Name = ***-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 11.04.2013 12:32:09 | Computer Name = ***-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 11.04.2013 13:37:09 | Computer Name = ***-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 11.04.2013 13:37:09 | Computer Name = ***-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

 

< End of report >

Ich bin für jede Hilfe dankbar!