So, GMER Log diesmal richtig:
GMER Logfile: Code:
GMER 1.0.14.14536 - hxxp://www.gmer.net
Rootkit scan 2010-11-23 17:36:49
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT F7F55DFC ZwCreateThread
SSDT F7F55DE8 ZwOpenProcess
SSDT F7F55DED ZwOpenThread
SSDT F7F55DF7 ZwTerminateProcess
SSDT F7F55DF2 ZwWriteVirtualMemory
---- User code sections - GMER 1.0.14 ----
.text C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes JMP 00D1ADCD
.text C:\WINDOWS\System32\svchost.exe[1236] NETAPI32.dll!NetpwPathCanonicalize 597DA101 5 Bytes JMP 00D1AD64
.text C:\WINDOWS\System32\svchost.exe[1388] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes JMP 007CADCD
---- Services - GMER 1.0.14 ----
Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] ilkij <-- ROOTKIT !!!
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@DisplayName Installer Center
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Description Erm?glicht einem Benutzer, automatische Vorg?nge auf diesem Computer zu konfigurieren und zu planen. Wenn dieser Dienst beendet wird, werden diese Vorg?nge nicht zu den geplanten Zeiten ausgef?hrt werden. Wenn dieser Dienst deaktiviert wird, werden alle von diesem Dienst explizit abh?ngigen Dienste nicht gestartet werden k?nnen.
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\Services\ilkij\Parameters@ServiceDll C:\WINDOWS\system32\coiemqx.dll
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@DisplayName Installer Center
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@Type 32
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@Start 2
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij@Description Erm?glicht einem Benutzer, automatische Vorg?nge auf diesem Computer zu konfigurieren und zu planen. Wenn dieser Dienst beendet wird, werden diese Vorg?nge nicht zu den geplanten Zeiten ausgef?hrt werden. Wenn dieser Dienst deaktiviert wird, werden alle von diesem Dienst explizit abh?ngigen Dienste nicht gestartet werden k?nnen.
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij\Parameters
Reg HKLM\SYSTEM\ControlSet003\Services\ilkij\Parameters@ServiceDll C:\WINDOWS\system32\coiemqx.dll
---- EOF - GMER 1.0.14 ---- --- --- ---
OTL.txtOTL Logfile: Code:
OTL logfile created on: 23.11.2010 17:42:54 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
479,00 Mb Total Physical Memory | 77,00 Mb Available Physical Memory | 16,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 8,90 Gb Free Space | 23,88% Space Free | Partition Type: NTFS
Computer Name: MAERCHENSTUNDE | User Name: Julia Madeleine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Programme\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe (Popwire AB)
PRC - C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
PRC - C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe (Teleca Software Solutions)
PRC - C:\WINDOWS\system32\bmwebcfg.exe (Bytemobile, Inc.)
PRC - C:\WINDOWS\system32\LXSUPMON.EXE (Lexmark International Inc.)
========== Modules (SafeList) ==========
MOD - C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (AntiVirScheduler) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (bmwebcfg) -- C:\WINDOWS\System32\bmwebcfg.exe (Bytemobile, Inc.)
========== Driver Services (SafeList) ==========
DRV - (MEMSWEEP2) -- C:\WINDOWS\System32\4.tmp File not found
DRV - (gmer) -- C:\WINDOWS\system32\drivers\gmer.sys (GMER)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (ewusbnet) -- C:\WINDOWS\system32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (VIAudio) Vinyl AC'97 Audio Controller (WDM) -- C:\WINDOWS\system32\drivers\vinyl97.sys (VIA Technologies, Inc.)
DRV - (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM) -- C:\WINDOWS\system32\drivers\se27unic.sys (MCCI)
DRV - (SE27obex) -- C:\WINDOWS\system32\drivers\SE27obex.sys (MCCI)
DRV - (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS) -- C:\WINDOWS\system32\drivers\se27nd5.sys (MCCI)
DRV - (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\SE27mgmt.sys (MCCI)
DRV - (SE27mdm) -- C:\WINDOWS\system32\drivers\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) -- C:\WINDOWS\system32\drivers\SE27mdfl.sys (MCCI)
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\SE27bus.sys (MCCI)
DRV - (w810obex) -- C:\WINDOWS\system32\drivers\w810obex.sys (MCCI)
DRV - (w810mdm) -- C:\WINDOWS\system32\drivers\w810mdm.sys (MCCI)
DRV - (w810mdfl) -- C:\WINDOWS\system32\drivers\w810mdfl.sys (MCCI)
DRV - (w810bus) Sony Ericsson W810 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\w810bus.sys (MCCI)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (cs429x) -- C:\WINDOWS\system32\drivers\cwawdm.sys (Cirrus Logic Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?o=101764&l=dis
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..network.proxy.type: 4
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.11.23 16:24:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.11.23 16:24:28 | 000,000,000 | ---D | M]
[2010.08.31 11:48:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Extensions
[2010.11.23 16:40:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions
[2008.02.14 13:37:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.01.24 19:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010.11.23 16:36:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-1.xml
[2008.03.27 14:14:34 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-2.xml
[2008.04.27 11:48:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-3.xml
[2009.01.07 20:42:22 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-4.xml
[2008.02.14 13:36:33 | 000,000,962 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin.xml
[2010.11.23 16:36:18 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.09.04 01:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npbittorrent.dll
[2010.10.27 06:24:34 | 000,001,538 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010.10.27 06:24:34 | 000,000,947 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010.10.27 06:24:34 | 000,000,769 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010.10.27 06:24:34 | 000,001,135 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-en-GB.xml
O1 HOSTS File: ([2001.08.23 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (ICQ Toolbar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll File not found
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (ICQ Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O4 - HKLM..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [High Defination Audio] C:\WINDOWS\HDaudio.exe File not found
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE (Lexmark International Inc.)
O4 - HKLM..\Run: [Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1757981266-764733703-854245398-1003..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Cisco Systems VPN Client.lnk = C:\Programme\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O15 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..Trusted Domains: ([]msn in Arbeitsplatz)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.24 15:35:57 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\AutoPlay\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\AutoRun\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Explore\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Open\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Scan\command - "" = G:\
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{2e8db1a0-5900-11dd-a0c8-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{2e8db1a0-5900-11dd-a0c8-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{959094b0-d9b6-11de-a341-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{959094b0-d9b6-11de-a341-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\AutoPlay\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\AutoRun\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Explore\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Open\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Scan\command - "" = F:\
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\AutoRun\command - "" = gabptk6d.bat
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\explore\Command - "" = gabptk6d.bat
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\open\Command - "" = gabptk6d.bat
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{d5f76961-a4ad-11dc-9f39-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{d5f76961-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\F\Shell\AutoPlay\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Explore\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Open\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Scan\command - "" = F:\
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: ilkij - C:\WINDOWS\System32\coiemqx.dll File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OneNote 2007 Screen Clipper and Launcher.lnk - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk - C:\Programme\OpenOffice.org 2.3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= - C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: Load - hkey= - key= - Reg Error: Value error. File not found
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - Microsoft .NET Framework 1.1 Hotfix (KB928366)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)
========== Files/Folders - Created Within 30 Days ==========
[2010.11.23 16:55:08 | 000,085,969 | ---- | C] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010.11.23 15:45:00 | 000,957,288 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Julia Madeleine\Desktop\Q815485_WXP_SP2_x86_DEU.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010.11.23 17:24:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.11.23 16:55:08 | 000,085,969 | ---- | M] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010.11.23 16:55:08 | 000,000,080 | ---- | M] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010.11.23 16:55:07 | 000,884,736 | ---- | M] () -- C:\WINDOWS\gmer.dll
[2010.11.23 16:55:01 | 000,811,008 | ---- | M] () -- C:\WINDOWS\gmer.exe
[2010.11.23 16:24:39 | 000,001,566 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.11.23 16:17:28 | 000,075,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.11.23 15:45:01 | 000,957,288 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Julia Madeleine\Desktop\Q815485_WXP_SP2_x86_DEU.exe
[2010.11.23 14:41:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.11.19 18:02:17 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.10.31 08:26:00 | 000,394,478 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.10.31 08:26:00 | 000,383,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.10.31 08:26:00 | 000,064,820 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.10.31 08:26:00 | 000,053,942 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010.11.23 16:55:08 | 000,000,080 | ---- | C] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010.11.23 16:55:07 | 000,884,736 | ---- | C] () -- C:\WINDOWS\gmer.dll
[2010.11.23 16:55:07 | 000,811,008 | ---- | C] () -- C:\WINDOWS\gmer.exe
[2010.11.23 16:24:39 | 000,001,566 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2008.05.22 21:37:19 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2008.04.13 14:32:14 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxazlcnp.dll
[2007.11.27 20:59:25 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.11.26 16:51:29 | 000,029,744 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2007.11.26 16:50:39 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007.11.26 16:50:37 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007.11.26 16:10:31 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2007.11.26 16:05:27 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2007.11.26 14:23:42 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2007.11.26 12:49:31 | 000,115,200 | ---- | C] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.11.26 12:32:59 | 000,000,148 | ---- | C] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.11.24 17:04:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2007.11.24 15:27:09 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001.12.03 14:48:36 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll
[2001.12.03 14:48:36 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll
[2001.12.03 14:48:36 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll
[2001.12.03 14:48:36 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll
[2001.12.03 14:48:36 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll
[2001.12.03 14:48:36 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll
[2001.12.03 14:48:36 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll
[2001.12.03 14:48:32 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
========== LOP Check ==========
[2007.11.24 16:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ACD Systems
[2007.11.26 15:10:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2007.11.26 12:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2007.12.09 14:51:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ACD Systems
[2010.02.24 06:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\BitTorrent
[2010.11.23 16:32:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\DNA
[2008.02.12 20:17:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ
[2009.01.06 22:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ Toolbar
[2007.12.09 15:27:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Leadertech
[2007.11.26 12:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Teleca
[2007.11.26 15:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Bytemobile
========== Purity Check ==========
========== Custom Scans ==========
< %ALLUSERSPROFILE%\Application Data\*. >
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
< %APPDATA%\*. >
[2008.10.15 18:03:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\.clamwin
[2007.12.09 14:51:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ACD Systems
[2007.11.26 12:29:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Adobe
[2007.11.24 19:08:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\AdobeUM
[2009.03.27 15:11:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Ahead
[2008.08.14 16:16:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Apple Computer
[2010.02.24 06:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\BitTorrent
[2010.11.23 16:32:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\DNA
[2010.11.12 22:08:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\dvdcss
[2007.12.02 01:47:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Google
[2007.12.05 23:43:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Help
[2008.02.12 20:17:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ
[2009.01.06 22:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ Toolbar
[2007.11.24 15:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Identities
[2008.02.12 20:12:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\InstallShield
[2007.11.24 17:14:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Intel
[2007.12.09 15:27:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Leadertech
[2007.12.01 20:24:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Macromedia
[2010.05.23 10:55:48 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft
[2010.11.23 16:23:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla
[2007.11.24 19:08:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\MSN6
[2009.05.05 20:11:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\OpenOffice.org2
[2007.11.26 12:24:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Sony Ericsson
[2007.12.11 16:19:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Sun
[2007.11.26 12:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Teleca
[2007.11.26 16:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\vlc
[2007.11.26 16:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\WinRAR
< %APPDATA%\*.exe /s >
[2007.11.24 16:04:22 | 000,053,248 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ACDSee_Dsktp_Shtcut.exe
[2007.11.24 16:04:22 | 000,053,248 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ACDSee_PM_Shtcut.exe
[2007.11.24 16:04:22 | 002,592,768 | R--- | M] (ACD Systems, Ltd.) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ARPPRODUCTICON.exe
[2007.11.24 16:04:22 | 000,012,062 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\FotoCanvasLite_Dsktp_Shtcut.exe
[2007.11.24 16:04:22 | 000,012,062 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\FotoCanvasLite_PM_Shtcut.exe
< %SYSTEMDRIVE%\*.exe >
< MD5 for: AGP440.SYS >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >
[2002.08.29 03:52:58 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2002.08.29 01:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll
[2002.08.29 03:43:22 | 000,049,152 | ---- | M] (Microsoft Corporation) MD5=B9358A1FB66CF656328FD8B792B2CCC4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: EXPLORER.EXE >
[2002.08.29 03:43:36 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\explorer.exe
[2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\explorer.exe
[2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\system32\dllcache\explorer.exe
< MD5 for: NETLOGON.DLL >
[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2002.08.29 03:43:26 | 000,399,360 | ---- | M] (Microsoft Corporation) MD5=BCA549B21E651111CE7BAD0FC8C45F4B -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\netlogon.dll
< MD5 for: SCECLI.DLL >
[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll
[2002.08.29 03:43:30 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=ADD49C10F5DADFA81912D124FE1C9A99 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
< MD5 for: USER32.DLL >
[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\dllcache\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\user32.dll
[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2002.08.29 03:43:32 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=E3DAFFDB1C86C1AEAC1B205F6CF67009 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
< MD5 for: USERINIT.EXE >
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2002.08.29 03:43:42 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
< MD5 for: WINLOGON.EXE >
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
[2002.08.29 03:43:42 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
[2007.11.24 16:25:15 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007.11.24 16:25:15 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007.11.24 16:25:15 | 000,401,408 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report > --- --- ---
Extras.txtOTL Logfile: Code:
OTL Extras logfile created on: 23.11.2010 17:42:54 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
479,00 Mb Total Physical Memory | 77,00 Mb Available Physical Memory | 16,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 8,90 Gb Free Space | 23,88% Space Free | Partition Type: NTFS
Computer Name: MAERCHENSTUNDE | User Name: Julia Madeleine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
":TCP" = :TCP:*:Enabled:Explorer
"9357:TCP" = 9357:TCP:*:Enabled:daxekgk
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Programme\BitTorrent\bittorrent.exe" = C:\Programme\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\WINDOWS\HDaudio.exe" = C:\WINDOWS\HDaudio.exe:*:Enabled:Explorer -- File not found
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{24561814-4815-4387-AC59-05DDEC5AF013}" = ACDSee 4.0.1 Standard
"{29FB1084-25B5-4F29-9BC0-16BBB6ECB52B}" = OpenOffice.org 2.3
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35B91753-5789-4517-9CF1-2CCE3A8CF4F1}" = Apple Mobile Device Support
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{52809086-618D-4F0B-8BF1-B75A5BB817A4}" = Sony Ericsson PC Suite
"{5624C000-B109-11D4-9DB4-00E0290FCAC5}" = VPN Client
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EF6C4600-306D-4F6A-A119-C2A877D25B4A}" = iTunes
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FFAB5ABB-8AAB-42E2-847F-1743E51E01E9}" = Disc2Phone
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"Ask Toolbar_is1" = Ask Toolbar
"Connection Manager" = Connection Manager deinstallieren
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Lexmark Supplies Monitor" = Lexmark Supplies Monitor
"Lexmark Z45" = Lexmark Z45
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"ProInst" = Intel(R) PROSet/Wireless Software
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR
"WinZip" = WinZip
"XTTB00001.XTTB00001Toolbar" = ICQ Toolbar
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 22.11.2009 11:10:32 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.3156, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 06.02.2010 16:08:31 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 10.08.2010 05:08:04 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung HDaudio.exe, Version 4.1.0.24, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 04.09.2010 08:58:47 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 04.09.2010 09:02:44 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung capabilitymanager.exe, Version 1.2.0.70,
fehlgeschlagenes Modul wininet.dll, Version 6.0.2900.3462, Fehleradresse 0x00003670.
Error - 04.09.2010 12:06:37 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes
Modul dbghelp.dll, Version 5.1.2600.2180, Fehleradresse 0x0001295d.
Error - 25.10.2010 09:17:35 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung HDaudio.exe, Version 4.1.0.24, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 25.10.2010 09:18:19 | Computer Name = MAERCHENSTUNDE | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 winword.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2180, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.
Error - 25.10.2010 09:18:39 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.4518.1014, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 25.10.2010 09:19:23 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.4518.1014, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
[ OSession Events ]
Error - 01.01.2008 20:41:15 | Computer Name = MAERCHENSTUNDE | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 8112 seconds with 7920 seconds of active time. This session ended with a
crash.
[ System Events ]
Error - 23.11.2010 10:15:05 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 31012
Description = Es ist ein Fehler bei der Übertragung der lokalen Liste der Namensauflösungsserver
zum DNS-Proxy-Agenten aufgetreten. Einige DNS- oder WINS-Server sind für Clients
des lokalen Netzwerks nicht erreichbar. Die Daten enthalten den Fehlercode.
Error - 23.11.2010 10:15:12 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.20 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 23.11.2010 10:15:29 | Computer Name = MAERCHENSTUNDE | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
Peer "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
Minuten wiederholt. Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
(0x80072751)
Error - 23.11.2010 10:15:29 | Computer Name = MAERCHENSTUNDE | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 23.11.2010 10:42:40 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 23.11.2010 11:11:42 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Installer Center" wurde mit folgendem Fehler beendet:
%%1114
Error - 23.11.2010 11:12:01 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 23.11.2010 11:40:23 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst AntiVirScheduler.
Error - 23.11.2010 12:24:57 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Installer Center" wurde mit folgendem Fehler beendet:
%%1114
Error - 23.11.2010 12:37:41 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
< End of report > --- --- --- |