Fake HDD. Schwarzer Bildschirm, Nachricht festplatte beschädight private Daten in Gefahr.

peahi

Hallo Trojaner Board

Ich hoffe sehr das Ihr mir helfen könnt. Gestern habe ich die Nachricht bekommen dass meine Festplatte beschädigt sei, nach Recherche im Forum scheint dies ein Virus zu sein. Ich habe mir Malwarebytes einen kompletten Scan durchgeführt das Logfile ist hier:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6897

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20.06.2011 03:18:00
mbam-log-2011-06-20 (03-18-00).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 306613
Laufzeit: 2 Stunde(n), 52 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EYcdebEQBmb (Trojan.FakeHDD) -> Value: EYcdebEQBmb -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\all users\anwendungsdaten\eycdebeqbmb.exe (Trojan.FakeHDD) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\24567588.exe (Trojan.Agent.PF) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Matthias\lokale einstellungen\Temp\jar_cache3676098246424999735.tmp (Trojan.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{08a5f15b-d5f0-4d17-893d-8b358608dcf6}\RP664\A0308250.exe (Trojan.Agent.PF) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\19317.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\spool\prtprocs\w32x86\20016.tmp (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.


Danach habe ich die infizierten dateien bereinigt und mit OTL einen benutzerdefinierten Quickscan durchgeführt wie es im Forum beschrieben ist.
Das Logfile ist hier:

OTL logfile created on: 21.06.2011 01:15:59 - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Dokumente und Einstellungen\Matthias\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,37 Mb Total Physical Memory | 77,23 Mb Available Physical Memory | 15,10% Memory free
1,22 Gb Paging File | 0,75 Gb Available in Paging File | 61,80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 52,80 Gb Total Space | 4,80 Gb Free Space | 9,10% Space Free | Partition Type: NTFS

Computer Name: PC-PEAHI-KANAL | User Name: Matthias | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.06.20 03:32:40 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe
PRC - [2011.02.11 07:34:33 | 000,230,640 | -H-- | M] (Sophos Plc) -- c:\Programme\Sophos\AutoUpdate\ALsvc.exe
PRC - [2011.02.11 07:34:23 | 000,439,536 | -H-- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe
PRC - [2011.02.11 07:29:26 | 001,541,360 | -H-- | M] (Sophos Plc) -- c:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2011.02.11 07:27:40 | 000,097,520 | -H-- | M] (Sophos Plc) -- c:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2011.02.11 07:26:45 | 000,163,056 | -H-- | M] (Sophos Plc) -- c:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2011.02.02 00:48:50 | 000,604,408 | -H-- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2010.06.10 21:03:08 | 000,144,176 | -H-- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.10.30 15:59:54 | 000,385,024 | -H-- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2004.09.13 17:33:20 | 000,155,648 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Programme\Apoint\Apoint.exe
PRC - [2004.09.07 17:12:32 | 000,225,353 | -H-- | M] (Intel® Corporation) -- C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2004.09.07 17:08:02 | 000,389,120 | -H-- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2004.09.07 17:03:40 | 000,245,760 | -H-- | M] (Intel) -- C:\Programme\Intel\Wireless\Bin\1XConfig.exe
PRC - [2004.08.19 15:40:08 | 000,045,056 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Programme\Apoint\ApntEx.exe
PRC - [2004.07.27 17:50:18 | 000,081,920 | -H-- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2011.06.20 03:32:40 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe
MOD - [2011.02.11 07:30:30 | 000,234,408 | -H-- | M] (Sophos Plc) -- c:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll
MOD - [2010.08.23 18:11:46 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.02.11 07:34:33 | 000,230,640 | -H-- | M] (Sophos Plc) [Auto | Running] -- c:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2011.02.11 07:29:26 | 001,541,360 | -H-- | M] (Sophos Plc) [Auto | Running] -- c:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2011.02.11 07:27:40 | 000,097,520 | -H-- | M] (Sophos Plc) [Unknown | Running] -- c:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2011.02.11 07:26:45 | 000,163,056 | -H-- | M] (Sophos Plc) [Unknown | Running] -- c:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2011.02.02 00:48:50 | 000,604,408 | -H-- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2010.06.10 21:03:08 | 000,144,176 | -H-- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2005.04.04 00:41:10 | 000,069,632 | -H-- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004.09.07 17:12:32 | 000,225,353 | -H-- | M] (Intel® Corporation) [Auto | Running] -- C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER)


========== Driver Services (SafeList) ==========

DRV - [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.02.11 07:28:45 | 000,024,064 | -H-- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2011.02.11 07:27:58 | 000,023,928 | -H-- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)
DRV - [2011.02.11 07:27:42 | 000,153,344 | -H-- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2011.02.02 00:33:39 | 000,019,680 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpnva.sys -- (vpnva)
DRV - [2008.09.30 11:50:44 | 000,014,976 | -H-- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008.04.17 17:59:02 | 000,015,616 | RH-- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw95rc.sys -- (hcw95rc)
DRV - [2008.04.17 17:58:00 | 000,560,640 | RH-- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw95bda.sys -- (hcw95bda)
DRV - [2008.04.13 20:46:22 | 000,015,232 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2005.05.13 03:46:20 | 001,132,544 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.03.10 23:56:06 | 000,273,168 | -H-- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004.11.16 17:03:52 | 000,108,791 | -H-- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2004.10.21 21:56:04 | 003,210,496 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2004.08.31 09:53:04 | 000,011,354 | -H-- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2004.08.18 15:53:54 | 000,016,128 | -H-- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004.08.12 09:44:04 | 000,234,496 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA)
DRV - [2004.06.17 21:57:02 | 000,200,064 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004.06.17 21:55:38 | 000,685,056 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004.06.17 21:55:04 | 001,041,536 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004.05.26 21:18:18 | 000,044,928 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004.02.13 17:46:00 | 000,017,153 | -H-- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:de-DEfficial"


[2009.07.11 20:40:18 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\qlf6uq2c.default\extensions
[2008.05.06 12:53:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2005.08.27 13:44:00 | 001,312,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPSWF32.dll

O1 HOSTS File: ([2004.08.04 15:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - c:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] File not found
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] c:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - HKCU..\Run: [bcjxhf] File not found
O4 - Startup: C:\Dokumente und Einstellungen\Matthias\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_13.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://86.47.108.229:5600/activex/AMC.cab (AxisMediaControlEmb Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (c:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - c:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\IntelWireless: DllName - C:\Programme\Intel\Wireless\Bin\LgNotify.dll - C:\Programme\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.18 14:18:44 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{09c7109a-e059-11df-b683-00123fe7f55c}\Shell\AutoRun\command - "" = usbControl.exe
O33 - MountPoints2\{524811af-ea21-11de-b5f6-00123fe7f55c}\Shell\AutoRun\command - "" = WDSetup.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - Services: "Bonjour Service"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Philips Geräte-Manager.lnk - C:\Programme\Philips\SA28XX Device Manager\main.exe - (KeenHigh Tech.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinTV Recording Status..lnk - - File not found
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found
MsConfig - StartUpReg: DMXLauncher - hkey= - key= - C:\Programme\Dell\Media Experience\DMXLauncher.exe ()
MsConfig - StartUpReg: DVDLauncher - hkey= - key= - C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
MsConfig - StartUpReg: Free Download Manager - hkey= - key= - File not found
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Programme\Winamp\winampa.exe ()
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17465059307421696)

========== Files/Folders - Created Within 30 Days ==========

[2011.06.20 03:33:28 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe
[2011.06.19 19:47:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Malwarebytes
[2011.06.19 19:47:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.06.19 19:47:00 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.06.19 19:46:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.06.19 19:46:52 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.06.19 19:21:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Matthias\Recent
[2011.06.19 12:07:16 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Matthias\Startmenü\Programme\Windows XP Repair
[2011.06.17 03:03:54 | 000,000,000 | -H-D | C] -- C:\WINDOWS\SxsCaPendDel
[2011.06.13 18:35:58 | 000,000,000 | -H-D | C] -- C:\texlive
[2011.06.13 16:28:14 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\MiKTeX 2.9 Setup
[2011.06.13 15:42:44 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\MiKTeX
[2011.06.13 15:13:54 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MiKTeX 2.9
[2011.06.13 15:01:22 | 000,000,000 | -H-D | C] -- C:\Programme\MiKTeX 2.9
[2011.06.13 14:30:03 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeXnicCenter
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.06.21 01:11:47 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\defogger_reenable
[2011.06.21 01:10:35 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Defogger.exe
[2011.06.21 00:56:47 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9EA50C78-1918-4612-9792-C25A3B324B6C}.job
[2011.06.21 00:55:21 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.06.21 00:55:11 | 000,001,088 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.21 00:54:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.06.21 00:54:02 | 536,281,088 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.20 03:33:11 | 000,001,092 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.20 03:32:40 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe
[2011.06.19 19:47:03 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.19 19:21:48 | 000,000,336 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\24567588
[2011.06.19 12:07:19 | 000,000,825 | -H-- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Windows XP Repair.lnk
[2011.06.17 03:09:47 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011.06.13 14:30:04 | 000,000,759 | -H-- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\TeXnicCenter.lnk
[2011.06.02 16:43:46 | 273,759,542 | -H-- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Surf Cult California.mov
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.05.26 23:56:57 | 000,001,045 | -H-- | M] () -- C:\Dokumente und Einstellungen\Matthias\Startmenü\Programme\Autostart\Dropbox.lnk
[2011.05.26 23:56:57 | 000,001,045 | -H-- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Dropbox.lnk
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.06.21 01:11:47 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\defogger_reenable
[2011.06.21 01:10:31 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Defogger.exe
[2011.06.19 19:47:03 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.19 19:21:48 | 000,000,336 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\24567588
[2011.06.19 12:07:19 | 000,000,825 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Windows XP Repair.lnk
[2011.06.14 00:22:35 | 273,759,542 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Surf Cult California.mov
[2011.06.13 14:30:04 | 000,000,759 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\TeXnicCenter.lnk
[2011.06.08 21:49:05 | 675,214,823 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Stoked and Broke.mov
[2011.04.20 10:50:06 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\ltserial.dll
[2011.04.07 23:32:58 | 000,110,080 | -H-- | C] () -- C:\WINDOWS\System32\advd.dll
[2011.04.07 23:32:58 | 000,023,040 | -H-- | C] () -- C:\WINDOWS\System32\auth.dll
[2011.04.07 23:32:57 | 000,237,568 | -H-- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2011.02.23 23:20:40 | 000,000,099 | -H-- | C] () -- C:\WINDOWS\abreg.ini
[2010.10.18 17:14:21 | 000,078,528 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.07.10 16:41:15 | 000,149,504 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.EXE
[2010.07.10 16:40:34 | 000,032,825 | -H-- | C] () -- C:\WINDOWS\Irremote.ini
[2010.07.10 16:39:58 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\dmcrypto.dll
[2010.07.10 16:37:59 | 000,163,840 | -H-- | C] () -- C:\WINDOWS\System32\hcwChDB.dll
[2009.12.13 12:31:07 | 000,247,643 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\bcjxhf_nav.dat
[2009.12.13 12:31:07 | 000,004,829 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\bcjxhf_navps.dat
[2009.12.13 12:31:07 | 000,003,285 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\bcjxhf.dat
[2009.07.11 21:03:01 | 000,142,337 | -H-- | C] () -- C:\WINDOWS\System32\Wait.exe
[2009.07.11 21:02:16 | 000,006,361 | -H-- | C] () -- C:\WINDOWS\HCWPNP.INI
[2009.07.11 20:59:54 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2009.04.17 13:59:26 | 000,000,020 | -H-- | C] () -- C:\WINDOWS\ACMPro.ini
[2009.02.20 10:21:33 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.12.30 13:24:16 | 000,000,043 | -H-- | C] () -- C:\WINDOWS\gswin32.ini
[2008.07.01 10:13:26 | 000,000,004 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sysqcl1129139270.dat
[2008.05.29 11:21:00 | 000,000,295 | -H-- | C] () -- C:\WINDOWS\MindMan.INI
[2008.04.21 12:22:55 | 000,001,759 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2006.07.12 19:17:14 | 000,679,936 | -H-- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006.07.12 19:17:14 | 000,188,416 | -H-- | C] () -- C:\WINDOWS\System32\libfaac.dll
[2006.07.12 19:17:14 | 000,182,488 | -H-- | C] () -- C:\WINDOWS\System32\libvorbis-0.dll
[2006.07.12 19:17:14 | 000,052,474 | -H-- | C] () -- C:\WINDOWS\System32\libogg-0.dll
[2006.07.12 19:17:13 | 006,753,149 | -H-- | C] () -- C:\WINDOWS\System32\encoderc.dll
[2006.05.04 10:36:12 | 000,245,760 | RH-- | C] () -- C:\WINDOWS\System32\setupsup.dll
[2005.11.23 06:00:00 | 000,778,240 | -H-- | C] () -- C:\WINDOWS\System32\DivXsm.exe
[2005.10.23 12:21:34 | 000,000,507 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2005.10.09 19:20:04 | 000,126,976 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005.10.07 16:30:59 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2005.10.07 16:30:53 | 000,100,489 | -H-- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005.10.07 16:30:02 | 000,003,247 | -H-- | C] () -- C:\WINDOWS\mozver.dat
[2005.10.07 16:29:29 | 000,000,155 | -H-- | C] () -- C:\WINDOWS\winamp.ini
[2005.10.06 03:52:26 | 000,000,141 | -H-- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005.09.23 12:40:03 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2005.09.23 12:35:44 | 000,000,138 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2005.09.23 12:25:32 | 000,000,004 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QSLLPSVCShare
[2005.09.23 12:03:38 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2005.09.23 12:03:20 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\setpwrcg.exe
[2005.09.23 12:02:52 | 000,087,540 | -H-- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2005.09.23 12:02:48 | 000,000,412 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.08.12 23:57:09 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.04.09 18:04:54 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\px.ini
[2004.08.18 14:26:49 | 000,000,849 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.18 14:22:05 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.08.18 14:16:54 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.18 14:15:48 | 000,003,776 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.08.18 14:12:14 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.18 14:11:35 | 000,365,712 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.18 14:05:50 | 000,460,908 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.18 14:05:50 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.18 14:05:50 | 000,085,594 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.18 14:05:50 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.18 14:05:37 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.18 14:05:35 | 000,442,800 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.18 14:05:35 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.18 14:05:35 | 000,072,066 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.18 14:05:35 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.18 14:05:33 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.18 14:05:33 | 000,004,627 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.18 14:05:31 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.08.18 14:05:25 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.18 14:05:25 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.18 14:05:23 | 000,264,192 | -H-- | C] () -- C:\WINDOWS\System32\osm8gdr.dll
[2004.08.18 14:05:23 | 000,001,025 | -H-- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2004.08.18 14:05:23 | 000,001,025 | -H-- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2004.08.18 14:05:23 | 000,001,025 | -H-- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2004.08.18 14:05:23 | 000,001,025 | -H-- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2004.08.18 14:05:23 | 000,000,204 | -H-- | C] () -- C:\WINDOWS\System32\c1a6z4t.dll
[2004.08.18 14:05:23 | 000,000,100 | -H-- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2004.08.18 14:05:23 | 000,000,072 | -H-- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2004.08.18 14:05:23 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\o24yqla.dll
[2004.08.18 14:05:23 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\nm2x0r3.dll
[2004.08.18 14:05:18 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.18 14:05:07 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.12 09:44:10 | 000,016,384 | -H-- | C] () -- C:\WINDOWS\System32\iwca.dll
[1999.01.22 20:46:58 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1996.03.22 00:32:26 | 000,162,304 | -H-- | C] () -- C:\WINDOWS\System32\DLWBC31.DLL

========== LOP Check ==========

[2006.08.27 15:24:40 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2010.06.30 15:24:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cisco
[2006.05.08 12:59:05 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2005.10.23 12:31:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SBT
[2011.02.14 21:02:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.02.14 21:03:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence
[2009.03.20 12:48:27 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010.08.02 12:19:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2006.08.27 15:24:57 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Ashampoo
[2011.04.07 10:18:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\autobingooo
[2010.11.21 13:24:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canon
[2011.04.07 23:46:45 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\concept design
[2011.06.19 11:24:32 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Dropbox
[2011.06.14 17:17:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\EndNote
[2009.07.11 21:07:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Free Download Manager
[2010.01.09 11:00:14 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\gtk-2.0
[2005.10.08 01:54:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Leadertech
[2006.05.08 13:00:01 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\PC Suite
[2010.11.23 22:15:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Softland
[2005.10.07 20:30:12 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\ISP-Anmeldungserinnerung 1.job
[2011.06.21 00:56:47 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{9EA50C78-1918-4612-9792-C25A3B324B6C}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2007.01.16 16:42:19 | 000,000,000 | -H-D | M] -- C:\516f8c993a95eab538ec
[2009.12.14 12:20:12 | 000,000,000 | -H-D | M] -- C:\51fc159132ff68ffd4a7
[2010.02.11 19:17:18 | 000,000,000 | -H-D | M] -- C:\6dbe81dcc5645cb4b1f85eed00a0
[2010.10.08 15:13:27 | 000,000,000 | -H-D | M] -- C:\ab67d1758e237a3c6a95e159
[2005.10.07 16:56:46 | 000,000,000 | -H-D | M] -- C:\dell
[2008.09.11 10:20:01 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen
[2009.07.11 20:57:03 | 000,000,000 | -H-D | M] -- C:\Downloads
[2005.09.23 12:03:38 | 000,000,000 | -H-D | M] -- C:\drivers
[2010.03.27 13:53:26 | 000,000,000 | -HSD | M] -- C:\found.000
[2005.10.07 16:15:59 | 000,000,000 | -H-D | M] -- C:\i386
[2010.07.10 16:38:08 | 000,000,000 | -H-D | M] -- C:\MyVideos
[2009.04.17 13:57:32 | 000,000,000 | -H-D | M] -- C:\Program Files
[2011.06.19 19:46:52 | 000,000,000 | RH-D | M] -- C:\Programme
[2005.10.07 16:30:57 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2008.04.18 09:33:17 | 000,000,000 | -H-D | M] -- C:\savwsa
[2005.10.06 03:52:13 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.13 18:35:59 | 000,000,000 | -H-D | M] -- C:\texlive
[2011.06.17 19:37:51 | 000,000,000 | -H-D | M] -- C:\WINDOWS

< %PROGRAMFILES%\*.exe >

Invalid Environment Variable: LOCALAPPDATA

< %systemroot%\*. /mp /s >


< MD5 for: EXPLORER.EXE >
[2004.08.04 15:00:00 | 001,035,264 | -H-- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:10:08 | 001,036,288 | -H-- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | -H-- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | -H-- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 15:21:45 | 001,036,288 | -H-- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: REGEDIT.EXE >
[2004.08.04 15:00:00 | 000,153,600 | -H-- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\i386\REGEDIT.EXE
[2004.08.04 15:00:00 | 000,153,600 | -H-- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe
[2008.04.14 04:22:58 | 000,153,600 | -H-- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe
[2008.04.14 04:22:58 | 000,153,600 | -H-- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe

< MD5 for: USERINIT.EXE >
[2008.04.14 04:23:03 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 15:00:00 | 000,025,088 | -H-- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\i386\userinit.exe
[2004.08.04 15:00:00 | 000,025,088 | -H-- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004.08.04 15:00:00 | 000,507,392 | -H-- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\i386\winlogon.exe
[2004.08.04 15:00:00 | 000,507,392 | -H-- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | -H-- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | -H-- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-17 01:18:35

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 63 bytes -> C:\Dokumente und Einstellungen\Matthias\Desktop\Surf Cult California.mov:com.dropbox.attributes
@Alternate Data Stream - 63 bytes -> C:\Dokumente und Einstellungen\Matthias\Desktop\Stoked and Broke.mov:com.dropbox.attributes

< End of report >


Hier ist noch der extra logfile von dem ersten scan den ich nicht mit der benutzerdefinierten einstellungen gemacht habe, beim zweiten mal hat mir otl kein ectra file erstellt:

OTL Extras logfile created on: 20.06.2011 03:34:21 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Dokumente und Einstellungen\Matthias\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,37 Mb Total Physical Memory | 111,42 Mb Available Physical Memory | 21,79% Memory free
1,22 Gb Paging File | 0,81 Gb Available in Paging File | 66,83% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 52,80 Gb Total Space | 5,14 Gb Free Space | 9,74% Space Free | Partition Type: NTFS

Computer Name: PC-PEAHI-KANAL | User Name: Matthias | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Digital Photo Professional] -- C:\Programme\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNetisabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNetisabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabledropbox -- (Dropbox, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00040407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0C0BE8DE-7BD2-45A5-BBA4-95C9FA2CE292}" = DM_Install
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Energieverwaltung der internen Netzwerkkarte
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{43224D30-5941-47A4-9AD7-9250EE794396}" = SigmaPlot 10.0
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}" = mCore
"{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}" = mIWCA
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A912021A-FEDD-4DA3-8DB4-245EBDA84778}" = OriginPro 8
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Dell Media Experience
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch
"{AFD12747-7CDA-49A5-BC5F-18B90FAD6822}" = DM_Install
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CA9BAADB-C262-4E05-B2E2-CEE8CE9809EC}" = mToolkit
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCF6C6CE-5F00-4543-BC2E-8F8C3CAB527C}" = SigmaStat 3.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE6ED5AE-4F78-4B50-ADA5-A8F24DBDC673}" = Cisco AnyConnect VPN Client
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FFA98080-B0C6-11D5-91CB-005004F84FA1}" = Sun Java Runtime Environment and JMF
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Ashampoo Burning Studio 6" = Ashampoo Burning Studio 6
"ATI Display Driver" = ATI Display Driver
"AXIS Media Control Embedded" = AXIS Media Control Embedded
"bcjxhf" = Favorit
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.9x Modem
"doPDF 7 printer_is1" = doPDF 7.1 printer
"DPP" = Canon Utilities Digital Photo Professional 3.8
"EndNote" = EndNote
"EOS Utility" = Canon Utilities EOS Utility
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MiKTeX 2.6" = MiKTeX 2.6
"MiKTeX 2.9" = MiKTeX 2.9
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"ProInst" = Intel(R) PROSet/Wireless Software
"RIS Web Helper" = RIS Web Helper
"Surfer 7" = Surfer 7
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"WFTK" = Canon Utilities WFT Utility
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.4.6
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 13.06.2011 07:50:15 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung texcntr.exe, Version 0.7.1.0, fehlgeschlagenes
Modul texcntr.exe, Version 0.7.1.0, Fehleradresse 0x00021633.

Error - 13.06.2011 08:01:47 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung texcntr.exe, Version 0.7.1.0, fehlgeschlagenes
Modul texcntr.exe, Version 0.7.1.0, Fehleradresse 0x00021633.

Error - 14.06.2011 15:46:44 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung texcntr.exe, Version 1.0.0.0, fehlgeschlagenes
Modul mfc42.dll, Version 6.2.8081.0, Fehleradresse 0x000625ac.

Error - 16.06.2011 04:37:26 | Computer Name = PC-PEAHI-KANAL | Source = Google Update | ID = 20
Description =

Error - 17.06.2011 14:33:09 | Computer Name = PC-PEAHI-KANAL | Source = Google Update | ID = 20
Description =

Error - 17.06.2011 15:33:07 | Computer Name = PC-PEAHI-KANAL | Source = Google Update | ID = 20
Description =

Error - 18.06.2011 08:32:25 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung texcntr.exe, Version 1.0.0.0, fehlgeschlagenes
Modul mfc42.dll, Version 6.2.8081.0, Fehleradresse 0x000625ac.

Error - 18.06.2011 17:33:08 | Computer Name = PC-PEAHI-KANAL | Source = Google Update | ID = 20
Description =

Error - 18.06.2011 21:35:46 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung texcntr.exe, Version 1.0.0.0, fehlgeschlagenes
Modul mfc42.dll, Version 6.2.8081.0, Fehleradresse 0x000625ac.

Error - 19.06.2011 21:27:17 | Computer Name = PC-PEAHI-KANAL | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul mshtml.dll, Version 8.0.6001.19088, Fehleradresse 0x0038f58b.

[ Cisco AnyConnect VPN Client Events ]
Error - 19.06.2011 21:26:14 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CTlsTransport::OnTransportInitiateComplete File: .\IP\TlsTransport.cpp
Line:
344 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
-31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:14 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnTransportInitiateComplete File: .\IP\HttpSessionAsync.cpp
Line:
1002 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
-31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:14 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780
(0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:14 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp
Line:
1175 Invoked Function: CSocketTransport:ostConnectProcessing Return Code: -31522780
(0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnTransportInitiateComplete File: .\IP\HttpSessionAsync.cpp
Line:
1002 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
-31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780
(0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp
Line:
1175 Invoked Function: CSocketTransport:ostConnectProcessing Return Code: -31522780
(0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
1020 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
(0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
not contact target

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
856 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target

Error - 19.06.2011 21:26:22 | Computer Name = PC-PEAHI-KANAL | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target

[ System Events ]
Error - 17.06.2011 13:39:42 | Computer Name = PC-PEAHI-KANAL | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.5 für die Netzwerkkarte mit der Netzwerkadresse
0013CE428066 wurde durch den DHCP-Server 1.1.1.1 abgelehnt (der DHCP-Server hat
eine DHCPNACK-Meldung gesendet).

Error - 19.06.2011 06:02:43 | Computer Name = PC-PEAHI-KANAL | Source = DCOM | ID = 10010
Description = Der Server "{24DC0815-9D82-47FD-81B3-11DE033EF7A3}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error - 19.06.2011 13:23:39 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Sophos Web Intelligence Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000
Millisekunden durchgeführt: Starten Sie den Dienst neu..

Error - 19.06.2011 13:24:22 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7034
Description = Dienst "EvtEng" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error - 19.06.2011 21:21:01 | Computer Name = PC-PEAHI-KANAL | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error - 19.06.2011 21:23:28 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7000
Description = Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 19.06.2011 21:23:28 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7001
Description = Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%2

Error - 19.06.2011 21:23:28 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
IntelIde

Error - 19.06.2011 21:24:46 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7000
Description = Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 19.06.2011 21:24:46 | Computer Name = PC-PEAHI-KANAL | Source = Service Control Manager | ID = 7001
Description = Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%2


< End of report >


Viele Gruesse
Peahi