Hijacking nach Windows XP Repair Entfernung

hilfen00b

Liebe Trojaner-Board.de Mitglieder,

beim herunterlanden eines .pdfs von einer legitimen Seite habe ich meinen PC mit Windows XP Repair infiziert gehabt. Ich habe eure Anweisungen hier befolgt (vielen Dank!!!) und das Programm entfernt. Jetzt habe ich jedoch beim klicken auf links im Internet Explorer hijacking auf irrelevante Seiten und auch so werden ab und zu Fenster zu Seiten geöffnet (mitunter zu einer Seite von BMW!?).
Hier sind meine OTL und Extras files:

OTL logfile created on: 21.06.2011 14:01:05 - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1015,36 Mb Total Physical Memory | 325,62 Mb Available Physical Memory | 32,07% Memory free
2,39 Gb Paging File | 1,76 Gb Available in Paging File | 73,80% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 92,75 Gb Free Space | 62,23% Space Free | Partition Type: NTFS
Drive D: | 359,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive R: | 1149,99 Gb Total Space | 470,67 Gb Free Space | 40,93% Space Free | Partition Type: NTFS
Drive U: | 399,99 Gb Total Space | 45,32 Gb Free Space | 11,33% Space Free | Partition Type: NTFS
Drive V: | 1149,99 Gb Total Space | 470,67 Gb Free Space | 40,93% Space Free | Partition Type: NTFS
Drive W: | 68,33 Gb Total Space | 34,85 Gb Free Space | 51,00% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: *** | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\Common Framework\McTray.exe (McAfee, Inc.)
PRC - C:\WINNT\system32\DWRCST.EXE (DameWare Development)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\NetInst\NiAgnt32.exe (enteo Software GmbH)


========== Modules (SafeList) ==========

MOD - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========


========== Driver Services (SafeList) ==========


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.de/ie
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.***.de:80

========== FireFox ==========

FF - prefs.js..network.proxy.ftp: "proxy.***.de"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.http: "proxy.***.de"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.***.de"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "proxy.***.de"
FF - prefs.js..network.proxy.ssl_port: 80
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Programme\Java\jre1.6.0_10\lib\deploy\jqs\ff [2011.05.30 13:59:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.05.20 16:01:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

[2009.07.03 20:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2009.07.03 20:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\vscdeb8q.default\extensions
[2011.05.30 14:02:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) --
[2011.05.30 13:59:37 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE1.6.0_10\LIB\DEPLOY\JQS\FF
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.02.04 20:07:00 | 000,023,864 | ---- | M] (McAfee, Inc.) -- C:\Programme\Mozilla Firefox\components\Scriptff.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_10\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre1.6.0_10\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre1.6.0_10\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DameWare MRC Agent] C:\WINNT\system32\DWRCST.EXE (DameWare Development)
O4 - HKLM..\Run: [Discovery User Input] C:\Discovery\User Input\userin32.exe (FrontRange Solutions USA Inc. )
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ShStatEXE] C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKCU..\Run: [farErWOHlXkPpQP] File not found
O4 - HKCU..\Run: [H/PC Connection Agent] File not found
O4 - HKCU..\Run: [swg] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: MaxGPOScriptWait = 180
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 1
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKLM\..Trusted Domains: ***.de ([****] http in Local intranet)
O15 - HKLM\..Trusted Domains: ***.de ([****] https in Local intranet)
O15 - HKLM\..Trusted Ranges: Range1 ([***] in Local intranet)
O15 - HKLM\..Trusted Ranges: Range2 ([file] in Local intranet)
O15 - HKLM\..Trusted Ranges: Range3 ([file] in Local intranet)
O15 - HKLM\..Trusted Ranges: Range4 ([file] in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([www] https in Local intranet)
O15 - HKCU\..Trusted Domains: ***.de ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: ***.de ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***.***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: *** ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] https in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] * in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***.intranet] * in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([****.***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Trusted sites)
O15 - HKCU\..Trusted Domains: *** ([***.***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([*.***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] *** in Local intranet)
O15 - HKCU\..Trusted Domains: *** ([***] http in Trusted sites)
O15 - HKCU\..Trusted Domains: *** ([***] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([***] in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range2 ([***] in Local intranet)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Programme\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {A7B17C34-D894-11D3-AE37-0050DA39FE5C} hxxp://***.de/magicweb/cabs/WebClientInstall.cab (WebClientInstall Class)
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} hxxp://f007.mail.lycos.de/app/uploader/FileUploader.cab (Lycos File Upload Component)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ***.de
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\Programme\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\Programme\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINNT\NiAMH.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: System - (ziswin.exe) - File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.10.17 00:45:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [1999.06.16 21:33:04 | 000,147,456 | ---- | M] () - C:\AUTOREN.MDB -- [ NTFS ]
O32 - AutoRun File - [1997.10.08 12:02:22 | 000,000,043 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{11ba3f78-4d35-11da-abbd-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{11ba3f78-4d35-11da-abbd-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{11ba3f78-4d35-11da-abbd-806d6172696f}\Shell\AutoRun\command - "" = D:\ASTART.EXE -- [1997.03.15 10:34:50 | 000,154,624 | R--- | M] ()
O33 - MountPoints2\{5c8ae196-437e-11de-a715-001438c35028}\Shell\verb1\command - "" = desktop.exe
O33 - MountPoints2\{72c1d5ff-f6fa-11df-86c2-00199933efaa}\Shell\AutoRun\command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{72c1d5ff-f6fa-11df-86c2-00199933efaa}\Shell\Explore\Command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{72c1d5ff-f6fa-11df-86c2-00199933efaa}\Shell\Open\Command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9749b448-6177-11de-b12c-00199933f008}\Shell\AutoRun\command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9749b448-6177-11de-b12c-00199933f008}\Shell\Explore\Command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9749b448-6177-11de-b12c-00199933f008}\Shell\Open\Command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9f5a0d42-e7fe-11db-8c41-001438c363ea}\Shell\AutoRun\command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9f5a0d42-e7fe-11db-8c41-001438c363ea}\Shell\Explore\Command - "" = AutoRun\AutoStart.exe
O33 - MountPoints2\{9f5a0d42-e7fe-11db-8c41-001438c363ea}\Shell\Open\Command - "" = AutoRun\AutoStart.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.06.21 13:53:24 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2011.06.20 14:50:37 | 001,441,584 | ---- | C] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\***\Desktop\tdsskiller.exe
[2011.06.20 09:20:40 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\HiJackThis.exe
[2011.06.16 12:48:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
[2011.06.16 08:08:04 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2011.06.16 08:08:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.06.16 08:08:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.06.16 08:07:57 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.06.15 16:12:35 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\***\Recent
[2011.06.15 15:42:03 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\***\Desktop\herbert.exe
[2011.06.15 15:29:15 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTH.scr
[2011.06.15 12:42:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Startmenü\Programme\Windows XP Restore
[2011.06.14 13:44:14 | 000,000,000 | ---D | C] -- \\***\My Documents\Version Cue
[2011.06.08 10:12:36 | 000,000,000 | ---D | C] -- C:\WINNT\DicomWebClient
[2011.05.26 11:13:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\.pdfsam
[2011.05.26 10:47:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDF Split And Merge
[2011.05.26 10:47:55 | 000,000,000 | ---D | C] -- C:\Programme\pdfsam
[2011.05.26 10:47:28 | 014,593,325 | ---- | C] (Andrea Vacondio) -- C:\pdfsam-win-v2_2_1.exe
[2011.05.24 14:59:50 | 000,000,000 | ---D | C] -- \\***
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.06.21 13:56:17 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2011.06.21 13:53:36 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2011.06.21 13:17:55 | 001,351,680 | ---- | M] () -- C:\EDV.MDB
[2011.06.21 12:10:48 | 000,000,064 | ---- | M] () -- C:\EDV.ldb
[2011.06.21 12:10:07 | 000,159,744 | ---- | M] () -- C:\WEIN.MDB
[2011.06.21 09:43:17 | 000,000,064 | ---- | M] () -- C:\ADRESSEN.ldb
[2011.06.21 08:22:00 | 000,001,182 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-1015157209-3483221682-2525886298-10686Core1ca5d1eefa3d8d8.job
[2011.06.21 08:13:45 | 000,000,781 | ---- | M] () -- C:\WINNT\ODBC.INI
[2011.06.21 08:11:15 | 000,054,156 | ---- | M] () -- C:\WINNT\QTFont.qfn
[2011.06.21 08:07:12 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2011.06.20 16:44:41 | 000,005,262 | RHS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.pol
[2011.06.20 14:50:48 | 001,441,584 | ---- | M] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\***\Desktop\tdsskiller.exe
[2011.06.20 14:33:06 | 000,002,505 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Word.lnk
[2011.06.20 11:02:42 | 000,000,664 | ---- | M] () -- C:\WINNT\System32\d3d9caps.dat
[2011.06.20 09:20:48 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\HiJackThis.exe
[2011.06.20 09:18:32 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\klhflqpn.exe
[2011.06.20 08:07:55 | 000,002,206 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2011.06.16 08:08:05 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.15 16:12:54 | 000,000,040 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~19128100
[2011.06.15 15:42:12 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\***\Desktop\herbert.exe
[2011.06.15 15:27:21 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTH.scr
[2011.06.15 12:42:13 | 000,000,833 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Windows XP Restore.lnk
[2011.06.15 10:49:29 | 001,600,694 | ---- | M] () -- \\***newsletter-december2010-final.pdf
[2011.06.15 08:14:44 | 000,001,409 | ---- | M] () -- C:\WINNT\QTFont.for
[2011.06.09 16:44:12 | 000,017,900 | RHS- | M] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2011.05.26 10:48:01 | 000,000,125 | ---- | M] () -- C:\WINNT\wininit.ini
[2011.05.26 10:47:35 | 014,593,325 | ---- | M] (Andrea Vacondio) -- C:\pdfsam-win-v2_2_1.exe
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.06.21 13:56:15 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2011.06.21 12:10:27 | 000,000,064 | ---- | C] () -- C:\EDV.ldb
[2011.06.21 09:43:15 | 000,000,064 | ---- | C] () -- C:\ADRESSEN.ldb
[2011.06.21 09:43:04 | 001,351,680 | ---- | C] () -- C:\EDV.MDB
[2011.06.21 09:43:04 | 000,409,600 | ---- | C] () -- C:\ADRESSEN.MDB
[2011.06.21 09:43:04 | 000,200,704 | ---- | C] () -- C:\LEIHBUCH.MDB
[2011.06.21 09:43:04 | 000,172,032 | ---- | C] () -- C:\LIEF-ART.MDB
[2011.06.21 09:43:04 | 000,167,936 | ---- | C] () -- C:\AKTIEN.MDB
[2011.06.21 09:43:04 | 000,159,744 | ---- | C] () -- C:\WEIN.MDB
[2011.06.21 09:43:04 | 000,147,456 | ---- | C] () -- C:\AUTOREN.MDB
[2011.06.21 09:43:04 | 000,139,264 | ---- | C] () -- C:\KU-AUF.MDB
[2011.06.21 09:43:04 | 000,126,976 | ---- | C] () -- C:\KREUZTAB.MDB
[2011.06.21 09:43:04 | 000,020,806 | ---- | C] () -- C:\MAKETAB.EXE
[2011.06.21 09:43:04 | 000,008,931 | ---- | C] () -- C:\CHIPS.HTM
[2011.06.21 09:43:04 | 000,008,309 | ---- | C] () -- C:\US_TOP.HTM
[2011.06.21 09:43:04 | 000,007,900 | ---- | C] () -- C:\READFILE.EXE
[2011.06.21 09:43:04 | 000,007,156 | ---- | C] () -- C:\KUNDEN.HTM
[2011.06.21 09:43:04 | 000,003,925 | ---- | C] () -- C:\ARTIKEL.HTM
[2011.06.21 09:43:04 | 000,001,024 | ---- | C] () -- C:\PLZ.NDX
[2011.06.21 09:43:04 | 000,001,024 | ---- | C] () -- C:\NAME.NDX
[2011.06.21 09:43:04 | 000,000,910 | ---- | C] () -- C:\HYPERLNK.HTM
[2011.06.21 09:43:04 | 000,000,476 | ---- | C] () -- C:\ADRESSEN.DBF
[2011.06.21 09:40:50 | 000,547,530 | ---- | C] () -- C:\DEMOS.EXE
[2011.06.20 09:18:28 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\klhflqpn.exe
[2011.06.16 08:20:52 | 000,000,790 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Yahoo! Messenger.lnk
[2011.06.16 08:20:51 | 000,002,505 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Word.lnk
[2011.06.16 08:20:51 | 000,001,567 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\WebRIS.lnk
[2011.06.16 08:20:51 | 000,001,485 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Windows-Explorer.lnk
[2011.06.16 08:20:51 | 000,001,483 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Yahoo! Mail.lnk
[2011.06.16 08:20:51 | 000,000,712 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\WinZip.lnk
[2011.06.16 08:20:51 | 000,000,697 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2011.06.16 08:20:50 | 000,001,623 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:50 | 000,001,543 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:50 | 000,001,377 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Software aktualisieren.lnk
[2011.06.16 08:20:50 | 000,000,939 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***Terminplanung.lnk
[2011.06.16 08:20:50 | 000,000,880 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:49 | 000,002,541 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerPoint.lnk
[2011.06.16 08:20:49 | 000,001,603 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:49 | 000,001,586 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2011.06.16 08:20:49 | 000,000,872 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:49 | 000,000,695 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerArchiver 2000.lnk
[2011.06.16 08:20:48 | 000,001,878 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PASW Statistics 18.lnk
[2011.06.16 08:20:48 | 000,001,624 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\MS Frontpage XP.lnk
[2011.06.16 08:20:48 | 000,001,559 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Outlook Webmail.lnk
[2011.06.16 08:20:48 | 000,001,333 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PC Info.lnk
[2011.06.16 08:20:48 | 000,000,817 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nero StartSmart.lnk
[2011.06.16 08:20:48 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.06.16 08:20:47 | 000,001,649 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:47 | 000,001,639 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office PowerPoint 2003.lnk
[2011.06.16 08:20:47 | 000,001,630 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office Word 2003.lnk
[2011.06.16 08:20:47 | 000,001,614 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office Excel 2003.lnk
[2011.06.16 08:20:47 | 000,001,388 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Photoeditor.lnk
[2011.06.16 08:20:47 | 000,000,825 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office Access 2003.lnk
[2011.06.16 08:20:47 | 000,000,818 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office Outlook 2003.lnk
[2011.06.16 08:20:46 | 000,002,603 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mail (Aktuell).lnk
[2011.06.16 08:20:46 | 000,001,591 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:46 | 000,000,677 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:46 | 000,000,642 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:46 | 000,000,585 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:46 | 000,000,387 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:45 | 000,001,800 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2011.06.16 08:20:45 | 000,001,636 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\InterVideo WinDVD 4.lnk
[2011.06.16 08:20:45 | 000,000,723 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Internet.lnk
[2011.06.16 08:20:45 | 000,000,621 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\IrfanView.lnk
[2011.06.16 08:20:45 | 000,000,482 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:44 | 000,000,767 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:43 | 000,002,533 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Excel.lnk
[2011.06.16 08:20:43 | 000,001,611 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\GraphPad Prism 4.lnk
[2011.06.16 08:20:43 | 000,001,520 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\EndNote Program.lnk
[2011.06.16 08:20:43 | 000,000,863 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\IBM SPSS Statistics 19.lnk
[2011.06.16 08:20:43 | 000,000,810 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\fastView.lnk
[2011.06.16 08:20:43 | 000,000,390 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:42 | 000,000,394 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:36 | 000,001,715 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:36 | 000,001,711 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk
[2011.06.16 08:20:36 | 000,000,624 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:20:35 | 000,001,211 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\***.lnk
[2011.06.16 08:08:05 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.15 12:42:13 | 000,000,833 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Windows XP Restore.lnk
[2011.06.15 12:42:11 | 000,000,040 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~19128100
[2011.06.15 10:49:29 | 001,600,694 | ---- | C] () -- \\***\My Documents\newsletter-december2010-final.pdf
[2011.06.15 08:14:44 | 000,001,409 | ---- | C] () -- C:\WINNT\QTFont.for
[2011.06.15 08:14:43 | 000,054,156 | ---- | C] () -- C:\WINNT\QTFont.qfn
[2011.05.26 10:48:01 | 000,000,125 | ---- | C] () -- C:\WINNT\wininit.ini
[2011.05.18 12:34:14 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.20 11:07:42 | 000,086,016 | ---- | C] () -- C:\WINNT\OEMQuery.exe
[2011.01.19 15:49:29 | 000,155,152 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2009.09.29 13:14:16 | 000,095,744 | ---- | C] () -- C:\WINNT\System32\h5rtf32.dll
[2009.09.29 13:14:16 | 000,051,200 | ---- | C] () -- C:\WINNT\System32\h5tool32.dll
[2009.09.29 13:14:15 | 001,064,960 | ---- | C] () -- C:\WINNT\System32\h5krnl32.dll
[2009.09.29 13:14:15 | 000,188,928 | ---- | C] () -- C:\WINNT\System32\h5icon32.dll
[2009.09.29 13:14:15 | 000,175,616 | ---- | C] () -- C:\WINNT\System32\h5menu32.dll
[2009.06.18 12:50:58 | 000,000,664 | ---- | C] () -- C:\WINNT\System32\d3d9caps.dat
[2009.05.28 08:28:25 | 000,013,312 | ---- | C] () -- C:\WINNT\System32\drivers\CDProbe.SYS
[2008.11.25 13:39:06 | 000,000,148 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2008.02.21 11:07:56 | 000,000,000 | ---- | C] () -- C:\WINNT\BARTEST.INI
[2008.02.21 11:00:14 | 000,129,024 | ---- | C] () -- C:\WINNT\System32\ZIPDLL.DLL
[2008.02.21 11:00:14 | 000,125,440 | ---- | C] () -- C:\WINNT\System32\UNZDLL.DLL
[2008.02.21 11:00:13 | 000,101,888 | ---- | C] () -- C:\WINNT\System32\LIBBZ2.DLL
[2008.02.21 11:00:13 | 000,053,248 | ---- | C] () -- C:\WINNT\System32\UNRAR.DLL
[2008.02.21 11:00:13 | 000,045,056 | ---- | C] () -- C:\WINNT\System32\UNACE.DLL
[2008.02.21 10:09:10 | 000,096,256 | ---- | C] () -- C:\WINNT\vlc.exe
[2008.02.21 10:08:57 | 009,889,280 | ---- | C] () -- C:\WINNT\perma.exe
[2007.10.31 11:56:34 | 000,000,647 | ---- | C] () -- C:\WINNT\System32\hppapr04.dat
[2007.08.27 17:44:34 | 002,326,528 | ---- | C] () -- C:\WINNT\System32\ccme_eccaccel.dll
[2007.08.27 17:44:34 | 000,901,120 | ---- | C] () -- C:\WINNT\System32\ccme_ecc.dll
[2007.08.27 17:44:34 | 000,471,040 | ---- | C] () -- C:\WINNT\System32\ccme_base.dll
[2007.08.27 17:44:34 | 000,393,216 | ---- | C] () -- C:\WINNT\System32\cryptocme2.dll
[2007.08.22 16:26:06 | 000,295,606 | R--- | C] () -- C:\WINNT\System32\SC_Reader.exe
[2007.08.22 16:26:04 | 000,129,075 | ---- | C] () -- C:\WINNT\System32\PSYII.EXE
[2007.08.22 16:25:46 | 000,295,606 | R--- | C] () -- C:\WINNT\SC_Reader.exe
[2007.08.22 16:25:46 | 000,129,075 | ---- | C] () -- C:\WINNT\PSYII.EXE
[2007.08.15 15:28:50 | 000,001,024 | ---- | C] () -- C:\WINNT\System32\clauth2.dll
[2007.08.15 15:28:50 | 000,001,024 | ---- | C] () -- C:\WINNT\System32\clauth1.dll
[2007.08.15 15:28:50 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\ssprs.dll
[2007.08.15 15:28:50 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\serauth2.dll
[2007.08.15 15:28:50 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\serauth1.dll
[2007.08.15 15:28:50 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\nsprs.dll
[2007.08.15 15:23:54 | 000,001,025 | ---- | C] () -- C:\WINNT\System32\sysprs7.dll
[2007.08.15 15:23:54 | 000,000,203 | ---- | C] () -- C:\WINNT\System32\lsprst7.dll
[2007.08.09 15:37:17 | 000,000,687 | ---- | C] () -- C:\WINNT\System32\DWRCCMDError.ini
[2007.05.23 12:07:12 | 000,126,976 | ---- | C] () -- C:\WINNT\sleep.exe
[2007.05.23 12:07:11 | 000,061,440 | ---- | C] () -- C:\WINNT\ConCon2006.exe
[2007.05.23 12:06:33 | 000,000,000 | ---- | C] () -- C:\WINNT\admin.ini
[2007.05.23 12:05:38 | 001,288,704 | ---- | C] () -- C:\WINNT\System32\***.exe
[2007.05.23 12:05:37 | 001,655,296 | ---- | C] () -- C:\WINNT\System32\***.exe
[2007.05.23 12:05:36 | 000,899,072 | ---- | C] () -- C:\WINNT\System32\***.exe
[2007.05.23 12:04:54 | 001,288,704 | ---- | C] () -- C:\WINNT\***.exe
[2007.05.23 12:04:53 | 001,655,296 | ---- | C] () -- C:\WINNT\***.exe
[2007.05.23 12:04:52 | 000,899,072 | ---- | C] () -- C:\WINNT\***.exe
[2007.02.19 17:23:02 | 000,000,061 | ---- | C] () -- C:\WINNT\NiMgr32.INI
[2007.02.19 17:14:19 | 002,924,544 | ---- | C] () -- C:\WINNT\System32\EQUINET.EXE
[2007.02.19 17:14:08 | 002,924,544 | ---- | C] () -- C:\WINNT\EQUINET.EXE
[2006.12.05 15:37:43 | 000,000,000 | ---- | C] () -- C:\WINNT\medwdat.ini
[2006.12.05 15:32:15 | 000,003,776 | ---- | C] () -- C:\WINNT\System32\call32.dll
[2006.12.05 15:31:57 | 000,000,034 | ---- | C] () -- C:\WINNT\System32\mirage.ini
[2006.12.05 15:31:49 | 000,164,864 | ---- | C] () -- C:\WINNT\UNWISE.EXE
[2006.12.05 15:31:49 | 000,006,836 | ---- | C] () -- C:\WINNT\UNWISE.INI
[2006.08.21 16:45:40 | 000,241,664 | ---- | C] () -- C:\WINNT\System32\hppapr04.dll
[2006.02.08 14:08:01 | 000,004,031 | ---- | C] () -- C:\WINNT\mozver.dat
[2005.11.22 14:01:55 | 000,000,084 | ---- | C] () -- C:\WINNT\SQL-DB.INI
[2005.11.07 11:45:14 | 000,000,069 | ---- | C] () -- C:\WINNT\NeroDigital.ini
[2005.10.17 13:27:50 | 000,000,225 | ---- | C] () -- C:\WINNT\netscape.INI
[2005.10.17 08:23:27 | 000,034,018 | ---- | C] () -- C:\WINNT\nsreg.dat
[2005.10.17 08:23:15 | 000,698,168 | ---- | C] () -- C:\WINNT\cd32.exe
[2005.10.17 08:23:12 | 000,904,164 | ---- | C] () -- C:\WINNT\rexx.exe
[2005.10.17 08:23:07 | 000,001,284 | ---- | C] () -- C:\WINNT\saplogon.ini
[2005.10.17 08:23:07 | 000,000,141 | ---- | C] () -- C:\WINNT\Sapmsg.ini
[2005.10.17 08:22:49 | 000,015,872 | ---- | C] () -- C:\WINNT\System32\vtssm32.dll
[2005.10.17 08:22:30 | 000,000,034 | ---- | C] () -- C:\WINNT\SETUP32.INI
[2005.10.17 08:22:29 | 000,102,400 | ---- | C] () -- C:\WINNT\BARCODE.DLL
[2005.10.17 08:21:11 | 000,000,781 | ---- | C] () -- C:\WINNT\ODBC.INI
[2005.10.17 08:10:20 | 000,032,256 | ---- | C] () -- C:\WINNT\System32\swhive.exe
[2005.10.17 01:39:59 | 000,004,217 | ---- | C] () -- C:\WINNT\ODBCINST.INI
[2005.10.17 01:39:15 | 001,497,600 | ---- | C] () -- C:\WINNT\System32\FNTCACHE.DAT
[2005.10.17 01:05:18 | 000,040,960 | ---- | C] () -- C:\WINNT\System32\ChCfg.exe
[2005.10.17 01:05:18 | 000,001,996 | ---- | C] () -- C:\WINNT\System32\drivers\HDACfg.dat
[2005.10.17 00:47:37 | 000,002,048 | --S- | C] () -- C:\WINNT\bootstat.dat
[2005.10.17 00:43:50 | 000,021,740 | ---- | C] () -- C:\WINNT\System32\emptyregdb.dat
[2003.03.26 09:47:28 | 000,061,440 | ---- | C] () -- C:\WINNT\System32\XMLPARSE.DLL
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINNT\System32\OUTLPERF.INI
[2001.10.28 17:42:30 | 000,116,224 | ---- | C] () -- C:\WINNT\System32\pdfcmnnt.dll
[1999.08.07 01:05:16 | 000,212,480 | ---- | C] () -- C:\WINNT\System32\DBPORT6.DLL
[1980.01.01 01:00:00 | 013,107,200 | ---- | C] () -- C:\WINNT\System32\oembios.bin
[1980.01.01 01:00:00 | 000,673,088 | ---- | C] () -- C:\WINNT\System32\mlang.dat
[1980.01.01 01:00:00 | 000,398,212 | ---- | C] () -- C:\WINNT\System32\perfh007.dat
[1980.01.01 01:00:00 | 000,383,706 | ---- | C] () -- C:\WINNT\System32\perfh009.dat
[1980.01.01 01:00:00 | 000,272,128 | ---- | C] () -- C:\WINNT\System32\perfi009.dat
[1980.01.01 01:00:00 | 000,269,480 | ---- | C] () -- C:\WINNT\System32\perfi007.dat
[1980.01.01 01:00:00 | 000,218,003 | ---- | C] () -- C:\WINNT\System32\dssec.dat
[1980.01.01 01:00:00 | 000,074,502 | ---- | C] () -- C:\WINNT\System32\perfc007.dat
[1980.01.01 01:00:00 | 000,062,934 | ---- | C] () -- C:\WINNT\System32\perfc009.dat
[1980.01.01 01:00:00 | 000,053,248 | ---- | C] () -- C:\WINNT\System32\setupw2k.dll
[1980.01.01 01:00:00 | 000,046,258 | ---- | C] () -- C:\WINNT\System32\mib.bin
[1980.01.01 01:00:00 | 000,040,960 | ---- | C] () -- C:\WINNT\System32\nwslog32.dll
[1980.01.01 01:00:00 | 000,034,478 | ---- | C] () -- C:\WINNT\System32\perfd007.dat
[1980.01.01 01:00:00 | 000,028,626 | ---- | C] () -- C:\WINNT\System32\perfd009.dat
[1980.01.01 01:00:00 | 000,004,569 | ---- | C] () -- C:\WINNT\System32\secupd.dat
[1980.01.01 01:00:00 | 000,004,463 | ---- | C] () -- C:\WINNT\System32\oembios.dat
[1980.01.01 01:00:00 | 000,001,804 | ---- | C] () -- C:\WINNT\System32\dcache.bin
[1980.01.01 01:00:00 | 000,000,741 | ---- | C] () -- C:\WINNT\System32\noise.dat
[1980.01.01 01:00:00 | 000,000,166 | ---- | C] () -- C:\WINNT\System32\OEMINFO.INI

========== LOP Check ==========

[2009.05.13 10:50:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GraphPad Software
[2010.12.27 17:47:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GroupPolicy
[2011.01.19 15:53:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SafeNet Sentinel
[2010.07.05 16:52:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.01.19 16:44:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SPSS
[2011.03.30 13:44:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon Easy-WebPrint EX
[2010.02.04 11:32:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EndNote
[2010.05.19 10:22:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Facebook
[2011.01.25 17:50:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\GraphPad Software
[2010.02.22 13:49:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\InterVideo
[2008.07.14 08:38:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MIK
[2010.01.25 10:37:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Nvu
[2010.10.07 12:55:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\webex
[2009.09.24 13:33:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Zeon

========== Purity Check ==========



< End of report >









OTL Extras logfile created on: 21.06.2011 13:54:12 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1015,36 Mb Total Physical Memory | 315,50 Mb Available Physical Memory | 31,07% Memory free
2,39 Gb Paging File | 1,76 Gb Available in Paging File | 73,83% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 92,75 Gb Free Space | 62,23% Space Free | Partition Type: NTFS
Drive D: | 359,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive R: | 1149,99 Gb Total Space | 470,67 Gb Free Space | 40,93% Space Free | Partition Type: NTFS
Drive U: | 399,99 Gb Total Space | 45,33 Gb Free Space | 11,33% Space Free | Partition Type: NTFS
Drive V: | 1149,99 Gb Total Space | 470,67 Gb Free Space | 40,93% Space Free | Partition Type: NTFS
Drive W: | 68,33 Gb Total Space | 34,85 Gb Free Space | 51,00% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: *** | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
.js [@ = jsfile] -- Reg Error: Value error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
jsfile [open] -- Reg Error: Value error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"6129:TCP" = 6129:TCP:*:EnabledameWare Mini Remote Control Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"6129:TCP" = 6129:TCP:*:EnabledameWare Mini Remote Control Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\McAfee\Common Framework\FrameworkService.exe" = C:\Programme\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)
"C:\Programme\IBM\SPSS\Statistics\19\stats.exe" = C:\Programme\IBM\SPSS\Statistics\19\stats.exe:*isabled:Statistics19:exe -- (IBM Inc.)
"C:\Programme\IBM\SPSS\Statistics\19\WinWrapIDE.exe" = C:\Programme\IBM\SPSS\Statistics\19\WinWrapIDE.exe:*isabled:SPSS Basic Script Editor -- (IBM Inc.)
"C:\Programme\IBM\SPSS\Statistics\19\stats.com" = C:\Programme\IBM\SPSS\Statistics\19\stats.com:*isabled:Statistics19:com -- (IBM Inc.)
"C:\Programme\SPSSInc\PASWStatistics18\paswstat.com" = C:\Programme\SPSSInc\PASWStatistics18\paswstat.com:*isabled:Statistics18:com -- (SPSS Inc.)
"C:\Programme\SPSSInc\PASWStatistics18\paswstat.exe" = C:\Programme\SPSSInc\PASWStatistics18\paswstat.exe:*isabled:Statistics18:exe -- (SPSS Inc.)
"C:\Programme\SPSSInc\PASWStatistics18\WinWrapIDE.exe" = C:\Programme\SPSSInc\PASWStatistics18\WinWrapIDE.exe:*isabled:SPSS Basic Script Editor -- (SPSS Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINNT\system32\dpmw32.exe" = C:\WINNT\system32\dpmw32.exe:*:Enabled:NDPS RPM & Notification Listener
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Programme\Yahoo!\Messenger\YServer.exe" = C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
"C:\Programme\McAfee\Common Framework\FrameworkService.exe" = C:\Programme\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{047F20E4-0212-4286-9BF3-58FA54CB5CF7}" = SPSS SmartViewer 15G
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06012001-4E98-4989-BC62-8BB0CFB00000}" = Amondis Client Instanz 1 Version 6.1.20.0104
"{06012100-4E98-4989-BC62-8BB0CFB00000}" = Amondis Client Instanz 0 Version 6.1.21.0118
"{06C43FAA-7226-41EF-A05E-9AE0AA849FFE}" = IBM SPSS Statistics 19
"{07187E69-D3BC-4B5A-B533-890A9F0506D7}" = User Profile Hive Cleanup Service
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0EAD304C-6822-4700-81B4-5A3EE4F459CB}" = Amondis Prod Web
"{1444B16A-766B-4AD1-8AE8-F0C04C782E2F}" = MySQL Query Browser 1.1
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2
"{2492C635-AA84-46BC-81F9-D1B823A69615}" = MagicWeb Client VA42B
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 10
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}" = McAfee Agent
"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{32A3A4F4-B792-11D6-A78A-00B0D0150050}" = J2SE Development Kit 5.0 Update 5
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{437E061E-F98D-4D6C-A764-DAA16B7CA8B7}" = MySQL Administrator 1.0
"{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}" = MSXML4.0 redistributable
"{5318F137-F039-415E-8ACB-FC37A21773AD}" = SPSS 15.0 für Windows
"{53C020C2-8C1A-11D9-8BDE-F66BAD1E3F3A}" = EndNote 9 Volume License Edition
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{625119AD-D23A-4AC0-A34C-F953203576A4}" = MagicWeb VA60C_0111 Client
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{88D881EF-0567-443A-9A84-E5AAEF29BB34}" = Adobe Flash Player 10 ActiveX
"{8A2DA523-38FD-49DA-88E9-6BCDD7CCE9CF}" = MySQL Administrator 1.1
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8E770F99-CF23-4BF9-BF4E-E3A2924FEB27}" = Microsoft redistributable runtime DLLs VS2005 SP1(x86)
"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{90F80407-6000-11D3-8CFE-0150048383C9}" = Tool zum Entfernen verborgener Daten
"{9357AE3A-B2ED-4138-BB9B-0564352C3F0A}" = iTunes
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD 4
"{9B2AD57A-83C2-4287-907C-4A1C1B2669D5}" = Amondis Test Web
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A06CFA41-788A-4C42-81E5-4B0C5790893F}" = IETools
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43B2A2F-1DB5-47F9-A608-F11A4835D7CB}" = Apple Mobile Device Support
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.7 - Deutsch
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0DB380B-97B5-4BB8-AC8D-1835E61439B6}" = Microsoft redistributable runtime DLLs VS2005(x86)
"{C25215FC-5900-48B0-B93C-8D3379027312}" = PASW Statistics 18
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC124C22-C490-43A7-9064-F3E76BDC6399}" = ***
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEA791BB-6F54-48ED-BC2A-F78157C1D558}" = Adobe Setup
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0
"{EC5B30DD-7637-408F-83D2-D1E6946ABF88}" = IBM SPSS Statistics 19 Patch
"{F02DBC5D-33E3-45E9-B0F8-B7745229ED1C}" = NICI (Shared) U.S./Worldwide (128 bit) (2.6.8-2)
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe_c015d5ef39552390a753ee735d16041" = Adobe Illustrator CS3
"AIDA32_is1" = AIDA32 v3.70
"DamewareMirror" = DameWare Development Mirror Driver Uninstall
"Data Access Objects (DAO) 3.5" = Data Access Objects (DAO) 3.5
"GraphPad Prism_is1" = GraphPad Prism 4
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
"kid 2000 Demoversion 2.0.1 Client Installation" = kid 2000 2.0.1 Client Installation
"kid 2000 Demoversion 2.0.1 Server Installation" = kid 2000 2.0.1 Server Installation
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"McAfee Anti-Spyware Enterprise Module" = McAfee AntiSpyware Enterprise Module
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom!UninstallKey" = Nero 6
"Nero BurnRights!UninstallKey" = Nero BurnRights (Ahead Software)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"pdfsam" = pdfsam
"Reference Manager 10" = Reference Manager 10
"Review Manager 4.2.8" = Review Manager 4.2.8
"SAPGUI710" = SAP GUI 7.10
"Software AG Adabas D 12.00" = Software AG Adabas D 12.00
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Customizations" = Yahoo! Extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome
"Nvu_is1" = Nvu 1.0

========== Last 10 Event Log Errors ==========

Error: Unable to start EventLog service!

< End of report >

Vielen Dank im Voraus !!!