PC extrem langsam, viele Denkpausen

OTL logfile created on: 03.07.2011 18:08:48 - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Dokumente und Einstellungen\ebi\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,48 Mb Total Physical Memory | 624,11 Mb Available Physical Memory | 61,04% Memory free
2,40 Gb Paging File | 2,08 Gb Available in Paging File | 86,54% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58,17 Gb Total Space | 36,91 Gb Free Space | 63,46% Space Free | Partition Type: NTFS
Drive E: | 57,84 Gb Total Space | 45,61 Gb Free Space | 78,85% Space Free | Partition Type: FAT32
Drive F: | 36,63 Gb Total Space | 24,06 Gb Free Space | 65,68% Space Free | Partition Type: FAT32
Drive J: | 34,18 Gb Total Space | 34,11 Gb Free Space | 99,80% Space Free | Partition Type: NTFS
Drive K: | 34,18 Gb Total Space | 11,39 Gb Free Space | 33,33% Space Free | Partition Type: NTFS
Drive N: | 161,12 Gb Total Space | 101,90 Gb Free Space | 63,25% Space Free | Partition Type: NTFS
Drive O: | 175,78 Gb Total Space | 160,54 Gb Free Space | 91,33% Space Free | Partition Type: NTFS
Drive P: | 190,90 Gb Total Space | 190,71 Gb Free Space | 99,90% Space Free | Partition Type: NTFS
 
Computer Name: LOTTE | User Name: ebi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.07.03 18:06:19 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ebi\Desktop\OTL.exe
PRC - [2011.06.30 10:43:33 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.07 23:09:18 | 000,220,824 | ---- | M] () -- C:\Programme\Macrium\Reflect\ReflectService.exe
PRC - [2011.04.28 20:39:42 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.08 12:59:52 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.03.04 14:36:11 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.09.05 17:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2008.04.14 12:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.23 14:50:35 | 000,046,640 | ---- | M] (AOL LLC) -- C:\Programme\Gemeinsame Dateien\aol\acs\AOLacsd.exe
PRC - [2006.08.02 23:12:36 | 000,577,536 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2005.12.16 13:57:56 | 000,094,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
PRC - [2001.06.05 10:10:52 | 000,049,152 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_monitor.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.07.03 18:06:19 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ebi\Desktop\OTL.exe
MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- -- (MSDisk)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (Crypkey License)
SRV - [2011.06.30 10:43:33 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.07 23:09:18 | 000,220,824 | ---- | M] () [Auto | Running] -- C:\Programme\Macrium\Reflect\ReflectService.exe -- (ReflectService)
SRV - [2011.04.28 20:39:42 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2006.10.23 14:50:35 | 000,046,640 | ---- | M] (AOL LLC) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe -- (AOL ACS)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.06.30 10:43:34 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.30 10:43:34 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.06.07 23:09:44 | 000,016,024 | ---- | M] (Macrium Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pssnap.sys -- (pssnap)
DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.06.17 14:26:52 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.14 09:14:01 | 003,455,488 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008.12.10 17:36:09 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008.12.04 22:21:46 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2008.12.04 22:21:44 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2008.04.14 12:00:00 | 000,035,072 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msgpc.sys -- (Gpc)
DRV - [2008.04.13 22:06:08 | 000,084,480 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97via.sys -- (VIAudio) VIA AC'97 Audiocontroller (WDM)
DRV - [2008.04.13 18:34:28 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)
DRV - [2007.12.28 16:02:12 | 000,287,232 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wg111v3.sys -- (RTL8187B)
DRV - [2007.04.23 16:54:50 | 000,100,488 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mgmt.sys -- (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM)
DRV - [2007.04.23 16:54:50 | 000,098,568 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115obex.sys -- (s115obex)
DRV - [2007.04.23 16:54:48 | 000,108,680 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdm.sys -- (s115mdm)
DRV - [2007.04.23 16:54:48 | 000,015,112 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdfl.sys -- (s115mdfl)
DRV - [2007.04.23 16:54:46 | 000,083,208 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115bus.sys -- (s115bus) Sony Ericsson Device 115 driver (WDM)
DRV - [2006.11.06 10:01:50 | 004,024,832 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2006.10.17 20:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\videX32.sys -- (videX32)
DRV - [2006.10.13 10:16:36 | 000,081,664 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006.02.23 05:39:06 | 000,011,264 | R--- | M] (VIA Technologies,Inc) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\xfilt.sys -- (xfilt)
DRV - [2005.03.09 08:53:00 | 000,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004.08.22 16:31:48 | 000,005,248 | ---- | M] ( ) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt)
DRV - [2004.08.22 16:31:10 | 000,155,136 | ---- | M] ( ) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus)
DRV - [2004.01.06 15:21:18 | 000,705,536 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmuda2.sys -- (cmuda2)
DRV - [2003.07.01 22:42:00 | 000,027,904 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003.01.10 23:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001.08.17 14:00:04 | 000,000,000 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001.08.17 13:14:24 | 000,444,416 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fpcibase.sys -- (fpcibase)
DRV - [2001.08.17 13:13:48 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN)
DRV - [2001.08.17 12:50:26 | 000,731,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4.sys -- (nv4)
DRV - [2001.08.17 12:48:32 | 000,148,352 | ---- | M] (3dfx Interactive, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\3dfxvsm.sys -- (3dfxvs)
DRV - [2001.08.17 12:19:58 | 000,072,192 | ---- | M] (ESS Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\es1969.sys -- (es1969) ESS 1969-Audiotreiber (WDM)
DRV - [2001.03.02 19:21:30 | 000,166,906 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\omcamvid.sys -- (OVT511Plus)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?o=41647931&l=dis&gct=hp
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.3
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=WCR&o=41647931&locale=de_DE&apn_uid=BAA4F477-C50D-423E-B622-77C34FD83B8F&apn_ptnrs=81&apn_sauid=66E16576-712B-46D1-B4F2-8870EB6AD9C2&apn_dtid=YYYYYYYYDE&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.06.22 11:14:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.06.22 11:14:04 | 000,000,000 | ---D | M]
 
[2008.12.06 15:31:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Extensions
[2011.07.03 17:58:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions
[2011.07.03 17:47:07 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.07.03 17:47:10 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.07.03 17:47:01 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.07.03 17:47:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.04.05 21:16:34 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010.04.17 13:41:44 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2011.07.03 17:46:56 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\engine@conduit.com
[2011.07.03 17:46:57 | 000,000,000 | ---D | M] (Oberon GamesBar) -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\extensions\gamesbar@oberon-media.com
[2011.04.07 17:00:58 | 000,002,401 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\searchplugins\askcom.xml
[2010.04.17 14:01:43 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\searchplugins\conduit.xml
[2010.04.12 14:01:34 | 000,002,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Mozilla\Firefox\Profiles\gwsuge8n.default\searchplugins\iMeshWebSearch.xml
[2011.07.03 17:58:36 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.10.13 14:17:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.01 13:41:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.07.01 16:59:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2010.04.12 12:02:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2009.04.25 18:25:03 | 000,056,576 | ---- | M] (Foxit Software Company) -- C:\Programme\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\mozilla firefox\plugins\npwachk.dll
[2010.11.03 16:09:46 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.11.03 16:09:46 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.04.12 14:01:34 | 000,002,456 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\iMeshWebSearch.xml
[2010.11.03 16:09:46 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.01.11 22:49:15 | 000,001,456 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\WebSearchober44083984.xml
[2010.11.03 16:09:46 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.11.03 16:09:46 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O2 - BHO: (WiseCleaner Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (WiseCleaner Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CmUsbAudio] File not found
O4 - HKLM..\Run: [CXMon] C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [DAEMON Tools-1033] C:\Programme\D-Tools\daemon.exe (DAEMON'S HOME)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Resume copy] C:\WINDOWS\copyfstq.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB (Reg Error: Key error.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.10.25 22:26:41 | 000,000,020 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{68a8971f-c2fd-11dd-af76-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{68a8971f-c2fd-11dd-af76-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{68a8971f-c2fd-11dd-af76-00038a000015}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\{df112565-9f91-11dd-af58-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df112565-9f91-11dd-af58-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df112565-9f91-11dd-af58-00038a000015}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
 
MsConfig - Services: "Sysinfo Tool for Win32 "
MsConfig - Services: "gusvc"
MsConfig - Services: "AOL ACS"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 0
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.07.03 18:06:14 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ebi\Desktop\OTL.exe
[2011.06.30 12:20:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ebi\Eigene Dateien\gegl-0.0
[2011.06.19 16:07:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Runtime Software
[2011.06.19 16:07:15 | 000,000,000 | ---D | C] -- C:\Programme\Runtime Software
[2011.06.19 16:06:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ebi\Eigene Dateien\Reflect
[2011.06.19 16:03:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrium
[2011.06.19 16:02:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ebi\Startmenü\Programme\Macrium
[2011.06.19 16:02:06 | 000,000,000 | ---D | C] -- C:\Programme\Macrium
[2011.06.07 23:10:12 | 000,012,952 | ---- | C] (Paramount Software UK Ltd) -- C:\WINDOWS\System32\drivers\PSVolAcc.sys
[2011.06.07 23:09:44 | 000,016,024 | ---- | C] (Macrium Software) -- C:\WINDOWS\System32\drivers\pssnap.sys
[2011.06.07 23:09:32 | 000,045,208 | ---- | C] (Macrium Software) -- C:\WINDOWS\System32\drivers\psmounter.sys
[2009.02.11 12:28:22 | 002,228,326 | ---- | C] (Foxit Software Company) -- C:\Programme\Foxit_JS_ExObjects.dll
[2009.02.08 01:48:24 | 000,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2009.02.08 01:48:24 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[2003.06.19 11:05:04 | 000,431,888 | --S- | C] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\riched20.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.07.03 18:06:19 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ebi\Desktop\OTL.exe
[2011.07.03 18:04:30 | 000,184,409 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011.07.03 18:03:28 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.07.03 18:03:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.07.03 18:03:18 | 1072,222,208 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.03 18:01:59 | 000,000,052 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\defogger_reenable
[2011.07.03 18:01:00 | 000,000,222 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.07.03 17:58:42 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Defogger.exe
[2011.07.02 17:14:55 | 000,485,778 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.07.02 17:14:55 | 000,455,632 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.07.02 17:14:55 | 000,105,890 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.07.02 17:14:55 | 000,084,614 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.07.01 17:39:30 | 000,283,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Ackergaul.pps
[2011.06.30 14:32:33 | 000,245,248 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.30 12:24:16 | 000,009,216 | ---- | M] () -- C:\WINDOWS\PFW.INI
[2011.06.30 12:24:16 | 000,000,055 | ---- | M] () -- C:\WINDOWS\Access.Cde
[2011.06.30 10:43:34 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011.06.30 10:43:34 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011.06.27 12:29:23 | 000,159,528 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Mona-Lisa-1503-1506.jpg
[2011.06.27 10:17:28 | 000,372,410 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Zetteldieesinsichhaben.pdf
[2011.06.27 09:43:22 | 000,093,009 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\digi160sback.JPG
[2011.06.27 09:41:28 | 000,107,594 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\digi160sfont.JPG
[2011.06.27 09:35:10 | 000,000,151 | ---- | M] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2011.06.27 08:49:44 | 000,578,560 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100904.JPG
[2011.06.27 08:49:06 | 000,568,043 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100903.JPG
[2011.06.27 08:47:42 | 000,651,323 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100902.JPG
[2011.06.27 08:45:58 | 000,655,230 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100901.JPG
[2011.06.20 12:41:24 | 000,002,451 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Macrium Reflect.lnk
[2011.06.19 16:07:16 | 000,000,752 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DriveImage XML.lnk
[2011.06.19 15:57:19 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.06.17 11:22:01 | 001,230,916 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100874a.jpg
[2011.06.14 10:15:30 | 000,321,958 | ---- | M] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100893.JPG
[2011.06.14 10:08:59 | 000,007,060 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.06.07 23:10:12 | 000,012,952 | ---- | M] (Paramount Software UK Ltd) -- C:\WINDOWS\System32\drivers\PSVolAcc.sys
[2011.06.07 23:09:44 | 000,016,024 | ---- | M] (Macrium Software) -- C:\WINDOWS\System32\drivers\pssnap.sys
[2011.06.07 23:09:32 | 000,045,208 | ---- | M] (Macrium Software) -- C:\WINDOWS\System32\drivers\psmounter.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.07.03 18:01:47 | 000,000,052 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\defogger_reenable
[2011.07.03 17:58:42 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Defogger.exe
[2011.07.01 17:39:27 | 000,283,648 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Ackergaul.pps
[2011.06.27 12:29:22 | 000,159,528 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Mona-Lisa-1503-1506.jpg
[2011.06.27 10:17:24 | 000,372,410 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Zetteldieesinsichhaben.pdf
[2011.06.27 09:43:22 | 000,093,009 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\digi160sback.JPG
[2011.06.27 09:41:28 | 000,107,594 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\digi160sfont.JPG
[2011.06.27 09:34:03 | 000,655,230 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100901.JPG
[2011.06.27 09:34:03 | 000,578,560 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100904.JPG
[2011.06.27 09:34:03 | 000,568,043 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100903.JPG
[2011.06.27 09:34:02 | 000,651,323 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100902.JPG
[2011.06.19 16:07:16 | 000,000,752 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DriveImage XML.lnk
[2011.06.19 16:02:08 | 000,002,451 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\Macrium Reflect.lnk
[2011.06.17 11:21:57 | 001,230,916 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100874a.jpg
[2011.06.14 10:14:05 | 000,321,958 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Desktop\SH100893.JPG
[2011.01.11 23:01:51 | 000,000,931 | ---- | C] () -- C:\WINDOWS\posteriza.INI
[2010.09.07 00:23:23 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dmm.dat
[2010.08.13 16:56:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010.07.23 16:59:51 | 001,456,640 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\Falk Navi-Manager.msi
[2010.07.23 16:59:29 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\$_hpcst$.hpc
[2010.03.06 15:40:14 | 000,000,060 | ---- | C] () -- C:\WINDOWS\AdvPld99SE.INI
[2010.03.06 15:34:07 | 000,000,185 | ---- | C] () -- C:\WINDOWS\PCB3D99SE.INI
[2010.03.06 15:31:43 | 000,000,072 | ---- | C] () -- C:\WINDOWS\hdkctnts.ini
[2010.03.06 15:15:52 | 000,007,836 | ---- | C] () -- C:\WINDOWS\ADVPCB99SE.INI
[2010.03.06 15:10:24 | 000,000,667 | ---- | C] () -- C:\WINDOWS\ProHelp99SE.INI
[2010.03.06 15:09:31 | 000,005,863 | ---- | C] () -- C:\WINDOWS\Client99SE.INI
[2010.03.06 15:09:31 | 000,003,299 | ---- | C] () -- C:\WINDOWS\AdvSch99SE.ini
[2010.03.06 15:09:31 | 000,000,107 | ---- | C] () -- C:\WINDOWS\HelpAdvisor99SE.ini
[2010.03.06 15:09:31 | 000,000,010 | ---- | C] () -- C:\WINDOWS\AdvSIM99SE.INI
[2010.03.06 15:09:31 | 000,000,009 | ---- | C] () -- C:\WINDOWS\CRYPKEY.INI
[2010.03.02 02:42:54 | 000,307,200 | ---- | C] () -- C:\WINDOWS\System32\AscSQLite.dll
[2009.12.19 23:51:44 | 000,000,021 | ---- | C] () -- C:\WINDOWS\autoagf.Ini
[2009.12.19 23:50:39 | 000,000,154 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2009.12.19 22:25:50 | 000,002,575 | ---- | C] () -- C:\WINDOWS\photoimpression.ini
[2009.12.19 22:25:16 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2009.12.19 22:14:36 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2009.06.20 14:02:15 | 000,094,636 | ---- | C] () -- C:\WINDOWS\dropcpyr.dll
[2009.06.20 14:02:14 | 000,073,728 | ---- | C] () -- C:\WINDOWS\copyfstq.exe
[2009.04.26 11:20:25 | 000,000,020 | ---- | C] () -- C:\WINDOWS\cserve.ini
[2009.04.26 11:00:46 | 000,028,177 | ---- | C] () -- C:\WINDOWS\SETUP1.EXE
[2009.02.11 12:08:52 | 000,071,787 | ---- | C] () -- C:\Programme\lang_nl_nl.xml
[2009.02.08 12:36:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2009.02.08 01:48:25 | 000,035,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\msgpc.sys
[2009.02.08 01:48:25 | 000,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009.02.08 01:48:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\msmpu401.sys
[2009.02.08 01:48:23 | 000,278,728 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2009.02.08 01:47:57 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2009.02.08 01:47:51 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2009.02.08 01:47:50 | 000,000,087 | ---- | C] () -- C:\WINDOWS\System32\scconfig.ini
[2009.02.08 01:47:49 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2009.02.08 01:47:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2009.02.08 01:47:47 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009.02.08 01:47:45 | 000,485,778 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2009.02.08 01:47:45 | 000,455,632 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2009.02.08 01:47:45 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2009.02.08 01:47:45 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2009.02.08 01:47:45 | 000,105,890 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2009.02.08 01:47:45 | 000,084,614 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2009.02.08 01:47:45 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2009.02.08 01:47:45 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2009.02.08 01:47:44 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2009.02.08 01:47:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2009.02.08 01:47:40 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2009.02.08 01:47:32 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2009.02.08 01:47:32 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2009.02.08 01:47:21 | 000,214,472 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.02.08 01:47:20 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.02.08 01:47:18 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2009.02.08 01:47:16 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2009.02.08 01:47:13 | 000,007,060 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009.02.08 01:47:10 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009.02.08 01:47:09 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\BMPPROC.DLL
[2009.02.08 01:46:56 | 000,001,427 | ---- | C] () -- C:\WINDOWS\XI420Ke.INI
[2009.02.08 01:46:56 | 000,000,315 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009.02.08 01:46:56 | 000,000,050 | ---- | C] () -- C:\WINDOWS\Winamp.ini
[2009.02.08 01:46:56 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini
[2009.02.08 01:46:55 | 000,069,632 | ---- | C] () -- C:\WINDOWS\UNINSTCC.EXE
[2009.02.08 01:46:55 | 000,068,608 | ---- | C] () -- C:\WINDOWS\prohelp.dll
[2009.02.08 01:46:55 | 000,009,216 | ---- | C] () -- C:\WINDOWS\PFW.INI
[2009.02.08 01:46:55 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.02.08 01:46:55 | 000,001,457 | ---- | C] () -- C:\WINDOWS\Netlist.INI
[2009.02.08 01:46:55 | 000,001,400 | ---- | C] () -- C:\WINDOWS\TextEdit.INI
[2009.02.08 01:46:55 | 000,000,668 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2009.02.08 01:46:55 | 000,000,440 | ---- | C] () -- C:\WINDOWS\ProHelp.INI
[2009.02.08 01:46:55 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.02.08 01:46:55 | 000,000,376 | ---- | C] () -- C:\WINDOWS\mozregistry.dat
[2009.02.08 01:46:55 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.02.08 01:46:55 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.02.08 01:46:55 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2009.02.08 01:46:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009.02.08 01:46:55 | 000,000,098 | ---- | C] () -- C:\WINDOWS\SPL3614.DAT
[2009.02.08 01:46:40 | 000,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2009.02.08 01:46:40 | 000,032,528 | ---- | C] () -- C:\WINDOWS\amcap.exe
[2009.02.08 01:46:40 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll
[2009.02.08 01:46:40 | 000,007,094 | ---- | C] () -- C:\WINDOWS\AdvSch.INI
[2009.02.08 01:46:40 | 000,006,276 | ---- | C] () -- C:\WINDOWS\CLIENT.INI
[2009.02.08 01:46:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.02.08 01:46:40 | 000,000,164 | R--- | C] () -- C:\WINDOWS\avrack.ini
[2009.02.08 01:46:40 | 000,000,046 | ---- | C] () -- C:\WINDOWS\hmview.ini
[2009.02.08 01:46:40 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2009.02.08 01:46:40 | 000,000,039 | ---- | C] () -- C:\WINDOWS\MB.ini
[2009.02.07 22:46:14 | 000,012,415 | ---- | C] () -- C:\WINDOWS\System32\drivers\wADV01nt.sys
[2008.05.16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.05.16 14:01:00 | 001,630,208 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2008.05.16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.05.16 14:01:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2008.05.16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.05.16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.05.16 14:01:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2008.05.16 14:01:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.05.16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.08.23 23:07:52 | 004,034,560 | ---- | C] () -- C:\Programme\Foxit_Reader.exe
[2007.08.13 00:58:53 | 000,245,248 | ---- | C] () -- C:\Dokumente und Einstellungen\ebi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004.01.05 19:17:38 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\cmdrvrm.exe
[2003.05.30 15:27:46 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\cmdrvrm.dll
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2010.08.20 02:59:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\D39B
[2010.07.22 00:23:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DipTrace
[2010.05.16 15:50:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Whiz
[2010.08.18 12:20:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\E109
[2010.10.15 20:38:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2008.02.10 21:21:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\fun communications
[2010.08.13 19:37:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iMesh
[2011.06.19 16:03:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrium
[2010.08.12 03:08:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2007.08.11 17:33:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2010.08.13 19:38:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D03368CA-EF7C-469B-BB28-F42606DD402F}
[2009.12.19 22:20:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\ACD Systems
[2008.12.06 01:38:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Ankh
[2008.12.19 23:27:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Auslogics
[2011.03.25 13:19:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\CadSoft
[2007.11.11 16:02:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
[2011.05.21 23:02:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\FileZilla
[2009.04.25 18:25:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Foxit
[2010.09.07 02:38:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\gtk-2.0
[2007.09.12 03:37:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\gtopala
[2008.10.21 19:41:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\ibf
[2009.12.30 02:58:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Kazaa Lite
[2007.12.27 19:46:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Micrografx
[2010.08.12 03:08:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\NCH Swift Sound
[2011.04.04 11:37:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\PriceGong
[2010.11.05 20:16:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\Teleca
[2010.02.17 00:31:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ebi\Anwendungsdaten\WEBDE
[2011.07.03 18:01:00 | 000,000,222 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2009.07.04 02:06:51 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2008.03.13 20:00:02 | 000,000,000 | ---D | M] -- C:\ASM
[2008.12.13 19:31:04 | 000,000,000 | ---D | M] -- C:\ATI
[2009.02.08 00:52:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2009.02.07 23:37:58 | 000,000,000 | ---D | M] -- C:\Electronic Design CD
[2009.07.04 01:54:46 | 000,000,000 | -HSD | M] -- C:\found.000
[2009.07.04 23:32:55 | 000,000,000 | -HSD | M] -- C:\found.001
[2009.07.13 09:53:06 | 000,000,000 | -HSD | M] -- C:\found.002
[2009.07.14 18:56:39 | 000,000,000 | -HSD | M] -- C:\found.003
File not found -- C:\magicvc.
[2010.05.06 16:09:36 | 000,000,000 | ---D | M] -- C:\Mp3 Output
[2009.02.14 19:41:40 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.12.30 02:57:54 | 000,000,000 | ---D | M] -- C:\My Shared Folder
[2009.04.25 19:19:02 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.02.08 01:28:36 | 000,000,000 | ---D | M] -- C:\Postinstall
[2009.12.19 22:14:34 | 000,000,000 | ---D | M] -- C:\Program Files
[2011.06.20 12:25:20 | 000,000,000 | R--D | M] -- C:\Programme
[2009.10.17 23:28:38 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2009.02.08 01:42:44 | 000,000,000 | ---D | M] -- C:\scheise
[2011.03.11 10:35:59 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.07.02 17:08:47 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2009.02.08 16:08:09 | 000,000,000 | ---D | M] -- C:\WINXP
 
< %PROGRAMFILES%\*.exe >
[2008.01.14 00:01:05 | 004,034,560 | ---- | M] () -- C:\Programme\Foxit_Reader.exe
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE >
[2008.04.14 12:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\scheise\system32\dllcache\explorer.exe
[2008.04.14 12:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 12:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: REGEDIT.EXE >
[2008.04.14 12:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\scheise\system32\dllcache\regedit.exe
[2008.04.14 12:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe
[2008.04.14 12:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\system32\dllcache\regedit.exe
 
< MD5 for: USERINIT.EXE >
[2008.04.14 12:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\scheise\system32\dllcache\userinit.exe
[2008.04.14 12:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 12:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE >
[2008.04.14 12:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\scheise\system32\dllcache\winlogon.exe
[2008.04.14 12:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 12:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-03 15:46:48
 
< End of report >
         

OTL Extras logfile created on: 03.07.2011 18:08:48 - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Dokumente und Einstellungen\ebi\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,48 Mb Total Physical Memory | 624,11 Mb Available Physical Memory | 61,04% Memory free
2,40 Gb Paging File | 2,08 Gb Available in Paging File | 86,54% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58,17 Gb Total Space | 36,91 Gb Free Space | 63,46% Space Free | Partition Type: NTFS
Drive E: | 57,84 Gb Total Space | 45,61 Gb Free Space | 78,85% Space Free | Partition Type: FAT32
Drive F: | 36,63 Gb Total Space | 24,06 Gb Free Space | 65,68% Space Free | Partition Type: FAT32
Drive J: | 34,18 Gb Total Space | 34,11 Gb Free Space | 99,80% Space Free | Partition Type: NTFS
Drive K: | 34,18 Gb Total Space | 11,39 Gb Free Space | 33,33% Space Free | Partition Type: NTFS
Drive N: | 161,12 Gb Total Space | 101,90 Gb Free Space | 63,25% Space Free | Partition Type: NTFS
Drive O: | 175,78 Gb Total Space | 160,54 Gb Free Space | 91,33% Space Free | Partition Type: NTFS
Drive P: | 190,90 Gb Total Space | 190,71 Gb Free Space | 99,90% Space Free | Partition Type: NTFS
 
Computer Name: LOTTE | User Name: ebi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\PROGRA~2\ACDSYS~1\ACDSee\ACDSee.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\iMesh Applications\iMesh\iMesh.exe" = C:\Programme\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\AOL 9.0 VRa\waol.exe" = C:\Programme\AOL 9.0 VRa\waol.exe:*:Disabled:AOL Software -- (AOL, LLC.)
"P:\warcraft3\Warcraft III.exe" = P:\warcraft3\Warcraft III.exe:*:Disabled:Warcraft III
"C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_JetSend.exe" = C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_JetSend.exe:*:Enabled:JetSendTray Application -- ()
"C:\Programme\Kazaa Lite\clean.kmd" = C:\Programme\Kazaa Lite\clean.kmd:*:Enabled:clean
"C:\Programme\Java\jre1.6.0_03\bin\javaw.exe" = C:\Programme\Java\jre1.6.0_03\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\iMesh Applications\iMesh\iMesh.exe" = C:\Programme\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04AABF6D-55C5-4779-ABF9-992016E913A2}" = Micrografx Picture Publisher 10
"{0D007C7C-5813-4FDE-9E61-63A63DD1A0CD}" = Macrium Reflect - Free Edition
"{0D00CD3F-AEDC-45F1-A2DD-DADF74407D7B}_is1" = Edna Bricht Aus 6.3
"{1A1BEE58-8EA1-772E-10DF-97C19C5F1031}" = Nero 7 Demo
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 26
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}" = DAEMON Tools
"{428102E6-8A39-48B9-8389-847F5A44A600}" = MSXML 4.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54BB0384-1C33-488F-A95B-877E480D3EDC}" = MSXML 4.0
"{54E8D06A-445B-4AE2-BB2E-516362C149F8}" = T-Concept XI420
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{748F4870-8350-11D3-B0BF-080009FB4A19}" = HP Share-to-Web
"{7F658C69-3FC8-42B7-B852-EA8DD05BE2CF}" = eazySales
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}" = iMesh
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{F35C4331-A385-4DC9-9BAE-485E4C999D07}" = PCC-1O01A
"{F7E1CA14-B39D-452A-960B-39423DDDD933}" = DriveImage XML (Private Edition)
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FFB61832-3942-4EC0-B7B6-0B32695CB436}" = GC-Prevue 18.3.2
"A Vampyre Story" = A Vampyre Story
"ACDSee" = ACDSee
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Aide PDF to DXF Converter_is1" = Aide PDF to DXF Converter 9.6
"AOL Deinstallation" = AOL Deinstallation
"Audacity_is1" = Audacity 1.2.4
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"C-Media USB Audio Driver" = C-Media USB WDM Audio Driver
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"EAGLE 4.16r2" = EAGLE 4.16r2
"EAGLE 5.11.0" = EAGLE 5.11.0
"EVEREST Home Edition_is1" = EVEREST Home Edition v1.51
"FileZilla Client" = FileZilla Client 3.4.0
"FLV Player" = FLV Player 2.0 (build 25)
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF (Remove only)
"FRITZ! 2.0" = AVM FRITZ!
"GPL Ghostscript 8.56" = GPL Ghostscript 8.56
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"hp deskjet 920c series" = hp deskjet 920c series (nur entfernen)
"HP Fotobearbeitungs-Programm" = HP Fotobearbeitungs-Programm
"HP Fotodruck-Programm" = HP Fotodruck-Programm
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Jack Keane" = Jack Keane
"LetsTrade" = LetsTrade Komponenten
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.18)" = Mozilla Firefox (3.6.18)
"MVApplication1" = SureThing CD Labeler 4 SE
"NeroVision!UninstallKey" = Nero Digital
"Novarm DipTrace" = Novarm DipTrace
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoSmart Printer Software" = PhotoSmart Printer Software
"POSTERIZA" = POSTERIZA 1.1.1
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"sPlan_60_is1" = sPlan 6.0
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"Tomb Raider: Legend" = Tomb Raider: Legend 1.0
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.0
"Unlocker" = Unlocker 1.8.5
"ViewpointMediaPlayer" = Viewpoint Media Player
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR Archivierer
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework CRT" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework PreXP" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update "Dr.
Watson" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework 1" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework 2" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework ASP .NET" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 02.07.2011 11:15:52 | Computer Name = LOTTE | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update ".NET
Framework WinForms" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen
sind in der Protokolldatei C:\WINDOWS\TEMP\dd_NET_Framework20_Setup4074.txt enthalten.
 
Error - 03.07.2011 11:46:48 | Computer Name = LOTTE | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb953300,
P2 1031, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10 
0.
 
Error - 03.07.2011 12:03:59 | Computer Name = LOTTE | Source = WinMgmt | ID = 28
Description = WinMgmt konnte die Kernteile nicht initialisieren. Mögliche Ursache
hierfür könnte eine beschädigte WinMgmt-Version, ein WinMgmt-Repositoryaktualisierungsfehler
oder nicht genügend Speicherplatz oder Arbeitsspeicher sein.
 
Error - 03.07.2011 12:03:59 | Computer Name = LOTTE | Source = SecurityCenter | ID = 1802
Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der
WMI herstellen, um Antivirus- und Firewallprogramme von Drittanbietern zu überwachen.
 
[ System Events ]
Error - 01.07.2011 10:59:01 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework 1.1 Service Pack 1
 
Error - 01.07.2011 10:59:33 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework*2.0 Service Pack*1, 
Sicherheitsupdate für Windows*2000, Windows Server*2003 und Windows*XP (KB953300)
 
Error - 01.07.2011 11:45:32 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework 1.1 Service Pack 1
 
Error - 01.07.2011 11:45:36 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework*2.0 Service Pack*1, 
Sicherheitsupdate für Windows*2000, Windows Server*2003 und Windows*XP (KB953300)
 
Error - 02.07.2011 11:17:39 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Update für die Microsoft .NET Framework 3.5 Service
Pack 1- und .NET Framework 3.5-Produktfamilie für die .NET-Versionen 2.0 bis 3.5
(KB951847) x86
 
Error - 03.07.2011 11:44:58 | Computer Name = LOTTE | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 192.168.1.11 über die
Netzwerkkarte mit der Netzwerkadresse 0019DB497E80 ist verloren gegangen.
 
Error - 03.07.2011 11:45:01 | Computer Name = LOTTE | Source = NetDDE | ID = 206
Description = "Listen" fehlgeschlagen: 23: NCB_LANA_NUM hat keine gültige Netzwerknummer
angegeben.
 
Error - 03.07.2011 11:45:17 | Computer Name = LOTTE | Source = NetDDE | ID = 206
Description = "Listen" fehlgeschlagen: 15: 
 
Error - 03.07.2011 11:46:47 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework 1.1 Service Pack 1
 
Error - 03.07.2011 11:47:08 | Computer Name = LOTTE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Microsoft .NET Framework*2.0 Service Pack*1, 
Sicherheitsupdate für Windows*2000, Windows Server*2003 und Windows*XP (KB953300)
 
 
< End of report >
         

GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-03 18:49:22
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-10 Maxtor_6Y160P0 rev.YAR41BW0
Running: yjzv7z2j.exe; Driver: C:\DOKUME~1\ebi\LOKALE~1\Temp\uxtdapow.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT F7C3F254 ZwClose
SSDT F7C3F20E ZwCreateKey
SSDT F7C3F25E ZwCreateSection
SSDT F7C3F204 ZwCreateThread
SSDT F7C3F213 ZwDeleteKey
SSDT F7C3F21D ZwDeleteValueKey
SSDT F7C3F24F ZwDuplicateObject
SSDT F7C3F222 ZwLoadKey
SSDT F7C3F1F0 ZwOpenProcess
SSDT F7C3F1F5 ZwOpenThread
SSDT F7C3F22C ZwReplaceKey
SSDT F7C3F227 ZwRestoreKey
SSDT F7C3F263 ZwSetContextThread
SSDT F7C3F218 ZwSetValueKey
SSDT F7C3F1FF ZwTerminateProcess
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6C9B360, 0x37388D, 0xE8000020]
.text C:\WINDOWS\System32\DRIVERS\atksgt.sys section is writeable [0xB9E82300, 0x3ACC8, 0xE8000020]
.text C:\WINDOWS\System32\DRIVERS\lirsgt.sys section is writeable [0xF79D0300, 0x1B7E, 0xE8000020]
 
---- Devices - GMER 1.0.15 ----
 
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 
---- Registry - GMER 1.0.15 ----
 
Reg HKLM\SOFTWARE\Classes\CLSID\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}\InProcServer32 
Reg HKLM\SOFTWARE\Classes\CLSID\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}\InProcServer32@iaaenimnjgpgpllmkm 0x61 0x61 0x00 0x00 
Reg HKLM\SOFTWARE\Classes\CLSID\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}\InProcServer32@iaaenimnjgfgfmodee 0x61 0x61 0x00 0x00 
Reg HKLM\SOFTWARE\Classes\CLSID\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}\InProcServer32@jaaejjaoifkpcfabmanj 0x6A 0x61 0x67 0x6A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}\InProcServer32@iaaedkcoalmmmjikcl 0x6A 0x61 0x62 0x6A ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9} 
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}@hagfkombkbloelei 0x61 0x61 0x00 0x00 
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}@hagfkombaafniiph 0x61 0x61 0x00 0x00 
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}@iaceckbhhmkjilgolc 0x6A 0x61 0x67 0x6A ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CC8D45E-E1B7-C960-C177-8D200AFF88E9}@haedmjeghhldbklm 0x6B 0x61 0x62 0x6A ...
 
---- Files - GMER 1.0.15 ----
 
File C:\magicvc.\R.dat 12 bytes
File C:\magicvc.\RTT.dat 12 bytes
 
---- EOF - GMER 1.0.15 ----