Hallo Zusammen,

nach dem Beseitigen des Angriffes von Malware TR/LockScreen.Q mittels der Bit defender (unter Linux) erscheint nun nach dem Neustart des OS WinXP Pro. SP3 nun kein Desktop mehr.

Ich kann über den Taskmanager ("Ausführen" ...) die explorer.exe aufrufen, es erscheint jedoch nur der Dateimanager, kein Desktop.

Was muß ich jetzt noch händisch "reparieren", damit der Desktop wieder erscheint?

HAbe OTL laufen lassen und hier kommen die Posts. Kann mir jemand helfen???
OTL.txt
OTL logfile created on: 29.07.2011 05:52:52 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Dokumente und Einstellungen\Herbert\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,91% Memory free
3,84 Gb Paging File | 3,35 Gb Available in Paging File | 87,28% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 152,66 Gb Total Space | 49,88 Gb Free Space | 32,67% Space Free | Partition Type: NTFS
Drive K: | 89,30 Gb Total Space | 51,41 Gb Free Space | 57,57% Space Free | Partition Type: NTFS

Computer Name: RAEKA001 | User Name: Herbert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\Herbert\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Office 2003\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Dokumente und Einstellungen\Herbert\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (TeamViewer6) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Radio.fx) -- C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (TeamViewer5) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (afcdpsrv) -- C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe ()
SRV - (McComponentHostService) -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (SandraAgentSrv) -- C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\RpcAgentSrv.exe (SiSoftware)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\hpzipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (afcdp) -- C:\WINDOWS\system32\drivers\afcdp.sys (Acronis)
DRV - (tdrpman258) Acronis Try&Decide and Restore Points filter (build 258) -- C:\WINDOWS\system32\DRIVERS\tdrpm258.sys (Acronis)
DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (HWiNFO32) -- C:\TEMP\hw32_344_650\HWiNFO32.sys (REALiX(tm))
DRV - (cpudrv) -- C:\Programme\SystemRequirementsLab\cpudrv.sys ()
DRV - (SANDRA) -- C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\WNt500x86\sandra.sys (SiSoftware)
DRV - (RTL8169) -- C:\WINDOWS\system32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (Pivot) -- C:\WINDOWS\system32\drivers\pivot.sys (Portrait Displays, Inc.)
DRV - (pivotmou) -- C:\WINDOWS\system32\drivers\pivotmou.sys (Portrait Displays, Inc.)
DRV - (FreshIO) -- C:\Programme\FreshDevices\FreshDiagnose\FreshIO.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=stonicde&s={searchTerms}&f=4

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=stonicde
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic Deutsch Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1351351&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.3.3
FF - prefs.js..extensions.enabledItems: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c}:3.2.3.3
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.07.14 10:10:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.07.14 10:10:10 | 000,000,000 | ---D | M]

[2010.06.17 10:14:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Extensions
[2010.06.17 10:14:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2011.07.14 10:16:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions
[2010.10.28 16:08:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.28 11:30:05 | 000,000,000 | ---D | M] (Softonic Deutsch Community Toolbar) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}
[2011.03.24 17:50:11 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions\engine@conduit.com
[2011.02.02 10:42:08 | 000,000,000 | ---D | M] (Facemoods) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions\ffxtlbr@Facemoods.com
[2011.07.14 10:16:23 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\extensions\plugin@yontoo.com
[2010.11.02 16:54:38 | 000,000,935 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\searchplugins\conduit.xml
[2011.06.07 09:40:38 | 000,005,508 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Mozilla\Firefox\Profiles\wyd14fab.default\searchplugins\webde-suche.xml
[2011.03.24 17:07:50 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.09.02 17:10:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.21 08:48:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\HERBERT\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\WYD14FAB.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2010.09.02 17:09:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.06.27 10:27:50 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.03.24 17:49:23 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.03.24 17:49:23 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.03.24 17:49:23 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.28 18:14:06 | 000,002,040 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\fcmdSrchstonicde.xml
[2011.03.24 17:49:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.10.27 16:56:19 | 000,001,456 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\WebSearchober7631406.xml
[2011.03.24 17:49:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.03.24 17:49:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2002.08.29 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.)
O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo Layers\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&DisplayView Surf) - {B9F633F6-EA44-45F4-91EB-FABFC65A0634} - C:\Programme\Portrait Displays\DisplayView Surf\sybil.dll (Portrait Displays, Inc.)
O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (&DisplayView Surf) - {B9F633F6-EA44-45F4-91EB-FABFC65A0634} - C:\Programme\Portrait Displays\DisplayView Surf\sybil.dll (Portrait Displays, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LiquidView] C:\Programme\Portrait Displays\DisplayView Scale\lview.exe (Portrait Displays, Inc.)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [PivotSoftware] C:\Programme\Portrait Displays\DisplayView Pivot\wpctrl.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Herbert\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Office 2003\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Office 2003\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\jashla.exe) - File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.29 22:10:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{600575fe-3bdc-11df-b2f9-f9d5bc8bc574}\Shell\AutoRun\command - "" = J:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.07.28 19:42:43 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Herbert\Desktop\OTL.exe
[2011.07.28 17:03:49 | 000,000,000 | ---D | C] -- C:\bd_logs
[2011.07.22 16:04:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes
[2011.07.22 16:03:50 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2011.07.22 16:03:47 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2011.07.22 16:00:02 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2011.07.22 16:00:00 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.07.21 23:03:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MailStore Home
[2011.07.21 23:03:51 | 000,000,000 | ---D | C] -- C:\Programme\deepinvent
[2011.07.21 22:51:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2011.07.19 14:16:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Herbert\Eigene Dateien\Kyocera
[2011.07.19 14:15:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Kyocera
[2011.07.19 07:34:57 | 000,000,000 | ---D | C] -- C:\Programme\Kyocera
[2011.07.14 10:16:22 | 000,000,000 | ---D | C] -- C:\Programme\Yontoo Layers
[2011.07.14 10:16:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tarma Installer
[2011.07.14 10:15:54 | 006,892,392 | ---- | C] (Driver-Soft Inc. ) -- C:\Dokumente und Einstellungen\Herbert\Desktop\Driver_Genius_10_Professional_DE.exe
[2011.07.14 10:10:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime
[2011.07.14 10:09:37 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2011.07.12 11:20:54 | 000,083,816 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\dns-sd.exe
[2011.07.12 11:20:54 | 000,073,064 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\dnssd.dll
[2011.07.11 17:20:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\kmw
[2011.07.11 17:19:13 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2011.07.11 07:52:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Herbert\Lokale Einstellungen\Anwendungsdaten\FRITZ!
[2011.07.11 07:52:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\FRITZ!
[2011.07.11 07:52:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FRITZ!
[2011.07.11 07:51:52 | 000,050,480 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\AvmColorFaxRender.dll
[2011.07.11 07:51:52 | 000,046,384 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\AvmFaxRender.dll
[2011.07.11 07:51:52 | 000,024,880 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\FritzVistaMon.dll
[2011.07.11 07:51:52 | 000,024,880 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\FritzVistaColorMon.dll
[2011.07.11 07:51:51 | 001,066,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.dll
[2011.07.11 07:51:51 | 000,980,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc70.dll
[2011.07.11 07:51:51 | 000,970,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc70u.dll
[2011.07.11 07:51:51 | 000,492,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp70.dll
[2011.07.11 07:51:51 | 000,451,888 | ---- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\System32\HHActiveX.dll
[2011.07.11 07:51:51 | 000,349,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr70.dll
[2011.07.11 07:51:51 | 000,070,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71DEU.DLL
[2011.07.11 07:51:51 | 000,060,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvci70.dll
[2011.07.11 07:51:51 | 000,054,576 | ---- | C] (AVM Berlin GmbH) -- C:\WINDOWS\System32\FritzPort.dll
[2011.07.11 07:51:51 | 000,054,576 | ---- | C] (AVM Berlin GmbH) -- C:\WINDOWS\System32\FritzColorPort.dll
[2011.07.11 07:51:51 | 000,042,288 | ---- | C] (AVM Berlin GmbH) -- C:\WINDOWS\System32\Fridru32.dll
[2011.07.11 07:51:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ISDNWatch
[2011.07.11 07:51:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\FRITZ!fax für FRITZ!Box
[2011.07.11 07:51:51 | 000,000,000 | ---D | C] -- C:\Programme\FRITZ!
[2011.07.08 12:38:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeamViewer 6
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Herbert\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Herbert\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.07.28 20:11:00 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.07.28 20:01:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.07.28 19:42:51 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Herbert\Desktop\OTL.exe
[2011.07.28 16:50:31 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.07.28 16:50:21 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.07.28 16:50:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.07.28 16:50:07 | 2137,313,280 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.28 15:01:18 | 000,001,536 | ---- | M] () -- C:\WINDOWS\MKDEWE.TRN
[2011.07.22 16:08:44 | 000,001,846 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Safari.lnk
[2011.07.22 16:04:46 | 000,001,522 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2011.07.22 14:40:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.07.21 23:03:56 | 000,000,771 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\MailStore Home.lnk
[2011.07.14 15:57:19 | 000,000,506 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Decker Abschluss II.pdf.lnk
[2011.07.14 15:57:19 | 000,000,503 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Decker Abschluss I.pdf.lnk
[2011.07.14 15:57:19 | 000,000,476 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Hentschel.pdf.lnk
[2011.07.14 15:57:19 | 000,000,476 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Dokument1.pdf.lnk
[2011.07.14 15:57:19 | 000,000,466 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit RG Computer.lnk
[2011.07.14 15:57:19 | 000,000,452 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit SWB.pdf.lnk
[2011.07.14 10:16:25 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Driver Genius Professional Edition.lnk
[2011.07.14 10:16:13 | 006,892,392 | ---- | M] (Driver-Soft Inc. ) -- C:\Dokumente und Einstellungen\Herbert\Desktop\Driver_Genius_10_Professional_DE.exe
[2011.07.14 10:10:02 | 000,001,584 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2011.07.14 09:36:40 | 000,335,464 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.07.14 03:01:06 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.07.12 11:20:54 | 000,083,816 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\dns-sd.exe
[2011.07.12 11:20:54 | 000,073,064 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\dnssd.dll
[2011.07.11 07:52:21 | 000,000,638 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FRITZ!fax.lnk
[2011.07.08 12:38:20 | 000,000,787 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 6.lnk
[2011.07.04 16:46:19 | 001,910,143 | ---- | M] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\beethovendenkmal_07_09.jpeg
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Herbert\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Herbert\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.07.22 16:04:46 | 000,001,522 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2011.07.21 23:03:56 | 000,000,771 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\MailStore Home.lnk
[2011.07.14 15:57:19 | 000,000,506 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Decker Abschluss II.pdf.lnk
[2011.07.14 15:57:19 | 000,000,503 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Decker Abschluss I.pdf.lnk
[2011.07.14 15:57:19 | 000,000,476 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Hentschel.pdf.lnk
[2011.07.14 15:57:19 | 000,000,476 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit Dokument1.pdf.lnk
[2011.07.14 15:57:19 | 000,000,466 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit RG Computer.lnk
[2011.07.14 15:57:19 | 000,000,452 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\Verknüpfung mit SWB.pdf.lnk
[2011.07.14 10:10:02 | 000,001,584 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2011.07.11 07:52:21 | 000,000,638 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FRITZ!fax.lnk
[2011.07.08 12:38:20 | 000,000,787 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 6.lnk
[2011.07.04 16:46:18 | 001,910,143 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Desktop\beethovendenkmal_07_09.jpeg
[2010.09.09 18:12:57 | 015,849,560 | ---- | C] () -- C:\WINDOWS\AdobeAIRInstaller.exe
[2010.08.02 12:34:52 | 000,000,432 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.08.02 12:34:52 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD2030.DAT
[2010.07.13 17:56:56 | 000,796,672 | ---- | C] () -- C:\WINDOWS\System32\SQL_SERVER_6.exe
[2010.06.14 16:55:09 | 000,071,048 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.06.11 13:18:14 | 000,554,496 | ---- | C] () -- C:\WINDOWS\System32\dvmsg.dll
[2010.06.08 18:06:37 | 000,000,048 | ---- | C] () -- C:\WINDOWS\System32\bs.bin
[2010.04.16 09:50:12 | 000,001,555 | ---- | C] () -- C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\SAS7_000.DAT
[2010.04.08 11:43:43 | 012,550,144 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sandra.mda
[2010.04.07 12:49:10 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2010.04.06 09:45:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.04.06 09:43:02 | 000,000,024 | ---- | C] () -- C:\WINDOWS\Design.ini
[2010.04.06 09:33:09 | 000,320,512 | ---- | C] () -- C:\WINDOWS\W32MKDE.EXE
[2010.04.06 09:33:09 | 000,149,504 | ---- | C] () -- C:\WINDOWS\WBMANAGE.EXE
[2010.04.06 09:33:09 | 000,147,456 | ---- | C] () -- C:\WINDOWS\DBU_UI.DLL
[2010.04.06 09:33:09 | 000,126,929 | ---- | C] () -- C:\WINDOWS\WBROLL.EXE
[2010.04.06 09:33:09 | 000,110,080 | ---- | C] () -- C:\WINDOWS\W32MKRC.DLL
[2010.04.06 09:33:09 | 000,101,888 | ---- | C] () -- C:\WINDOWS\BUTIL.DLL
[2010.04.06 09:33:09 | 000,100,864 | ---- | C] () -- C:\WINDOWS\WDBUUI32.DLL
[2010.04.06 09:33:09 | 000,065,536 | ---- | C] () -- C:\WINDOWS\WDBUMK32.DLL
[2010.04.06 09:33:09 | 000,058,368 | ---- | C] () -- C:\WINDOWS\WBEXEC.EXE
[2010.04.06 09:33:09 | 000,053,248 | ---- | C] () -- C:\WINDOWS\BUTIL.EXE
[2010.04.06 09:33:09 | 000,038,576 | ---- | C] () -- C:\WINDOWS\NWLOCALE.DLL
[2010.04.06 09:33:09 | 000,015,627 | ---- | C] () -- C:\WINDOWS\WBROLLRS.DLL
[2010.04.06 09:33:09 | 000,015,360 | ---- | C] () -- C:\WINDOWS\BGBMNG.EXE
[2010.04.06 09:33:09 | 000,000,821 | ---- | C] () -- C:\WINDOWS\bti.ini
[2010.03.31 14:03:07 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.03.31 11:04:00 | 000,017,896 | ---- | C] () -- C:\WINDOWS\hplj1010.ini
[2010.03.30 11:24:08 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010.03.30 11:17:18 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.03.30 11:11:26 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2010.03.30 11:11:26 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2010.03.30 11:11:26 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2010.03.30 11:11:26 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2010.03.30 11:11:26 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2010.03.30 10:32:42 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010.03.29 23:00:19 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.03.29 22:59:33 | 000,335,464 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.03.29 22:12:04 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.03.29 22:08:43 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.08.29 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002.08.29 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2002.08.29 14:00:00 | 000,452,720 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2002.08.29 14:00:00 | 000,435,816 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002.08.29 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2002.08.29 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2002.08.29 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2002.08.29 14:00:00 | 000,081,546 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2002.08.29 14:00:00 | 000,068,712 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002.08.29 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2002.08.29 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2002.08.29 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2002.08.29 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002.08.29 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002.08.29 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001.07.31 11:17:12 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F35A93AD

< End of report >

Extra.txt

OTL Extras logfile created on: 29.07.2011 05:52:52 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Dokumente und Einstellungen\Herbert\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,91% Memory free
3,84 Gb Paging File | 3,35 Gb Available in Paging File | 87,28% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 152,66 Gb Total Space | 49,88 Gb Free Space | 32,67% Space Free | Partition Type: NTFS
Drive K: | 89,30 Gb Total Space | 51,41 Gb Free Space | 57,57% Space Free | Partition Type: NTFS

Computer Name: RAEKA001 | User Name: Herbert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Programme\Opera\opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Opera\opera.exe" (Opera Software)
https [open] -- "C:\Programme\Opera\opera.exe" (Opera Software)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [SCHLECKER Foto Digital Service] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\SCHLECKER Foto Digital Service.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe" = C:\Programme\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe:*:Enabled:javaw -- ()
"C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\RpcAgentSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service -- (SiSoftware)
"C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\WNt500x86\sandra.07.mui" = C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\WNt500x86\sandra.07.mui:*:Enabled:SiSoftware Sandra Agent Service -- (SiSoftware)
"C:\Programme\Tobit Radio.fx\Server\rfx-server.exe" = C:\Programme\Tobit Radio.fx\Server\rfx-server.exe:*:Enabled:Radio.fx Server -- ()
"C:\Programme\Tobit Radio.fx\Client\rfx-client.exe" = C:\Programme\Tobit Radio.fx\Client\rfx-client.exe:*:Enabled:Radio.fx Client -- (Tobit.Software)
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\WNt500x86\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Professional Business 2010c\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service -- (SiSoftware)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\Herbert\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabledropbox -- (Dropbox, Inc.)
"C:\Programme\TeamViewer\Version6\TeamViewer.exe" = C:\Programme\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Programme\FRITZ!\igd_finder.exe" = C:\Programme\FRITZ!\igd_finder.exe:LocalSubNet:Enabled:AVM FRITZ!fax for FRITZ!Box - igd_finder.exe -- ()
"C:\Programme\FRITZ!\FriFax32.exe" = C:\Programme\FRITZ!\FriFax32.exe:*:Enabled:FRITZ!fax -- (AVM Berlin)
"C:\Programme\deepinvent\MailStore Home\MailStoreLocal.exe" = C:\Programme\deepinvent\MailStore Home\MailStoreLocal.exe:*:Enabled:MailStore Home -- (deepinvent Software GmbH)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}" = DisplayView Pivot
"{05ADEEC8-BD58-43D9-A9E3-1F53B0DA117A}" = Opera 10.51
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
"{292C47B2-8DB7-47BF-896C-C3C5EE8108C4}" = hp LaserJet 1010 Series
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B0CFB08-515C-4AD4-89DF-997BF8545622}" = Nuance Voice Recorder
"{4281435C-AD1D-4C8A-B9C0-3961C08EF142}_is1" = GoogleClean
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5E53DD4A-E25A-0A06-CFD6-4B1FF9384070}" = Allianz Prozesskostenrechner Premium
"{67ED38A3-4882-448B-B44D-3428AB00D7D5}" = Acronis*True*Image*Home
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D960CA6-6907-4874-8A22-B2A32769EAE5}" = Personal DVD
"{7057ABC2-EFF3-4E43-9806-8BCB6EEA9FE6}" = Microsoft IntelliPoint 7.1
"{729713E3-CFD5-4E9F-A301-5BD8EA25A28B}" = COMPUTERBILD-PC-Schnellstarter
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{735619D4-B42A-437A-958C-199BFCAEDB38}" = Safari
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F213562-D9E0-47C9-A97E-7F601605CAEF}" = DisplayView Scale
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.0.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers 1.10.01
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97A63A16-E76C-4E7F-9DFC-7A116FC09698}" = DisplayView Surf
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8194FA6-87C0-4D0F-B005-8F44089D3681}" = juris Smarttags
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Professional Business 2010c
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E7712E53-7A7F-46EB-AA13-70D5987D30F2}" = Dragon NaturallySpeaking 10
"{F45CB013-7BA8-454C-BB4D-9E1C08A81D96}" = BeckRecherche
"{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1" = AntiBrowserSpy
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Allianz ProzessFinanz Prozesskostenrechner Premium_is1" = Allianz ProzessFinanz Prozesskostenrechner Premium 1.0
"AnwaltFormulare Zivilprozessrecht" = AnwaltFormulare Zivilprozessrecht
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"com.pentos.air.allianzprozesskostenrechner.A768EEE467BE29480AA1493403DB72DCDA84E8C8.1" = Allianz Prozesskostenrechner Premium
"conduitEngine" = Conduit Engine
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"ElsterFormular für Unternehmer 12.0.0.5880u" = ElsterFormular für Unternehmer
"facemoods" = facemoods
"FE5AE7DC-7B01-4263-A94C-B4526C276549_is1" = iPhone Explorer
"FormularBuch Arbeitsrecht" = FormularBuch Arbeitsrecht 6. Auflage
"Foxit Reader" = Foxit Reader
"Free PDF to Word Converter_is1" = Free PDF to Word Converter 4.2.3.183
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"FreshDevices - FreshDiagnose_is1" = FreshDiagnose
"FRITZ! 2.0" = AVM FRITZ!fax für FRITZ!Box
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Kanzlei Manager PDF Printer_is1" = Kanzlei Manager PDF Printer (novaPDF 6.4 printer)
"Kyocera Product Library" = Kyocera Product Library
"MailStore Home_is1" = MailStore Home 4.2.0.5431
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 5.0 (x86 de)" = Mozilla Firefox 5.0 (x86 de)
"Picasa 3" = Picasa 3
"SCHLECKER Foto Digital Service" = SCHLECKER Foto Digital Service
"Scribus 1.3.7" = Scribus 1.3.7
"SharePod" = SharePod
"Softonic_Deutsch Toolbar" = Softonic Deutsch Toolbar
"TeamViewer 5" = TeamViewer 5
"TeamViewer 6" = TeamViewer 6
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"TomTom HOME" = TomTom HOME 2.8.0.2146
"Totalcmd" = Total Commander (Remove or Repair)
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"VLC media player" = VLC media player 1.1.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinZip" = WinZip
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 27.07.2011 07:53:32 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 200: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 27.07.2011 07:53:32 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 216: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 27.07.2011 09:51:02 | Computer Name = RAEKA001 | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application software4u.ipelauncher.exe, version 1.0.1.0,
stamp 4dadfe7e, faulting module kernel32.dll, version 5.1.2600.5781, stamp 49c4f482,
debug? 0, fault address 0x00012afb.

Error - 28.07.2011 04:07:39 | Computer Name = RAEKA001 | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application software4u.ipelauncher.exe, version 1.0.1.0,
stamp 4dadfe7e, faulting module kernel32.dll, version 5.1.2600.5781, stamp 49c4f482,
debug? 0, fault address 0x00012afb.

Error - 28.07.2011 07:00:18 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 188: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 28.07.2011 07:00:18 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 232: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 28.07.2011 07:00:18 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 420: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 28.07.2011 07:00:18 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 436: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 28.07.2011 07:00:18 | Computer Name = RAEKA001 | Source = Bonjour Service | ID = 100
Description = 452: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)

Error - 28.07.2011 08:47:43 | Computer Name = RAEKA001 | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application software4u.ipelauncher.exe, version 1.0.1.0,
stamp 4dadfe7e, faulting module kernel32.dll, version 5.1.2600.5781, stamp 49c4f482,
debug? 0, fault address 0x00012afb.

[ System Events ]
Error - 28.07.2011 10:46:14 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:46:35 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:46:56 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:47:28 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "." unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:47:49 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:48:10 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:48:31 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:49:04 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "." unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:49:25 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.

Error - 28.07.2011 10:49:46 | Computer Name = RAEKA001 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SERVER" unter Verwendung eines beliebigen,
konfigurierten Protokolls keine Daten austauschen.


< End of report >




Vorab vielen Dank,
Grüße

Shark001

nach dem Beseitigen des Angriffes von Malware TR/LockScreen.Q mittels der Bit defender (unter Linux) erscheint nun nach dem Neustart des OS WinXP Pro. SP3 nun kein Desktop mehr.

Was hat der Bitdefender genau entfernt? Welche Datei?