Problem mit TR/Crypt.XPack.Gen3

Twix

Hallo,

habe seit einigen Tagen ein Problem mit TR/Crypt.XPack.Gen3. Habe den Rechner bereits einmal im abgesicherten Modus mit AVIRA überprüfen lassen und die Funde in Quarantäne geschickt.
Seit dem gibt es keine neuen Meldungen mehr. Kann vielleicht jmd. trotzdem mal einen Blick draufwerfen?
Gruß und vielen Dank.

OTL logfile created on: 28.10.2011 12:33:46 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = H:\Dokumente und Einstellungen\***\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,97 Gb Total Physical Memory | 2,37 Gb Available Physical Memory | 79,91% Memory free
4,26 Gb Paging File | 3,82 Gb Available in Paging File | 89,50% Paging File free
Paging file location(s): H:\pagefile.sys 1488 2976 [binary data]

%SystemDrive% = H: | %SystemRoot% = H:\WINDOWS | %ProgramFiles% = H:\Programme
Drive H: | 149,04 Gb Total Space | 91,23 Gb Free Space | 61,21% Space Free | Partition Type: NTFS

Computer Name: ARBEITSZIMMER | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.10.28 12:31:57 | 000,584,192 | ---- | M] (OldTimer Tools) -- H:\Dokumente und Einstellungen\****\Desktop\OTL.exe
PRC - [2011.09.06 02:44:38 | 001,302,640 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\mshaktuell.exe
PRC - [2011.07.24 09:39:49 | 000,136,360 | ---- | M] (Avira GmbH) -- H:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.07.24 09:39:47 | 000,269,480 | ---- | M] (Avira GmbH) -- H:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.08 16:27:05 | 000,281,768 | ---- | M] (Avira GmbH) -- H:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.07.12 18:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- H:\Programme\Winamp\winampa.exe
PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- H:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- H:\WINDOWS\explorer.exe
PRC - [2008.03.14 21:49:28 | 001,241,088 | ---- | M] (Sun Microsystems, Inc.) -- H:\Programme\Sun\StarOffice 8\program\soffice.bin
PRC - [2008.03.14 21:49:28 | 001,019,904 | ---- | M] (Sun Microsystems, Inc.) -- H:\Programme\Sun\StarOffice 8\program\soffice.exe
PRC - [2007.09.11 15:50:28 | 000,804,144 | ---- | M] (AVM Berlin) -- H:\Programme\FRITZ!DSL\StCenter.exe
PRC - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) -- H:\Programme\FRITZ!DSL\IGDCTRL.EXE
PRC - [2007.06.26 20:27:46 | 000,312,320 | ---- | M] (shbox.de) -- H:\Programme\FreePDF_XP\fpassist.exe
PRC - [2007.01.26 17:56:21 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- H:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2007.01.25 03:52:26 | 000,065,536 | ---- | M] () -- H:\Programme\Gemeinsame Dateien\NMSAccessU.exe
PRC - [2006.12.21 01:00:20 | 000,039,936 | ---- | M] (C-Dilla Ltd) -- H:\WINDOWS\system32\drivers\CDAC11BA.EXE
PRC - [2006.02.17 11:40:18 | 000,270,336 | ---- | M] (NVIDIA Corporation) -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
PRC - [2006.02.17 11:39:02 | 000,139,264 | ---- | M] () -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
PRC - [2006.02.17 11:35:58 | 000,127,035 | ---- | M] (NVIDIA Corporation) -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
PRC - [2006.02.17 11:35:42 | 000,061,503 | ---- | M] (NVIDIA) -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
PRC - [2005.06.27 15:32:28 | 000,278,528 | ---- | M] (T-Online International AG, Marmiko IT-Solutions GmbH) -- H:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
PRC - [2005.05.31 01:04:00 | 001,415,824 | ---- | M] (Safer Networking Limited) -- H:\Programme\Spybot - Search & Destroy\TeaTimer.exe


========== Modules (No Company Name) ==========

MOD - [2011.09.06 09:48:02 | 007,809,536 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wgui11.dll
MOD - [2011.09.06 09:47:20 | 000,007,168 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\rscorewinapi47.dll
MOD - [2011.09.06 03:23:18 | 004,449,792 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wstyle11.dll
MOD - [2011.09.06 03:23:11 | 024,962,048 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wstyle111.dll
MOD - [2011.09.06 03:21:42 | 004,233,728 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wauff11.dll
MOD - [2011.09.06 03:16:54 | 001,807,360 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wfvie11.dll
MOD - [2011.09.06 02:44:38 | 001,302,640 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\mshaktuell.exe
MOD - [2011.09.06 02:32:22 | 001,371,648 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wreli11.dll
MOD - [2011.09.06 02:30:25 | 000,130,048 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\rsodbc47.dll
MOD - [2011.09.06 02:30:14 | 000,028,672 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\rsdcom47.dll
MOD - [2011.09.06 02:15:06 | 003,111,424 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wcore11.dll
MOD - [2011.09.06 02:10:09 | 001,367,040 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\wsteu11.dll
MOD - [2011.09.06 02:07:58 | 000,314,880 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\rsguiwinapi47.dll
MOD - [2011.03.21 13:49:42 | 000,701,952 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtsqlrs47.dll
MOD - [2011.02.01 10:17:40 | 000,357,376 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtxmlrs47.dll
MOD - [2011.02.01 10:17:19 | 011,162,624 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtwebkitrs47.dll
MOD - [2011.02.01 10:17:18 | 000,280,576 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtsvgrs47.dll
MOD - [2011.02.01 10:17:18 | 000,096,256 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qttestrs47.dll
MOD - [2011.02.01 10:17:17 | 001,329,152 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtscriptrs47.dll
MOD - [2011.02.01 10:17:16 | 000,925,696 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtnetworkrs47.dll
MOD - [2011.02.01 10:17:13 | 008,854,016 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtguirs47.dll
MOD - [2011.02.01 10:17:10 | 002,394,112 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qt3supportrs47.dll
MOD - [2011.02.01 10:17:10 | 002,341,376 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\qtcorers47.dll
MOD - [2011.02.01 10:17:09 | 000,271,360 | ---- | M] () -- H:\Programme\WISO\Steuersoftware 2011\phononrs47.dll
MOD - [2010.01.28 14:57:53 | 000,355,688 | ---- | M] () -- H:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2007.12.19 15:04:24 | 000,828,416 | ---- | M] () -- H:\Programme\Sun\StarOffice 8\program\libxml2.dll
MOD - [2007.01.25 03:52:26 | 000,065,536 | ---- | M] () -- H:\Programme\Gemeinsame Dateien\NMSAccessU.exe
MOD - [2006.02.17 11:39:02 | 000,139,264 | ---- | M] () -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- H:\WINDOWS\system32\redmonnt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.07.24 09:39:49 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- H:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.07.24 09:39:47 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- H:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Running] -- H:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV - [2007.05.29 19:41:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- H:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.01.25 03:52:26 | 000,065,536 | ---- | M] () [Auto | Running] -- H:\Programme\Gemeinsame Dateien\NMSAccessU.exe -- (NMSAccessU)
SRV - [2006.12.21 01:00:20 | 000,039,936 | ---- | M] (C-Dilla Ltd) [Auto | Running] -- H:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA)
SRV - [2006.02.17 11:39:02 | 000,139,264 | ---- | M] () [Auto | Running] -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2006.02.17 11:35:58 | 000,127,035 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)
SRV - [2006.02.17 11:35:42 | 000,061,503 | ---- | M] (NVIDIA) [Auto | Running] -- H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)


========== Driver Services (SafeList) ==========

DRV - [2011.07.24 09:39:50 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- H:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.24 09:39:50 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- H:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 11:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- H:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- H:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.04.13 20:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- H:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.02.13 19:07:02 | 000,008,864 | ---- | M] () [Kernel | Auto | Running] -- H:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2007.02.06 11:00:00 | 000,383,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- H:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2006.05.22 07:40:30 | 000,017,152 | ---- | M] (T-Online International AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- H:\Programme\Gemeinsame Dateien\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.02.17 04:28:32 | 000,013,056 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006.02.17 04:28:30 | 000,034,176 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006.01.27 08:04:16 | 000,099,584 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- H:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005.09.28 11:58:18 | 000,017,664 | ---- | M] (T-Online International AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- H:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
DRV - [2005.08.11 07:49:28 | 000,393,088 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
DRV - [2005.06.23 13:56:26 | 000,048,384 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- H:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005.03.09 16:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- H:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004.10.27 16:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- H:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004.08.23 13:55:54 | 000,029,440 | ---- | M] (Siemens AG) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\actser.sys -- (actser)
DRV - [2004.08.13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2001.08.17 15:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- H:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*hxxp://www.yahoo.com/ext/search/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - H:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: H:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: H:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: H:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: h:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: H:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: H:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: H:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: H:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: H:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: H:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.10 21:06:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: H:\Programme\Mozilla Firefox\components [2011.10.10 15:25:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: H:\Programme\Mozilla Firefox\plugins [2011.05.24 08:50:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: H:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.10 21:06:03 | 000,000,000 | ---D | M]

[2011.07.01 09:33:57 | 000,000,000 | ---D | M] (No name found) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Extensions
[2011.07.01 09:33:57 | 000,000,000 | ---D | M] (No name found) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2011.10.01 11:21:56 | 000,000,000 | ---D | M] (No name found) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\extensions
[2010.11.20 13:38:10 | 000,000,000 | ---D | M] (Winamp Toolbar) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.04.29 16:44:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.16 16:25:19 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011.10.01 11:21:56 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.11.21 15:00:57 | 000,001,196 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\gvyvd02d.default\searchplugins\winamp-search.xml
[2011.05.19 16:24:06 | 000,000,000 | ---D | M] (No name found) -- H:\Programme\Mozilla Firefox\extensions
[2006.12.28 17:06:54 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- H:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.08.13 16:49:29 | 000,000,000 | ---D | M] (Java Console) -- H:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.11 16:57:00 | 000,000,000 | ---D | M] (Java Console) -- H:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- H:\DOKUMENTE UND EINSTELLUNGEN\****\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\GVYVD02D.DEFAULT\EXTENSIONS\{DD05FD3D-18DF-4CE4-AE53-E795339C5F01}.XPI
[2009.12.16 17:45:38 | 000,000,000 | ---D | M] (Java Quick Starter) -- H:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.10.10 15:25:07 | 000,134,104 | ---- | M] (Mozilla Foundation) -- H:\Programme\mozilla firefox\components\browsercomps.dll
[2010.09.15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- H:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- H:\Programme\mozilla firefox\plugins\npwachk.dll
[2011.10.10 15:25:04 | 000,001,392 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.10 15:25:04 | 000,002,252 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.10.10 15:25:03 | 000,001,153 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.10 15:25:03 | 000,006,805 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.10 15:25:03 | 000,001,178 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.10 15:25:03 | 000,001,105 | ---- | M] () -- H:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = H:\Programme\Google\Chrome\Application\14.0.835.202\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = H:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = H:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = H:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = H:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = H:\Programme\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = H:\Programme\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = H:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = H:\Programme\Google\Chrome\Application\14.0.835.202\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = H:\Programme\Google\Chrome\Application\14.0.835.202\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = H:\Programme\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = H:\Programme\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Winamp Application Detector (Enabled) = H:\Programme\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = H:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = H:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Earth Plugin (Enabled) = H:\Programme\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = H:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = h:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | ---- | M]) - H:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - H:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - H:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - H:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - H:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - H:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - H:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - H:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - H:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] H:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [FreePDF Assistant] H:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] H:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [nTrayFw] H:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [NvCplDaemon] H:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] H:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] H:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] "H:\Programme\Java\jre6\bin\jusched.exe" File not found
O4 - HKLM..\Run: [TkBellExe] H:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] H:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (T-Online International AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [WinampAgent] H:\Programme\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] H:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [updateMgr] H:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\FRITZ!DSL Startcenter.lnk = H:\WINDOWS\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe ()
O4 - Startup: H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Office-Bibliothek-Direktsuche.lnk = File not found
O4 - Startup: H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Quicken 2009 Zahlungserinnerung.lnk = H:\Programme\Lexware\Quicken\2009\billmind.exe (Lexware GmbH & Co. KG)
O4 - Startup: H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = H:\Programme\WISO\Steuersoftware 2011\mshaktuell.exe ()
O4 - Startup: H:\Dokumente und Einstellungen\Fahrenkrug\Startmenü\Programme\Autostart\StarOffice 8.lnk = H:\Programme\Sun\StarOffice 8\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Winamp Search - H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programme\Java\jre1.6.0_04\bin\npjpi160_04.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - H:\Programme\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - H:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - H:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - H:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - H:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.186.161 83.169.186.225
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{776FC041-1F6A-4D08-B9EC-FD7C4B110504}: DhcpNameServer = 83.169.186.161 83.169.186.225
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - H:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - H:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -H:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (H:\WINDOWS\system32\userinit.exe) -H:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{b752348a-99d3-11dd-b2da-0018f3e26c08}\Shell - "" = AutoRun
O33 - MountPoints2\{b752348a-99d3-11dd-b2da-0018f3e26c08}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b752348a-99d3-11dd-b2da-0018f3e26c08}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\{e0f031ec-655b-11dd-b287-0018f3e26c08}\Shell\AutoRun\command - "" = J:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.10.28 12:31:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- H:\Dokumente und Einstellungen\Fahrenkrug\Desktop\OTL.exe
[2011.10.28 12:16:39 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.10.28 12:16:35 | 000,000,000 | ---D | C] -- H:\Programme\Malwarebytes' Anti-Malware
[2011.10.14 18:12:22 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.10.14 18:06:28 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\****\Startmenü\Programme\myphotobook.de
[2011.10.14 18:06:13 | 000,000,000 | ---D | C] -- H:\Programme\myphotobook.de
[2011.10.14 18:06:04 | 000,000,000 | ---D | C] -- H:\Programme\Gemeinsame Dateien\Adobe AIR
[2011.10.14 13:04:06 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2008.07.14 18:33:32 | 001,581,056 | ---- | C] (Microsoft Corporation) -- H:\Programme\FreePDFXP3.24.EXE
[2006.12.21 00:27:20 | 002,809,128 | R--- | C] (T-Online) -- H:\Programme\SoftwarePlus.exe
[6 H:\WINDOWS\System32\*.tmp files -> H:\WINDOWS\System32\*.tmp -> ]
[2 H:\WINDOWS\*.tmp files -> H:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.10.28 12:31:57 | 000,584,192 | ---- | M] (OldTimer Tools) -- H:\Dokumente und Einstellungen\****\Desktop\OTL.exe
[2011.10.28 12:22:43 | 000,193,460 | ---- | M] () -- H:\WINDOWS\System32\nvapps.xml
[2011.10.28 12:22:42 | 000,002,165 | ---- | M] () -- H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\FRITZ!DSL Startcenter.lnk
[2011.10.28 12:22:38 | 000,001,094 | ---- | M] () -- H:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.10.28 12:22:38 | 000,000,452 | ---- | M] () -- H:\WINDOWS\tasks\Microsoft Outlook.job
[2011.10.28 12:22:35 | 000,002,048 | --S- | M] () -- H:\WINDOWS\bootstat.dat
[2011.10.28 12:01:03 | 000,001,098 | ---- | M] () -- H:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.10.28 10:19:06 | 000,000,000 | ---- | M] () -- H:\Dokumente und Einstellungen\****\defogger_reenable
[2011.10.27 20:03:10 | 000,001,787 | ---- | M] () -- H:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2011.10.27 11:27:50 | 000,001,934 | ---- | M] () -- H:\WINDOWS\wiso.ini
[2011.10.27 09:56:57 | 000,002,495 | ---- | M] () -- H:\Dokumente und Einstellungen\Fahrenkrug\Desktop\Microsoft Word.lnk
[2011.10.27 09:46:05 | 000,013,728 | ---- | M] () -- H:\WINDOWS\System32\wpa.dbl
[2011.10.27 09:45:50 | 000,146,808 | ---- | M] () -- H:\WINDOWS\System32\FNTCACHE.DAT
[2011.10.25 17:15:08 | 000,123,904 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.16 22:34:25 | 000,000,069 | ---- | M] () -- H:\WINDOWS\NeroDigital.ini
[2011.10.14 18:06:28 | 000,000,738 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\myphotobook.de.lnk
[2011.10.14 14:44:28 | 000,030,817 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Mitglieder 2011 mit Adressen Beiträge.ods
[2011.10.14 12:15:38 | 000,001,680 | ---- | M] () -- H:\Dokumente und Einstellungen\****\.recently-used.xbel
[2011.10.13 09:18:24 | 000,001,393 | ---- | M] () -- H:\WINDOWS\imsins.BAK
[2011.10.13 09:18:01 | 000,459,250 | ---- | M] () -- H:\WINDOWS\System32\perfh007.dat
[2011.10.13 09:18:01 | 000,441,552 | ---- | M] () -- H:\WINDOWS\System32\perfh009.dat
[2011.10.13 09:18:01 | 000,084,754 | ---- | M] () -- H:\WINDOWS\System32\perfc007.dat
[2011.10.13 09:18:01 | 000,071,488 | ---- | M] () -- H:\WINDOWS\System32\perfc009.dat
[2011.10.12 18:06:08 | 000,459,354 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Attest ****.pdf
[2011.10.12 16:42:26 | 001,799,734 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Eigene Dateien\Film- VLC Player_Einführung.pdf
[2011.10.12 16:42:06 | 000,038,914 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Film- Schwarzfahrer Unterrichtsvorschlag Lenz.pdf
[2011.10.12 16:41:39 | 000,020,095 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Film- Literaturauswahl zum Thema Film.pdf
[2011.10.07 15:28:16 | 001,678,666 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Malteser Bescheinigung.pdf
[2011.10.06 16:14:03 | 000,012,438 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Intuit (2).pdf
[2011.10.06 16:06:08 | 000,012,381 | ---- | M] () -- H:\Dokumente und Einstellungen\****\Desktop\Intuit (1).pdf
[6 H:\WINDOWS\System32\*.tmp files -> H:\WINDOWS\System32\*.tmp -> ]
[2 H:\WINDOWS\*.tmp files -> H:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.10.28 10:19:06 | 000,000,000 | ---- | C] () -- H:\Dokumente und Einstellungen\****\defogger_reenable
[2011.10.14 18:06:28 | 000,000,738 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\myphotobook.de.lnk
[2011.10.14 12:15:38 | 000,001,680 | ---- | C] () -- H:\Dokumente und Einstellungen\****\.recently-used.xbel
[2011.10.12 18:06:08 | 000,459,354 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Attest ****.pdf
[2011.10.12 16:44:15 | 001,799,734 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Film- VLC Player_Einführung.pdf
[2011.10.12 16:42:26 | 001,799,734 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Eigene Dateien\Film- VLC Player_Einführung.pdf
[2011.10.12 16:42:06 | 000,038,914 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Film- Schwarzfahrer Unterrichtsvorschlag Lenz.pdf
[2011.10.12 16:41:39 | 000,020,095 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Film- Literaturauswahl zum Thema Film.pdf
[2011.10.07 15:28:16 | 001,678,666 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Malteser Bescheinigung.pdf
[2011.10.06 16:13:56 | 000,012,438 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Intuit (2).pdf
[2011.10.06 16:06:01 | 000,012,381 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Desktop\Intuit (1).pdf
[2011.09.02 12:43:41 | 000,000,043 | ---- | C] () -- H:\WINDOWS\gswin32.ini
[2010.05.08 10:05:32 | 000,000,664 | ---- | C] () -- H:\WINDOWS\System32\d3d9caps.dat
[2010.03.10 23:35:19 | 000,153,940 | ---- | C] () -- H:\WINDOWS\hpwins22.dat.temp
[2010.03.10 23:35:19 | 000,001,075 | ---- | C] () -- H:\WINDOWS\hpwmdl22.dat.temp
[2010.03.08 17:41:50 | 000,023,671 | ---- | C] () -- H:\WINDOWS\hpqins15.dat.temp
[2010.03.08 17:31:46 | 000,078,196 | ---- | C] () -- H:\WINDOWS\hpqins05.dat.temp
[2010.03.05 17:48:20 | 000,217,081 | ---- | C] () -- H:\WINDOWS\hpwins22.dat
[2010.03.05 17:48:20 | 000,002,979 | ---- | C] () -- H:\WINDOWS\hpwmdl22.dat
[2010.02.15 10:46:59 | 000,023,671 | ---- | C] () -- H:\WINDOWS\hpqins15.dat
[2010.02.15 10:37:22 | 000,078,195 | ---- | C] () -- H:\WINDOWS\hpqins05.dat
[2009.12.27 16:14:53 | 000,002,324 | ---- | C] () -- H:\Programme\Microsoft-Tastatur.lnk
[2009.10.18 11:23:55 | 000,000,000 | ---- | C] () -- H:\WINDOWS\PowerReg.dat
[2009.10.05 22:37:00 | 000,001,276 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\FASTWiz.html
[2009.10.05 22:28:30 | 000,000,792 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\FASTApp.html
[2009.08.11 16:52:45 | 000,001,876 | ---- | C] () -- H:\Programme\Genius starten.lnk
[2009.02.02 12:11:40 | 000,001,594 | ---- | C] () -- H:\Programme\QuickTime Player.lnk
[2008.12.23 11:31:05 | 000,001,656 | ---- | C] () -- H:\Programme\WISO Sparbuch 2009.lnk
[2008.11.28 17:57:19 | 000,000,754 | ---- | C] () -- H:\Programme\MindManager Smart.lnk
[2008.08.25 18:52:04 | 000,000,019 | ---- | C] () -- H:\WINDOWS\QwTools.INI
[2008.07.14 18:34:11 | 000,116,224 | ---- | C] () -- H:\WINDOWS\System32\redmonnt.dll
[2008.07.14 18:34:11 | 000,045,056 | ---- | C] () -- H:\WINDOWS\System32\unredmon.exe
[2008.07.14 18:29:43 | 012,972,544 | ---- | C] () -- H:\Programme\gs854w32.exe
[2008.07.04 15:26:33 | 003,211,264 | ---- | C] () -- H:\Programme\Gemeinsame DateienDDBACSetup.msi
[2008.07.04 14:40:06 | 000,000,769 | ---- | C] () -- H:\Programme\Wertpapieranalyse 2009.lnk
[2008.05.17 11:13:25 | 000,001,730 | ---- | C] () -- H:\Programme\Adobe Reader 7.0.lnk
[2007.11.25 13:30:35 | 000,001,759 | ---- | C] () -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007.11.15 21:27:40 | 000,303,104 | ---- | C] () -- H:\WINDOWS\System32\dnt27VC8.dll
[2007.11.15 21:25:28 | 000,090,112 | ---- | C] () -- H:\WINDOWS\System32\dntvmc27VC8.dll
[2007.11.15 21:25:12 | 000,086,016 | ---- | C] () -- H:\WINDOWS\System32\dntvm27VC8.dll
[2007.09.06 16:45:35 | 000,000,052 | ---- | C] () -- H:\WINDOWS\Relax.ini
[2007.08.29 16:16:00 | 000,472,656 | ---- | C] () -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\pswi_preloaded.exe
[2007.08.29 13:54:40 | 000,002,516 | -HS- | C] () -- H:\WINDOWS\System32\KGyGaAvL.sys
[2007.08.29 13:54:40 | 000,000,008 | RHS- | C] () -- H:\WINDOWS\System32\965EAF02A5.sys
[2007.04.29 15:00:50 | 000,000,000 | ---- | C] () -- H:\WINDOWS\nsreg.dat
[2007.04.27 13:48:23 | 000,000,000 | ---- | C] () -- H:\WINDOWS\tm.ini
[2007.04.19 18:47:53 | 000,000,831 | ---- | C] () -- H:\Programme\Ad-Aware SE Personal.lnk
[2007.04.17 15:47:07 | 000,000,945 | ---- | C] () -- H:\Programme\Spybot - Search & Destroy.lnk
[2007.02.13 19:07:03 | 000,008,864 | ---- | C] () -- H:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2007.02.13 18:52:32 | 000,000,029 | ---- | C] () -- H:\WINDOWS\DEBUGSM.INI
[2007.01.26 18:12:28 | 000,000,075 | ---- | C] () -- H:\WINDOWS\cdplayer.ini
[2007.01.26 17:55:19 | 000,000,069 | ---- | C] () -- H:\WINDOWS\NeroDigital.ini
[2007.01.25 03:52:26 | 000,065,536 | ---- | C] () -- H:\Programme\Gemeinsame Dateien\NMSAccessU.exe
[2007.01.22 16:48:54 | 000,001,934 | ---- | C] () -- H:\WINDOWS\wiso.ini
[2007.01.22 16:42:22 | 000,000,256 | ---- | C] () -- H:\WINDOWS\BUHL.INI
[2007.01.21 20:01:57 | 000,000,122 | ---- | C] () -- H:\WINDOWS\ALBUM.INI
[2007.01.12 20:21:28 | 000,001,892 | ---- | C] () -- H:\Programme\T-Online 6.0.lnk
[2006.12.29 19:39:14 | 000,001,152 | ---- | C] () -- H:\WINDOWS\mozver.dat
[2006.12.21 17:27:31 | 000,123,904 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.12.21 01:08:34 | 000,000,400 | ---- | C] () -- H:\WINDOWS\ODBC.INI
[2006.12.21 00:55:28 | 000,000,130 | ---- | C] () -- H:\WINDOWS\EPSON Perfection 1670G.ini
[2006.12.21 00:52:06 | 000,061,440 | R--- | C] () -- H:\WINDOWS\scrub2k.exe
[2006.12.21 00:52:06 | 000,000,104 | R--- | C] () -- H:\WINDOWS\hpw1100k.ini
[2006.12.21 00:50:39 | 000,006,862 | ---- | C] () -- H:\WINDOWS\hpbj1100.ini
[2006.12.21 00:49:41 | 000,000,360 | ---- | C] () -- H:\WINDOWS\hpbvspst.ini
[2006.12.21 00:49:39 | 000,001,115 | ---- | C] () -- H:\WINDOWS\hpbvnstp.ini
[2006.12.21 00:49:37 | 000,196,608 | R--- | C] () -- H:\WINDOWS\System32\hpbvnstp.dll
[2006.12.21 00:49:37 | 000,000,242 | R--- | C] () -- H:\WINDOWS\System32\hpbvnstp.dat
[2006.12.21 00:31:24 | 000,000,143 | ---- | C] () -- H:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.12.20 19:27:44 | 000,000,305 | ---- | C] () -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006.12.20 19:01:29 | 000,021,933 | ---- | C] () -- H:\WINDOWS\Ascd_tmp.ini
[2006.12.20 18:48:25 | 000,022,254 | ---- | C] () -- H:\WINDOWS\Ascd_log.ini
[2006.12.20 18:48:12 | 000,005,810 | R--- | C] () -- H:\WINDOWS\System32\drivers\ASACPI.sys
[2006.12.20 18:47:57 | 000,005,824 | ---- | C] () -- H:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006.12.20 18:39:18 | 000,002,048 | --S- | C] () -- H:\WINDOWS\bootstat.dat
[2006.12.20 18:33:44 | 000,021,740 | ---- | C] () -- H:\WINDOWS\System32\emptyregdb.dat
[2006.12.20 18:16:33 | 000,004,161 | ---- | C] () -- H:\WINDOWS\ODBCINST.INI
[2006.12.20 18:13:39 | 000,146,808 | ---- | C] () -- H:\WINDOWS\System32\FNTCACHE.DAT
[2006.02.28 14:00:00 | 013,107,200 | ---- | C] () -- H:\WINDOWS\System32\oembios.bin
[2006.02.28 14:00:00 | 000,673,088 | ---- | C] () -- H:\WINDOWS\System32\mlang.dat
[2006.02.28 14:00:00 | 000,459,250 | ---- | C] () -- H:\WINDOWS\System32\perfh007.dat
[2006.02.28 14:00:00 | 000,441,552 | ---- | C] () -- H:\WINDOWS\System32\perfh009.dat
[2006.02.28 14:00:00 | 000,272,128 | ---- | C] () -- H:\WINDOWS\System32\perfi009.dat
[2006.02.28 14:00:00 | 000,269,480 | ---- | C] () -- H:\WINDOWS\System32\perfi007.dat
[2006.02.28 14:00:00 | 000,218,003 | ---- | C] () -- H:\WINDOWS\System32\dssec.dat
[2006.02.28 14:00:00 | 000,084,754 | ---- | C] () -- H:\WINDOWS\System32\perfc007.dat
[2006.02.28 14:00:00 | 000,071,488 | ---- | C] () -- H:\WINDOWS\System32\perfc009.dat
[2006.02.28 14:00:00 | 000,046,258 | ---- | C] () -- H:\WINDOWS\System32\mib.bin
[2006.02.28 14:00:00 | 000,034,478 | ---- | C] () -- H:\WINDOWS\System32\perfd007.dat
[2006.02.28 14:00:00 | 000,028,626 | ---- | C] () -- H:\WINDOWS\System32\perfd009.dat
[2006.02.28 14:00:00 | 000,004,569 | ---- | C] () -- H:\WINDOWS\System32\secupd.dat
[2006.02.28 14:00:00 | 000,004,461 | ---- | C] () -- H:\WINDOWS\System32\oembios.dat
[2006.02.28 14:00:00 | 000,001,804 | ---- | C] () -- H:\WINDOWS\System32\dcache.bin
[2006.02.28 14:00:00 | 000,000,741 | ---- | C] () -- H:\WINDOWS\System32\noise.dat
[2006.01.24 12:15:00 | 001,724,416 | ---- | C] () -- H:\WINDOWS\System32\nvwdmcpl.dll
[2006.01.24 12:15:00 | 001,657,376 | ---- | C] () -- H:\WINDOWS\System32\nwiz.exe
[2006.01.24 12:15:00 | 001,503,232 | ---- | C] () -- H:\WINDOWS\System32\nview.dll
[2006.01.24 12:15:00 | 001,346,080 | ---- | C] () -- H:\WINDOWS\System32\nvdspsch.exe
[2006.01.24 12:15:00 | 001,101,824 | ---- | C] () -- H:\WINDOWS\System32\nvwimg.dll
[2006.01.24 12:15:00 | 000,573,440 | ---- | C] () -- H:\WINDOWS\System32\nvhwvid.dll
[2006.01.24 12:15:00 | 000,466,944 | ---- | C] () -- H:\WINDOWS\System32\nvshell.dll
[2006.01.24 12:15:00 | 000,449,056 | ---- | C] () -- H:\WINDOWS\System32\nvappbar.exe
[2006.01.24 12:15:00 | 000,436,768 | ---- | C] () -- H:\WINDOWS\System32\keystone.exe
[2006.01.24 12:15:00 | 000,286,720 | ---- | C] () -- H:\WINDOWS\System32\nvnt4cpl.dll

========== LOP Check ==========

[2007.12.30 11:44:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl
[2007.11.27 15:22:56 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2008.07.04 14:39:26 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2006.12.21 01:18:41 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2010.12.30 12:50:04 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2011.09.02 12:02:13 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2008.07.04 14:39:48 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\World Money
[2007.01.17 18:07:35 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Yahoo
[2009.03.19 19:39:08 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010.04.05 11:01:19 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.02.28 19:35:58 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.05.18 11:02:59 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010.12.30 11:50:40 | 000,000,000 | -HSD | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2009.10.20 16:41:24 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Ashampoo Cover Studio 2009
[2007.12.29 11:38:41 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Buhl Data Service
[2009.08.11 18:20:34 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Cornelsen
[2008.07.04 14:50:12 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\DataDesign
[2011.10.14 18:12:22 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.08.24 17:36:01 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\DVDVideoSoft
[2011.08.24 17:01:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\DVDVideoSoftIEHelpers
[2007.02.18 19:07:00 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\EPSON
[2011.09.03 10:33:27 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\FRITZ!
[2011.10.14 12:18:27 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\gtk-2.0
[2008.07.04 14:39:35 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Lexware
[2010.09.22 18:07:57 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Opera
[2011.10.19 17:38:01 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\PriceGong
[2008.02.23 16:40:39 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\putzi4win
[2008.10.28 21:08:52 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\RagTime
[2011.05.27 14:19:07 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\Scribus
[2011.10.28 12:22:48 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\StarOffice8
[2006.12.21 00:32:23 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\T-Online
[2011.07.01 09:33:47 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\TomTom
[2010.12.30 11:51:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\TuneUp Software
[2007.07.19 15:00:07 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\****\Anwendungsdaten\XCPCSync.OEM

========== Purity Check ==========



< End of report >


OTL Extras logfile created on: 28.10.2011 12:33:46 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = H:\Dokumente und Einstellungen\****\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,97 Gb Total Physical Memory | 2,37 Gb Available Physical Memory | 79,91% Memory free
4,26 Gb Paging File | 3,82 Gb Available in Paging File | 89,50% Paging File free
Paging file location(s): H:\pagefile.sys 1488 2976 [binary data]

%SystemDrive% = H: | %SystemRoot% = H:\WINDOWS | %ProgramFiles% = H:\Programme
Drive H: | 149,04 Gb Total Space | 91,23 Gb Free Space | 61,21% Space Free | Partition Type: NTFS

Computer Name: ARBEITSZIMMER | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] -- H:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- H:\Programme\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "H:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "H:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "H:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "H:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "H:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"G:\setup\hpznui01.exe" = G:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"H:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = H:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = H:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\bin\hpofxs08.exe" = H:\Programme\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqfxt08.exe" = H:\Programme\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe -- (TODO: <Company name>)
"H:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = H:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = H:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = H:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\HP Software Update\HPWUCli.exe" = H:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = H:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = H:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = H:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hposid01.exe" = H:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = H:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"H:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe" = H:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server -- (Apache Software Foundation)
"G:\fsetup.exe" = G:\fsetup.exe:*:Enabled:AVM FSetup Application
"H:\Programme\FRITZ!DSL\IGDCTRL.EXE" = H:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:AVM FRITZ!DSL - igdctrl.exe -- (AVM Berlin)
"H:\Programme\FRITZ!DSL\FBOXUPD.EXE" = H:\Programme\FRITZ!DSL\FBOXUPD.EXE:*:Enabled:AVM FRITZ!DSL - fboxupd.exe -- (AVM Berlin)
"H:\Programme\FRITZ!DSL\WebwaIgd.exe" = H:\Programme\FRITZ!DSL\WebwaIgd.exe:*:Enabled:AVM FRITZ!DSL - webwaigd.exe -- (AVM Berlin)
"H:\Programme\Opera\opera.exe" = H:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"G:\setup\hpznui01.exe" = G:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"H:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = H:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = H:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\bin\hpofxs08.exe" = H:\Programme\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqfxt08.exe" = H:\Programme\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe -- (TODO: <Company name>)
"H:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = H:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = H:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = H:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\HP Software Update\HPWUCli.exe" = H:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"H:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = H:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = H:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = H:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hposid01.exe" = H:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"H:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = H:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"H:\Programme\Bonjour\mDNSResponder.exe" = H:\Programme\Bonjour\mDNSResponder.exe:*:Enabledienst "Bonjour"


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status
"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg
"{102CBC47-7FDE-4E6C-8A3A-67B79833FAC8}" = BPDSoftware_Ini
"{11B2F891-91C8-47ce-945A-A91003EA27FB}" = BPDSoftware
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6423DE-7959-4178-80E0-023C7EAA5347}" = NVIDIA ForceWare Network Access Manager
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 22
"{2A329FB6-389D-4396-A974-29656D6864AE}" = MarketResearch
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{432A850B-3558-4BFF-B1F9-30626835B523}" = BPD_DSWizards
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F60D52-630B-43C5-BD20-176F5CD4EED6}" = bpd_scan
"{588A4F4D-FA7D-4CBC-87B8-D25CEE762463}" = DDBAC
"{5B12573C-9C90-4790-BFEE-2BC43C2EB997}" = Siemens SmartSync
"{5C52CED3-D45C-4DA9-932F-B91BD44BB461}" = Adabas D 13.01.00
"{5E714600-BAF1-4B6B-AAA9-B9C5CB082EF7}" = Quicken 2009 - ServicePack 1
"{624E7452-BA43-4f55-B9D5-FC75EEA0808B}" = Officejet Pro 8500 A909 Series
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{676981B7-A2D9-49D0-9F4C-03018F131DA9}" = DocProc
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69E8BEBD-B3AA-4981-BA49-AD0AEA731031}" = Nero BackItUp 2 Essentials
"{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}" = Mobile Phone Manager
"{7D7C9A8A-F3B4-42A2-9AD2-5B0CA013267C}" = Lexware online banking
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84F7CAD9-2316-4701-B5CA-E90FD60029E9}" = ANNO 1602
"{87A9A9A9-FAB7-4224-9328-0FA2058C0FD5}" = Network
"{8E77C3B6-6971-44ED-9267-A8E494785607}" = Quicken 2009
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{94056AE8-EF0F-45E4-A1B4-D754115F8A28}" = Numedia CD-DVD writing as non-admin user
"{94A065E8-455D-41C1-AF1F-F0C1AF8F50F3}" = Microsoft IntelliType Pro 7.0
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B7EBE71-677B-11D4-BD0F-0001020A5D35}" = DAO 3.6 Installation
"{9CCCFD9C-248F-47FE-9496-1680E3E5C163}" = Scan
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}" = ABBYY FineReader 6.0
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B495547C-01F8-4836-A2E6-749B5F3EA691}" = 8500A909_Help
"{B516126E-607A-47BD-8B35-335A76328576}" = Quicken Import Export Server 2009
"{BEDFB0D0-CA1E-4CBA-9664-B25A74019D0C}" = Lexware Info Service
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C29C1940-CB85-4F3B-906C-33FEE0E67103}" = DocMgr
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC038D57-788A-4544-BF8F-179E5CF50D2F}" = Microsoft Visual C++ 2005 SP1 CRT Redistributable
"{CD8C5C7F-7C58-4F85-8977-A6C08C087912}" = MPM
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5DEF057-D3BC-499f-99EE-884ED429B6D1}" = 8500A909g
"{D9AA99DB-259F-4961-BCAB-08F81856DC39}" = StarOffice 8
"{D9B07961-A319-385E-79A6-6E14F315F7FE}" = myphotobook.de
"{DA8BF070-1358-4a30-A68F-21E0E9421AEF}" = ProductContext
"{E5A24EC1-61AF-4AF4-A103-756359FAC92E}" = Quicken 2009 - ServicePack 3
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"FreePDF_XP" = FreePDF XP (Remove only)
"Genius Politik" = Genius Politik
"Google Chrome" = Google Chrome
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 12.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 12.0
"HPOCR" = OCR Software by I.R.I.S. 12.0
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{1F6423DE-7959-4178-80E0-023C7EAA5347}" = NVIDIA ForceWare Network Access Manager
"InstallShield_{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}" = Mobile Phone Manager
"InstallShield_{8E77C3B6-6971-44ED-9267-A8E494785607}" = Quicken Deluxe 2009
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 11.52.1100" = Opera 11.52
"P1670 Referenzhandbuch" = P1670 Referenzhandbuch
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Scribus 1.3.9" = Scribus 1.3.9
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"sv.net" = sv.net
"T-Online Copas" = T-Online Copas
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinGimp-2.0_is1" = GIMP 2.6.7

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 09.05.2011 12:25:21 | Computer Name = ARBEITSZIMMER | Source = ESENT | ID = 490
Description = svchost (1876) Versuch, Datei "H:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error - 19.05.2011 10:12:53 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 19.05.2011 10:12:53 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 19.05.2011 10:12:53 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 28.05.2011 06:41:28 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 28.05.2011 06:41:28 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 28.05.2011 06:41:28 | Computer Name = ARBEITSZIMMER | Source = Bonjour Service | ID = 100
Description =

Error - 01.07.2011 03:33:42 | Computer Name = ARBEITSZIMMER | Source = TomTomHOMEService | ID = 10000
Description =

Error - 24.07.2011 03:33:29 | Computer Name = ARBEITSZIMMER | Source = ESENT | ID = 490
Description = svchost (1888) Versuch, Datei "H:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error - 10.08.2011 11:09:04 | Computer Name = ARBEITSZIMMER | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .

[ System Events ]
Error - 14.10.2011 08:04:34 | Computer Name = ARBEITSZIMMER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
Bibliothek OLYMPUS E-PL1 USB Device nicht laden.

Error - 26.10.2011 03:27:47 | Computer Name = ARBEITSZIMMER | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 77.21.12.171 über die
Netzwerkkarte mit der Netzwerkadresse 0018F3E26C08 ist verloren gegangen.

Error - 28.10.2011 04:42:42 | Computer Name = ARBEITSZIMMER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28.10.2011 04:42:51 | Computer Name = ARBEITSZIMMER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 28.10.2011 04:43:46 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DHCP-Client" ist vom Dienst "NetBios über TCP/IP" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31

Error - 28.10.2011 04:43:46 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DNS-Client" ist vom Dienst "TCP/IP-Protokolltreiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31

Error - 28.10.2011 04:43:46 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "TCP/IP-NetBIOS-Hilfsprogramm" ist vom Dienst "AFD" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31

Error - 28.10.2011 04:43:46 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7001
Description = Der Dienst "IPSEC-Dienste" ist vom Dienst "IPSEC-Treiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31

Error - 28.10.2011 04:43:46 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD AmdK8 avgio avipbb eeCtrl Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip WS2IFSL

Error - 28.10.2011 05:59:00 | Computer Name = ARBEITSZIMMER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >