Hallo Zusammen,

auch mich hat der o. g. Trojaner erwischt.
Nach euren Anleitungen habe ich bereits OTL.exe installiert und habe nun zwei Logfiles erstellen können:

1.

OTL logfile created on: 12.03.2012 20:43:37 - Run 1
OTL by OldTimer - Version 3.2.36.3 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,97 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 78,41% Memory free
3,30 Gb Paging File | 3,06 Gb Available in Paging File | 92,81% Paging File free
Paging file location(s): C:\pagefile.sys 1512 3024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,44 Gb Total Space | 58,06 Gb Free Space | 77,99% Space Free | Partition Type: NTFS
Drive I: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive L: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive N: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive O: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive P: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive Q: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive S: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive U: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive V: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive W: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive Z: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS

Computer Name: AP-DT-082 | User Name: ***| Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - (stllssvr) -- File not found
SRV - (DM1Service) -- File not found
SRV - (SolidWorks Licensing Service) -- C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (DWMRCS) -- C:\WINDOWS\System32\DWRCS.EXE (DameWare Development LLC)
SRV - (DNTUS26) -- C:\WINDOWS\system32\DNTUS26.EXE (DameWare Development LLC)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ASFAgent) -- C:\Programme\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)
SRV - (TIRmtSvc) -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe (Numara Software, Inc.)
SRV - (TIRmtCtl) -- C:\WINDOWS\TIREMOTE\wuser32.exe (Intuit Track-It!)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (DSXUSB) -- File not found
DRV - (Changer) -- File not found
DRV - (CdpPacket) -- File not found
DRV - (hhibbty) -- C:\WINDOWS\system32\drivers\hyngjk.sys ()
DRV - (ksjfm) -- C:\WINDOWS\system32\drivers\fbgj.sys ()
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (SenFiltService) -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (HECI) Intel(R) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (pmxmouse) -- C:\WINDOWS\system32\drivers\pmxmouse.sys (Primax Electronics Ltd.)
DRV - (pmxusblf) -- C:\WINDOWS\system32\drivers\pmxusblf.sys (Primax Electronics Ltd.)
DRV - (dwvkbd) -- C:\WINDOWS\system32\drivers\dwvkbd.sys (DameWare)
DRV - (DwMirror) -- C:\WINDOWS\system32\drivers\DamewareMini.sys (DameWare Development, Inc.)
DRV - (AsfAlrt) -- C:\WINDOWS\system32\drivers\Asfalrt.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row-rel&channel=de&ibd=3080104
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.de/ig/dell?hl=de&client=dell-row-rel&channel=de&ibd=3080104
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row-rel&channel=de&ibd=3080104
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de/hws/sb/dell-row-rel/de/side.html?channel=de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.de/hws/sb/dell-row-rel/de/side.html?channel=de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row-rel&channel=de&ibd=3080104
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.10.835: C:\Programme\Real\RealOne Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.1136: C:\Programme\Real\RealOne Player\Netscape6\nprjplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.847: C:\Programme\Real\RealOne Player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)


[2010.12.21 16:05:20 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

O1 HOSTS File: ([2004.08.04 15:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AAFCTIListener] File not found
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (rootkit-scan)] C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe (Numara Software, Inc.)
O4 - HKCU..\Run: [SkypeM] C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Skype\Skype.exe (Jacal Consulting)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_21.dll (Sun Microsystems, Inc.)
O15 - HKLM\..Trusted Domains: ap-bx1-fm1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-fs1-bl1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-fs1-fm1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-fs1-kl1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-sq1-fm1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-wb1-fm1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-wb1-fm1 ([]http in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: ap-wb2-fm1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ap-wb2-fm1 ([]http in Lokales Intranet)
O15 - HKLM\..Trusted Domains: ger-d1-dc1 ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: internet ([]about in Lokales Intranet)
O15 - HKLM\..Trusted Domains: localhost ([]* in Lokales Intranet)
O15 - HKLM\..Trusted Domains: localhost ([]http in Lokales Intranet)
O15 - HKLM\..Trusted Domains: localhost ([]https in Lokales Intranet)
O15 - HKLM\..Trusted Domains: lufthansa.com ([]http in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: lufthansa.com ([]https in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: lufthansa.com ([book] http in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: lufthansa.de ([]http in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: lufthansa.de ([]https in Vertrauenswürdige Sites)
O15 - HKLM\..Trusted Domains: naiapollo.eu ([]ftp in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: ap-bx1-fm1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-fs1-bl1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-fs1-fm1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-fs1-kl1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-sq1-fm1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-wb1-fm1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-wb1-fm1 ([]http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: ap-wb2-fm1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: ap-wb2-fm1 ([]http in Lokales Intranet)
O15 - HKCU\..Trusted Domains: dyndns.org ([etcos-gmbh] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: ger-d1-dc1 ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: internet ([]about in Lokales Intranet)
O15 - HKCU\..Trusted Domains: localhost ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: localhost ([]http in Lokales Intranet)
O15 - HKCU\..Trusted Domains: localhost ([]https in Lokales Intranet)
O15 - HKCU\..Trusted Domains: lufthansa.com ([]http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: lufthansa.com ([]https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: lufthansa.com ([book] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: lufthansa.de ([]http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: lufthansa.de ([]https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: naiapollo.eu ([]ftp in Vertrauenswürdige Sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://go.microsoft.com/fwlink/?linkid=58813 (Office Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281013499211 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281013492508 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.22.1.254 10.20.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = apollo.intra
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CACC73EC-75BD-43D2-A8FA-E2F7F0224DE4}: DhcpNameServer = 10.22.1.254 10.20.1.254
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.13 13:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010.05.11 14:16:46 | 000,000,043 | ---- | M] () - W:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\##ap-fs1-fm1#BDRWK2010\Shell - "" = AutoRun
O33 - MountPoints2\##ap-fs1-fm1#BDRWK2010\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\##ap-fs1-fm1#BDRWK2010\Shell\AutoRun\command - "" = W:\bin\shelexec.exe index.html
O33 - MountPoints2\{72046191-06ae-11e0-896e-001e4fecb0c4}\Shell - "" = AutoRun
O33 - MountPoints2\{72046191-06ae-11e0-896e-001e4fecb0c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{72046191-06ae-11e0-896e-001e4fecb0c4}\Shell\AutoRun\command - "" = J:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.03.12 20:42:45 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.03.12 19:45:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.02.23 10:57:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Neuer Ordner
[2012.02.16 10:07:50 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.03.12 20:42:50 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.03.12 20:32:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.03.12 20:31:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.03.12 20:29:53 | 000,532,412 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.03.12 20:29:53 | 000,506,688 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.03.12 20:29:53 | 000,107,208 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.03.12 20:29:53 | 000,089,356 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.03.12 19:45:17 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.12 14:53:20 | 000,000,440 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{B4112441-CD84-438A-911A-176889C1B61A}.job
[2012.03.12 14:49:54 | 000,089,683 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Hochzeit.JPG
[2012.03.02 11:05:08 | 001,039,288 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Rozycki_Personalausweis.pdf
[2012.02.29 17:20:59 | 001,713,701 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Hochzeitsmappe.pdf
[2012.02.24 08:56:07 | 000,004,242 | RHS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.pol
[2012.02.17 10:05:05 | 000,868,807 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Neuss_Brandschau 2009.pdf
[2012.02.17 10:04:48 | 000,308,279 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Neuss_Brandnachschau 2011.pdf
[2012.02.17 09:12:02 | 000,328,296 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.02.16 10:05:33 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.03.12 19:45:17 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.12 14:49:54 | 000,089,683 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Hochzeit.JPG
[2012.03.02 11:05:08 | 001,039,288 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Rozycki_Personalausweis.pdf
[2012.02.29 17:20:54 | 001,713,701 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Hochzeitsmappe.pdf
[2012.02.17 10:05:05 | 000,868,807 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Neuss_Brandschau 2009.pdf
[2012.02.17 10:04:48 | 000,308,279 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Neuss_Brandnachschau 2011.pdf
[2012.02.16 08:55:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.16 08:55:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\dllcache\iacenc.dll
[2010.11.24 12:03:24 | 000,008,704 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.19 12:24:41 | 000,000,149 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2010.10.19 12:20:49 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010.10.19 12:03:03 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\hyngjk.sys
[2010.10.19 11:58:04 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\fbgj.sys

========== LOP Check ==========

[2008.05.19 13:43:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avery
[2010.08.05 14:14:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Delta Access
[2012.03.12 14:53:20 | 000,000,440 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{B4112441-CD84-438A-911A-176889C1B61A}.job

========== Purity Check ==========



< End of report >

2.

OTL Extras logfile created on: 12.03.2012 20:43:38 - Run 1
OTL by OldTimer - Version 3.2.36.3 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,97 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 78,41% Memory free
3,30 Gb Paging File | 3,06 Gb Available in Paging File | 92,81% Paging File free
Paging file location(s): C:\pagefile.sys 1512 3024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,44 Gb Total Space | 58,06 Gb Free Space | 77,99% Space Free | Partition Type: NTFS
Drive I: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive L: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive N: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive O: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive P: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive Q: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive S: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive U: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive V: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive W: | 820,33 Gb Total Space | 429,92 Gb Free Space | 52,41% Space Free | Partition Type: NTFS
Drive Z: | 1394,37 Gb Total Space | 72,13 Gb Free Space | 5,17% Space Free | Partition Type: NTFS

Computer Name: AP-DT-082 | User Name: ***| Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"5985:TCP" = 5985:TCP:*isabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*isabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Cisco Systems\Cisco IP Communicator\AudioTuningWizard.exe" = C:\Programme\Cisco Systems\Cisco IP Communicator\AudioTuningWizard.exe:*isabled:AudioTuningWizard
"C:\Programme\Cisco Systems\Cisco IP Communicator\communicatork9.exe" = C:\Programme\Cisco Systems\Cisco IP Communicator\communicatork9.exe:*isabled:Cisco IP Communicator

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\TIREMOTE\wuser32.exe" = C:\WINDOWS\TIREMOTE\wuser32.exe:*:Enabled:Track-It! Remote Control -- (Intuit Track-It!)
"C:\WINDOWS\TIREMOTE\TIRemoteService.exe" = C:\WINDOWS\TIREMOTE\TIRemoteService.exe:*:Enabled:Track-It! Workstation Manager -- (Numara Software, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06B80546-0FB2-4930-A174-6FF52A175385}" = eDrawings 2007
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{281ECE39-F043-492B-8337-F2E546B5604A}" = PowerDVD
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{37E1EB56-C59B-4C5C-B0B3-B5076046EF8A}" = BlackBerry Desktop Software 4.2
"{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3ED570AA-3D0B-4350-B32A-9752C7A70D19}" = iX-HAUS Client Setup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53183B25-FBDC-4B95-856A-DCDD69DFEE18}" = Intel(R) PRO Alerting Agent
"{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}" = Oracle Data Provider for .NET Help
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.12.4
"{82AFA5D5-A39A-48C2-8675-A09E22E373BB}" = Client Setup Crystall Report 11.5 Update
"{8398B542-3CC4-44D9-83DF-696CCE70124B}" = Windows Support Tools
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87841AF8-C785-42FF-A76E-CC0F0C2816CC}" = ATI Catalyst Control Center
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{92FD71D5-ED7E-40B2-8DF3-4B5E6F684367}" = Dell ETS Factory Installation
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{99997464-9243-4C6B-B45F-526FAA664129}" = iX-HAUS Client Setup
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C73F2AA-310E-49CE-A33C-E129444E6D1F}" = iX-HAUS Client Setup
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E80FA3FD-7997-4BD0-B03B-DDC8CAA140A0}" = CREM Login Manager
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"ATI Display Driver" = ATI Display Driver
"BlackBerry_{37E1EB56-C59B-4C5C-B0B3-B5076046EF8A}" = BlackBerry Desktop Software 4.2
"FreePDF_XP" = FreePDF XP (Remove only)
"GPL Ghostscript 8.54" = GPL Ghostscript 8.54
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"RealPlayer 6.0" = RealOne Player
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR Archivierer
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 09.03.2012 10:39:23 | Computer Name = AP-DT-082 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul mshtml.dll, Version 8.0.6001.19190, Fehleradresse 0x00067978.

Error - 09.03.2012 10:42:30 | Computer Name = AP-DT-082 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul mshtml.dll, Version 8.0.6001.19190, Fehleradresse 0x00067978.

Error - 12.03.2012 03:46:08 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

Error - 12.03.2012 12:03:56 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

Error - 12.03.2012 12:08:38 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

Error - 12.03.2012 14:32:51 | Computer Name = AP-DT-082 | Source = Userenv | ID = 1085
Description = Die clientseitige Erweiterung Softwareinstallation der Gruppenrichtlinien
konnte nicht ausgeführt werden. Überprüfen Sie, ob diese Erweiterung bereits früher
Fehler verursacht hat.

Error - 12.03.2012 14:32:55 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

Error - 12.03.2012 15:28:49 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

Error - 12.03.2012 15:32:09 | Computer Name = AP-DT-082 | Source = Userenv | ID = 1085
Description = Die clientseitige Erweiterung Softwareinstallation der Gruppenrichtlinien
konnte nicht ausgeführt werden. Überprüfen Sie, ob diese Erweiterung bereits früher
Fehler verursacht hat.

Error - 12.03.2012 15:32:45 | Computer Name = AP-DT-082 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\apollo.intra\SysVol\apollo.intra\scripts\CheckReg.vbs.
Das System kann die angegebene Datei nicht finden.

[ System Events ]
Error - 12.03.2012 15:25:31 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "wuauserv"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 12.03.2012 15:25:31 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "wuauserv"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 12.03.2012 15:26:29 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12.03.2012 15:28:47 | Computer Name = AP-DT-082 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DM1Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3

Error - 12.03.2012 15:33:05 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12.03.2012 15:33:14 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12.03.2012 15:33:39 | Computer Name = AP-DT-082 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Fips intelppm

Error - 12.03.2012 15:34:56 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12.03.2012 15:35:01 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12.03.2012 15:38:17 | Computer Name = AP-DT-082 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}


< End of report >


Ich bin jedem dankbar, der mir weiterhelfen kann.

Viele Grüße

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = apollo.intra

Sieht schwer nach einem Firmenrechner aus - kann das sein?

Hallo Zusammen,

bitte den Threat hier löschen, das Thema hat sich erledigt.

Trotzdem vielen Dank und viele Grüße!

Dieses Thema scheint erledigt und wurde aus meinen Abos gelöscht.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und ein eigenes Thema erstellen!