absturz mit Meldung: Failed to save all the components for the file \\system32...

gunnar73

Guten Morgen,

gestern abend ist beim surfen der Rechner mit der Fehlermeldung "Failed to save all the components for the file \\system32\0000.....
Anschließend ist der Rechner runtergefahren.
Beim Hochfahren war der BS schwarz wie die Nacht und keine icons mehr da.
hab mit OTL nen scan gemacht.
bräuchte dringend eure Hilfe, wie ich meinen Rechner wieder in Gang bringe...
bin aber auch eher ein user...

Vielen Dank für Eure Unterstützung!!
Gruss Gunnar


hier meine OTLogfile:

OTL logfile created on: 23.03.2012 08:44:24 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\life-fitness\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,87 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 64,33% Memory free
3,75 Gb Paging File | 3,10 Gb Available in Paging File | 82,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 103,51 Gb Free Space | 69,45% Space Free | Partition Type: NTFS
Drive E: | 156,25 Gb Total Space | 136,59 Gb Free Space | 87,42% Space Free | Partition Type: NTFS
Drive F: | 309,50 Gb Total Space | 308,56 Gb Free Space | 99,70% Space Free | Partition Type: NTFS

Computer Name: THEKE | User Name: life-fitness | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\life-fitness\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\BGNKveQAbc.exe ()
PRC - C:\Programme\Zune\ZuneLauncher.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Users\life-fitness\AppData\Local\CrossLoop\CrossLoopService.exe (CrossLoop Inc)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Windows\System32\lxeccoms.exe ( )
PRC - C:\Windows\System32\spool\drivers\w32x86\3\lxecserv.exe (Lexmark International, Inc.)
PRC - C:\Programme\Join Air\AssistantServices.exe ()
PRC - C:\Programme\Join Air\UIExec.exe ()
PRC - C:\Programme\Common Files\microsoft shared\ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Windows\System32\attrib.exe (Microsoft Corporation)
PRC - C:\Programme\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE (CANON INC.)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe ()
PRC - C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()


========== Modules (No Company Name) ==========

MOD - C:\ProgramData\BGNKveQAbc.exe ()
MOD - C:\Programme\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
MOD - C:\Programme\Lexmark Pro800-Pro900 Series\lxecdrs.dll ()
MOD - C:\Programme\Lexmark Pro800-Pro900 Series\lxecscw.dll ()
MOD - C:\Programme\Join Air\UIExec.exe ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\lxecdatr.dll ()
MOD - C:\Windows\System32\LXECsmr.dll ()
MOD - C:\Programme\Lexmark Pro800-Pro900 Series\lxeccaps.dll ()
MOD - C:\Windows\System32\LXECsm.dll ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()


========== Win32 Services (SafeList) ==========

SRV - (ZuneWlanCfgSvc) -- C:\Programme\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) -- C:\Programme\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) -- C:\Programme\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (TeamViewer6) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (CrossLoopService) -- C:\Users\life-fitness\AppData\Local\CrossLoop\CrossLoopService.exe (CrossLoop Inc)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (tvnserver) -- C:\Users\life-fitness\AppData\Local\CrossLoop\tvnserver.exe (GlavSoft LLC.)
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (lxec_device) -- C:\Windows\System32\lxeccoms.exe ( )
SRV - (lxecCATSCustConnectService) -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe ()
SRV - (UI Assistant Service) -- C:\Programme\Join Air\AssistantServices.exe ()
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (RetroExpLauncher) -- C:\Programme\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation)
SRV - (s4service) -- C:\Programme\Codebase\s4service.exe (Sequiter Software Inc.)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (vpcvmm) -- C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation)
DRV - (vpcbus) -- C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (vpcusb) -- C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation)
DRV - (vpcnfltr) -- C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.life-fitnessclub.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 38 0A 4E 67 A3 BB CA 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.life-fitnessclub.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:11.0.0.232
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.0.232


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.15 10:17:53 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.15 07:55:13 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2011.05.13 11:56:59 | 000,000,000 | -H-D | M]

[2010.03.04 15:38:56 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\life-fitness\AppData\Roaming\mozilla\Extensions
[2012.03.23 08:28:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\life-fitness\AppData\Roaming\mozilla\Firefox\Profiles\fvc3xdze.default\extensions
[2010.10.30 09:20:27 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Users\life-fitness\AppData\Roaming\mozilla\Firefox\Profiles\fvc3xdze.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.03.23 08:28:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.10.30 09:24:12 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.30 09:19:46 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.05.13 11:58:53 | 000,000,000 | -H-D | M] (Kaspersky Anti-Banner) -- C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru
[2011.05.13 11:58:55 | 000,000,000 | -H-D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.10.30 09:24:12 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.30 09:19:46 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.05.13 11:58:53 | 000,000,000 | -H-D | M] (Kaspersky Anti-Banner) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\KAVANTIBANNER@KASPERSKY.RU
[2011.05.13 11:58:55 | 000,000,000 | -H-D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\LINKFILTER@KASPERSKY.RU
[2010.10.30 09:19:29 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.06 08:20:29 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.07.06 08:20:29 | 000,002,344 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.07.06 08:20:29 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.07.06 08:20:29 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.07.06 08:20:29 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BGNKveQAbc.exe] C:\ProgramData\BGNKveQAbc.exe ()
O4 - HKLM..\Run: [lxecmon.exe] C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4 - HKLM..\Run: [MFNetworkScanUtility] C:\Programme\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE (CANON INC.)
O4 - HKLM..\Run: [UIExec] C:\Program Files\Join Air\UIExec.exe ()
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F6FCA67-A3F7-4CEE-A305-9345EDE73CBC}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.06.20 17:40:22 | 000,000,000 | -H-- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.03.14 08:49:14 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.14 08:49:13 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 08:48:50 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.03.14 08:48:50 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.03.14 08:48:50 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.03.14 08:48:49 | 000,919,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll
[2012.03.14 08:48:48 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.03.23 08:51:35 | 000,013,536 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.23 08:51:35 | 000,013,536 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.23 08:42:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.23 08:42:12 | 1508,413,440 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.22 20:49:29 | 000,452,096 | -H-- | M] () -- C:\ProgramData\BGNKveQAbc.exe
[2012.03.22 14:00:59 | 000,000,734 | -H-- | M] () -- C:\Users\life-fitness\Desktop\aidooCheckInOut.lnk
[2012.03.14 09:36:40 | 000,410,064 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.13 08:32:35 | 000,659,312 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.13 08:32:35 | 000,619,252 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.13 08:32:35 | 000,131,444 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.13 08:32:35 | 000,107,572 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.05 07:55:13 | 000,414,368 | -H-- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.02.28 15:32:34 | 000,001,024 | ---- | M] () -- C:\DTAUS1
[2012.02.23 09:18:36 | 000,237,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.03.22 20:52:30 | 000,452,096 | -H-- | C] () -- C:\ProgramData\BGNKveQAbc.exe
[2012.02.28 15:32:34 | 000,001,024 | ---- | C] () -- C:\DTAUS1
[2012.02.16 21:33:57 | 000,000,127 | -H-- | C] () -- C:\Windows\System32\MRT.INI
[2012.01.30 12:28:42 | 000,000,161 | -H-- | C] () -- C:\Windows\ODBC.INI
[2011.11.03 18:21:52 | 000,011,776 | -H-- | C] () -- C:\Windows\System32\pmsbfn32.dll
[2011.11.03 18:18:13 | 000,000,323 | -H-- | C] () -- C:\Windows\System32\CNCMFP36.INI
[2011.09.11 08:44:56 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2011.06.30 14:29:51 | 000,000,322 | -H-- | C] () -- C:\Users\life-fitness\AppData\Roaming\RHCData.xml
[2011.06.24 08:25:53 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.06.24 08:24:07 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.05.13 11:58:40 | 000,115,369 | -H-- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011.05.13 11:58:40 | 000,097,859 | -H-- | C] () -- C:\Windows\System32\drivers\klick.dat
[2011.05.11 11:09:11 | 000,040,960 | -H-- | C] () -- C:\Windows\System32\lxecvs.dll
[2011.05.11 11:09:09 | 000,442,368 | -H-- | C] ( ) -- C:\Windows\System32\lxeccoin.dll
[2011.05.11 11:09:03 | 000,086,016 | -H-- | C] () -- C:\Windows\System32\lxecgcfg.dll
[2011.05.11 11:09:02 | 000,294,912 | -H-- | C] () -- C:\Windows\System32\lxeccui.dll
[2011.05.11 11:09:02 | 000,110,592 | -H-- | C] () -- C:\Windows\System32\lxeccuir.dll
[2011.05.11 11:07:04 | 000,000,044 | -H-- | C] () -- C:\Windows\System32\lxecrwrd.ini
[2011.05.11 11:06:50 | 000,847,872 | -H-- | C] ( ) -- C:\Windows\System32\lxecusb1.dll
[2011.05.11 11:06:50 | 000,364,544 | -H-- | C] ( ) -- C:\Windows\System32\lxecinpa.dll
[2011.05.11 11:06:50 | 000,356,352 | -H-- | C] ( ) -- C:\Windows\System32\LXEChcp.dll
[2011.05.11 11:06:50 | 000,344,064 | -H-- | C] ( ) -- C:\Windows\System32\lxeciesc.dll
[2011.05.11 11:06:50 | 000,331,776 | -H-- | C] () -- C:\Windows\System32\LXECinst.dll
[2011.05.11 11:06:49 | 001,048,576 | -H-- | C] ( ) -- C:\Windows\System32\lxecserv.dll
[2011.05.11 11:06:49 | 000,643,072 | -H-- | C] ( ) -- C:\Windows\System32\lxecpmui.dll
[2011.05.11 11:06:49 | 000,577,536 | -H-- | C] ( ) -- C:\Windows\System32\lxeclmpm.dll
[2011.05.11 11:06:49 | 000,262,144 | -H-- | C] () -- C:\Windows\System32\lxecinsb.dll
[2011.05.11 11:06:49 | 000,057,344 | -H-- | C] () -- C:\Windows\System32\lxecjswr.dll
[2011.05.11 11:06:48 | 000,688,128 | -H-- | C] ( ) -- C:\Windows\System32\lxechbn3.dll
[2011.05.11 11:06:48 | 000,324,264 | -H-- | C] ( ) -- C:\Windows\System32\lxecih.exe
[2011.05.11 11:06:48 | 000,323,584 | -H-- | C] () -- C:\Windows\System32\lxecins.dll
[2011.05.11 11:06:48 | 000,208,896 | -H-- | C] () -- C:\Windows\System32\lxecgrd.dll
[2011.05.11 11:06:48 | 000,114,688 | -H-- | C] () -- C:\Windows\System32\lxecinsr.dll
[2011.05.11 11:06:48 | 000,090,112 | -H-- | C] () -- C:\Windows\System32\lxeccub.dll
[2011.05.11 11:06:48 | 000,036,864 | -H-- | C] () -- C:\Windows\System32\lxeccur.dll
[2011.05.11 11:06:47 | 000,802,816 | -H-- | C] ( ) -- C:\Windows\System32\lxeccomc.dll
[2011.05.11 11:06:47 | 000,598,696 | -H-- | C] ( ) -- C:\Windows\System32\lxeccoms.exe
[2011.05.11 11:06:47 | 000,373,416 | -H-- | C] ( ) -- C:\Windows\System32\lxeccfg.exe
[2011.05.11 11:06:47 | 000,372,736 | -H-- | C] ( ) -- C:\Windows\System32\lxeccomm.dll
[2011.05.11 11:06:47 | 000,253,952 | -H-- | C] () -- C:\Windows\System32\lxeccu.dll
[2011.05.11 11:06:11 | 000,024,064 | -H-- | C] () -- C:\Windows\System32\LXECsmr.dll
[2011.05.11 11:06:10 | 000,299,008 | -H-- | C] () -- C:\Windows\System32\LXECsm.dll
[2011.03.18 09:34:44 | 000,003,584 | -H-- | C] () -- C:\Users\life-fitness\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2011.05.23 07:07:09 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\Ahje
[2012.01.20 12:46:12 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\Byguroi
[2011.12.22 15:34:25 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\DVDVideoSoft
[2011.05.13 13:21:43 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\Kuja
[2011.02.10 11:42:43 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\Micrografx
[2011.12.15 19:13:59 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\NewSoft
[2010.08.12 13:54:30 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\SteelBytes
[2011.07.02 09:11:22 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\TeamViewer
[2012.02.17 08:38:06 | 000,000,000 | -H-D | M] -- C:\Users\life-fitness\AppData\Roaming\Yroq
[2012.03.05 07:54:04 | 000,032,632 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >