Windows gesperrt - Trojaner: jetzt auch wir!

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.01.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
marcel :: PCMS [Administrator]

01.05.2012 19:59:50
mbam-log-2012-05-01 (19-59-50).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 353938
Laufzeit: 1 Stunde(n), 6 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|E0BAFC2F (Trojan.Downloader) -> Daten: C:\WINDOWS\system32\E2575B9EE0BAFC2FC7D5.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Worm.Palevo) -> Daten: C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\gog.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 6
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Trojan.Downloader) -> Bösartig: (C:\WINDOWS\system32\E2575B9EE0BAFC2FC7D5.exe) Gut: () -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\WINDOWS\system32\E2575B9EE0BAFC2FC7D5.exe (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Temp\elirkqzayd.pre (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Kblgpx\F556B044E0BAFC2F7862.exe (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
c:\_otl\movedfiles\04042012_223118\c_dokumente und einstellungen\all users\anwendungsdaten\ab0kwwygqfzhoo.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

OTL logfile created on: 01.05.2012 23:26:47 - Run 1
OTL by OldTimer - Version 3.2.42.2     Folder = C:\Dokumente und Einstellungen\marcel\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,23 Mb Total Physical Memory | 499,52 Mb Available Physical Memory | 48,82% Memory free
2,96 Gb Paging File | 0,69 Gb Available in Paging File | 23,21% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 32,00 Gb Total Space | 1,51 Gb Free Space | 4,72% Space Free | Partition Type: NTFS
Drive D: | 40,00 Gb Total Space | 39,67 Gb Free Space | 99,17% Space Free | Partition Type: NTFS
Drive E: | 40,00 Gb Total Space | 39,93 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
Drive F: | 37,05 Gb Total Space | 36,98 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
 
Computer Name: PCMS | User Name: marcel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2012.05.01 23:12:57 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\marcel\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.03.18 12:12:15 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.02.26 16:01:44 | 000,295,728 | ---- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe
PRC - [2012.02.16 15:29:02 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2010.02.18 11:43:20 | 000,490,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
PRC - [2010.02.18 11:43:18 | 000,248,040 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.12.17 09:40:01 | 000,346,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mspaint.exe
PRC - [2009.04.14 15:14:18 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\AntiVir PersonalEdition Classic\sched.exe
PRC - [2009.04.14 15:14:17 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.07.28 07:54:08 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.19 13:52:24 | 000,061,440 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2012.03.18 12:12:14 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.12.05 13:47:45 | 008,527,008 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2008.05.01 09:58:54 | 000,339,968 | ---- | M] () -- C:\Programme\AntiVir PersonalEdition Classic\sqlite3.dll
MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe -- (HotSpotFSvc)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2011.11.08 22:39:38 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.04.14 15:14:18 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2009.04.14 15:14:17 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2006.12.23 17:54:04 | 000,262,144 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.10.19 13:52:24 | 000,061,440 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tsmpkt.sys -- (TSMPacket)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PLCMPR5.SYS -- (PLCMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2010.10.01 02:00:00 | 000,926,080 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fwlanusb4.sys -- (fwlanusb4)
DRV - [2009.05.27 19:33:05 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.05.27 19:33:02 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2009.05.27 19:32:55 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2008.05.01 09:58:54 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2006.10.18 21:12:16 | 000,012,664 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)
DRV - [2006.09.06 18:04:12 | 004,377,600 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.08.22 15:36:56 | 000,035,712 | R--- | M] (Attansic Technology corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atl01_xp.sys -- (AtcL001)
DRV - [2006.02.23 19:39:06 | 000,011,264 | ---- | M] (VIA Technologies,Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\xfilt.sys -- (xfilt)
DRV - [2006.02.23 19:38:32 | 000,009,728 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2005.10.29 05:12:31 | 001,391,104 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.07.22 11:02:12 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005.07.22 11:01:10 | 000,231,168 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2005.07.22 11:01:00 | 000,717,952 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004.11.22 16:58:31 | 000,014,342 | R--- | M] (Intellon Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbethmp.sys -- (A_USBETHMP)
DRV - [2004.08.13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 28 7D 2D B8 98 77 CC 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{1E1E26EE-2EA3-47D4-84D2-162430F2A9CB}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.03.18 12:12:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.12.04 22:50:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.20\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2012.03.18 12:11:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.20\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2012.01.06 13:11:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Extensions
[2011.06.18 01:24:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.06 13:11:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Extensions\prism@developer.mozilla.org
[2012.05.01 19:54:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\extensions
[2011.06.16 09:28:40 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\extensions\engine@conduit.com
[2012.01.12 10:19:20 | 000,000,000 | ---D | M] (Babylon) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\extensions\ffxtlbr@babylon.com
[2011.06.19 20:43:51 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\extensions\plugin@yontoo.com
[2012.05.01 13:06:38 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-conduit.xml.segz
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-1.xml.svei
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-10.xml.tznq
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-11.xml.wjfy
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-12.xml.vdnm
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-13.xml.pxqy
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-14.xml.kqdf
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-15.xml.ngpl
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-16.xml.tznq
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-17.xml.ffop
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-18.xml.lypg
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-19.xml.gypa
[2012.05.01 13:06:38 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-2.xml.yoxm
[2012.05.01 13:06:38 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-3.xml.lypg
[2012.05.01 13:06:38 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-4.xml.gypa
[2012.05.01 13:06:38 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-5.xml.moxc
[2012.05.01 13:06:38 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-6.xml.ilrr
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-7.xml.ibrt
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-8.xml.dlio
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin-9.xml.dbro
[2012.05.01 13:06:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-icqplugin.xml.lulb
[2012.05.01 13:06:38 | 000,002,072 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-Linkury Smartbar Search.xml.nrhx
[2012.05.01 13:06:38 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Mozilla\Firefox\Profiles\bj28cgpq.default\searchplugins\locked-sweetim.xml.rfmp
[2011.12.26 20:03:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.18 12:12:16 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.06.14 22:41:30 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.21 22:36:10 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.21 22:36:10 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.02.21 22:36:10 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.21 22:36:10 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.21 22:36:10 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.21 22:36:10 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
CHR - Extension: No name found = C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\locked-.xrhj
CHR - Extension: No name found = C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\locked-.hpcp
CHR - Extension: No name found = C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0\locked-.vjfy
CHR - Extension: No name found = C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif\1.4.0_0\locked-.lver
CHR - Extension: No name found = C:\Dokumente und Einstellungen\marcel\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo\3.0.2_0\locked-.wray
 
O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo Layers\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1308211494332 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F49FA627-B77C-447E-BC62-84A5245CACB1}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.05.14 21:23:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1c5e6ba8-eb45-11df-a11c-0018f3c0d66d}\Shell\AutoRun\command - "" = M:\Menu.exe
O33 - MountPoints2\{8f1ae382-0ab1-11e1-a3ba-0018f3c0d66d}\Shell - "" = AutoRun
O33 - MountPoints2\{8f1ae382-0ab1-11e1-a3ba-0018f3c0d66d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8f1ae382-0ab1-11e1-a3ba-0018f3c0d66d}\Shell\AutoRun\command - "" = M:\pushinst.exe
O33 - MountPoints2\{f9fd143b-0a29-11e1-a3b8-0018f3c0d66d}\Shell\AutoRun\command - "" = M:\sources\sperr32.exe x64
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012.05.01 19:57:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Malwarebytes
[2012.05.01 19:57:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.01 19:57:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.01 19:57:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.01 19:57:24 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.01 13:00:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\Kblgpx
[2012.04.22 13:43:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\marcel\Desktop\Homepage 2204
[2012.04.22 13:35:27 | 000,000,000 | ---D | C] -- C:\Programme\FileZilla FTP Client
[2012.04.22 13:31:30 | 000,000,000 | ---D | C] -- C:\Programme\SweetIM
[2012.04.22 13:31:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM
[2012.04.04 22:30:12 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\marcel\Recent
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012.05.01 23:14:02 | 000,000,926 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\Verknüpfung mit OTL.exe.lnk
[2012.05.01 21:29:34 | 001,459,896 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.01 21:29:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.01 21:29:22 | 1073,008,640 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.01 19:57:30 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.01 19:32:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.01 13:15:14 | 001,293,496 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-TAK_25_Musterformulare_2012.pdf.nrhx
[2012.05.01 13:15:14 | 000,145,927 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-Steuer2010.s11.yznt
[2012.05.01 13:15:13 | 018,386,448 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-PDFCreator-1_2_1_setup.exe.rcwu
[2012.05.01 13:15:13 | 017,873,152 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-PDFCreator-1_0_2_setup.exe.qhlf
[2012.05.01 13:15:13 | 017,327,195 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-PhotoScapeSetup_V3.5.exe.ctjk
[2012.05.01 13:15:13 | 000,036,171 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-Lebenslauf_Marcel_Spengler.pdf.ucwe
[2012.05.01 13:15:13 | 000,022,618 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-Maße Armlehnenhussen.pdf.gypa
[2012.05.01 13:15:11 | 005,888,714 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8252.JPG.sjfz
[2012.05.01 13:15:11 | 002,985,931 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8250.JPG.clrk
[2012.05.01 13:15:11 | 000,164,192 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8254.JPG.lfob
[2012.05.01 13:15:11 | 000,161,515 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8251.JPG.fypf
[2012.05.01 13:15:11 | 000,043,610 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8253.JPG.fvec
[2012.05.01 13:15:11 | 000,018,261 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8248.JPG.vrhr
[2012.05.01 13:15:11 | 000,017,270 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8255.JPG.yuly
[2012.05.01 13:15:11 | 000,017,223 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8245.JPG.ypum
[2012.05.01 13:15:11 | 000,016,925 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8247.JPG.yegq
[2012.05.01 13:15:11 | 000,016,807 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8256.JPG.lfob
[2012.05.01 13:15:11 | 000,016,642 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8249.JPG.ehla
[2012.05.01 13:06:59 | 003,547,449 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-Ausstellerunterlagen HOCHZEITSMESSE TRAUMHOCHZEIT LUDWIGSBURG 2012.pdf.begr
[2012.05.01 13:06:59 | 000,058,090 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-feier.jpg.cxqk
[2012.05.01 13:06:49 | 000,000,006 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-start.ageh
[2012.05.01 13:05:28 | 000,000,010 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-install.thlj
[2012.05.01 13:05:26 | 000,000,006 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-completescan.uhrr
[2012.05.01 13:05:16 | 000,000,043 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-1.gif.mfjy
[2012.05.01 13:04:14 | 003,832,754 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010320.JPG.iprs
[2012.05.01 13:04:14 | 003,689,033 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010322.JPG.vmfa
[2012.05.01 13:04:14 | 003,638,566 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010321.JPG.iarl
[2012.05.01 13:04:14 | 002,995,753 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010319.JPG.xiso
[2012.05.01 13:04:14 | 002,949,508 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010324.JPG.lpyp
[2012.05.01 13:04:14 | 002,888,817 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010323.JPG.rwcl
[2012.05.01 13:04:14 | 002,740,092 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-Wedding.001.JPG.fvpc
[2012.05.01 13:04:14 | 000,017,408 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-photothumb.db.pnrr
[2012.05.01 13:04:13 | 003,348,036 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-P1010318.JPG.vfkr
[2012.05.01 13:04:13 | 000,331,081 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-Marcel 1.jpg.aykg
[2012.05.01 13:04:13 | 000,176,394 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-Marcel2.jpg.xsnf
[2012.05.01 13:04:13 | 000,128,959 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-HUSSEN UND MEHR-BRIEFBOGEN.pdf.pfkr
[2012.05.01 13:04:05 | 000,392,542 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-Catrin1.jpg.mlry
[2012.05.01 13:04:05 | 000,275,841 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\locked-Catrin 2.jpg.zdnn
[2012.05.01 13:01:06 | 000,000,305 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\locked-addr_file.html.dluz
[2012.04.30 23:26:19 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for marcel.job
[2012.04.30 17:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012.04.30 17:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012.04.30 17:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012.04.30 17:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012.04.27 14:03:02 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.04.26 18:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325
[2012.04.26 18:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012.04.22 13:35:30 | 000,001,627 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FileZilla Client.lnk
[2012.04.16 19:05:51 | 000,002,503 | ---- | M] () -- C:\Dokumente und Einstellungen\marcel\Desktop\Microsoft Office Word 2007.lnk
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.04.03 14:23:56 | 000,448,800 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.04.03 14:23:56 | 000,432,492 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.04.03 14:23:56 | 000,080,108 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.04.03 14:23:56 | 000,067,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.04.02 14:53:42 | 000,000,103 | ---- | M] () -- C:\WINDOWS\wiso.ini
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012.05.01 23:14:02 | 000,000,926 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\Verknüpfung mit OTL.exe.lnk
[2012.05.01 19:57:30 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012.05.01 13:00:34 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012.05.01 12:59:29 | 003,547,449 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-Ausstellerunterlagen HOCHZEITSMESSE TRAUMHOCHZEIT LUDWIGSBURG 2012.pdf.begr
[2012.04.29 15:13:55 | 000,017,270 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8255.JPG.yuly
[2012.04.29 15:13:54 | 000,164,192 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8254.JPG.lfob
[2012.04.29 15:13:53 | 000,043,610 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8253.JPG.fvec
[2012.04.29 15:13:50 | 005,888,714 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8252.JPG.sjfz
[2012.04.29 15:13:49 | 000,161,515 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8251.JPG.fypf
[2012.04.29 15:13:47 | 002,985,931 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8250.JPG.clrk
[2012.04.29 15:13:46 | 000,016,642 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8249.JPG.ehla
[2012.04.29 15:13:44 | 000,018,261 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8248.JPG.vrhr
[2012.04.29 15:13:43 | 000,016,925 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8247.JPG.yegq
[2012.04.29 15:13:42 | 000,017,223 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8245.JPG.ypum
[2012.04.29 15:13:40 | 000,016,807 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-IMG_8256.JPG.lfob
[2012.04.24 15:49:37 | 000,058,090 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-feier.jpg.cxqk
[2012.04.22 13:35:30 | 000,001,627 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FileZilla Client.lnk
[2012.04.06 14:28:44 | 001,293,496 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Desktop\locked-TAK_25_Musterformulare_2012.pdf.nrhx
[2011.11.09 19:49:16 | 000,049,792 | ---- | C] () -- C:\WINDOWS\System32\drivers\fwlanusb4.bin
[2011.11.08 22:50:21 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2011.08.28 13:47:28 | 000,000,103 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2011.06.19 20:44:35 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011.03.31 15:42:21 | 000,000,006 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-start.ageh
[2011.03.31 15:34:55 | 000,000,006 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-completescan.uhrr
[2011.03.31 15:32:44 | 000,000,010 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-install.thlj
[2011.03.31 15:29:35 | 000,000,043 | ---- | C] () -- C:\Dokumente und Einstellungen\marcel\Anwendungsdaten\locked-1.gif.mfjy
[2010.11.08 17:10:40 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2010.06.18 18:16:08 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

< End of report >

OTL Extras logfile created on: 01.05.2012 23:26:47 - Run 1
OTL by OldTimer - Version 3.2.42.2     Folder = C:\Dokumente und Einstellungen\marcel\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,23 Mb Total Physical Memory | 499,52 Mb Available Physical Memory | 48,82% Memory free
2,96 Gb Paging File | 0,69 Gb Available in Paging File | 23,21% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 32,00 Gb Total Space | 1,51 Gb Free Space | 4,72% Space Free | Partition Type: NTFS
Drive D: | 40,00 Gb Total Space | 39,67 Gb Free Space | 99,17% Space Free | Partition Type: NTFS
Drive E: | 40,00 Gb Total Space | 39,93 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
Drive F: | 37,05 Gb Total Space | 36,98 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
 
Computer Name: PCMS | User Name: marcel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== File Associations ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[color=#E56717]========== Shell Spawning ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [CEWE FOTOSCHAU] -- "C:\Programme\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [dm-Fotowelt] -- "C:\Programme\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Programme\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [Pixum Fotobuch] -- "C:\Programme\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[color=#E56717]========== Security Center Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[color=#E56717]========== System Restore Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
[color=#E56717]========== Firewall Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
[color=#E56717]========== Authorized Applications List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\homepage MAKER 7 Ultimate\p3AppServ\bin\mysql\bin\mysqld.exe" = C:\homepage MAKER 7 Ultimate\p3AppServ\bin\mysql\bin\mysqld.exe:*:Enabled:mysqld
"C:\homepage MAKER 7 Ultimate\p3AppServ\bin\apache\bin\httpd.exe" = C:\homepage MAKER 7 Ultimate\p3AppServ\bin\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server
"D:\tmp\Facemoods(1).exe" = D:\tmp\Facemoods(1).exe:*:Enabled:InstallCore™ -- (InstallCore© Technologies         )
"C:\Programme\mirabyte\SuperHTML Web Studio\Shtml85.exe" = C:\Programme\mirabyte\SuperHTML Web Studio\Shtml85.exe:*:Enabled:SuperHTML Web Studio -- (mirabyte GmbH & Co. KG)
"C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe" = C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe:*:Enabled:SweetPacksUpdateManager -- (SweetIM Technologies Ltd.)
 
 
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{02C91E12-74A4-45E1-9D3F-C3DD7D6FECAE}" = 5700_Help
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0965F857-DAAD-4F93-8054-0E2EC3C8C5B0}" = SweetIM for Messenger 3.6
"{0A55CDBB-0566-4AA2-A15B-24C7F27C6FF4}" = BPD_Scan
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0E92A5AC-05AB-48c2-9227-9AD504EAF4EA}" = J5700
"{11655C91-EF58-4aab-BF09-E8F205324FBF}" = BPDSoftware
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1C00A3F1-6DA0-49F8-94E4-01AB6FC01031}" = Nero 7 Essentials
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{31D72726-2A42-11E1-9D98-20824824019B}_is1" = SuperHTML Web Studio 8.5.6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D30BAC1-C250-4F10-9C78-C379D05A445E}" = BPDSoftware_Ini
"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5B58EF61-85F2-4977-97A5-84C19F926579}" = SweetPacks Toolbar for Internet Explorer 4.5
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{62562224-27D6-4542-AD91-1DAD0B965A0D}" = MAGIX Foto & Grafik Designer 7 Download-Version
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 2.9.0
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers 1.10.01
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8FB1A5EA-7DA8-4D57-80FB-BD923CCCC852}" = OpenOffice.org 2.1
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7646-A70000000000}" = Adobe Reader 7.0 - Deutsch
"{AC76BA86-7AD7-EF45-47A7-7E8A45000002}" = Adobe Reader Multimedia Package
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B929776E-7527-4F98-AE4D-BEBCF0BEA669}" = BPD_HPSU
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = BPDfax
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D21E6539-FC51-4096-ACEA-BE8209A6845E}" = XXXL Küchenplaner
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{DA896917-C1DA-45B2-B4D2-68162F16C0DD}" = Adobe Creative Suite 3 Master Collection
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DFFDDCF5-CB32-4354-8823-1B9E68025953}" = Adobe Setup
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe  1.4.124.1
"{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2CA5A0D-5F2F-4d99-89F0-2D1358218A7A}" = ProductContext
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"A1-Faktura_is1" = A1-Faktura 1.424
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_67a7fb1e97aa14ee9ef0950eb6fd757" = Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen
"All ATI Software" = ATI - Software Uninstall Utility
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"ASUS_Ai_Proactive_Screensaver (E)" = ASUS_Ai_Proactive_Screensaver (E)
"AtcL1" = Attansic L1 Gigabit Ethernet Driver
"ATI Display Driver" = ATI Display Driver
"Audio Edit Pro_is1" = Audio Edit Pro 4.0
"BabylonToolbar" = Babylon toolbar
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = Soft Data Fax Modem with SmartCP
"CSS Button Designer" = CSS Button Designer
"dm-Fotowelt" = dm-Fotowelt
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"ElsterFormular 13.0.0.8086k" = ElsterFormular
"FileZilla Client" = FileZilla Client 3.5.3
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Officejet All-In-One Series" = HP Officejet All-In-One Series
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPExtendedCapabilities" = HP Customer Participation Program 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn (Remove Only)
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Lidl-Fotos_is1" = Lidl-Fotos
"MAGIX_MSI_Foto_Grafik_Designer_7" = MAGIX Foto & Grafik Designer 7 Download-Version
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"Mozilla Thunderbird (3.1.20)" = Mozilla Thunderbird (3.1.20)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NSS" = Norton Security Scan
"PhotoScape" = PhotoScape
"Pixum Fotobuch" = Pixum Fotobuch
"PowerArchiver" = PowerArchiver
"Tweak UI 2.10" = Tweak UI
"Verwaltungsscout" = Verwaltungsscout
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Zoner Photo Studio 9_is1" = Zoner Photo Studio 9
 
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
 
[ Application Events ]
Error - 13.04.2012 09:31:00 | Computer Name = PCMS | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 23.04.2012 10:16:36 | Computer Name = PCMS | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 23.04.2012 10:16:36 | Computer Name = PCMS | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 24.04.2012 09:57:18 | Computer Name = PCMS | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application ois.exe, version 12.0.4518.1014, stamp 454175ff,
 faulting module msctf.dll, version 5.1.2600.5512, stamp 4802bfd8, debug? 0, fault
 address 0x00036e1b.
 
Error - 24.04.2012 10:01:16 | Computer Name = PCMS | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application ois.exe, version 12.0.4518.1014, stamp 454175ff,
 faulting module crypt32.dll, version 5.131.2600.5512, stamp 4802bf98, debug? 0,
 fault address 0x00009836.
 
Error - 24.04.2012 10:10:55 | Computer Name = PCMS | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application ois.exe, version 12.0.4518.1014, stamp 454175ff,
 faulting module msctf.dll, version 5.1.2600.5512, stamp 4802bfd8, debug? 0, fault
 address 0x00036e1b.
 
Error - 24.04.2012 10:12:15 | Computer Name = PCMS | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application ois.exe, version 12.0.4518.1014, stamp 454175ff,
 faulting module msctf.dll, version 5.1.2600.5512, stamp 4802bfd8, debug? 0, fault
 address 0x00036e1b.
 
Error - 25.04.2012 09:26:57 | Computer Name = PCMS | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application ois.exe, version 12.0.4518.1014, stamp 454175ff,
 faulting module ntdll.dll, version 5.1.2600.5755, stamp 49900abe, debug? 0, fault
 address 0x00011119.
 
Error - 29.04.2012 08:09:49 | Computer Name = PCMS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung thunderbird.exe, Version 1.9.2.4448, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 01.05.2012 13:54:08 | Computer Name = PCMS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 11.0.0.4454, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ OSession Events ]
Error - 31.10.2010 18:04:43 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 946
 seconds with 240 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2012 09:57:16 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 18, Application Name: Picture Manager, Application Version: 12.0.4518.1014,
 Microsoft Office Version: 12.0.4518.1014. This session lasted 55 seconds with 0
 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2012 10:01:15 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 18, Application Name: 12.0.4518.1014, Application Version: 12.0.4518.1014,
 Microsoft Office Version: 12.0.4518.1014. This session lasted 218 seconds with 
180 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2012 10:10:54 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 18, Application Name: Picture Manager, Application Version: 12.0.4518.1014,
 Microsoft Office Version: 12.0.4518.1014. This session lasted 44 seconds with 0
 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2012 10:12:14 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 18, Application Name: Picture Manager, Application Version: 12.0.4518.1014,
 Microsoft Office Version: 12.0.4518.1014. This session lasted 59 seconds with 0
 seconds of active time.  This session ended with a crash.
 
Error - 25.04.2012 09:26:51 | Computer Name = PCMS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 18, Application Name: Picture Manager, Application Version: 12.0.4518.1014,
 Microsoft Office Version: 12.0.4518.1014. This session lasted 81872 seconds with
 60 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 01.05.2012 13:33:35 | Computer Name = PCMS | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst ATI
 Smart.
 
Error - 01.05.2012 13:33:35 | Computer Name = PCMS | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ATI Smart" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1053
 
Error - 01.05.2012 13:33:35 | Computer Name = PCMS | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Cyberlink
 RichVideo Service(CRVS).
 
Error - 01.05.2012 13:33:35 | Computer Name = PCMS | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Cyberlink RichVideo Service(CRVS)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 01.05.2012 13:49:28 | Computer Name = PCMS | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst AntiVir
 PersonalEdition Classic Planer.
 
Error - 01.05.2012 13:49:28 | Computer Name = PCMS | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AntiVir PersonalEdition Classic Planer" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%1053
 
Error - 01.05.2012 13:49:28 | Computer Name = PCMS | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst ATI
 Smart.
 
Error - 01.05.2012 13:49:28 | Computer Name = PCMS | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ATI Smart" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1053
 
Error - 01.05.2012 15:10:07 | Computer Name = PCMS | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 01.05.2012 15:10:49 | Computer Name = PCMS | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   PCIIde  ViaIde
 
 
< End of report >