Hallo zusammen!

Heute Morgen schalte ich meinen Computer an und es kommen beim Hochfahren unzählige Warnhinweise, dass mit winlogon.exe was nicht stimmt (genauer: "Windows\Fonts") und dass ich chkdsk laufen lassen soll. Hab ich via "Ausführen" gemacht, es passiert aber nichts. Das Dos-Fenster blitzt nur kurz auf und dann tut sich nichts. Via Start/Programme/Zubehör/Ausführen wird mir "Als Administrator ausführen" per Rechts-Klick gar nicht angeboten.

Gleichzeitig führt die Verknüpfung zu meinem Thunderbird-Emailprogramm auf dem Desktop plötzlich ins Leere und der Thunderbird-Ordner unter C:\Users\BENUTZERNAME\AppData\Roaming lässt sich nicht mehr öffnen und zeigt unter "Eigenschaften" eine Größe von 0 Bytes an (war bis gestern ca. 5 GB und funktionierte einwandfrei). hxxp://i.imgur.com/mdVre.jpg

Malwarebytes kann ich auch nicht ausführen, nicht einmal als Administrator, siehe hxxp://i.imgur.com/ccXT2.jpg
Ich habe versucht, das Programm neu zu installieren, auch dabei gab es eine Fehlermeldung, siehe hxxp://i.imgur.com/MQkkO.jpg aber nach "Ignorieren" konnte ich Malwarebytes wenigstens starten. Ist Malwarebytes jetzt fehlerhaft installiert? Der Quickscan als Administrator hat keine "infizierten Objekte" gemeldet. Beim vollständigen Suchlauf wurde dann lediglich ein infiziertes Objekt gefunden, siehe unten. hxxp://i.imgur.com/Nb8KJ.jpg Seither habe ich neu gestartet.

AntiVir hat nicht von selbst ausgeschlagen, aber ein System-Check hat 36 Warnungen hervorgebracht, siehe unten.

Der verbliebene Speicherplatz auf C:\ hat sich im Vergleich zu vielleicht ner Woche nicht wirklich verändert, wenn ich mich richtig erinnere.

Klingt nach nem Virus? Und sind meine Emails alle verloren oder ist der Thunderbird nur irgendwohin "versteckt" worden? Ich habe zum Glück einen Backup, wenn auch leider nur von Mitte Juli.

Danke an alle.
Gruß, SteGri



AntiVir

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\$Recycle.Bin\S-1-5-21-2208915766-2941739076-3352613170-1001\$RH5B1DB.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynCOM.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynCtrl.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynMood.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTP.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTPAPI.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTPCOM.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTPCpl.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTPEnh.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynTPRes.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\dell\drivers\R230731\WinWDF\x86\SynZMetr.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files\Windows Media Player\setup_wm.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamcore.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamnet.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbampt.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Program Files (x86)\Windows Media Player\setup_wm.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Users\Office-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RLMJ3LLW\install_flashplayer11x32ax_gtba_chra_dy_aih[1].exe
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Users\Office-PC\AppData\Local\Temp\install_flashplayer11x32ax_gtba_chra_dy_aih.exe
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Users\Office-PC\AppData\Local\Temp\AIH.286d535efec6250007fd8cdf0a71e4819ac3d110\downloader.bundle
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Users\Office-PC\AppData\Local\Temp\AIH.286d535efec6250007fd8cdf0a71e4819ac3d110\launcher.bundle
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.GPowerShell.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\35930a8bda01bcaa3f992622bc63e17a\System.Data.OracleClient.ni.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\finger.exe
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\MRINFO.EXE
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\NETSTAT.EXE
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\ROUTE.EXE
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\UIRibbon.dll
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\System32\drivers\mbam.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\SysWOW64\ARP.EXE
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Windows\SysWOW64\HOSTNAME.EXE
[WARNUNG] Die Datei konnte nicht geöffnet werden!

Ende des Suchlaufs: Samstag, 1. September 2012 12:48
Benötigte Zeit: 59:43 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

12812 Verzeichnisse wurden überprüft
251266 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
32 Dateien konnten nicht durchsucht werden
251234 Dateien ohne Befall
3582 Archive wurden durchsucht
36 Warnungen
0 Hinweise



Malwarebytes'

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.01.02

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Office-PC :: NAME [Administrator]

01.09.2012 12:29:13
mbam-log-2012-09-01 (12-29-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 251280
Laufzeit: 29 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Office-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UBSI5EGM\PDFCreator_Stub_5874[1].exe (PUP.Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Die winlogon.exe/CHKDSK Fehlermeldungen bleiben nach Neustarts. Thunderbird bleibt verschwunden. Alle Thunderbird-Ordner (ob in "Programme" oder "Benutzer") haben 0 Bytes. Sonst ist mir eigentlich nichts aufgefallen.

Die winlogon.exe/CHKDSK Fehlermeldungen bleiben nach Neustarts. Thunderbird bleibt verschwunden. Alle Thunderbird-Ordner (ob in "Programme" oder "Benutzer") haben 0 Bytes. Sonst ist mir eigentlich nichts aufgefallen.

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.


Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner

Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

• Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
• Dein Anti-Virus-Programm während des Scans deaktivieren.
  
  Im als Administrator geöffneten Browser diesen Link aufrufen => ESET Online Scanner
  • Firefox-User:
    Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
  • IE-User:
    müssen das Installieren eines ActiveX Elements erlauben.
• Setze den einen Haken bei Yes, i accept the Terms of Use.
• Drücke den Button.
• Warte bis die Komponenten herunter geladen wurden.
• Setze einen Haken bei "Scan archives".
• Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
• drücken.
• Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

• Klicke Finish.
• Browser schließen.

Drücke bitte die + R Taste und kopiere folgenden Text in das Ausführen Fenster.

"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
         

Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
         

Poste nun den Inhalt der log.txt.


Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

Hallo, danke für die Rückmeldung! Ich habe das ESET vor knapp drei Stunden gestartet. Nach zwei Stunden war der Virus Scan bei 52% und ich hatte den Eindruck es tut sich nichts mehr. Dann hab ich auf Stop gedrückt und das Ganze von vorne laufen lassen. Nach einer weiteren Stunde ist er jetzt (nach Neustart) bei 33% und die "Files scanned" Zahl steigt weiterhin. Soll ich das Ganze einfach mal in Ruhe fünf Stunden laufen lassen, oder ist das nicht normal? Ich hab eigentlich nicht so viel Krempel auf meiner Festplatte...
Danke, SteGri

Irgendwie wärs mir ja lieber gewesen, das Ding hätte was gefunden als Erklärung, warum mein Thunderbird verschwunden ist und winlogon.exe plötzlich Probleme macht...
Was mach ich den jetzt?

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=53251
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-01 09:17:43
# local_time=2012-09-01 11:17:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 3799320 3799320 0 0
# compatibility_mode=5892 16776573 100 56 0 184038996 0 0
# compatibility_mode=8192 67108863 100 0 8558 8558 0 0
# scanned=255575
# found=0
# cleaned=0
# scan_time=19172
         

Irgendwie wärs mir ja lieber gewesen, das Ding hätte was gefunden als Erklärung, warum mein Thunderbird verschwunden ist und winlogon.exe plötzlich Probleme macht...
Was mach' ich denn jetzt?

CHKDSK kann ich ja auch nicht ausführen...

"Office-PC" ist das Administrator-Konto:
(Ist der Rechtschreibfehler schon Grund zur Besorgnis?)



OK, habe cmd.exe in der Suche rechtsgeklickt, um echter Administrator-Administrator zu sein. Das ist die ganze Zeit von "beschädigt" und "verwaist" die Rede und dass chkdsk im gesicherten Modus nicht ausgeführt werden kann.

Ich habe mal das OTL laufen lassen:

OTL Logfile:

OTL logfile created on: 02.09.2012 11:26:04 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\NAME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,19% Memory free
8,16 Gb Paging File | 6,62 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,12 Gb Total Space | 28,45 Gb Free Space | 36,42% Space Free | Partition Type: NTFS
Drive D: | 219,93 Gb Total Space | 129,31 Gb Free Space | 58,80% Space Free | Partition Type: NTFS
 
Computer Name: NAME | User Name: Office-PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.02 11:25:36 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\NAME\Desktop\OTL.exe
PRC - [2012.08.08 23:50:53 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.12.06 05:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.18 11:08:00 | 000,382,464 | ---- | M] (Marvell) [Auto | Running] -- C:\Windows\SysNative\ykx64mpcoinst.dll -- (yksvc)
SRV:64bit: - [2009.03.06 12:51:04 | 000,268,288 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe -- (STacSV)
SRV:64bit: - [2009.03.02 14:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe -- (AESTFilters)
SRV - [2012.08.31 12:13:30 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.05.21 21:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.06 05:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.12.06 04:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.06.25 19:26:10 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.03.18 11:08:00 | 000,406,016 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2009.03.09 17:00:00 | 000,311,456 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\OA013Vid.sys -- (OA013Vid)
DRV:64bit: - [2009.03.06 12:51:04 | 000,477,696 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.03.06 07:33:58 | 000,159,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\OA013Ufd.sys -- (OA013Ufd)
DRV:64bit: - [2008.11.17 08:29:14 | 001,526,776 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XX)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?hl=de&tab=ww"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.18 18:32:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 12:13:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.20 14:29:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.18 18:32:11 | 000,000,000 | ---D | M]
 
[2012.07.19 18:32:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Extensions
[2012.07.19 23:43:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions
[2012.07.19 23:43:47 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.07.19 23:43:50 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2012.07.19 23:43:55 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.19 23:43:47 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\ich@maltegoetz.de
[2012.07.19 18:31:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.19 18:54:34 | 000,000,000 | ---D | M] (Flagfox) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{1018E4D6-728F-4B20-AD56-37578A4DE76B}
[2011.07.31 08:55:18 | 000,009,253 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{2E17E2B2-B8D4-4A67-8D7B-FAFA6CC9D1D0}.XPI
[2012.07.19 18:54:35 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{B9DB16A4-6EDC-47EC-A1F4-B86292ED211D}
[2011.10.08 09:22:44 | 000,456,652 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C07D1A49-9894-49FF-A594-38960EDE8FB9}.XPI
[2011.05.23 00:39:52 | 000,111,171 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C151D79E-E61B-4A90-A887-5A46D38FBA99}.XPI
[2012.03.05 17:28:38 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.05 17:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.06.21 08:47:32 | 000,045,066 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
[2012.06.21 08:47:22 | 000,208,985 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\EXIF_VIEWER@MOZILLA.DOSLASH.ORG.XPI
[2012.07.19 18:54:34 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE
[2012.06.21 08:47:22 | 000,159,870 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
[2012.08.31 12:13:30 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.31 12:13:27 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9FC19CB-C4D5-461B-8014-BB3676C5BCBE}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2D70B3E-F96F-498E-B943-16A117771B0A}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.01 15:35:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.09.01 13:26:01 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\vlc
[2012.09.01 12:18:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware (2)
[2012.08.21 15:24:03 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\pdfforge
[2012.08.21 15:24:00 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX
[2012.08.21 15:23:59 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.08.21 15:23:59 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX
[2012.08.21 15:23:59 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.08.21 15:23:57 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL
[2012.08.21 15:23:57 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL
[2012.08.21 15:23:57 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL
[2012.08.21 15:23:57 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL
[2012.08.21 15:23:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012.08.20 14:29:10 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.20 03:01:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012.08.18 19:19:11 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2012.08.18 19:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\HP
[2012.08.18 19:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Local\HP
[2012.08.18 18:30:01 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2012.08.18 18:26:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012.08.18 18:25:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\HP
[2012.08.18 18:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Hewlett-Packard
[2012.08.18 18:24:52 | 000,000,000 | ---D | C] -- C:\Windows\hpoj4500g510n-z
[2012.08.18 18:22:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP
[2012.08.18 18:15:13 | 000,642,360 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hpzids40.dll
[2012.08.18 18:15:09 | 000,136,704 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\SysNative\hpf3l092.dll
[2012.08.18 18:13:40 | 000,902,656 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hpwwiax9.dll
[2012.08.18 18:13:40 | 000,742,912 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpwtscl5.dll
[2012.08.18 18:13:40 | 000,551,424 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hppldcoi.dll
[2012.08.18 18:13:40 | 000,503,296 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpwvst01.dll
[2012.08.18 18:13:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2012.08.16 03:04:39 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.16 03:04:38 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.16 03:04:36 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.16 03:04:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.16 03:04:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.16 03:04:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.16 03:04:34 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.08.16 03:04:33 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.08.16 03:04:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.08.16 03:04:33 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.08.16 03:04:32 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.08.16 03:04:30 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.16 03:04:30 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 18:04:41 | 000,788,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.15 18:04:40 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\localspl.dll
[2012.08.15 18:04:37 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.10 09:52:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.02 11:27:31 | 001,653,338 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.02 11:27:31 | 000,706,834 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.02 11:27:31 | 000,661,788 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.02 11:27:31 | 000,159,690 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.02 11:27:31 | 000,130,674 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.02 11:20:03 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 11:20:03 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 11:19:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.01 12:19:51 | 000,000,976 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.26 11:38:58 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.26 11:38:58 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.19 10:01:17 | 000,255,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.18 19:21:09 | 000,000,000 | ---- | M] () -- C:\Windows\hpqEmlSz.INI
[2012.08.18 19:16:55 | 000,241,119 | ---- | M] () -- C:\Windows\hpwins28.dat
[2012.08.18 18:27:41 | 000,002,002 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
 
========== Files Created - No Company Name ==========
 
[2012.09.01 12:19:51 | 000,000,976 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.18 19:21:09 | 000,000,000 | ---- | C] () -- C:\Windows\hpqEmlSz.INI
[2012.08.18 18:30:43 | 000,000,891 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
[2012.08.18 18:27:41 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012.08.18 18:17:13 | 000,241,119 | ---- | C] () -- C:\Windows\hpwins28.dat
[2012.07.20 01:23:55 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2012.07.20 01:22:57 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2012.07.20 01:22:00 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2012.07.19 23:44:05 | 000,007,680 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.19 22:09:30 | 001,633,344 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.19 21:14:07 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2012.07.19 19:17:27 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\ARP.EXE
[2012.07.19 19:17:27 | 000,008,704 | ---- | C] () -- C:\Windows\SysWow64\HOSTNAME.EXE
[2012.07.19 18:16:37 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.07.19 16:58:11 | 000,000,732 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\d3d9caps64.dat
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.09.13 01:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

< End of report >
         

--- --- ---

[/code]

OTL EXTRAS Logfile:

OTL Extras logfile created on: 02.09.2012 11:26:04 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\NAME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,19% Memory free
8,16 Gb Paging File | 6,62 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,12 Gb Total Space | 28,45 Gb Free Space | 36,42% Space Free | Partition Type: NTFS
Drive D: | 219,93 Gb Total Space | 129,31 Gb Free Space | 58,80% Space Free | Partition Type: NTFS
 
Computer Name: NAME | User Name: Office-PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
"VistaSp2" = 3C D1 D1 D6 68 67 CD 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AC5F33E-7313-46AA-B497-0C086F5B50D5}" = rport=445 | protocol=6 | dir=out | app=system | 
"{134013AF-C3C0-4DF8-91EA-35BF917EB4A5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{3E154840-7BD7-419E-BAFC-337D8391B4A8}" = rport=138 | protocol=17 | dir=out | app=system | 
"{4665FA82-F3B5-44B8-A8D8-4E290188A783}" = rport=139 | protocol=6 | dir=out | app=system | 
"{5179F783-FDCD-4CFC-842D-8578A89FBF9B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{53299A55-9984-4F9F-8EE2-43AB6A57E863}" = lport=138 | protocol=17 | dir=in | app=system | 
"{60A1C472-CB57-4D1F-8C08-5836CAA51E00}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{74A76AE6-22E4-4269-81EC-234BE0EACAAB}" = lport=137 | protocol=17 | dir=in | app=system | 
"{AEC90E70-DF14-483D-B3CF-FC7D0235D527}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B0036124-4FCA-4819-8301-4F5269CA2499}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{CFA4AC50-C147-41E3-852C-595B402391E6}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{063AFEB5-8107-47FC-A5FC-317CFDD98F61}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 
"{12DE57D9-333B-4C2F-BE1A-A2600C9034A4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 
"{1C895038-D33D-493C-A640-87C12B83C655}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe | 
"{26B36055-B04B-4932-97E1-200890664827}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{306C60FE-1314-4767-BA22-322B8EB6F7DF}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 
"{370899EC-2940-41C1-88F2-F4EBB85E206C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe | 
"{45C420A0-AD61-412D-B1B8-E090E8DD173E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 
"{52B47930-E75B-42DD-AA3A-33420407F364}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{69910973-E14E-4D21-AC2B-2091C6A97B02}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{73F4FFC7-8057-44AB-965D-FF34A5543D5F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe | 
"{7D8ED491-7225-4E4F-801A-55705F56240D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 
"{8584FF35-7152-4956-95B6-751795244822}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{8B12A310-9D05-4843-AA83-C0B0051D4FF1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 
"{92D5D0EB-76F3-495A-BE28-65C8EDA4A6EC}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 
"{A5608E7C-E5CE-47F4-9A5C-4E8FB82ED519}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 
"{B7BDBE64-EE9D-49CD-BC7A-8D6DEE20ED4F}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 
"{B8C82B77-DC11-4805-A825-22CA0E1067A5}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe | 
"{BD1F1DC5-C43F-4BFC-A226-ABBADC60ACE0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 
"{C1CC6AEC-18FD-4C6F-A713-09979622614D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C2ED3477-6185-47EB-8ED8-C7CD7F4DCE77}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 
"{DD0E6D38-FDBD-40BC-9115-7278F3EEB1FB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{E9C125B0-1729-499D-854E-5A414F9053E8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{FE355C85-77FD-4DFF-8073-5FF44962FA4A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe | 
"TCP Query User{8136C421-618A-4412-BD6C-829E8B4AED2B}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{1CEEE0D9-6628-482F-90BF-F27E5393B243}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D98B285-0777-B3B7-7A3D-9C85422203B9}" = ccc-utility64
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{6E5159B4-A519-41EF-80EF-AD58371515DF}" = Eraser 6.0.10.2620
"{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}" = HP Officejet 4500 G510n-z
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8924F1FE-8AC5-C2AE-59EF-C5D65B226933}" = AMD Catalyst Install Manager
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{A4DDB2AB-ECCD-4C3A-8633-77D5A1A0E542}" = Network64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Creative OA013" = Integrated Webcam Driver (1.00.04.0310)  
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Dell Touchpad
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{06870F63-4D1C-171F-9552-368D3890D92F}" = CCC Help French
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{14CE04AF-0EBC-B865-382F-1FB466CAC301}" = CCC Help English
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1DBC5882-96E2-3A01-A32C-9B6F6EF6CF25}" = CCC Help Korean
"{1F36B20F-7408-EC75-2825-E9FE81B0339D}" = CCC Help Norwegian
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{30DAAF05-3679-C10C-953C-BB422FCDF557}" = CCC Help Swedish
"{3A4D5E2D-988D-4ee9-8E7F-3AC200A2B8F5}" = 4500G510nz_Software_Min
"{428536FB-25A0-8531-75EF-D7A7C340B0A4}" = Catalyst Control Center
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4BA6B7C9-65AE-BE8B-687A-6F1A2D7F9705}" = CCC Help Czech
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{4C8E1E1B-175F-AF47-8B21-E12C7C8B5D40}" = CCC Help Thai
"{4EAF46A2-DB90-6B67-F640-5CC876A2B5C4}" = CCC Help Greek
"{5B05FF91-F20C-4832-A8DE-E1912639C17C}" = 4500G510nz
"{5D5B8455-50E0-F94A-4C82-0F9303BB4C0E}" = CCC Help Danish
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{690879A5-18EF-447B-98D6-B699D51008AB}" = 4500_G510nz_Help
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{7765BB73-D985-42C9-C7EE-AB434D59429F}" = CCC Help Chinese Traditional
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7ADFB885-8E98-6AAE-8687-D6EFB5127F6B}" = Catalyst Control Center Graphics Previews Common
"{7F7C616E-6971-77D9-7D59-82DC35DF81AC}" = CCC Help Russian
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9FA5B08F-9162-BCCB-AFAC-28DF1751BEC3}" = Catalyst Control Center Localization All
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF859F36-5F97-F6EC-A617-62771A8B4FDC}" = CCC Help Finnish
"{BB095F3E-0A7D-7DD4-B2A8-47CB12E416B0}" = CCC Help Japanese
"{BC71B06F-BFAE-6A73-091C-F18ACF00A04C}" = CCC Help Italian
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BDCBA80C-A3BD-9DA5-E43F-EBBBE779C032}" = CCC Help Hungarian
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CEEA6219-8792-3E40-D361-4FB5F0FBBB0F}" = CCC Help Portuguese
"{CF053286-7F4C-CAFB-616B-58EC562BB28E}" = CCC Help Chinese Standard
"{D07BB56A-7DB4-4564-A1F9-EBCE75FBE3C6}" = Catalyst Control Center InstallProxy
"{D3689EED-3943-9E90-1D65-D2246EB58AD1}" = CCC Help Turkish
"{DBA5EE42-A143-A658-9F86-C611BFDBEFCA}" = CCC Help Dutch
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E19490CD-5380-4F37-B0A7-624D635605DC}" = Catalyst Control Center - Branding
"{EAF0F475-CFE2-9F4D-F26A-875FF09AD40E}" = CCC Help Spanish
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1F1CCD6-34FE-81C6-CE0C-F22695E6409F}" = CCC Help German
"{F71A71E1-285C-95CE-A8F7-231E3827138E}" = CCC Help Polish
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avidemux 2.5" = Avidemux 2.5 (32-bit)
"Avira AntiVir Desktop" = Avira Free Antivirus
"ESET Online Scanner" = ESET Online Scanner v3
"Foxit Reader_is1" = Foxit Reader
"HDD-Booster_is1" = HDD-Booster v1.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.2
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = VSS | ID = 12293
Description = 
 
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = System Restore | ID = 8193
Description = 
 
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = System Restore | ID = 8210
Description = 
 
Error - 01.09.2012 19:46:48 | Computer Name = NAME | Source = EventSystem | ID = 4609
Description = 
 
Error - 01.09.2012 19:59:49 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 01.09.2012 20:00:08 | Computer Name = NAME | Source = VSS | ID = 12293
Description = 
 
Error - 01.09.2012 20:01:48 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 02.09.2012 05:21:35 | Computer Name = NAME | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.09.2012 05:21:38 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 02.09.2012 05:25:50 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
[ System Events ]
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME| Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
 
< End of report >
         

--- --- ---
[/code]



Ich hab noch mal geschaut: es ist als ob jemand systematisch alle Thunderbird-Dateien gelöscht hätte. Da wo die Hauptordner liegen ("C:\Users\USERNAME\AppData\Roaming\Thunderbird" und "C:\Programme(x86)\Mozilla Thunderbird") liegen offenbar leere Ordner, auf die nicht zugegriffen werden kann und deren Änderungsdatum mit Mitte Juli angegeben ist, als ich das Betriebssystem neu aufgespielt hatte. Den Thunderbird habe ich bis gestern benutzt, das Änderungsdatum müsste also 1.9.2012 lauten.

Die Benutzerkontensteuerung ist schon seit Vista da! Das ist nichts neues, dass man für Sachen wie chkdsk die Eingabeaufforderung per Rechtsklick als Administrator ausführen muss und erst dann die Prüfung machen kann!

Und einfach nur chkdsk fürht man nicht aus! Ohne die Option /f werden keine Fehler behoben!

chkdsk der Systempartition unter Windows Vista

1. Klick mit rechts auf einen freien Bereich auf dem Desktop und sag "Neu, Verknüpfung erstellen"
2. Tipp als Ziel cmd.exe ein und bestätige mit OK, eine neue Verknüpfung zur Konsole auf dem Desktop müsste sich nun befinden
3. Falls dem so ist, diese neue Verknüpfung rechtsklicken => Als Administrator ausführen => Sicherheitsabfrage von Vista Benutzerkontensteuerung ggf. bestätigen => schwarze Eingabeaufforderung öffnet sich
4. Tipp dort ein: chkdsk c: /f /r /v und bestätige mit enter.
5. Die folgende Abfrage mit j bestätigen und enter drücken.
6. Windows neu starten, es sollte ein Hinweis auf eine geplante Datenträgerüberprüfung erscheinen - die Zeit verstreichen lassen, keine Taste drücken!!
7. Abwarten bis der Vorgang abgeschlossen ist. Bei großen Partitionen kann es u.U. recht lange dauern. Windows bootet automatisch neu.

Vielen Dank für die Rückmeldung!
Ich hatte eigentlich Angst, dass mein Thread so weit nach hinten rutscht, dass sich keiner mehr dafür interessiert.

Ich habe mich im Administrator-Konto angemeldet und die Schritte 1) bis 6) EXAKT wie beschrieben ausgeführt.
C: ist auch das Laufwerk, auf dem das Betriebssystem und die Programme aufgespielt sind.



Nach dem Neustart kam sofort die folgende Antwort und ca. fünf Sekunden später ist der Computer im alten, beschädigten Zustand hochgefahren:



"Volume kann für direkten Zugriff nicht geöffner werden."

Ich hab das Ganze dreimal durchgespielt, immer mit dem gleichen Ergebnis. Hab ich was falsch gemacht?

Danke,
SteGri

PS: Ich habe festgestellt, dass in OpenOffice Writer plötzlich DejaVu Serif als Standardschrift eingestellt ist. War bislang immer Times New Roman. Hat das was mit der Sache zu tun? Mein Online-Banking habe ich sicherheitshalber bislang nicht betrieben... Ich hätte nur gerne meinen Thunderbird-Ordner von 5GB wieder zurück, dann würde ich den Computer auch liebend gerne platt machen, falls Virus/Trojaner-Alarm besteht!

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den möglicherweise infizierten bzw. defekten Rechner dann von dieser CD booten:
Unter OTLPE kannst du auch über die EIngabeaufforderung die Systempartition prüfen. Da ist kein Neustart notwendig, denn die Systempartition C ist kein Systemlaufwerk für die Live-CD

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

• Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

Darf ich kurz fragen: Wenn ich das alles mache wie beschrieben, gibts dann überhaupt eine Chance, den Thunderbird zu retten, oder muss ich danach das System sowieso neu aufspielen, weil eh' alles verloren ist? Ich hab nämlich leider keine anderen Rechner hier rumstehen, das heißt ich müsste erst jedanden anhauen, der das mit dem OTLPENET für mich macht, wenn ich den "infizierten" Computer dafür nicht benutzen soll...

Danke,
SteGri

Ich bin kein Hellseher!

Man muss es versuchen und dann weitersehen!

Hallo, guten Abend.

So, hallo.
Ich habe alles gemacht wie beschrieben: OTLP auf anderem Rechner heruntergeladen und auf bootfähige CD gebrannt, mit dieser CD meinen Rechner gestartet und das Programm laufen lassen.
Allerdings hat mich das Programm nicht gefragt: "Do you wish to load the remote registry?" wies in der Anleitung steht...?

Hier sind die Inhalte der beiden .txt-Dateien:

OTL

OTL Logfile:

OTL logfile created on: 02.09.2012 11:26:04 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\NAME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,19% Memory free
8,16 Gb Paging File | 6,62 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,12 Gb Total Space | 28,45 Gb Free Space | 36,42% Space Free | Partition Type: NTFS
Drive D: | 219,93 Gb Total Space | 129,31 Gb Free Space | 58,80% Space Free | Partition Type: NTFS
 
Computer Name: NAME | User Name: Office-PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.02 11:25:36 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\NAME\Desktop\OTL.exe
PRC - [2012.08.08 23:50:53 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.12.06 05:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.18 11:08:00 | 000,382,464 | ---- | M] (Marvell) [Auto | Running] -- C:\Windows\SysNative\ykx64mpcoinst.dll -- (yksvc)
SRV:64bit: - [2009.03.06 12:51:04 | 000,268,288 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe -- (STacSV)
SRV:64bit: - [2009.03.02 14:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe -- (AESTFilters)
SRV - [2012.08.31 12:13:30 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.05.21 21:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.06 05:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.12.06 04:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.06.25 19:26:10 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.03.18 11:08:00 | 000,406,016 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2009.03.09 17:00:00 | 000,311,456 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\OA013Vid.sys -- (OA013Vid)
DRV:64bit: - [2009.03.06 12:51:04 | 000,477,696 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.03.06 07:33:58 | 000,159,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\OA013Ufd.sys -- (OA013Ufd)
DRV:64bit: - [2008.11.17 08:29:14 | 001,526,776 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XX)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?hl=de&tab=ww"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.18 18:32:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 12:13:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.20 14:29:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.18 18:32:11 | 000,000,000 | ---D | M]
 
[2012.07.19 18:32:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Extensions
[2012.07.19 23:43:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions
[2012.07.19 23:43:47 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.07.19 23:43:50 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2012.07.19 23:43:55 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.19 23:43:47 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Office-PC\AppData\Roaming\mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\ich@maltegoetz.de
[2012.07.19 18:31:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.19 18:54:34 | 000,000,000 | ---D | M] (Flagfox) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{1018E4D6-728F-4B20-AD56-37578A4DE76B}
[2011.07.31 08:55:18 | 000,009,253 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{2E17E2B2-B8D4-4A67-8D7B-FAFA6CC9D1D0}.XPI
[2012.07.19 18:54:35 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{B9DB16A4-6EDC-47EC-A1F4-B86292ED211D}
[2011.10.08 09:22:44 | 000,456,652 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C07D1A49-9894-49FF-A594-38960EDE8FB9}.XPI
[2011.05.23 00:39:52 | 000,111,171 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C151D79E-E61B-4A90-A887-5A46D38FBA99}.XPI
[2012.03.05 17:28:38 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.05 17:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.06.21 08:47:32 | 000,045,066 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
[2012.06.21 08:47:22 | 000,208,985 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\EXIF_VIEWER@MOZILLA.DOSLASH.ORG.XPI
[2012.07.19 18:54:34 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE
[2012.06.21 08:47:22 | 000,159,870 | ---- | M] () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
[2012.08.31 12:13:30 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.31 12:13:27 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9FC19CB-C4D5-461B-8014-BB3676C5BCBE}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2D70B3E-F96F-498E-B943-16A117771B0A}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.01 15:35:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.09.01 13:26:01 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\vlc
[2012.09.01 12:18:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware (2)
[2012.08.21 15:24:03 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\pdfforge
[2012.08.21 15:24:00 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX
[2012.08.21 15:23:59 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.08.21 15:23:59 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX
[2012.08.21 15:23:59 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.08.21 15:23:57 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL
[2012.08.21 15:23:57 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL
[2012.08.21 15:23:57 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL
[2012.08.21 15:23:57 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL
[2012.08.21 15:23:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012.08.20 14:29:10 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.20 03:01:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012.08.18 19:19:11 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2012.08.18 19:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\HP
[2012.08.18 19:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Local\HP
[2012.08.18 18:30:01 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2012.08.18 18:26:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012.08.18 18:25:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\HP
[2012.08.18 18:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Hewlett-Packard
[2012.08.18 18:24:52 | 000,000,000 | ---D | C] -- C:\Windows\hpoj4500g510n-z
[2012.08.18 18:22:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP
[2012.08.18 18:15:13 | 000,642,360 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hpzids40.dll
[2012.08.18 18:15:09 | 000,136,704 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\SysNative\hpf3l092.dll
[2012.08.18 18:13:40 | 000,902,656 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hpwwiax9.dll
[2012.08.18 18:13:40 | 000,742,912 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpwtscl5.dll
[2012.08.18 18:13:40 | 000,551,424 | ---- | C] (Hewlett-Packard) -- C:\Windows\SysNative\hppldcoi.dll
[2012.08.18 18:13:40 | 000,503,296 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpwvst01.dll
[2012.08.18 18:13:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2012.08.16 03:04:39 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.16 03:04:38 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.16 03:04:36 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.16 03:04:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.16 03:04:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.16 03:04:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.16 03:04:34 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.08.16 03:04:33 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.08.16 03:04:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.08.16 03:04:33 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.08.16 03:04:32 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.08.16 03:04:30 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.16 03:04:30 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 18:04:41 | 000,788,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.15 18:04:40 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\localspl.dll
[2012.08.15 18:04:37 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.10 09:52:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.02 11:27:31 | 001,653,338 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.02 11:27:31 | 000,706,834 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.02 11:27:31 | 000,661,788 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.02 11:27:31 | 000,159,690 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.02 11:27:31 | 000,130,674 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.02 11:20:03 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 11:20:03 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 11:19:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.01 12:19:51 | 000,000,976 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.26 11:38:58 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.26 11:38:58 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.19 10:01:17 | 000,255,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.18 19:21:09 | 000,000,000 | ---- | M] () -- C:\Windows\hpqEmlSz.INI
[2012.08.18 19:16:55 | 000,241,119 | ---- | M] () -- C:\Windows\hpwins28.dat
[2012.08.18 18:27:41 | 000,002,002 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
 
========== Files Created - No Company Name ==========
 
[2012.09.01 12:19:51 | 000,000,976 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.18 19:21:09 | 000,000,000 | ---- | C] () -- C:\Windows\hpqEmlSz.INI
[2012.08.18 18:30:43 | 000,000,891 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
[2012.08.18 18:27:41 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012.08.18 18:17:13 | 000,241,119 | ---- | C] () -- C:\Windows\hpwins28.dat
[2012.07.20 01:23:55 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2012.07.20 01:22:57 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2012.07.20 01:22:00 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2012.07.19 23:44:05 | 000,007,680 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.19 22:09:30 | 001,633,344 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.19 21:14:07 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2012.07.19 19:17:27 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\ARP.EXE
[2012.07.19 19:17:27 | 000,008,704 | ---- | C] () -- C:\Windows\SysWow64\HOSTNAME.EXE
[2012.07.19 18:16:37 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.07.19 16:58:11 | 000,000,732 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\d3d9caps64.dat
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.09.13 01:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

< End of report >
         

--- --- ---
[/code]

Extras

OTL Logfile:

OTL Extras logfile created on: 02.09.2012 11:26:04 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\NAME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 64,19% Memory free
8,16 Gb Paging File | 6,62 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,12 Gb Total Space | 28,45 Gb Free Space | 36,42% Space Free | Partition Type: NTFS
Drive D: | 219,93 Gb Total Space | 129,31 Gb Free Space | 58,80% Space Free | Partition Type: NTFS
 
Computer Name: NAME | User Name: Office-PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
"VistaSp2" = 3C D1 D1 D6 68 67 CD 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AC5F33E-7313-46AA-B497-0C086F5B50D5}" = rport=445 | protocol=6 | dir=out | app=system | 
"{134013AF-C3C0-4DF8-91EA-35BF917EB4A5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{3E154840-7BD7-419E-BAFC-337D8391B4A8}" = rport=138 | protocol=17 | dir=out | app=system | 
"{4665FA82-F3B5-44B8-A8D8-4E290188A783}" = rport=139 | protocol=6 | dir=out | app=system | 
"{5179F783-FDCD-4CFC-842D-8578A89FBF9B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{53299A55-9984-4F9F-8EE2-43AB6A57E863}" = lport=138 | protocol=17 | dir=in | app=system | 
"{60A1C472-CB57-4D1F-8C08-5836CAA51E00}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{74A76AE6-22E4-4269-81EC-234BE0EACAAB}" = lport=137 | protocol=17 | dir=in | app=system | 
"{AEC90E70-DF14-483D-B3CF-FC7D0235D527}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B0036124-4FCA-4819-8301-4F5269CA2499}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{CFA4AC50-C147-41E3-852C-595B402391E6}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{063AFEB5-8107-47FC-A5FC-317CFDD98F61}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 
"{12DE57D9-333B-4C2F-BE1A-A2600C9034A4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 
"{1C895038-D33D-493C-A640-87C12B83C655}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe | 
"{26B36055-B04B-4932-97E1-200890664827}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{306C60FE-1314-4767-BA22-322B8EB6F7DF}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 
"{370899EC-2940-41C1-88F2-F4EBB85E206C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe | 
"{45C420A0-AD61-412D-B1B8-E090E8DD173E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 
"{52B47930-E75B-42DD-AA3A-33420407F364}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{69910973-E14E-4D21-AC2B-2091C6A97B02}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{73F4FFC7-8057-44AB-965D-FF34A5543D5F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe | 
"{7D8ED491-7225-4E4F-801A-55705F56240D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 
"{8584FF35-7152-4956-95B6-751795244822}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{8B12A310-9D05-4843-AA83-C0B0051D4FF1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 
"{92D5D0EB-76F3-495A-BE28-65C8EDA4A6EC}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 
"{A5608E7C-E5CE-47F4-9A5C-4E8FB82ED519}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 
"{B7BDBE64-EE9D-49CD-BC7A-8D6DEE20ED4F}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 
"{B8C82B77-DC11-4805-A825-22CA0E1067A5}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe | 
"{BD1F1DC5-C43F-4BFC-A226-ABBADC60ACE0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 
"{C1CC6AEC-18FD-4C6F-A713-09979622614D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C2ED3477-6185-47EB-8ED8-C7CD7F4DCE77}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 
"{DD0E6D38-FDBD-40BC-9115-7278F3EEB1FB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{E9C125B0-1729-499D-854E-5A414F9053E8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{FE355C85-77FD-4DFF-8073-5FF44962FA4A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe | 
"TCP Query User{8136C421-618A-4412-BD6C-829E8B4AED2B}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{1CEEE0D9-6628-482F-90BF-F27E5393B243}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D98B285-0777-B3B7-7A3D-9C85422203B9}" = ccc-utility64
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{6E5159B4-A519-41EF-80EF-AD58371515DF}" = Eraser 6.0.10.2620
"{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}" = HP Officejet 4500 G510n-z
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8924F1FE-8AC5-C2AE-59EF-C5D65B226933}" = AMD Catalyst Install Manager
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{A4DDB2AB-ECCD-4C3A-8633-77D5A1A0E542}" = Network64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Creative OA013" = Integrated Webcam Driver (1.00.04.0310)  
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Dell Touchpad
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{06870F63-4D1C-171F-9552-368D3890D92F}" = CCC Help French
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{14CE04AF-0EBC-B865-382F-1FB466CAC301}" = CCC Help English
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1DBC5882-96E2-3A01-A32C-9B6F6EF6CF25}" = CCC Help Korean
"{1F36B20F-7408-EC75-2825-E9FE81B0339D}" = CCC Help Norwegian
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{30DAAF05-3679-C10C-953C-BB422FCDF557}" = CCC Help Swedish
"{3A4D5E2D-988D-4ee9-8E7F-3AC200A2B8F5}" = 4500G510nz_Software_Min
"{428536FB-25A0-8531-75EF-D7A7C340B0A4}" = Catalyst Control Center
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4BA6B7C9-65AE-BE8B-687A-6F1A2D7F9705}" = CCC Help Czech
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{4C8E1E1B-175F-AF47-8B21-E12C7C8B5D40}" = CCC Help Thai
"{4EAF46A2-DB90-6B67-F640-5CC876A2B5C4}" = CCC Help Greek
"{5B05FF91-F20C-4832-A8DE-E1912639C17C}" = 4500G510nz
"{5D5B8455-50E0-F94A-4C82-0F9303BB4C0E}" = CCC Help Danish
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{690879A5-18EF-447B-98D6-B699D51008AB}" = 4500_G510nz_Help
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{7765BB73-D985-42C9-C7EE-AB434D59429F}" = CCC Help Chinese Traditional
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7ADFB885-8E98-6AAE-8687-D6EFB5127F6B}" = Catalyst Control Center Graphics Previews Common
"{7F7C616E-6971-77D9-7D59-82DC35DF81AC}" = CCC Help Russian
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9FA5B08F-9162-BCCB-AFAC-28DF1751BEC3}" = Catalyst Control Center Localization All
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF859F36-5F97-F6EC-A617-62771A8B4FDC}" = CCC Help Finnish
"{BB095F3E-0A7D-7DD4-B2A8-47CB12E416B0}" = CCC Help Japanese
"{BC71B06F-BFAE-6A73-091C-F18ACF00A04C}" = CCC Help Italian
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BDCBA80C-A3BD-9DA5-E43F-EBBBE779C032}" = CCC Help Hungarian
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CEEA6219-8792-3E40-D361-4FB5F0FBBB0F}" = CCC Help Portuguese
"{CF053286-7F4C-CAFB-616B-58EC562BB28E}" = CCC Help Chinese Standard
"{D07BB56A-7DB4-4564-A1F9-EBCE75FBE3C6}" = Catalyst Control Center InstallProxy
"{D3689EED-3943-9E90-1D65-D2246EB58AD1}" = CCC Help Turkish
"{DBA5EE42-A143-A658-9F86-C611BFDBEFCA}" = CCC Help Dutch
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E19490CD-5380-4F37-B0A7-624D635605DC}" = Catalyst Control Center - Branding
"{EAF0F475-CFE2-9F4D-F26A-875FF09AD40E}" = CCC Help Spanish
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1F1CCD6-34FE-81C6-CE0C-F22695E6409F}" = CCC Help German
"{F71A71E1-285C-95CE-A8F7-231E3827138E}" = CCC Help Polish
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avidemux 2.5" = Avidemux 2.5 (32-bit)
"Avira AntiVir Desktop" = Avira Free Antivirus
"ESET Online Scanner" = ESET Online Scanner v3
"Foxit Reader_is1" = Foxit Reader
"HDD-Booster_is1" = HDD-Booster v1.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.2
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = VSS | ID = 12293
Description = 
 
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = System Restore | ID = 8193
Description = 
 
Error - 01.09.2012 18:02:53 | Computer Name = NAME | Source = System Restore | ID = 8210
Description = 
 
Error - 01.09.2012 19:46:48 | Computer Name = NAME | Source = EventSystem | ID = 4609
Description = 
 
Error - 01.09.2012 19:59:49 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 01.09.2012 20:00:08 | Computer Name = NAME | Source = VSS | ID = 12293
Description = 
 
Error - 01.09.2012 20:01:48 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 02.09.2012 05:21:35 | Computer Name = NAME | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.09.2012 05:21:38 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
Error - 02.09.2012 05:25:50 | Computer Name = NAME | Source = Microsoft-Windows-CAPI2 | ID = 131328
Description = 
 
[ System Events ]
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
Error - 22.07.2012 07:00:59 | Computer Name = NAME | Source = Microsoft-Windows-Servicing | ID = 4385
Description = 
 
 
< End of report >
         

--- --- ---
[/code]

In dem Programm habe ich nichts verstellt:



Wenn man da rauslesen könnte, dass ich dies und das machen muss, und am Ende taucht der Thunderbird-Ordner wieder auf, wäre ich glücklich.

Das sind die falschen Logs - alte Logs siehe oben
Du solltest die Logs die von OTLPE erstellt wurden posten

Achje, sorry! Das kommt daher, dass ich das alles in einem Ordner gespeichert habe. Für den letzten Durchlauf habe ich keine "Extra" Datei, kann das sein? Muss ichs nochmal machen? Ich hatte so Schwierigkeiten, ins BIOS reinzukommen, obwohl ich beim Hochfahren immer sofort und unzählige Male F12 wie ein Irrer gedrückt habe. Nach ca. 80 Versuchen (neu starten und wieder warten) konnte ich dann endlich von CD booten. Ich kriege bald die Krise....

OTL Logfile:

OTL logfile created on: 9/8/2012 12:54:37 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78.12 Gb Total Space | 27.90 Gb Free Space | 35.72% Space Free | Partition Type: NTFS
Drive E: | 219.93 Gb Total Space | 129.31 Gb Free Space | 58.80% Space Free | Partition Type: NTFS
Drive F: | 7.53 Gb Total Space | 1.34 Gb Free Space | 17.74% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/12/05 23:11:56 | 000,235,520 | ---- | M] (AMD) [Auto] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/03/18 05:08:00 | 000,382,464 | ---- | M] (Marvell) [Auto] -- C:\Windows\System32\ykx64mpcoinst.dll -- (yksvc)
SRV:64bit: - [2009/03/06 06:51:04 | 000,268,288 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009/03/02 08:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/08/31 06:13:30 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/05/01 19:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/01 18:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/05/21 15:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009/03/30 00:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/05/02 09:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012/04/27 04:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/04/24 18:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/12/05 23:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/12/05 22:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009/09/30 20:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WpdUsb.sys -- (WpdUsb)
DRV:64bit: - [2009/03/18 05:08:00 | 000,406,016 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\Windows\System32\drivers\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2009/03/09 11:00:00 | 000,311,456 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA013Vid.sys -- (OA013Vid)
DRV:64bit: - [2009/03/06 06:51:04 | 000,477,696 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/03/06 01:33:58 | 000,159,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA013Ufd.sys -- (OA013Ufd)
DRV:64bit: - [2008/11/17 02:29:14 | 001,526,776 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2006/09/18 17:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NAME_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\NAME_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\NAME_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\NAME_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 E8 91 30 57 6A CD 01  [binary data]
IE - HKU\NAME_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\NAME_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Office-PC_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Office-PC_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Office-PC_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?hl=de&tab=ww"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF64_11_4_402_265.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/08/18 12:32:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/31 06:13:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/20 08:29:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/31 06:13:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/20 08:29:35 | 000,000,000 | ---D | M]
 
[2012/07/19 12:50:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NAME\AppData\Roaming\Mozilla\Extensions
[2012/08/31 06:15:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\p8o9pvz3.default\extensions
[2012/07/19 12:54:34 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012/07/19 12:54:34 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2012/07/19 12:54:35 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/19 12:54:34 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\p8o9pvz3.default\extensions\ich@maltegoetz.de
[2012/07/19 12:31:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) -- 
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{2E17E2B2-B8D4-4A67-8D7B-FAFA6CC9D1D0}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C07D1A49-9894-49FF-A594-38960EDE8FB9}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{C151D79E-E61B-4A90-A887-5A46D38FBA99}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\EXIF_VIEWER@MOZILLA.DOSLASH.ORG.XPI
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P8O9PVZ3.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
[2012/08/31 06:13:30 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/07/13 20:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/08/31 06:13:27 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/07/13 20:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/07/13 20:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/07/13 20:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/16 10:18:26 | 000,000,126 | ---- | M] () - F:\Autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{9a56d2f2-d1b0-11e1-b1a2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9a56d2f2-d1b0-11e1-b1a2-806e6f6e6963}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk /r \??\C:) -  File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/07 19:28:07 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\Canneverbe Limited
[2012/09/07 19:22:21 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\Canneverbe Limited
[2012/09/07 19:22:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012/09/07 19:22:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP
[2012/09/01 09:35:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012/09/01 07:26:01 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\vlc
[2012/09/01 06:18:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware (2)
[2012/08/21 09:24:03 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\pdfforge
[2012/08/21 09:24:00 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX
[2012/08/21 09:23:59 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012/08/21 09:23:59 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX
[2012/08/21 09:23:59 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\System32\pdfcmon.dll
[2012/08/21 09:23:57 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL
[2012/08/21 09:23:57 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL
[2012/08/21 09:23:57 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL
[2012/08/21 09:23:57 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL
[2012/08/21 09:23:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012/08/20 08:29:10 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/08/19 21:01:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012/08/18 13:19:54 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\HP
[2012/08/18 13:19:11 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2012/08/18 13:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Roaming\HP
[2012/08/18 13:17:08 | 000,000,000 | ---D | C] -- C:\Users\Office-PC\AppData\Local\HP
[2012/08/18 12:30:01 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2012/08/18 12:26:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012/08/18 12:25:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\HP
[2012/08/18 12:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Hewlett-Packard
[2012/08/18 12:24:52 | 000,000,000 | ---D | C] -- C:\Windows\hpoj4500g510n-z
[2012/08/18 12:22:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP
[2012/08/18 12:15:13 | 000,642,360 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpzids40.dll
[2012/08/18 12:15:09 | 000,136,704 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\hpf3l092.dll
[2012/08/18 12:13:40 | 000,902,656 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpwwiax9.dll
[2012/08/18 12:13:40 | 000,742,912 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpwtscl5.dll
[2012/08/18 12:13:40 | 000,551,424 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hppldcoi.dll
[2012/08/18 12:13:40 | 000,503,296 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpwvst01.dll
[2012/08/18 12:13:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2012/08/15 21:04:39 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/08/15 21:04:38 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/08/15 21:04:36 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/08/15 21:04:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/08/15 21:04:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/08/15 21:04:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/08/15 21:04:34 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/08/15 21:04:33 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/08/15 21:04:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/08/15 21:04:33 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/08/15 21:04:32 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/08/15 21:04:30 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/08/15 21:04:30 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/08/15 21:04:30 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/08/15 12:04:41 | 000,788,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2012/08/15 12:04:40 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\localspl.dll
[2012/08/15 12:04:37 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netapi32.dll
[2012/08/10 03:52:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012/09/08 05:41:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/08 05:40:51 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/08 05:40:51 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/08 05:20:20 | 000,706,834 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/09/08 05:20:20 | 000,661,788 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/09/08 05:20:20 | 000,159,690 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/09/08 05:20:20 | 000,130,674 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/09/07 19:22:04 | 000,001,812 | ---- | M] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\CDBurnerXP.lnk
[2012/09/07 19:22:04 | 000,001,788 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012/09/07 19:22:04 | 000,001,738 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012/09/04 14:41:37 | 000,122,368 | ---- | M] () -- C:\Users\NAME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/03 11:24:42 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2012/09/01 06:19:51 | 000,001,000 | ---- | M] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\ Malwarebytes Anti-Malware .lnk
[2012/09/01 06:19:51 | 000,000,976 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/09/01 06:19:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/01 05:50:09 | 000,000,005 | ---- | M] () -- C:\Users\NAME\AppData\Roaming\mbam.context.scan
[2012/09/01 05:43:10 | 000,000,870 | ---- | M] () -- C:\Users\NAME\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFCreator.lnk
[2012/08/26 05:38:58 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/08/26 05:38:58 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/08/25 11:36:16 | 000,000,732 | ---- | M] () -- C:\Users\NAME\AppData\Local\d3d9caps64.dat
[2012/08/21 09:24:05 | 000,000,839 | ---- | M] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFArchitect.lnk
[2012/08/21 09:24:04 | 000,000,894 | ---- | M] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFCreator.lnk
[2012/08/20 08:29:36 | 000,002,425 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/08/19 04:01:17 | 000,255,776 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/08/18 13:26:03 | 000,001,254 | ---- | M] () -- C:\Users\NAME\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HP Solution Center.lnk
[2012/08/18 13:21:09 | 000,000,000 | ---- | M] () -- C:\Windows\hpqEmlSz.INI
[2012/08/18 13:16:55 | 000,241,119 | ---- | M] () -- C:\Windows\hpwins28.dat
[2012/08/18 13:16:20 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/08/18 12:33:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012/08/18 12:30:43 | 000,000,891 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
[2012/08/18 12:27:41 | 000,002,002 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/08/16 02:27:17 | 000,001,614 | ---- | M] () -- C:\Users\NAME\Desktop\Eraser.lnk
[2012/08/10 03:52:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files Created - No Company Name ==========
 
[2012/09/07 19:22:04 | 000,001,738 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012/09/03 11:24:42 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2012/09/01 06:19:51 | 000,000,976 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/09/01 05:49:43 | 000,000,005 | ---- | C] () -- C:\Users\NAME\AppData\Roaming\mbam.context.scan
[2012/09/01 05:43:10 | 000,000,870 | ---- | C] () -- C:\Users\NAME\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFCreator.lnk
[2012/08/21 09:24:05 | 000,000,839 | ---- | C] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFArchitect.lnk
[2012/08/21 09:24:04 | 000,000,894 | ---- | C] () -- C:\Users\Office-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFCreator.lnk
[2012/08/18 13:26:03 | 000,001,254 | ---- | C] () -- C:\Users\NAME\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HP Solution Center.lnk
[2012/08/18 13:21:09 | 000,000,000 | ---- | C] () -- C:\Windows\hpqEmlSz.INI
[2012/08/18 12:30:43 | 000,000,891 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
[2012/08/18 12:27:41 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/08/18 12:17:13 | 000,241,119 | ---- | C] () -- C:\Windows\hpwins28.dat
[2012/07/20 08:58:23 | 000,000,732 | ---- | C] () -- C:\Users\NAME\AppData\Local\d3d9caps64.dat
[2012/07/20 08:54:45 | 000,000,680 | ---- | C] () -- C:\Users\NAME\AppData\Local\d3d9caps.dat
[2012/07/19 19:23:55 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2012/07/19 19:22:57 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2012/07/19 19:22:00 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2012/07/19 18:11:06 | 000,122,368 | ---- | C] () -- C:\Users\NAME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/07/19 17:44:05 | 000,007,680 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/07/19 16:09:30 | 001,633,344 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/19 15:14:07 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2012/07/19 13:17:27 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\ARP.EXE
[2012/07/19 13:17:27 | 000,008,704 | ---- | C] () -- C:\Windows\SysWow64\HOSTNAME.EXE
[2012/07/19 12:16:37 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012/07/19 10:58:11 | 000,000,732 | ---- | C] () -- C:\Users\Office-PC\AppData\Local\d3d9caps64.dat
[2011/12/05 16:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011/12/05 16:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/09/12 19:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009/08/18 03:18:40 | 000,000,418 | ---- | C] () -- C:\Windows\hpwmdl28.dat
[2008/01/20 22:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2006/11/02 11:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 11:02:31 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2006/11/02 08:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 08:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 08:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 05:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
 
========== LOP Check ==========
 
[2012/07/22 09:57:37 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\ASCOMP Software
[2012/09/07 19:22:21 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Canneverbe Limited
[2012/08/08 17:25:09 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Foxit Software
[2012/07/22 18:29:37 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\OpenOffice.org
[2012/07/19 13:38:20 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Thunderbird
[2012/07/19 19:23:57 | 000,000,000 | ---D | M] -- C:\Users\Office-PC\AppData\Roaming\Auslogics
[2012/07/31 15:41:40 | 000,000,000 | ---D | M] -- C:\Users\Office-PC\AppData\Roaming\avidemux
[2012/09/07 19:28:07 | 000,000,000 | ---D | M] -- C:\Users\Office-PC\AppData\Roaming\Canneverbe Limited
[2012/08/21 09:24:03 | 000,000,000 | ---D | M] -- C:\Users\Office-PC\AppData\Roaming\pdfforge
[2012/07/19 10:56:10 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/09/07 19:22:21 | 000,000,000 | ---D | M] -- C:\ProgramData\Canneverbe Limited
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2012/07/19 10:56:10 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012/07/19 10:56:10 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2012/07/19 10:56:10 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2012/07/19 10:56:10 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/09/08 05:40:56 | 000,024,400 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         

--- --- ---

Ist auch recht unauffällig
Ich befürchte hier, dass deine Platte im Sterben liegen könnte
Besorg dir mal das Disgnosetool vom Plattenhersteller. Welche Platte du hast siehst du am Anfang der Hardware- bzw. Laufwerkerkennung noch bevor Windows gebootet bzw. im BIOS. Auch im Windows-Gerätemanager sieht man welche Platte da drin ist.

Dann lädst du dir mal die UBCD, brennst das Image UBCD auf CD und bootest davon. Wähle dann über die HDD Tools das Diagnosetool von deinem Plattenhersteller aus und mach einen Check.

Ohje, das hört sich schlimm an. Dann ist wohl nicht nur alles verloren, sondern auch noch der ganze Computer im Arsch. Ich hab gerade einfach mal zehn Minuten geheult.

ST9320325AS ATA - klingt das nach Festplatte?
Damit bin ich via Google auf "Seagate" gestoßen und "SeaTools":
hxxp://www.seagate.com/de/de/support/downloads/seatools/

Soll ich das für Windows oder DOS runterladen?
Erst SeaTools machen und dann UBCD?

Ich bin total dankbar für die Hilfe, nur für mich ist das alles total kompliziert und schwierig, deshalb brauche ich immer so lange (und mache die Hälfte dann auch noch falsch...).

Was ist nochmal der Grund, warum ich nicht mal das CHKDSK ausführen kann? Gerade weil die Festplatte hinüber sein könnte?

Welche Seatools du nimmst ist eigentlich egal
Die für Windows sind etwas komfortabler zu bedienen

Erst SeaTools machen und dann UBCD?

Bitte richtig lesen! Auf der UBCD sind die Seatools drauf!

Hallo, ich war leider lange krank und konnte mich daher nicht um das Notebook kümmern.

Ich habe mal den SeaTools für Windows Test direkt über SeaTool gemacht, sieht mit "Kurzer Festplatten-Test", "S.M.A.R.T." und "Einfacher Kurz-Test" folgendermaßen aus:



Jetzt werde ich mir das Image von der Ultimate Boot CD machen, davon booten und SeaTools darüber laufen lassen. Muss ich eine bestimmte Test-Art ausführen oder "Reparatur" anklicken?



Vielen Dank!

PS: Beim Windows-Update kommt mittlerweile auch eine Fehlermeldung. Und wenn ich die Anweisung befolge, sagt DOS, dass ich das nicht ändern kann, weil das Verzeichnis beschädigt ist: