| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.05.2010, 13:25
| #1 |
| |  Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Hallo Ihr vom Expertenteam, das Antivir auf meinem Windows XP-PC meldete in den letzten Tagen mehrfach diese Meldung: In der Datei 'D:\System Volume Information\_restore{5AAAB577-A1A1-4071-A0D8-33B6276BAE80}\RP139\A0071353.Exe' wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden. Ausgeführte Aktion: Zugriff verweigern Wenn ich nachher den Suchlauf starte, ist dieser verdächtig schnell beendet und Antivir findet nichts. CCleaner hab ich laufen und löschen lassen. Ist mein System sauber? schonmal vielen Dank. Hier ist mein Hijackthis-Logfile: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:50:33, on 09.05.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Programme\Belkin\F5D7051\WLService.exe C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Programme\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Programme\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe C:\Programme\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\sistray.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Programme\Outlook Express\msimn.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\msiexec.exe C:\Programme\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Videoraptor_WebRipPlugin Class - {3C0372C2-04C3-4100-BAB1-1D42C552BC48} - D:\Programme\RapidSolution\RS Audials One\VideoRaptor\plugins\IE\VR_WebRipIePlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: CmjBrowserHelperObject Object - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Programme\Mindjet\MindManager 8\Mm8InternetExplorer.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SiSRaid] C:\Programme\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - res://D:\Programme\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /100 O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Programme\Mindjet\MindManager 8\Mm8InternetExplorer.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Belkin High-Speed Mode Wireless G USB Driver (Belkin High-Speed Mode Wireless G USB Network Adapter Service) - Unknown owner - C:\Programme\Belkin\F5D7051\WLService.exe O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate1c9f2a4e4fe1f2c) (gupdate1c9f2a4e4fe1f2c) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 10465 bytes |
|
09.05.2010, 21:03
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Hallo und
__________________ bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
15.05.2010, 17:49
| #3 |
| | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Ich weiß nicht genau, wo das Problem ist aber, wenn ich mit Malwarebytes den Vollscan mache, bleibt der PC entweder irgendwo hängen oder er stürzt ab. Der Quickscan hingegen funzt und spuckt folgendes Log aus:
__________________Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4103 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 15.05.2010 18:44:54 mbam-log-2010-05-15 (18-44-54).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 128918 Laufzeit: 7 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\avdrn.dat (Malware.Trace) -> No action taken. Soll ich jetzt trotzdem mit OTL scannen? Danke |
|
16.05.2010, 18:48
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Ok, dann bitte OTL Logs machen. Ist aber ungewöhnlich, dass der PC bei einem Vollscan von Malwarebytes stecken bleibt. Scanst Du nur Laufwerk C: beim Vollscan?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
18.05.2010, 18:04
| #5 |
| | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Hallo, zu deiner Frage: ich habe malwarebytes über alle Platten geschickt, es hat aber nicht bis zum Ende gescannt :-(. Hier meine Logs von OTL: OTL.txt: OTL logfile created on: 18.05.2010 18:30:24 - Run 1 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Dokumente und Einstellungen\xxx\Desktop\Download Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 61,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): C:\pagefile.sys 1104 2208 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 24,66 Gb Total Space | 2,40 Gb Free Space | 9,75% Space Free | Partition Type: NTFS Drive D: | 22,16 Gb Total Space | 7,06 Gb Free Space | 31,84% Space Free | Partition Type: NTFS Drive E: | 10,28 Gb Total Space | 0,28 Gb Free Space | 2,76% Space Free | Partition Type: NTFS Drive F: | 175,78 Gb Total Space | 10,65 Gb Free Space | 6,06% Space Free | Partition Type: NTFS Drive G: | 22,46 Gb Total Space | 0,36 Gb Free Space | 1,62% Space Free | Partition Type: NTFS Drive H: | 92,57 Gb Total Space | 48,86 Gb Free Space | 52,78% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Computer Name: xxxx Current User Name: xxx Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\xxx\Desktop\Download\OTL.exe (OldTimer Tools) PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Outlook Express\msimn.exe (Microsoft Corporation) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\UAService7.exe () PRC - C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis) PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) PRC - C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation) PRC - C:\Programme\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe () PRC - C:\Programme\Silicon Integrated Systems\SiSRaidPackage\Sraid.exe (SiS) PRC - C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) PRC - C:\Programme\Belkin\F5D7051\WLService.exe () PRC - C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe () PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation) PRC - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\xxx\Desktop\Download\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (Microsoft Corporation) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation) MOD - C:\Programme\Mindjet\MindManager 8\msscript.ocx (Microsoft Corporation) MOD - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\spoolss.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\msi.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\KMPJLMN.DLL (KYOCERA MITA Corporation) ========== Win32 Services (SafeList) ========== SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH) SRV - (LBTServ) -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (UserAccess7) SecuROM User Access Service (V7) -- C:\WINDOWS\system32\UAService7.exe () SRV - (NMIndexingService) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe (Nero AG) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (Belkin Wireless USB Network Adapter Service) -- C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe () SRV - (Belkin High-Speed Mode Wireless G USB Network Adapter Service) -- C:\Programme\Belkin\F5D7051\WLService.exe () SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation) SRV - (SoundMAX Agent Service (default)) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Driver Services (SafeList) ========== DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (cpuz132) -- C:\WINDOWS\system32\drivers\cpuz132_x32.sys (Windows (R) Codename Longhorn DDK provider) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (tbhsd) -- C:\WINDOWS\system32\drivers\tbhsd.sys (RapidSolution Software AG) DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\WINDOWS\system32\drivers\s0016unic.sys (MCCI Corporation) DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\WINDOWS\system32\drivers\s0016nd5.sys (MCCI Corporation) DRV - (s0016mdfl) -- C:\WINDOWS\system32\drivers\s0016mdfl.sys (MCCI Corporation) DRV - (s0016mdm) -- C:\WINDOWS\system32\drivers\s0016mdm.sys (MCCI Corporation) DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s0016mgmt.sys (MCCI Corporation) DRV - (s0016obex) -- C:\WINDOWS\system32\drivers\s0016obex.sys (MCCI Corporation) DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\WINDOWS\system32\drivers\s0016bus.sys (MCCI Corporation) DRV - (MPE) -- C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation) DRV - (61883) -- C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation) DRV - (Avc) -- C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation) DRV - (MSDV) -- C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation) DRV - (LMouKE) -- C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.) DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (L8042mou) -- C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.) DRV - (L8042Kbd) -- C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.) DRV - (PSI) -- C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia) DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis) DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis) DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis) DRV - (Ltn_stk7070P) -- C:\WINDOWS\system32\drivers\Ltn_stk7070P.sys (LITEON) DRV - (Ltn_stkrc) -- C:\WINDOWS\system32\drivers\Ltn_stkrc.sys (LITEON) DRV - (imagesrv) -- C:\WINDOWS\system32\DRIVERS\imagesrv.sys (Ahead Software AG) DRV - (imagedrv) -- C:\WINDOWS\System32\Drivers\imagedrv.sys (Ahead Software AG) DRV - (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM) -- C:\WINDOWS\system32\drivers\se27unic.sys (MCCI) DRV - (SE27obex) -- C:\WINDOWS\system32\drivers\SE27obex.sys (MCCI) DRV - (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS) -- C:\WINDOWS\system32\drivers\se27nd5.sys (MCCI) DRV - (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\SE27mgmt.sys (MCCI) DRV - (SE27mdm) -- C:\WINDOWS\system32\drivers\SE27mdm.sys (MCCI) DRV - (SE27mdfl) -- C:\WINDOWS\system32\drivers\SE27mdfl.sys (MCCI) DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\SE27bus.sys (MCCI) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (BTSERIAL) -- C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.) DRV - (BTSLBCSP) -- C:\WINDOWS\system32\drivers\btslbcsp.sys (Broadcom Corporation.) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (btwmodem) -- C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (k750obex) -- C:\WINDOWS\system32\drivers\k750obex.sys (MCCI) DRV - (k750mgmt) -- C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI) DRV - (k750mdm) -- C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI) DRV - (k750mdfl) -- C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI) DRV - (k750bus) Sony Ericsson 750 driver (WDM) -- C:\WINDOWS\system32\drivers\k750bus.sys (MCCI) DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation) DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation) DRV - (RT73) -- C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.) DRV - (AR5523) -- C:\WINDOWS\system32\drivers\ar5523.sys (Atheros Communications, Inc.) DRV - (ssm_mdm) -- C:\WINDOWS\system32\drivers\ssm_mdm.sys (MCCI) DRV - (ssm_bus) Samsung Mobile USB Device II 1.0 driver (WDM) -- C:\WINDOWS\system32\drivers\ssm_bus.sys (MCCI) DRV - (ssm_mdfl) -- C:\WINDOWS\system32\drivers\ssm_mdfl.sys (MCCI) DRV - (senfilt) -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura) DRV - (PCLEPCI) -- C:\WINDOWS\system32\drivers\Pclepci.sys (Pinnacle Systems GmbH) DRV - (ASAPIW2K) -- C:\WINDOWS\system32\drivers\asapiW2k.sys (VOB Computersysteme GmbH) DRV - (odysseyIM4) -- C:\WINDOWS\system32\drivers\odysseyIM4.sys (Funk Software, Inc.) DRV - (MidiSyn) -- C:\WINDOWS\system32\drivers\MidiSyn.sys (Analog Devices, Inc.) DRV - (SiSRaid1) -- C:\WINDOWS\system32\DRIVERS\SiSRaid1.sys (Silicon Integrated Systems) DRV - (ZD1211U(Siemens)) Gigaset USB Stick 54 Driver(Siemens) -- C:\WINDOWS\system32\drivers\ZD1211U.sys (ZyDAS Technology Corporation) DRV - (CBTNDIS5) -- C:\WINDOWS\system32\CBTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (NuVision) Hauppauge WinTV USB (PAL B/G FM) -- C:\WINDOWS\system32\drivers\Nuvision.sys (Hauppauge Computer Works) DRV - (PQNTDrv) -- C:\WINDOWS\system32\drivers\PQNTDRV.sys (PowerQuest Corporation) DRV - (SISNIC) -- C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation) DRV - (phil2vid) Philips VGA-Kamera (USB) -- C:\WINDOWS\system32\drivers\philcam2.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1 FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.1 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:20.1.0.4 FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4.5.1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..network.proxy.autoconfig_url: "file:///C:/Dokumente%20und%20Einstellungen/xxx/Lokale%20Einstellungen/Anwendungsdaten/RapidSolution/Videoraptor/WebRip/profile/rrproxy_ffox_4b33451b.pac" FF - prefs.js..network.proxy.no_proxies_on: "" FF - HKLM\software\mozilla\Firefox\Extensions\\videoraptor-firefox-surf-and-catch-extension@audials.com: D:\Programme\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\ [2008.10.19 18:37:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.26 13:47:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.28 23:47:15 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.19\extensions\\Components: D:\Programme\Mozilla Thunderbird\components [2010.04.09 15:41:31 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.19\extensions\\Plugins: D:\Programme\Mozilla Thunderbird\plugins [2010.04.28 23:47:15 | 000,000,000 | ---D | M] [2008.06.30 15:59:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions [2010.05.18 15:12:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions [2007.12.31 19:35:42 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010.04.30 13:50:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.20 21:42:24 | 000,000,000 | ---D | M] (IE View) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d} [2010.04.20 21:42:22 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2010.04.20 21:42:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\extensions\de-DE@dictionaries.addons.mozilla.org [2008.01.01 12:19:20 | 000,001,878 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\jekcwh3e.default\searchplugins\aolsearch.xml [2010.05.18 15:12:57 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2009.07.29 15:31:18 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Programme\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} [2007.06.21 19:38:54 | 000,079,432 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\CgpCore.dll [2007.06.21 19:38:56 | 000,071,240 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\confmgr.dll [2007.06.21 19:39:18 | 000,034,376 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\logging.dll [2007.06.21 19:39:34 | 000,325,200 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\npicaN.dll [2007.06.21 19:40:02 | 000,030,280 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\TcpPServ.dll [2010.02.01 20:41:35 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.02.01 20:41:35 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.02.01 20:41:35 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.02.01 20:41:35 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.02.01 20:41:35 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.04.25 22:28:41 | 000,392,061 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 13566 more lines... O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Videoraptor_WebRipPlugin Class) - {3C0372C2-04C3-4100-BAB1-1D42C552BC48} - D:\Programme\RapidSolution\RS Audials One\VideoRaptor\plugins\IE\VR_WebRipIePlugin.dll (RapidSolution Software) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Programme\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.dll (Silicon Integrated Systems Corporation) O4 - HKLM..\Run: [SiSRaid] C:\Programme\Silicon Integrated Systems\SiSRaidPackage\Sraid.exe (SiS) O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - D:\Programme\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll (ScanSoft, Inc.) O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Programme\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 217.237.151.97 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\ACD Wallpaper.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\ACD Wallpaper.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.09.10 14:56:12 | 000,000,087 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.05.15 17:22:12 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2010.05.15 17:17:17 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010.05.09 13:57:18 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\xxx\Recent [2010.05.09 13:48:17 | 000,000,000 | ---D | C] -- C:\Programme\HiJackThis [2010.04.28 22:35:55 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\dvd [2010.04.28 22:30:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\DVD Flick [2010.04.28 22:30:07 | 000,164,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comct232.ocx [2010.04.28 22:30:07 | 000,040,960 | ---- | C] (vbAccelerator) -- C:\WINDOWS\System32\ssubtmr6.dll [2010.04.28 22:30:07 | 000,036,864 | ---- | C] (Robdogg Inc.) -- C:\WINDOWS\System32\trayicon_handler.ocx [2010.04.28 22:30:07 | 000,028,672 | ---- | C] (-) -- C:\WINDOWS\System32\mousewheel.ocx [2010.04.28 22:09:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Licenses [2010.04.28 22:05:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Engelmann Media [2010.04.28 22:05:27 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\HDX4 [2010.04.28 22:05:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Engelmann Media [2010.04.28 21:54:37 | 000,054,920 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys [2010.04.28 21:54:37 | 000,030,320 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys [2010.04.28 21:54:36 | 000,024,400 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys [2010.04.20 21:57:35 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype ========== Files - Modified Within 30 Days ========== [2010.05.18 18:11:01 | 001,086,408 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.05.18 18:11:01 | 000,477,134 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.05.18 18:11:01 | 000,435,396 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.05.18 18:11:01 | 000,090,924 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.05.18 18:11:01 | 000,068,292 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.05.18 18:08:57 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2010.05.18 18:08:44 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.05.18 18:08:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.05.18 18:08:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.05.18 18:08:37 | 1576,390,656 | -HS- | M] () -- C:\hiberfil.sys [2010.05.18 16:18:56 | 013,631,488 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\NTUSER.DAT [2010.05.18 16:18:56 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\xxx\ntuser.ini [2010.05.18 16:00:23 | 000,000,053 | ---- | M] () -- C:\WINDOWS\KMSTMVM.ini [2010.05.18 16:00:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.05.18 15:51:54 | 000,002,503 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Microsoft Office Word 2007.lnk [2010.05.17 22:21:25 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.05.15 17:22:58 | 000,001,804 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2010.05.11 22:15:04 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2010.05.09 14:01:08 | 000,000,683 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.05.09 13:59:13 | 000,001,172 | ---- | M] () -- E:\Eigene Dateien\cc_20100509_135844.reg [2010.05.09 13:55:51 | 000,000,635 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\CCleaner.lnk [2010.05.09 13:48:34 | 000,002,545 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk [2010.05.03 15:41:49 | 000,024,362 | ---- | M] () -- E:\Eigene Dateien\Kxxxxur.docx [2010.04.30 20:26:23 | 000,014,400 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Kxxx.docx [2010.04.29 22:02:36 | 001,486,605 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Uxxxde.pdf [2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.04.28 23:47:15 | 000,001,716 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk [2010.04.28 23:05:22 | 000,023,560 | ---- | M] () -- E:\Eigene Dateien\cc_20100428_230513.reg [2010.04.28 22:30:15 | 000,000,662 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DVD Flick.lnk [2010.04.28 21:54:37 | 000,054,920 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys [2010.04.28 21:54:37 | 000,030,320 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys [2010.04.28 21:54:36 | 000,024,400 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys [2010.04.28 21:54:24 | 000,000,049 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010.04.27 12:38:42 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI [2010.04.27 12:38:09 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010.04.25 22:28:41 | 000,392,061 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010.04.25 21:16:20 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.04.24 17:07:17 | 000,055,808 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.04.24 14:35:50 | 000,000,004 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\avdrn.dat [2010.04.20 21:23:51 | 000,000,037 | ---- | M] () -- C:\WINDOWS\D660UES.ini [2010.04.19 21:02:44 | 000,001,894 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk [2010.04.19 14:35:06 | 000,000,162 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\~$ndout Lehrplan.docx ========== Files Created - No Company Name ========== [2010.05.15 17:22:58 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2010.05.09 14:01:08 | 000,000,683 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.05.09 13:58:46 | 000,001,172 | ---- | C] () -- E:\Eigene Dateien\cc_20100509_135844.reg [2010.05.09 13:48:17 | 000,002,545 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk [2010.05.03 14:55:09 | 000,024,362 | ---- | C] () -- E:\Eigene Dateien\Kexxxlur.docx [2010.04.30 14:16:33 | 000,014,400 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Küxxx.docx [2010.04.29 22:02:36 | 001,486,605 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Uxxxde.pdf [2010.04.28 23:50:54 | 000,287,384 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2010.04.28 23:05:18 | 000,023,560 | ---- | C] () -- E:\Eigene Dateien\cc_20100428_230513.reg [2010.04.28 22:30:15 | 000,000,662 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DVD Flick.lnk [2010.04.28 21:54:24 | 000,000,049 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010.04.28 19:05:32 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\kcmdte.dat [2010.04.25 21:53:31 | 1576,390,656 | -HS- | C] () -- C:\hiberfil.sys [2010.04.25 17:54:41 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.04.24 14:35:53 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\kcmdte.dat [2010.04.24 14:35:50 | 000,000,004 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\avdrn.dat [2010.04.20 21:57:35 | 000,002,243 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2010.04.20 21:23:51 | 000,000,037 | ---- | C] () -- C:\WINDOWS\D660UES.ini [2010.04.19 21:02:44 | 000,001,894 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk [2010.04.19 20:58:18 | 000,030,959 | ---- | C] () -- E:\Eigene Dateien\Untitled.pdf [2010.04.19 14:35:06 | 000,000,162 | -H-- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\~$ndout Lehrplan.docx [2010.03.19 14:14:16 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\EMRegSys.dll [2010.02.04 20:21:48 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI [2009.11.24 22:04:20 | 000,003,666 | ---- | C] () -- C:\WINDOWS\pixcache.ini [2009.11.24 21:47:53 | 000,032,411 | ---- | C] () -- C:\WINDOWS\SGTBox.INI [2009.05.25 12:44:09 | 000,000,092 | ---- | C] () -- C:\WINDOWS\NogaTw.INI [2009.01.31 11:15:42 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\B11gUSB.dll [2009.01.24 14:51:38 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll [2009.01.22 00:10:47 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\F5D7051.dll [2008.12.28 20:26:56 | 000,270,336 | ---- | C] () -- C:\WINDOWS\System32\WideDBAdapter.dll [2008.12.28 20:26:56 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\WideSyncManager.dll [2008.12.28 20:26:56 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\WideToolkit.dll [2008.12.28 20:26:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ObexLib.dll [2008.12.28 20:26:56 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\WideSyncAdminAdapter.dll [2008.10.07 10:17:54 | 000,000,053 | ---- | C] () -- C:\WINDOWS\KMSTMVM.ini [2008.07.23 18:50:52 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008.07.23 18:47:34 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2008.07.23 18:47:34 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2008.07.23 18:46:38 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2008.06.07 21:00:58 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008.05.26 22:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2008.05.26 22:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2008.05.26 22:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007.11.20 13:55:11 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt.dll [2007.11.17 21:40:53 | 000,000,568 | ---- | C] () -- C:\WINDOWS\HCWPNP.INI [2007.11.17 21:09:17 | 000,009,206 | ---- | C] () -- C:\WINDOWS\NTTuner.ini [2007.10.30 22:35:47 | 000,394,240 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll [2007.10.30 22:35:46 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll [2007.10.30 22:10:21 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\vzcontextmenu.dll [2007.09.25 23:10:15 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll [2007.09.10 14:58:53 | 000,194,248 | ---- | C] () -- C:\WINDOWS\System32\LTRFD13n.DLL [2007.09.10 14:56:12 | 000,001,289 | ---- | C] () -- C:\WINDOWS\VFO.INI [2007.09.10 14:56:10 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\macd32.dll [2007.09.10 14:56:10 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\mase32.dll [2007.09.10 14:56:10 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\mamc32.dll [2007.09.10 14:56:10 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\masd32.dll [2007.09.10 14:56:08 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\ma32.dll [2007.08.23 18:30:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2007.07.30 21:16:04 | 000,002,569 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2007.07.30 13:36:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI [2007.07.24 19:46:24 | 000,000,017 | ---- | C] () -- C:\WINDOWS\Missing.ini [2007.07.24 19:45:19 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI [2007.07.24 12:57:46 | 000,015,873 | ---- | C] () -- C:\WINDOWS\System32\Inetde.dll [2007.07.12 18:06:28 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\Chip.dll [2007.06.10 21:36:12 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A4W.INI [2007.06.10 21:35:13 | 000,000,936 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2007.06.10 21:31:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OP70.INI [2007.06.07 13:51:39 | 000,002,982 | ---- | C] () -- C:\WINDOWS\tm.ini [2007.06.07 13:36:42 | 000,000,655 | ---- | C] () -- C:\WINDOWS\wiso.ini [2007.06.07 13:34:51 | 000,000,245 | ---- | C] () -- C:\WINDOWS\BUHL.INI [2007.06.05 15:28:25 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007.02.11 22:31:46 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007.02.11 21:08:06 | 000,000,064 | ---- | C] () -- C:\WINDOWS\init.ini [2007.02.11 20:58:58 | 000,135,168 | R--- | C] () -- C:\WINDOWS\System32\property.dll [2007.02.11 16:18:21 | 000,076,011 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini [2007.02.11 16:16:42 | 000,074,443 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini [2006.05.12 14:23:22 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2005.07.29 20:38:24 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll [2004.08.31 11:32:48 | 000,327,680 | ---- | C] () -- C:\WINDOWS\System32\QFClient2.dll [2002.05.16 00:29:04 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest [2002.03.21 14:39:02 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL [2002.03.21 12:51:52 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll [2002.03.21 12:51:52 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll [2002.03.21 12:51:52 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll [2002.03.21 12:51:52 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll [2002.03.21 12:51:52 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll [2002.03.21 12:51:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll [2002.03.21 12:51:52 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll [2002.03.20 21:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys [2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll [2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll [2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll [2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll [2001.11.23 19:18:00 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest [2001.11.14 14:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 229 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0 < End of report > Ende Teil 1/2 |
|
18.05.2010, 18:06
| #6 |
| | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Teil 2/2 Extras.txt: OTL Extras logfile created on: 18.05.2010 18:30:24 - Run 1 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Dokumente und Einstellungen\xxx\Desktop\Download Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 61,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): C:\pagefile.sys 1104 2208 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 24,66 Gb Total Space | 2,40 Gb Free Space | 9,75% Space Free | Partition Type: NTFS Drive D: | 22,16 Gb Total Space | 7,06 Gb Free Space | 31,84% Space Free | Partition Type: NTFS Drive E: | 10,28 Gb Total Space | 0,28 Gb Free Space | 2,76% Space Free | Partition Type: NTFS Drive F: | 175,78 Gb Total Space | 10,65 Gb Free Space | 6,06% Space Free | Partition Type: NTFS Drive G: | 22,46 Gb Total Space | 0,36 Gb Free Space | 1,62% Space Free | Partition Type: NTFS Drive H: | 92,57 Gb Total Space | 48,86 Gb Free Space | 52,78% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Computer Name: GAxxx Current User Name: xxx Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [ACDBrowse] -- "C:\Programme\ACD Systems\ACDSee\5.0\ACDSee5.exe" "%1" (ACD Systems Ltd.) Directory [dm Fotowelt] -- "D:\Programme\dm\dm Fotowelt\dm Fotowelt.exe" "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet  isabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet isabled:@xpsp2res.dll,-22008"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Programme\Microsoft ActiveSync\rapimgr.exe" = C:\Programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Programme\Microsoft ActiveSync\wcescomm.exe" = C:\Programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Programme\Microsoft ActiveSync\WCESMgr.exe" = C:\Programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "D:\Programme\LimeWire\LimeWire.exe" = D:\Programme\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC) "D:\Programme\Azureus\Azureus.exe" = D:\Programme\Azureus\Azureus.exe:*:Enabled:Azureus -- (Vuze Inc.) "C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe" = C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup -- (Nero AG) "D:\Programme\TVAnts\Tvants.exe" = D:\Programme\TVAnts\Tvants.exe:*:Enabled:TVAnts -- (Zhejiang University) "D:\Programme\Pinnacle\Studio 10\programs\RM.exe" = D:\Programme\Pinnacle\Studio 10\programs\RM.exe:*:Enabled:Render Manager -- (Pinnacle Systems, Inc.) "D:\Programme\Pinnacle\Studio 10\programs\Studio.exe" = D:\Programme\Pinnacle\Studio 10\programs\Studio.exe:*:Enabled:Studio -- (Pinnacle Systems) "D:\Programme\Pinnacle\Studio 10\programs\PMSRegisterFile.exe" = D:\Programme\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile -- ( ) "D:\Programme\Pinnacle\Studio 10\programs\umi.exe" = D:\Programme\Pinnacle\Studio 10\programs\umi.exe:*:Enabled:umi -- (Pinnacle Systems, Inc.) "C:\Programme\Microsoft ActiveSync\rapimgr.exe" = C:\Programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Programme\Microsoft ActiveSync\wcescomm.exe" = C:\Programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Programme\Microsoft ActiveSync\WCESMgr.exe" = C:\Programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) "C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\Programme\Winamp Remote\bin\Orb.exe" = C:\Programme\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- (Orb Networks, Inc.) "C:\Programme\Winamp Remote\bin\OrbTray.exe" = C:\Programme\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- (Orb Networks) "C:\Programme\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Programme\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- (Orb Networks) "C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.) "C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "D:\Programme\eMule\emule.exe" = D:\Programme\eMule\emule.exe:*:Enabled:eMule -- (hxxp://www.emule-project.net) "D:\Programme\iTunes\iTunes.exe" = D:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009 "{031BDDC8-B6CD-4074-9D50-F92B648E7B92}" = Gigaset USB Stick 108 "{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3 "{08498FF9-6C9B-4FC2-8DE1-BD98C89CC220}" = SiSRaidPackage "{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting "{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth "{0A4DF5B0-983C-4691-9D4A-9FD1D4B2A69F}" = Secunia PSI (BETA) "{0B7DDCD3-D6D8-4366-A6D8-9B6495A2925E}" = ScanSoft OmniPage 15.0 "{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer "{11AEA686-CD61-4C11-B410-330119375147}" = WiDESYNC 2.0 "{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin "{1A0B8239-664B-434A-99D8-C50793513249}" = Audials TV "{1C27BA8F-0E90-4316-9F71-C0B55362A294}" = Samsung PC Studio II 2.0 Sample "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2 "{257D6C9F-BD8E-4739-9D03-FED55793C774}_is1" = floAt's Mobile Agent "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12 "{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime "{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3 "{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.006.00 "{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper "{34F85A4D-03CC-428A-80A4-880228646518}" = Safari "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3606DBAC-980D-4A18-9382-FECCB9E9E584}" = Duden Korrektor PLUS 3.5 "{38DFF723-C0B1-44AB-A927-62EDB033908F}" = Belkin 54g USB Network Adapter "{3CB05291-F546-458E-A796-B5BCF5A3CDC4}" = Studio 10 "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT "{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{48F32034-CDCC-411F-9620-D0752E29C313}" = Videoraptor "{4A425F14-0561-11D4-9027-0060089CDAE1}" = FileMaker Pro 5.5 "{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0 "{53927BDD-31EA-436D-94C9-81E8EE2FB829}" = ACDSee for PENTAX "{53C020C2-8C1A-11D9-8BDE-F66BAD1E3F3A}" = EndNote 9.0.1 Volume License Edition "{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3 "{54971F17-9D16-4D43-95D6-3A86E3D20EDB}" = Office-Bibliothek 4.0 "{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008 "{59686E80-DDAD-47E1-B2DF-AC2F1D8BFC1F}" = Visual Mind 10 "{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes "{5EDB9281-1F84-4195-9CDD-85985D17DDC7}" = WISO Sparbuch 2007 "{602A205F-8D02-48EE-8782-262B2103B984}" = ScanSoft PDF Converter 3.0 "{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}" = PixiePack Codec Pack "{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup "{668D583F-3BEE-4217-A149-09FDAFFE2477}" = Tunebite "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{69E8BEBD-B3AA-4981-BA49-AD0AEA731031}" = Nero BackItUp 2 Essentials "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All "{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic "{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings "{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3 "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings "{76629460-34BF-44E8-94A0-D5DCB876232E}" = Radiotracker "{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77F09242-A107-4CB6-A295-D8656C2C3795}" = Samsung USB Driver (MCCI 4.24) "{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3 "{8148F35A-B15C-465B-80C2-DC0E1234EC20}" = Samsung PC Studio II 2.0 Image Editor "{81D62C32-0984-11D3-86CD-00105AD33021}" = Caere Scan Manager 5.1 "{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility "{887F83FD-2273-4DAB-9F01-89EBE3FFBD6C}" = TERRA Methoden 5-6 "{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3 "{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support "{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12 "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ULTIMATER_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ULTIMATER_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ULTIMATER_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ULTIMATER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3 "{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage "{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007 "{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{979FCA90-1FA4-482F-0001-393419DB8F1B}" = MyTube HD 4.0 "{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync "{99D42EC7-652B-4819-B3E6-6450C815E03F}" = Odyssey Client "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3 "{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support "{A1973A71-BC23-4A8C-A0A0-2B0497B7EAF4}" = WISO Sparbuch 2008 "{A20A58C4-6784-4B4B-86CC-94E2E3671031}" = Nero 7 "{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A4ACDF24-3162-46B3-BD2A-8DC7734DE8F4}" = Arbeitsblätter - TERRA Erdkunde 5 - 10 Deutschland "{A77F3C2D-50CC-4A29-A1FB-1E018BE4DCA2}" = DiscAPI (Studio 10) "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings "{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional "{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9 "{AD1D8B40-F83C-41CA-BA08-9DB8D1653316}" = ScanSoft PDF Create 3.0 "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0 "{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{B727BD4D-0C42-43F7-AC60-4AFBDDC732BD}" = FlexPoints 2.01 "{B929A084-395B-4886-8474-CC55CF76F17E}" = Mindjet MindManager 8 "{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3 "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007 "{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3 "{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery "{CA832FE2-4E56-4B4C-A56F-1AEB7B71A8A9}" = Belkin High-Speed Mode Wireless G USB Network Adapter "{CA83357B-931E-44DC-AD43-9996FEEB8116}" = Acronis True Image "{CC038D57-788A-4544-BF8F-179E5CF50D2F}" = Microsoft Visual C++ 2005 SP1 CRT Redistributable "{CD95F661-A5C4-44F5-A6AA-ECDD91C240B2}" = WinZip 11.2 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CEA791BB-6F54-48ED-BC2A-F78157C1D558}" = Adobe Setup "{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files "{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center "{D4E01931-9B3F-49BD-B19B-511000A1E039}" = Samsung PC Studio II 2.0 PIMS & File Manager "{D99B8A7B-1896-4B3E-8372-3239A63B5362}" = Tagrunner "{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver "{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings "{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3 "{E89956F9-5B89-470E-818D-BD46102D0A01}" = Citrix Presentation Server Client "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung Mobie USB Driver Installer "{EEECE229-49F6-4851-A73A-99B058221F8C}" = RAPID (Studio 10) "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint "{F731E692-125E-4CFC-980F-658F4EE09F13}" = Gigaset USB Stick 54 "{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit "{FC906D5C-91F9-4DA4-A765-6DCBB669F317}" = Sony Ericsson PC Suite "{FECB001A-62F8-4E84-8FD0-4B963D039A63}" = Samsung Contacts Copier "{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings "8461-7759-5462-8226" = Vuze "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop 7.0" = Adobe Photoshop 7.0 "Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2 "Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings "Adobe_c015d5ef39552390a753ee735d16041" = Adobe Illustrator CS3 "AnyDVD" = AnyDVD "Audiograbber" = Audiograbber 1.83 SE "Avi2Dvd" = Avi2Dvd 0.4.5 beta "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AviSynth" = AviSynth 2.5 "Azureus" = Azureus "Canon ScanGear Toolbox CS" = Canon ScanGear Toolbox CS 2.5 "Canon ScanGear Toolbox FAU" = Canon ScanGear Toolbox FAU 2.5 "CCleaner" = CCleaner "CloneDVD2" = CloneDVD2 "CPUID CPU-Z_is1" = CPUID CPU-Z 1.51 "dm Fotowelt" = dm Fotowelt "dm-DIGI-Foto" = dm-DIGI-Foto "DVD Flick_is1" = DVD Flick 1.3.0.7 "eMule" = eMule "eMusic Promotion" = eMusic - 50 Free MP3 offer "FileZilla Client" = FileZilla Client 3.0.4.1 "Google Updater" = Google Updater "HijackThis" = HijackThis 2.0.2 "InstallShield_{3606DBAC-980D-4A18-9382-FECCB9E9E584}" = Duden Korrektor PLUS 3.5 "InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin "InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0 "InstallShield_{77F09242-A107-4CB6-A295-D8656C2C3795}" = Samsung USB Driver (MCCI 4.24) "InstallShield_{99D42EC7-652B-4819-B3E6-6450C815E03F}" = Odyssey Client "ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper "Kyocera FS-1100 / FS-1300D Printer Library" = Kyocera FS-1100 / FS-1300D Printer Library "ldoce4v2" = LONGMAN Dictionary of Contemporary English "LIDL Fotoservice_is1" = LIDL Fotoservice "LimeWire" = LimeWire 4.14.10 "Magic ISO Maker v5.4 (build 0251)" = Magic ISO Maker v5.4 (build 0251) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Medion GoPal Assistant" = Medion GoPal Assistant 3.00.0545 "Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "Mozilla Thunderbird (2.0.0.19)" = Mozilla Thunderbird (2.0.0.19) "Mp3tag" = Mp3tag "MPE" = MyPhoneExplorer "Orb" = Winamp Remote "PDF-XChange 3_is1" = PDF-XChange 3.0 "PhotoME_is1" = PhotoME "Picasa 3" = Picasa 3 "RealPlayer 6.0" = RealPlayer "RS Audials One_is1" = RS Audials One 2.1.35716.1600 "SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set "Samsung Mobile USB Modem" = Samsung Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "ShockwaveFlash" = Adobe Flash Player 9 ActiveX "SiS VGA Driver" = SiS VGA Utilities "SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver "Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4 "SUPER ©" = SUPER © Version 2007.bld.23 (July 4, 2007) "TERRA CD-ROM NRW 5-6_is1" = die TERRA CD-ROM NRW 5-6 "TERRA CD-ROM Realschule NRW 5-6_is1" = die TERRA CD-ROM Realschule NRW 5-6 "TVAnts 1.0" = TVAnts 1.0 "ULTIMATER" = Microsoft Office Ultimate 2007 "VSO DivxToDVD_is1" = DivxToDVD 0.5.2 "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Winamp" = Winamp "Winamp Toolbar for Firefox" = Winamp Toolbar for Firefox "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR archiver "xp-AntiSpy" = xp-AntiSpy 3.96-8 "YouRipper230" = YouRipper ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 07.05.2010 12:08:11 | Computer Name = xxx| Source = ESENT | ID = 490 Description = svchost (1496) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error - 11.05.2010 12:17:53 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung mbam.exe, Version 1.46.0.0, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x00002b67. Error - 11.05.2010 12:24:46 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes Modul dbghelp.dll, Version 5.1.2600.5512, Fehleradresse 0x0001295d. Error - 11.05.2010 13:18:01 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung mbam.exe, Version 1.46.0.0, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x00002b67. Error - 11.05.2010 13:26:55 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes Modul dbghelp.dll, Version 5.1.2600.5512, Fehleradresse 0x0001295d. Error - 11.05.2010 15:12:15 | Computer Name = xxx| Source = Avira AntiVir | ID = 4118 Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei E:\Eigene Dateien\Belege\karte.pdf. [ACCESS_VIOLATION Exception!! EIP = 0x14f2d2d] Bitte Avira informieren und die obige Datei übersenden! Error - 14.05.2010 08:05:25 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung avguard.exe, Version 9.0.1.32, fehlgeschlagenes Modul aevdf.dll, Version 8.1.2.0, Fehleradresse 0x00001218. Error - 15.05.2010 11:14:38 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung mbam.exe, Version 1.46.0.0, fehlgeschlagenes Modul oleaut32.dll, Version 5.1.2600.5512, Fehleradresse 0x00004ebc. Error - 15.05.2010 11:16:12 | Computer Name = xxx| Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes Modul dbghelp.dll, Version 5.1.2600.5512, Fehleradresse 0x0001295d. Error - 18.05.2010 12:09:36 | Computer Name = xxx| Source = ESENT | ID = 490 Description = svchost (1496) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. [ OSession Events ] Error - 15.07.2009 06:52:58 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 83 seconds with 60 seconds of active time. This session ended with a crash. Error - 15.07.2009 06:58:23 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 42 seconds with 0 seconds of active time. This session ended with a crash. Error - 15.07.2009 07:02:19 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 83 seconds with 60 seconds of active time. This session ended with a crash. Error - 18.07.2009 02:35:58 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 848 seconds with 660 seconds of active time. This session ended with a crash. Error - 02.09.2009 15:17:16 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3405 seconds with 3060 seconds of active time. This session ended with a crash. Error - 05.11.2009 15:20:33 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 46 seconds with 0 seconds of active time. This session ended with a crash. Error - 15.11.2009 10:01:59 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 14437 seconds with 6600 seconds of active time. This session ended with a crash. Error - 08.03.2010 13:21:32 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 867 seconds with 420 seconds of active time. This session ended with a crash. Error - 11.04.2010 16:42:59 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8293 seconds with 5640 seconds of active time. This session ended with a crash. Error - 25.04.2010 08:06:45 | Computer Name = xxx| Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3214 seconds with 2280 seconds of active time. This session ended with a crash. [ System Events ] Error - 18.05.2010 12:09:28 | Computer Name = xxx | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: nnsyfctj < End of report > So, jetzt weißt du alles über meinen PC, oder?  Danke Zappelmann |
|
18.05.2010, 18:55
| #7 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.05.2010, 20:19
| #8 |
| | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Ein Wunder!! Hab es noch mal laufen lassen upgedatet und über alle Platten und es ist nicht abgestürzt. Hatte deinen Post leider noch nicht gelesen. Hier also das LOG: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4112 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 18.05.2010 21:06:25 mbam-log-2010-05-18 (21-06-25).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|) Durchsuchte Objekte: 367160 Laufzeit: 2 Stunde(n), 0 Minute(n), 7 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: D:\Tools\MP3\WinAmp Plugins\Wave_surround\3.0\TNT\DSP_CRK.exe (Trojan.Bancos) -> No action taken. C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\avdrn.dat (Malware.Trace) -> No action taken. Danke! |
|
18.05.2010, 21:05
| #9 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Die Logs sind unauffällig. Den ersten Fund von MBAM in Winamp bewerte ich mal als Fehlalarm, werte die Datei aber trotzdem mal bei Virustotal aus und poste den Link. Die zweite Datei mit MBAM löschen lassen. Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.05.2010, 08:03
| #10 |
| | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Hi Arne, hier also der Link zum Virustotal-Scan. Die Datei ist glaub ich seit Jahren unbenutzt auf meinem Rechner. hxxp://www.virustotal.com/de/analisis/61a016834780ed4fac9b5345b08fe6b4b8ad3937e11d3769a9f109e13e4c9255-1274425171 Danke. zappelmann |
|
21.05.2010, 09:49
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? Wo hast Du das Plugin her? Lad die DSP_CRK bitte bei uns mal hoch => http://www.trojaner-board.de/54791-a...ner-board.html
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Antivir findet mehrfach "tr/crypt.xpack.gen", is mein PC sauber? |
| adobe, antivir, antivir guard, audials one, avira, bho, bonjour, browseui preloader, converter, desktop, excel, firefox, google, gupdate, hijack, hkus\s-1-5-18, internet, internet explorer, mozilla, outlook express, pdfconverter, plug-in, programm, rundll, senden, software, suchlauf, system, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen', trojan, usb, virus, windows |
Linear-Darstellung
