Probleme mit Popup-Fenstern, Minimirung von Programmen und Lautstärke(Wave)

OTL logfile created on: 13.07.2010 13:25:22 - Run 1
OTL by OldTimer - Version 3.2.9.0     Folder = C:\Dokumente und Einstellungen\Administrator\Desktop\Virus
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 567,00 Mb Available Physical Memory | 55,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 38,28 Gb Total Space | 9,53 Gb Free Space | 24,89% Space Free | Partition Type: NTFS
Drive D: | 1,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 74,53 Gb Total Space | 45,59 Gb Free Space | 61,16% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: XPPC03
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Administrator\Desktop\Virus\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Administrator\Desktop\Virus\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\MSSCRDE.DLL (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (getPlus(R) Helper) getPlus(R) -- C:\Programme\NOS\bin\getPlus_HelperSvc.exe (NOS Microsystems Ltd.)
SRV - (hasplms) -- C:\WINDOWS\System32\hasplms.exe (Aladdin Knowledge Systems Ltd.)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (upperdev) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys File not found
DRV - (fnwwbfwj) -- C:\WINDOWS\System32\01.tmp File not found
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (rt2870) -- C:\WINDOWS\system32\drivers\rt2870.sys (Ralink Technology, Corp.)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (aksfridge) -- C:\WINDOWS\system32\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.)
DRV - (hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (symc8xx) -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_u3) -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com?o=15015&l=dis
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Games Bar 1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2452474&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {bc04b34e-5dd8-465a-a5e0-86f7c11bc009}:2.5.2.14
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {e2c58150-9d72-11dd-ad8b-0800200c9a66}:1.3.1
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2452474&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2452474&q="
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.09 12:48:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.01 18:36:30 | 000,000,000 | ---D | M]
 
[2009.09.01 14:32:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2010.07.13 10:42:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\extensions
[2010.01.02 12:37:02 | 000,000,000 | ---D | M] (Games Bar 1 Toolbar) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\extensions\{bc04b34e-5dd8-465a-a5e0-86f7c11bc009}
[2010.01.02 12:43:01 | 000,000,000 | ---D | M] (Black Steel) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\extensions\{e2c58150-9d72-11dd-ad8b-0800200c9a66}
[2009.11.23 16:17:27 | 000,002,236 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\askcom.xml
[2009.12.31 13:27:40 | 000,000,925 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\conduit.xml
[2010.07.06 22:51:16 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-1.xml
[2010.01.07 22:04:39 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-2.xml
[2010.02.25 14:46:01 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-3.xml
[2010.04.01 21:38:17 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-4.xml
[2010.04.03 04:06:41 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-5.xml
[2010.04.03 15:04:54 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin-6.xml
[2009.12.12 21:03:01 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ttj5god1.default\searchplugins\icqplugin.xml
[2010.07.13 10:42:32 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.09.14 18:26:28 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.04.01 18:36:24 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:36:24 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:36:24 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:36:24 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:36:24 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.08.29 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\ADOBE\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\OFFICE10\OSA.EXE (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains:   ([]msn in Arbeitsplatz)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238670832150 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} Reg Error: Key error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.30 10:08:50 | 000,701,952 | R--- | M] () - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2006.09.30 10:08:50 | 000,000,047 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006.09.30 10:08:22 | 000,003,356 | R--- | M] () - D:\autorun.ini -- [ CDFS ]
O33 - MountPoints2\{2d6a0a94-d901-11de-af88-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{2d6a0a94-d901-11de-af88-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{378c0505-293e-11df-b040-000cf6809d00}\Shell - "" = AutoRun
O33 - MountPoints2\{378c0505-293e-11df-b040-000cf6809d00}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{534e1f7c-d607-11de-af7e-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{534e1f7c-d607-11de-af7e-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{74107caa-a7a4-11de-aeb5-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{74107caa-a7a4-11de-aeb5-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7c9f5e9b-a169-11de-ae9b-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{7c9f5e9b-a169-11de-ae9b-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7c9f5e9c-a169-11de-ae9b-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{7c9f5e9c-a169-11de-ae9b-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9077f6b8-a14b-11de-ae99-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{9077f6b8-a14b-11de-ae99-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{91c32a92-3749-11df-b059-000cf6809d00}\Shell\AutoRun\command - "" = F:\Launcher.exe -- File not found
O33 - MountPoints2\{a7b3a0ee-c14b-11de-af2f-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{a7b3a0ee-c14b-11de-af2f-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{be1ccad3-ef31-11de-afd5-000ea64e7f5b}\Shell - "" = AutoRun
O33 - MountPoints2\{be1ccad3-ef31-11de-afd5-000ea64e7f5b}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.13 12:59:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2010.07.13 12:58:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.07.13 12:58:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.07.13 12:58:48 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.07.13 12:47:49 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Recent
[2010.07.13 12:34:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\Virus
[2010.07.13 10:42:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2010.07.12 23:50:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[2010.07.06 16:54:55 | 185,600,232 | ---- | C] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Administrator\Desktop\anno1701_patch104_ger.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.13 13:19:18 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.13 13:19:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.13 13:17:50 | 007,888,896 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.dat
[2010.07.13 13:17:50 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini
[2010.07.13 12:58:53 | 000,000,534 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.13 12:53:15 | 000,004,718 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\cc_20100713_125306.reg
[2010.07.13 12:51:41 | 004,705,588 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\cc_20100713_125013.reg
[2010.07.13 12:40:49 | 000,000,532 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\CCleaner.lnk
[2010.07.13 10:44:53 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.12 23:47:09 | 002,662,542 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.07.06 17:23:38 | 185,600,232 | ---- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Administrator\Desktop\anno1701_patch104_ger.exe
[2010.07.06 13:11:35 | 000,000,519 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Anno 1701.lnk
[2010.07.06 12:32:30 | 000,000,023 | ---- | M] () -- C:\WINDOWS\BlendSettings.ini
[2010.06.23 14:37:43 | 000,012,735 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\1_peso_cubano_40_aniversario_moncada_reverso_182x180.JPG
[2010.06.22 22:24:42 | 000,002,495 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Word.lnk
[2010.06.19 07:01:54 | 000,078,296 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.06.16 21:25:52 | 000,304,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.16 21:24:13 | 000,000,509 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AK vs DR.lnk
[2010.06.16 19:43:39 | 000,002,523 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Excel.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.13 12:58:53 | 000,000,534 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.13 12:53:13 | 000,004,718 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\cc_20100713_125306.reg
[2010.07.13 12:50:30 | 004,705,588 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\cc_20100713_125013.reg
[2010.07.13 12:40:49 | 000,000,532 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\CCleaner.lnk
[2010.07.11 09:45:15 | 007,888,896 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.dat
[2010.07.06 13:11:35 | 000,000,519 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Anno 1701.lnk
[2010.06.23 14:37:43 | 000,012,735 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\1_peso_cubano_40_aniversario_moncada_reverso_182x180.JPG
[2010.06.16 21:24:13 | 000,000,509 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AK vs DR.lnk
[2010.04.22 17:54:42 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2010.02.22 21:29:08 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010.02.22 21:29:07 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009.08.17 14:09:40 | 000,000,021 | ---- | C] () -- C:\WINDOWS\KurusDeinstall.INI
[2008.10.16 13:47:38 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2008.10.16 13:20:52 | 000,000,021 | ---- | C] () -- C:\WINDOWS\DvInesKurusOleServer003.INI
[2006.11.09 17:25:01 | 000,000,021 | ---- | C] () -- C:\WINDOWS\DvInesKurusOleServer002.INI
[2005.11.24 15:48:40 | 000,000,027 | ---- | C] () -- C:\WINDOWS\VIPZKA.INI
[2005.09.15 16:02:14 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BO2700CN.INI
[2005.09.02 11:36:45 | 000,003,147 | ---- | C] () -- C:\WINDOWS\ANSE32.INI
[2005.07.29 15:16:53 | 000,000,159 | ---- | C] () -- C:\WINDOWS\dvinesinstalllocation001.INI
[2005.07.29 15:16:52 | 000,000,159 | ---- | C] () -- C:\WINDOWS\dvinesinstart001.INI
[2004.09.09 13:20:11 | 000,000,135 | ---- | C] () -- C:\WINDOWS\BoRiWe04.INI
[2004.08.10 10:22:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\winiv.INI
[2004.07.23 15:48:52 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BO5140.INI
[2004.03.16 16:42:56 | 000,003,214 | ---- | C] () -- C:\WINDOWS\WBSH32.INI
[2004.03.12 14:23:08 | 000,000,135 | ---- | C] () -- C:\WINDOWS\BoRiWe02.INI
[2004.02.27 14:58:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mandant.INI
[2004.02.16 10:32:50 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_5050.ini
[2004.02.16 10:13:19 | 000,000,078 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2004.02.13 12:14:03 | 000,000,236 | ---- | C] () -- C:\WINDOWS\brqikmon.ini
[2004.02.13 12:14:03 | 000,000,099 | ---- | C] () -- C:\WINDOWS\opt_2460.ini
[2004.02.13 12:14:03 | 000,000,090 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2004.02.13 12:13:17 | 000,000,547 | ---- | C] () -- C:\WINDOWS\dddwin.ini
[2004.02.13 12:08:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\netop.ini
[2004.02.13 12:00:12 | 000,000,165 | ---- | C] () -- C:\WINDOWS\DEINSTAL.INI
[2004.02.13 11:56:56 | 000,000,077 | ---- | C] () -- C:\WINDOWS\Startup.INI
[2004.02.13 11:55:13 | 000,000,502 | ---- | C] () -- C:\WINDOWS\brwmark.ini
[2004.02.06 09:32:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004.02.06 09:32:00 | 000,002,247 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004.02.06 09:29:59 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004.02.06 08:46:23 | 000,047,226 | ---- | C] () -- C:\WINDOWS\System32\interceptor.sys
[2004.02.06 08:44:20 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004.02.06 08:44:15 | 000,001,110 | ---- | C] () -- C:\WINDOWS\System32\OemInfo.ini
[2004.02.06 08:44:09 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[1999.08.26 15:50:36 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\ddma32.dll
[1998.05.07 14:10:16 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
[1997.09.22 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
[1995.05.19 12:13:00 | 000,005,440 | ---- | C] () -- C:\WINDOWS\System32\WINDVS16.DLL
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:661DFA1C
< End of report >
         

OTL Extras logfile created on: 13.07.2010 13:25:22 - Run 1
OTL by OldTimer - Version 3.2.9.0     Folder = C:\Dokumente und Einstellungen\Administrator\Desktop\Virus
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 567,00 Mb Available Physical Memory | 55,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 38,28 Gb Total Space | 9,53 Gb Free Space | 24,89% Space Free | Partition Type: NTFS
Drive D: | 1,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 74,53 Gb Total Space | 45,59 Gb Free Space | 61,16% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: XPPC03
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1947:TCP" = 1947:TCP:*:Enabled:HASP SRM 
"1947:UDP" = 1947:UDP:*:Enabled:HASP SRM 
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"8651:TCP" = 8651:TCP:*:Enabled:jnsqeq
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\McAfee\Common Framework\FrameworkService.exe" = C:\Programme\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- File not found
"C:\DATEV\PROGRAMM\A0000008\Nhstw32.exe" = C:\DATEV\PROGRAMM\A0000008\Nhstw32.exe:*:Enabled:Nhstw32.exe -- File not found
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\DATEV\PROGRAMM\A0000008\Nhstw32.exe" = C:\DATEV\PROGRAMM\A0000008\nhstw32.exe:*:Enabled:nhstw32.exe -- File not found
"C:\WINDOWS\Temp\KD_installer.exe" = C:\WINDOWS\Temp\KD_installer.exe:*:Enabled:Kabel Deutschland Installer -- (mquadr.at software engineering, hxxp://www.mquadr.at)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\Steam\SteamApps\dudelsak\counter-strike source\hl2.exe" = C:\Programme\Steam\SteamApps\dudelsak\counter-strike source\hl2.exe:*:Disabled:hl2 -- ()
"C:\Programme\Steam\SteamApps\kirbycope\counter-strike source\hl2.exe" = C:\Programme\Steam\SteamApps\kirbycope\counter-strike source\hl2.exe:*:Disabled:hl2 -- ()
"C:\Programme\Steam\SteamApps\kirbycope\day of defeat source\hl2.exe" = C:\Programme\Steam\SteamApps\kirbycope\day of defeat source\hl2.exe:*:Disabled:hl2 -- ()
"C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymedia.exe" = C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymedia.exe:*:Enabled:TwonkyMedia -- File not found
"C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymediaserver.exe" = C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymediaserver.exe:*:Enabled:TwonkyMediaServer -- File not found
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process  -- File not found
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- File not found
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Anno 1701\Anno1701.exe" = C:\Programme\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701 -- File not found
"E:\Anno 1701\Anno1701.exe" = E:\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701 -- (Related Designs Software GmbH)
"E:\PatrizierII\Patrizier 2.exe" = E:\PatrizierII\Patrizier 2.exe:*:Enabled:Patrizier 2 -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
""Truck Tycoon"_is1" = "Truck Tycoon"
"{01155424-B450-348E-C60B-AEE30EC5BD95}" = ccc-core-preinstall
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{0251283C-41B5-556A-8C47-D842E76613EF}" = Catalyst Control Center Localization Thai
"{02952E4C-5109-A630-639E-06E65CA6BD31}" = CCC Help Polish
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{073E6BDE-3AED-6A71-54C6-6756103F1FB8}" = Catalyst Control Center Core Implementation
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0881ECE5-DCA1-462D-B515-F1732875EC74}" = DATEV Infragistics Runtime V.3.2
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0C3353EB-252A-419F-A34E-4546A098847C}" = Microsoft SQL Server Native Client
"{0C714BB7-4CAD-D173-F84C-554F380E285F}" = Catalyst Control Center Localization Norwegian
"{0D106685-166E-0D6D-29B8-E3E8EE9D8BE4}" = Catalyst Control Center Localization Finnish
"{0FE84B98-9821-A472-3E63-A5D7C72A5BEA}" = CCC Help Danish
"{11387B95-F944-45C7-8458-F68010E1EEBF}" = Fish Tycoon
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{15E56370-5490-9534-330A-202CC9CB1A17}" = CCC Help Finnish
"{19459754-1243-9631-7808-568563783168}" = Fish Tycoon
"{2018A250-C32D-2164-C988-937412C1AEED}" = CCC Help English
"{205403B5-6EBC-32AB-F1D5-4BBD635B8211}" = CCC Help Greek
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{247286E7-3966-8A6B-F962-9FB49B193B65}" = Catalyst Control Center Localization Dutch
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{2D7FA997-376C-6870-A0B8-03C1928383DD}" = Catalyst Control Center Localization Swedish
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{354D2902-EBB4-A562-93E2-1CEECB35D1E0}" = Catalyst Control Center Graphics Light
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{3B7B9A55-BE2F-963B-1306-1C8AF4B6BEC5}" = CCC Help German
"{3D5FDC57-3D8C-3CA8-CEE1-64169C48E524}" = Catalyst Control Center Graphics Full Existing
"{3FA604E7-AE4E-08E9-CDB7-CD87A571641A}" = CCC Help Hungarian
"{4136A82D-6AAC-DDD0-AE14-7F26B4E5B5F1}" = CCC Help Norwegian
"{43EAAF27-94B9-4D83-9CC5-C7FDF95FA034}" = Gentleman
"{45C8D564-77BF-CBE5-BC3E-F731C536BC84}" = Skins
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{51356925-C6C8-5999-08D9-5A98C0645E80}" = CCC Help Chinese Traditional
"{56DF30DD-CEC9-06B0-C572-AEA477BD245C}" = CCC Help Spanish
"{57252EEC-6E6E-917B-B02A-F125B7CF0C9E}" = Catalyst Control Center Localization Japanese
"{5C49377D-699C-04F4-F26A-1583F0EB2525}" = CCC Help Italian
"{5C648FDB-0138-4619-B66E-230EF53E8E2C}" = Die Sims™ 2 Teen Style-Accessoires
"{5D3541C3-0A67-2587-360B-67ADD2A35491}" = ccc-utility
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{627FCE23-DC14-2D59-5449-5AACDDA59CDD}" = CCC Help Korean
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires
"{69A78876-1C3E-6F0A-BDEC-C09D5F302BC0}" = CCC Help French
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DCEF478-2917-F4DF-3265-8447E3DBB5B3}" = Catalyst Control Center Localization French
"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution
"{6E17F9751-F056-4335-B718-8AF1B1092AFB}" = Die Sims™ 2 IKEA® Home-Accessoires
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{714A15CA-8BA4-F6C9-D8FF-B28CE631BE8F}" = CCC Help Chinese Standard
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{7707CB13-8F15-36E2-9579-93F34838CE24}" = Catalyst Control Center Localization Polish
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B35C1CE-695E-D663-3F1E-0AA176C0D4C5}" = Catalyst Control Center Localization Greek
"{7DA669BD-1642-AD33-7377-4535BFB1BCE4}" = CCC Help Swedish
"{7E32F9DB-A6FC-5091-5533-2A061C2A2FC2}" = ccc-core-static
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = Die Sims™ 2 H&M®-Fashion-Accessoires
"{84F994E5-1565-06BB-171A-71AB7626E63B}" = CCC Help Portuguese
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{90DEF45B-F2BD-4451-A896-49257D1C0069}" = CleanBoot
"{91130407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95D1FD8D-9209-4C68-B7E4-95536D21BBD1}" = AK vs DR
"{992968F7-248A-1D5D-7FB5-BD6D5B953215}" = Catalyst Control Center Graphics Full New
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = Die Sims™ 2: Glamour-Accessoires
"{9D9D12DF-3EDB-A01A-F843-C613681467F8}" = Catalyst Control Center Localization Hungarian
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A161C3C9-BEA6-A806-D77F-81E018CA5D67}" = Catalyst Control Center Localization Italian
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3C177CE-97E1-6F90-D389-BD951A9FB81B}" = Catalyst Control Center Localization German
"{A654CDEB-F7A7-3CAC-0D17-94B66CCCAE59}" = Catalyst Control Center Localization Chinese Standard
"{A7709081-CE4E-4339-A727-F88E648F92FA}_is1" = Oblivion Improved 1.41
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AEAAA92E-9A5D-DF42-5FDD-74D545DAA7BA}" = CCC Help Thai
"{B5025AC2-F3AE-29F5-5A0E-CFC89B634958}" = Catalyst Control Center Localization Portuguese
"{B66C315A-2D08-9FDB-F655-DC331E97141B}" = CCC Help Dutch
"{B838DCFC-3490-263C-0FFE-50C8B306FC8D}" = Catalyst Control Center Localization Russian
"{BA040794-A600-8C78-D72F-1B4797C01472}" = CCC Help Japanese
"{BA05CD9C-59FF-B4FE-0544-855F0982D0A4}" = Catalyst Control Center Localization Danish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C67A4B20-E47F-4CF1-5522-98899F9A529A}" = Catalyst Control Center Localization Turkish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE453374-9697-4043-D2B2-16C41D906641}" = CCC Help Czech
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus(R) for Adobe
"{D57FF9F2-E6A1-6E10-16F0-58B676F6DE3C}" = Catalyst Control Center Localization Korean
"{DC550B90-A58E-6964-298D-18CF7DF550CD}" = CCC Help Turkish
"{DC8B50E5-AE03-EF2A-044F-9C1A2ED92BD1}" = Catalyst Control Center Graphics Previews Common
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E09F11E0-7E27-640C-ADB9-8B2F7CA19470}" = CCC Help Russian
"{E1352FB0-944D-68D4-1B08-35AB82CFD5CB}" = Catalyst Control Center Localization Czech
"{E5BD02EF-36F1-478F-88B2-D3990C62C2CB}" = SQLXML4
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EAA38532-7AD0-4f78-918A-4F4F02096ECE}" = Die Sims™ 2 Party-Accessoires
"{EB7A2041-6A16-4BAC-8079-43B985673C2C}" = Avery Zweckform Assistent 3.1
"{EC440285-203B-4535-AB8E-E781A697F253}" = DATEV Framework Library V.0.9
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = Die Sims™ 2 Gute Reise
"{F4A7123B-E1CB-97DD-D4CC-31BF6936DC82}" = Catalyst Control Center Localization Chinese Traditional
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F81415D2-CEC9-4F96-9ABA-B2CC5382A930}" = SweetIM for Messenger 3.0
"{F8F2008B-9CFC-B7A2-087C-26D7856D10C0}" = Catalyst Control Center Localization Spanish
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"EA0D8F08C10A625644188FE542C75305CB084120" = Windows-Treiberpaket - Ralink Technology, Corp. (rt2870) Net  (10/29/2008 1.02.04.0000)
"ICQToolbar" = ICQ Toolbar
"InstallShield_{EB7A2041-6A16-4BAC-8079-43B985673C2C}" = Avery Zweckform Assistent 3.1
"Java Web Start" = Java Web Start
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Patrizier II Gold_is1" = Patrizier II Gold
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"REHADAT-Elan 2007_is1" = REHADAT-Elan 2007
"Uninstall_is1" = Uninstall 1.0.0.1
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"WORDVIEW" = Microsoft Word Viewer
"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 18.05.2010 13:29:53 | Computer Name = XPPC03 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung gta_sa.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul gta_sa.exe, Version 0.0.0.0, Fehleradresse 0x003489ab.
 
Error - 24.05.2010 07:27:18 | Computer Name = XPPC03 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung gta_sa.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x6567696c.
 
Error - 24.05.2010 08:41:58 | Computer Name = XPPC03 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung gta_sa.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x6567696c.
 
Error - 01.07.2010 09:27:41 | Computer Name = XPPC03 | Source = ESENT | ID = 490
Description = svchost (1180) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 01.07.2010 09:27:41 | Computer Name = XPPC03 | Source = ESENT | ID = 470
Description = Catalog Database (1180) Datenbank C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
 wurde teilweise angehängt. Anhängungsstufe: 3. Fehler: -1032.
 
Error - 11.07.2010 03:24:09 | Computer Name = XPPC03 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.07.2010 03:24:09 | Computer Name = XPPC03 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.07.2010 03:24:11 | Computer Name = XPPC03 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.07.2010 05:43:18 | Computer Name = XPPC03 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.07.2010 05:43:18 | Computer Name = XPPC03 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
[ System Events ]
Error - 11.07.2010 13:59:27 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 12.07.2010 07:02:05 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 12.07.2010 17:49:58 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 13.07.2010 03:59:37 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 13.07.2010 04:46:05 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 13.07.2010 05:47:53 | Computer Name = XPPC03 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "wuauserv"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error - 13.07.2010 05:47:53 | Computer Name = XPPC03 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "wuauserv"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error - 13.07.2010 06:11:00 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
Error - 13.07.2010 07:19:36 | Computer Name = XPPC03 | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 13.07.2010 07:20:34 | Computer Name = XPPC03 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Center System" wurde mit folgendem Fehler beendet:   %%126
 
 
< End of report >