Hallo an alle.

Ich habe folgendes, in diesem Forum schon häufiger diskutiertesm, Problem.
Seit einiger Zeit öffnen sich auf meinm PC selbstständig Werbe-Popups im Internet-Explorer (obwohl FireFox mein Standardbrowser ist).
Weiterhin regelt sich meine Wave-Lautstärke automatisch auf 0, nach anklicken des Wave-Lautstärkereglers höre ich dann aber wieder was. Das hält dann aber auch immer nur für 5 min, dann habe ich das gleiche Problem.
Außerdem geht der Focus des Öfteren verloren, d.h. wenn ich zum Beispiel in Word etwas schreibe, ist der Focus auf einmal weg und ich muss wieder neu ins Dokument klicken um weiterschreiben zu können.

Ich habe darüber schon einiges gelesen und habe, wie anscheinend üblich, den CCleaner durchlaufen lassen, dann den Malwarebytes-Anti-Malware, dessen report hier zu sehen ist:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4325

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

7/19/2010 2:23:34 PM
mbam-log-2010-07-19 (14-23-34).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 238579
Laufzeit: 15 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
         

Außerdem hab ich noch OTL - Systemscan durchlaufen lassen, dessen zwei logfiles hier zu sehen sind.

OTL logfile created on: 7/19/2010 2:42:10 PM - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\andre\Desktop\find virus
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: Vereinigte Staaten von Amerika | Language: ENU | Date Format: M/d/yyyy
 
1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 34.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 43.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 34.42 Gb Total Space | 1.32 Gb Free Space | 3.85% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 5.11 Gb Total Space | 2.65 Gb Free Space | 51.84% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: GRACE2
Current User Name: andre
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\andre\Desktop\find virus\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WATCOM\binnt\ide.exe ()
PRC - C:\WATCOM\binnt\batserv.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\agent.exe (Macrovision Corporation)
PRC - c:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
PRC - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - C:\Programme\Network Associates\VirusScan\Mcshield.exe (Network Associates, Inc.)
PRC - C:\Programme\Network Associates\VirusScan\shstat.exe (Network Associates, Inc.)
PRC - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)
PRC - C:\Programme\Network Associates\Common Framework\naPrdMgr.exe (Network Associates, Inc.)
PRC - C:\Programme\Network Associates\Common Framework\UpdaterUI.exe (Network Associates, Inc.)
PRC - C:\Programme\Network Associates\Common Framework\FrameworkService.exe (Network Associates, Inc.)
PRC - c:\Programme\MATLAB7\bin\win32\MATLAB.exe (The MathWorks Inc.)
PRC - C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Programme\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
PRC - C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe (Network Associates, Inc.)
PRC - C:\Programme\TextPad 4\TextPad.exe (Helios Software Solutions)
PRC - C:\Programme\F-Secure\ssh server\fsshd2.exe (F-Secure Corporation)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
PRC - C:\Programme\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\andre\Desktop\find virus\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (WMConnectCDS) -- C:\Programme\Windows Media Connect 2\wmccds.exe (Microsoft Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (McShield) -- C:\Programme\Network Associates\VirusScan\Mcshield.exe (Network Associates, Inc.)
SRV - (McTaskManager) -- C:\Programme\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)
SRV - (McAfeeFramework) -- C:\Programme\Network Associates\Common Framework\FrameworkService.exe (Network Associates, Inc.)
SRV - (PsShutdownSvc) -- C:\WINDOWS\system32\PSSDNSVC.EXE ()
SRV - (matlabserver) -- C:\Programme\MATLAB7\webserver\bin\win32\matlabserver.exe ()
SRV - (AdobeVersionCue) -- C:\Programme\Adobe\Adobe Version Cue\service\VersionCue.exe (Adobe Sytems)
SRV - (F-Secure SSH Server) -- C:\Programme\F-Secure\ssh server\fsshd2.exe (F-Secure Corporation)
SRV - (DVD-RAM_Service) -- C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ulisa) Telekom ISDN-Adapter (USB) -- C:\WINDOWS\System32\Drivers\ulisa.sys File not found
DRV - (dtwmnic5) -- C:\WINDOWS\System32\DRIVERS\dtwmnic5.sys File not found
DRV - (DETEWECP) -- C:\WINDOWS\System32\drivers\detewecp.sys File not found
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (s117obex) -- C:\WINDOWS\system32\drivers\s117obex.sys (MCCI Corporation)
DRV - (s117mdm) -- C:\WINDOWS\system32\drivers\s117mdm.sys (MCCI Corporation)
DRV - (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s117mgmt.sys (MCCI Corporation)
DRV - (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM) -- C:\WINDOWS\system32\drivers\s117unic.sys (MCCI Corporation)
DRV - (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS) -- C:\WINDOWS\system32\drivers\s117nd5.sys (MCCI Corporation)
DRV - (s117mdfl) -- C:\WINDOWS\system32\drivers\s117mdfl.sys (MCCI Corporation)
DRV - (s117bus) Sony Ericsson Device 117 driver (WDM) -- C:\WINDOWS\system32\drivers\s117bus.sys (MCCI Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (NaiAvFilter1) -- C:\WINDOWS\system32\drivers\naiavf5x.sys (Network Associates, Inc.)
DRV - (NaiAvTdi1) -- C:\WINDOWS\system32\drivers\mvstdi5x.sys (Network Associates, Inc.)
DRV - (EntDrv51) -- C:\WINDOWS\system32\drivers\EntDrv51.sys (Network Associates, Inc)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (meiudf) -- C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (ElbyDelay) -- C:\WINDOWS\system32\drivers\ElbyDelay.sys (Elaborate Bytes)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://www.google.com/ie
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/08/20 10:11:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010/07/19 12:33:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010/07/19 12:33:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010/03/17 16:21:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2009/12/09 16:05:32 | 000,000,000 | ---D | M]
 
[2008/09/11 09:59:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\andre\Anwendungsdaten\Mozilla\Extensions
[2010/07/19 12:43:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\andre\Anwendungsdaten\Mozilla\Firefox\Profiles\tl9ze13e.default\extensions
[2009/10/08 15:02:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\andre\Anwendungsdaten\Mozilla\Firefox\Profiles\tl9ze13e.default\extensions\moveplayer@movenetworks.com
[2010/07/19 12:38:54 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010/07/19 12:33:49 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010/07/19 12:33:49 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010/07/19 12:33:49 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010/07/19 12:33:50 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010/07/19 12:33:50 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001/08/18 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No CLSID value found.
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeVersionCue] C:\Programme\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
O4 - HKLM..\Run: [CloneDVDElbyDelay] C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [ISUSPM Startup] c:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\Network Associates\Common Framework\UpdaterUI.exe (Network Associates, Inc.)
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Network Associates Error Reporting Service] C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe (Network Associates, Inc.)
O4 - HKLM..\Run: [ShStatEXE] C:\Programme\Network Associates\VirusScan\SHSTAT.EXE (Network Associates, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\andre\Startmenü\Programme\Autostart\OpenOffice.org 3.0.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {1F831FA3-42FC-11D4-95A6-0080AD30DCE1} f**e://C:\Programme\AutoCAD 2002 Deu\InstFred.ocx (InstaFred)
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} f**e://D:\components\hidinputmonitorx.ocx (HidInputMonitorX Control)
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} f**e://D:\components\A9.ocx (A9Helper.A9)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} h**p://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121244606218 (WUWebControl Class)
O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} f**e://D:\components\wmvhdrating.ocx (WMVHDRatingCtrl Class)
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} f**e://C:\Programme\AutoCAD 2002 Deu\AcDcToday.ocx (AcDcToday-Steuerung)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} h**p://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38113.2871759259 (Reg Error: Key error.)
O16 - DPF: {AE563724-B4F5-11D4-A415-00108302FDFD} f**e://C:\Programme\AutoCAD 2002 Deu\InstBanr.ocx (NOXLATE-BANR)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} h**p://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} f**e://C:\Programme\AutoCAD 2002 Deu\AcPreview.ocx (AcPreview-Steuerung)
O16 - DPF: DirectAnimation Java Classes f**e://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java f**e://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 130.149.4.20 130.149.2.12
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Programme\Microsoft ActiveSync\aatp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\andre\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\andre\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/05/06 14:39:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010/07/19 14:06:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\andre\Anwendungsdaten\Malwarebytes
[2010/07/19 14:06:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/19 14:06:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010/07/19 14:06:27 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/19 14:06:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010/07/19 13:55:42 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\andre\Recent
[2010/07/19 13:47:19 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010/07/19 13:45:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\andre\Desktop\find virus
[2010/07/19 10:18:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\F0856D1B11EE46528174EAF3D5AB6C66.TMP
[2010/07/19 10:11:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\andre\Anwendungsdaten\FileZilla
[2010/07/13 15:19:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2010/07/01 12:32:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\andre\Desktop\resi geb
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010/07/19 13:47:21 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\CCleaner.lnk
[2010/07/19 13:01:11 | 006,029,312 | -H-- | M] () -- C:\Dokumente und Einstellungen\andre\NTUSER.DAT
[2010/07/19 12:54:22 | 000,478,504 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\bootkit_remover.rar
[2010/07/19 10:55:15 | 000,785,643 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\Kinas-15072010073446.JPG
[2010/07/19 10:53:55 | 000,148,041 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\Kinas-15072010073446.tif
[2010/07/19 10:33:36 | 000,000,512 | ---- | M] () -- C:\WINDOWS\randseed.rnd
[2010/07/19 09:43:41 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/19 09:42:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/19 09:42:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/19 09:40:02 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\andre\ntuser.ini
[2010/07/19 09:36:43 | 001,578,480 | -H-- | M] () -- C:\Dokumente und Einstellungen\andre\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010/07/13 19:07:15 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/13 16:25:08 | 000,141,824 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\SpecMod.exe
[2010/07/13 14:47:03 | 001,053,728 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\KOEFFTMP
[2010/07/13 11:09:25 | 000,158,104 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\h&m.JPG
[2010/07/13 10:45:01 | 000,152,967 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava-geoid.pdf
[2010/07/13 10:17:42 | 000,502,347 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava-geoid.ps
[2010/07/12 15:26:53 | 000,008,652 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\GMTgui.form
[2010/07/07 10:42:54 | 002,073,600 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava.RUN
[2010/07/06 15:44:40 | 000,000,719 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\SpecresParameter.INP
[2010/07/05 12:07:01 | 000,528,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/01 16:17:03 | 000,144,424 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010/07/01 16:11:23 | 000,026,943 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\308.zip
[2010/07/01 14:19:44 | 000,080,503 | ---- | M] () -- C:\WINDOWS\FontData.fdb
[2010/06/24 12:30:13 | 000,000,947 | ---- | M] () -- C:\Dokumente und Einstellungen\andre\Desktop\KErdeParameter.INP
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010/07/19 13:47:21 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\CCleaner.lnk
[2010/07/19 12:54:18 | 000,478,504 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\bootkit_remover.rar
[2010/07/19 10:55:13 | 000,785,643 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\Kinas-15072010073446.JPG
[2010/07/19 10:52:57 | 000,148,041 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\Kinas-15072010073446.tif
[2010/07/13 14:37:14 | 001,053,728 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\KOEFFTMP
[2010/07/13 11:09:25 | 000,158,104 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\h&m.JPG
[2010/07/13 10:45:01 | 000,152,967 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava-geoid.pdf
[2010/07/13 10:17:41 | 000,502,347 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava-geoid.ps
[2010/07/12 16:43:07 | 002,073,600 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\ergJava.RUN
[2010/07/12 15:26:53 | 000,008,652 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\GMTgui.form
[2010/07/06 13:15:12 | 000,000,719 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\SpecresParameter.INP
[2010/07/06 12:22:33 | 000,141,824 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\SpecMod.exe
[2010/07/01 16:14:48 | 000,023,116 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\Barbie Medium.ttf
[2010/07/01 16:14:48 | 000,021,456 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\Barbie MediumItalic.ttf
[2010/07/01 16:11:21 | 000,026,943 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\308.zip
[2010/06/24 12:27:21 | 000,000,947 | ---- | C] () -- C:\Dokumente und Einstellungen\andre\Desktop\KErdeParameter.INP
[2008/09/10 13:49:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Import71.INI
[2007/07/18 09:31:06 | 000,000,138 | ---- | C] () -- C:\WINDOWS\asym.ini
[2007/03/26 11:49:54 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
[2007/01/23 11:16:16 | 000,000,669 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/10/09 20:14:56 | 000,000,325 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2006/08/21 15:45:00 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\hppapr04.dll
[2006/01/23 17:57:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\KMTIGBC.dll
[2006/01/23 17:57:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\KMTIGSN.dll
[2006/01/23 17:57:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\KMTIGBD.dll
[2004/09/29 14:01:45 | 000,001,016 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2004/09/10 15:49:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/08/27 09:52:41 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WINPHONE.INI
[2004/08/19 16:35:34 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5x.DLL
[2004/08/19 16:28:59 | 000,000,642 | ---- | C] () -- C:\WINDOWS\JCNETDEL.INI
[2004/08/19 16:28:56 | 000,002,268 | ---- | C] () -- C:\WINDOWS\DELJCNET.INI
[2004/08/19 15:45:57 | 000,000,017 | ---- | C] () -- C:\WINDOWS\PRI_SEEK.INI
[2004/05/11 15:23:30 | 000,000,005 | ---- | C] () -- C:\WINDOWS\mltconfip.ini
[2004/05/11 15:23:28 | 000,000,005 | ---- | C] () -- C:\WINDOWS\mltconfipx.ini
[2004/05/10 12:24:21 | 000,000,157 | ---- | C] () -- C:\WINDOWS\matlab.ini
[2004/05/07 18:04:06 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/05/07 15:48:03 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\FTPStubInstUtils.dll
[2004/05/07 15:19:39 | 000,007,550 | ---- | C] () -- C:\WINDOWS\uedit32.INI
[2004/05/07 11:17:09 | 000,416,192 | ---- | C] () -- C:\WINDOWS\System32\f90SQLLF95.dll
[2004/05/07 11:17:09 | 000,159,232 | ---- | C] () -- C:\WINDOWS\System32\glut32.dll
[2004/05/06 16:26:39 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/04/02 13:01:22 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\HPB1320V.DLL
[2002/05/03 16:40:32 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL
[2002/03/21 15:39:02 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002/03/20 22:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
[2000/09/19 01:50:28 | 000,202,752 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[1997/06/25 15:24:16 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\RegObj.dll
< End of report >
         

und

OTL Extras logfile created on: 7/19/2010 2:42:10 PM - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\andre\Desktop\find virus
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: Vereinigte Staaten von Amerika | Language: ENU | Date Format: M/d/yyyy
 
1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 34.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 43.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 34.42 Gb Total Space | 1.32 Gb Free Space | 3.85% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 5.11 Gb Total Space | 2.65 Gb Free Space | 51.84% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: GRACE2
Current User Name: andre
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\Programme\ACD Systems\ACDSee\6.0\ACDSee6.exe" "%1" (ACD Systems Ltd.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft ActiveSync\wcescomm.exe" = C:\Programme\Microsoft ActiveSync\wcescomm.exe:*:Disabled:Connection Manager -- (Microsoft Corporation)
"C:\Programme\Telekom\T-Eumex 520PC\HNetCtrl.exe" = C:\Programme\Telekom\T-Eumex 520PC\HNetCtrl.exe:*:Disabled:HomeNetCtrl -- File not found
"C:\Programme\MATLAB7\bin\win32\MATLAB.exe" = C:\Programme\MATLAB7\bin\win32\MATLAB.exe:*:Disabled:MATLAB -- (The MathWorks Inc.)
"C:\Programme\FileZilla Client\filezilla.exe" = C:\Programme\FileZilla Client\filezilla.exe:*:Enabled:FileZilla FTP Client -- (FileZilla Project)
"C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE" = C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE:*:Disabled:Microsoft Office Excel -- File not found
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\Microsoft Office\OFFICE11\POWERPNT.EXE" = C:\Programme\Microsoft Office\OFFICE11\POWERPNT.EXE:*:Enabled:Microsoft Office PowerPoint -- File not found
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE" = C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE:*:Enabled:Microsoft Office Word -- File not found
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jdk1.6.0_16\bin\java.exe" = C:\Programme\Java\jdk1.6.0_16\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{08094E03-AFE4-4853-9D31-6D0743DF5328}" = QuickTime
"{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}" = Java DB 10.2.2.0
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1B399A41-C1D0-40A2-9E4F-095868EFAF01}" = InterVideo WinDVD Platinum 5
"{1D2A3EDF-47E0-4E78-A32F-25E68FDC2E4B}" = Bubble Struggle 1.2
"{1F34839E-4826-4B64-B1B3-42E5AE8DEC5A}" = ArcGIS Desktop
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 3.205.00
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0160030}" = Java(TM) SE Development Kit 6 Update 3
"{32A3A4F4-B792-11D6-A78A-00B0D0160160}" = Java(TM) SE Development Kit 6 Update 16
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{362882AE-E40A-4435-B214-6420634C401F}" = Microsoft Visual C++ Toolkit 2003
"{38A0BB97-772D-422E-BCCA-4BA2A5D81F42}" = ACDSee 6.0 PowerPack
"{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}" = Google Earth
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{5783F2D7-0101-0407-0002-0060B0CE6BBA}" = AutoCAD 2002 - Deutsch
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8B4AE751-7055-4518-87B0-E148A8D50D0A}" = Macromedia FreeHand MX
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{926C96FB-9D0A-4504-8000-C6D3A4A3118E}" = Java DB 10.4.2.1
"{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM-Treiber
"{A0ABA7E5-2F4B-49ED-9BC1-2CF38C3ECAF2}" = KONICA MINOLTA PageScope Network Setup
"{A267A14C-6FDA-41A1-8B22-50A5D1E4444E}" = Mathematica 5
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-0000-7EC8-7489-000000000603}" = Adobe Acrobat and Reader 6.0.3 Update
"{AC76BA86-0000-7EC8-7489-000000000604}" = Adobe Acrobat and Reader 6.0.4 Update
"{AC76BA86-0000-7EC8-7489-000000000605}" = Adobe Acrobat and Reader 6.0.5 Update
"{AC76BA86-0000-7EC8-7489-000000000606}" = Adobe Acrobat and Reader 6.0.6 Update
"{AC76BA86-1033-F400-7760-000000000001}" = Adobe Acrobat 6.0.1 Professional - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{B510A987-487E-4C66-9F4F-D386AC275715}" = TextPad 4.7
"{C7F2C9FA-95C1-4FE4-BA0A-ADED2C8F6B8A}" = MATLAB Component Runtime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
"{D6E57B14-1B73-447E-A993-617CB5BE0EBF}" = X-Win32 5.2
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0856D1B-11EE-4652-8174-EAF3D5AB6C66}" = McAfee VirusScan Enterprise
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AFPL Ghostscript 8.14" = AFPL Ghostscript 8.14
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"Chikrii SoftLab Word2TeX" = Chikrii SoftLab Word2TeX
"CloneDVD" = CloneDVD
"Dia" = Dia (nur entfernen)
"DSMT5" = MathType 5
"DVDGenie" = DVD Genie (remove only)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ET GeoWizards 9.8" = ET GeoWizards 9.8
"FileZilla Client" = FileZilla Client 3.0.3
"F-Secure SSH Client" = F-Secure SSH Client
"F-Secure SSH Server" = F-Secure SSH Server
"Google Updater" = Google Updater
"GSview 4.6" = GSview 4.6
"InstallShield_{A267A14C-6FDA-41A1-8B22-50A5D1E4444E}" = Mathematica 5
"Lahey/Fujitsu Fortran 95 v5.6" = Lahey/Fujitsu Fortran 95 v5.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR14" = MATLAB Family of Products Release 14
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"MiKTeX 2.7" = MiKTeX 2.7
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"nbi-glassfish-mod-sun-3.0.0.28.20090708" = Sun GlassFish Enterprise Server v3 Prelude
"nbi-nb-base-6.7.1.0.0" = NetBeans IDE 6.7.1
"nbi-sjsas-2.1.60.20090309.0" = Sun GlassFish Enterprise Server v2.1
"Nero - Burning Rom!UninstallKey" = Ahead Nero Burning ROM
"PRICOM-Print CX" = PRICOM-Print CX
"PSPad editor_is1" = PSPad editor
"Python 2.4.1" = Python 2.4.1
"RealPlayer 6.0" = RealPlayer
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TeXnicCenter_is1" = TeXnicCenter Version 1 Beta 7.01 (Greengrass)
"Totalcmd" = Total Commander (Remove or Repair)
"UniTrans 1.2" = UniTrans 1.2
"Volo View Express" = Volo View Express
"WGA" = Windows Genuine Advantage Validation Tool
"Winamp" = Winamp
"Windows CE Services" = Microsoft ActiveSync 3.1
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinEdt" = WinEdt
"WinRAR archiver" = WinRAR Archivierer
"WinZip" = WinZip
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"WS_FTP Pro" = Ipswitch WS_FTP Pro
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"DialogDemo" = DialogDemo
"DocumentEventDemo" = DocumentEventDemo
"JWSFileChooserDemo" = JWSFileChooserDemo
"ListDemo" = ListDemo
"ListDialogRunner" = ListDialogRunner
"MouseEventDemo" = MouseEventDemo
"MouseMotionEventDemo" = MouseMotionEventDemo
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 7/12/2007 6:10:02 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 7/18/2007 3:28:02 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 7/23/2007 4:01:33 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 7/30/2007 3:59:24 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 8/2/2007 6:04:20 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 8/27/2007 4:17:21 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 8/28/2007 7:03:01 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 9/20/2007 7:03:48 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 9/24/2007 8:44:08 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
Error - 9/28/2007 4:56:41 AM | Computer Name = GRACE2 | Source = matlabserver | ID = 0
Description = 
 
[ System Events ]
Error - 7/5/2010 1:21:49 PM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/6/2010 12:01:43 PM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/9/2010 9:25:49 AM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/11/2010 2:39:50 PM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/12/2010 10:09:42 AM | Computer Name = GRACE2 | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "SNIPER" unter Verwendung eines beliebigen,
 konfigurierten   Protokolls keine Daten austauschen.
 
Error - 7/12/2010 11:04:52 AM | Computer Name = GRACE2 | Source = Print | ID = 6161
Description = 
 
Error - 7/14/2010 8:13:29 AM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/14/2010 8:19:30 AM | Computer Name = GRACE2 | Source = TermServDevices | ID = 1111
Description = Der für den Drucker Microsoft XPS Document Writer erforderliche Treiber
 Microsoft XPS Document Writer ist unbekannt. Wenden Sie sich an den Administrator,
 um den Treiber zu installieren, bevor Sie sich erneut anmelden.
 
Error - 7/19/2010 3:37:44 AM | Computer Name = GRACE2 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 7/19/2010 3:46:24 AM | Computer Name = GRACE2 | Source = Service Control Manager | ID = 7034
Description = Dienst "MATLAB Server" wurde unerwartet beendet. Dies ist bereits 
1 Mal passiert.
 
 
< End of report >
         

wenn ich mich jetzt richtig belesen habe, müsste ich nun remove.exe ausführen und das Ergebnis hier posten, oder?! Wäre sehr dankbar über eure Hilfe.

danke schonmal
gruß andré

bitte
esage lab - resources
herunterladen.
entpacke das archiv in einen eigenen ordner.
doppelklick in dem ordner auf remove.exe.
Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im
MBR suchen.
poste das ergebniss

WOW, das geht aber schnell hier. Super!!

alles klar....das habe ich gemacht und habe folgende Nachricht erhalten:

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: b19ee33a0168d5f0bb9afbe12e2bc035
\\.\E: -> \\.\PhysicalDrive0

     Size  Device Name          MBR Status
 --------------------------------------------
    76 GB  \\.\PhysicalDrive0   Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Press any key to quit...
         

jetzt muss ich etwas in die eingabeaufforderung eingeben, doch was?

start ausführen, cmd.exe
enter
START remover.exe fix \\.\PhysicalDrive0
enter
remover.exe sollte den mbr erneuern, wenn nicht, die remover.exe nach c:\windows\system32
kopieren und noch mal
wenn remover.exe fertig ist, tippe
exit
enter
pc neu sgtart, remover.exe ausführen, ergebniss posten.

hab ich gemacht und ich glaube es sieht jetzt ganz gut aus... hier mal der code:

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd
\\.\E: -> \\.\PhysicalDrive0

     Size  Device Name          MBR Status
 --------------------------------------------
    76 GB  \\.\PhysicalDrive0   OK (DOS/Win32 Boot code found)


Press any key to quit...
         

ist jetzt noch etwas zu tun, oder ist mein pc "geheilt"? bis jetzt sind die oben beschriebenen probleme auch noch nicht wieder aufgetreten!

gruß
andré

spiele das servicepack 3 und den internet explorer 8 über die windows update auf, poste dann ein neues otl log. otl.txt reicht dafür

alles klar...das schaffe ich heute leider nicht mehr, da es sich um einen arbeitsrechner handelt, also mach ich es morgen und poste dann die entsprechende datei...

aber erstmal vielen dank für die schnelle und sehr kompetente hilfe

gruß
andré