syscheckrt.exe

Logfile of HijackThis v1.99.1
Scan saved at 09:22:30, on 11.02.2011
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)

Running processes:
E:\Downloads\Diagnose&Security\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Programme\ATI Catalyst\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe Acrobat\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [syscheckrt.exe] C:\syscheckrt\syscheckrt.exe
O4 - Startup: Dropbox.lnk = lutz\AppData\Roaming\Dropbox\bin\Dropbox.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix: 
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing)
         

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5739

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11.02.2011 10:18:48
mbam-log-2011-02-11 (10-18-48).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Durchsuchte Objekte: 475094
Laufzeit: 31 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles (PUM.Disable.Recycle) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\lutz\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\1GLIHW4L\az3[1].exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\lutz\AppData\Local\Temp\9480.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
e:\downloads\Internet\mIRC\mirc612.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
e:\downloads\Tools\ventrilo-2.1.4.exe (Trojan.Dropper) -> Not selected for removal.
e:\Lutz\Fun\neu\fr029\fr029.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
         

OTL logfile created on: 11.02.2011 10:27:06 - Run 1
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Users\lutz\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 69,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 29,20 Gb Total Space | 6,50 Gb Free Space | 22,24% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 180,78 Gb Free Space | 92,56% Space Free | Partition Type: NTFS
Drive E: | 195,31 Gb Total Space | 68,03 Gb Free Space | 34,83% Space Free | Partition Type: NTFS
Drive F: | 177,31 Gb Total Space | 82,75 Gb Free Space | 46,67% Space Free | Partition Type: NTFS
Drive G: | 144,29 Gb Total Space | 129,24 Gb Free Space | 89,57% Space Free | Partition Type: NTFS
 
Computer Name: DESKTOP | User Name: lutz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\lutz\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\lutz\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\lutz\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirService) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (LBTServ) -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (arusb_win7x) -- C:\Windows\SysNative\drivers\arusb_win7x.sys (Atheros Communications, Inc.)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
 
 
 
 
IE - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F1 10 74 69 7D 4F CB 01  [binary data]
IE - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {455D905A-D37C-4643-A9E2-F6FEFAA0424A}:0.8.14
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {E19DF523-EFFD-48d2-95A2-883CB3BA32A4}:1.6.0.7
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: D:\Programme\Mozilla Firefox\components [2010.12.10 23:22:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2011.02.11 09:45:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Components: D:\Programme\Mozilla Thunderbird\components [2010.12.09 21:13:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Plugins: D:\Programme\Mozilla Thunderbird\plugins
 
[2010.02.19 21:17:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lutz\AppData\Roaming\mozilla\Extensions
[2010.02.19 21:17:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lutz\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.02.11 09:40:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions
[2010.03.26 21:43:58 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2011.01.27 21:47:07 | 000,000,000 | ---D | M] (RefControl) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}
[2011.01.11 15:25:42 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.01.03 02:35:58 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.21 17:41:24 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010.07.21 17:08:55 | 000,000,000 | ---D | M] (QuietUrl) -- C:\Users\lutz\AppData\Roaming\mozilla\Firefox\Profiles\f49uujz8.default\extensions\{E19DF523-EFFD-48d2-95A2-883CB3BA32A4}
[2010.03.24 16:16:03 | 000,001,959 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\lastfm.xml
[2011.01.31 12:28:22 | 000,001,872 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\musicbrainz-release-indexed.xml
[2011.02.09 14:42:35 | 000,001,840 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\score11-filmsuche.xml
[2010.03.24 16:09:58 | 000,000,888 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\torrentsto.xml
[2010.03.24 16:03:37 | 000,001,330 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\wikipedia-en.xml
[2010.03.24 16:17:06 | 000,002,057 | ---- | M] () -- C:\Users\lutz\AppData\Roaming\Mozilla\Firefox\Profiles\f49uujz8.default\searchplugins\youtube-video-search.xml
[2010.02.19 20:52:36 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] D:\Programme\Adobe Acrobat\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [StartCCC] D:\Programme\ATI Catalyst\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found
O4 - Startup: C:\Users\lutz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\lutz\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecycleFiles = 0
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.02.11 09:33:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.02.11 09:33:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.02.09 16:08:22 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\lutz\Desktop\OTL.exe
[2011.02.09 16:08:03 | 000,000,000 | ---D | C] -- C:\Users\lutz\AppData\Roaming\Malwarebytes
[2011.02.09 16:07:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.02.09 16:07:31 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.02.08 22:32:32 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011.02.08 22:32:31 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.02.08 22:32:31 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011.02.08 22:32:31 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.02.08 22:32:31 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011.02.08 22:32:31 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.02.08 22:32:31 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.02.08 22:32:31 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.02.08 22:32:31 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011.02.08 22:32:31 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011.02.08 22:32:30 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011.02.08 22:32:30 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011.02.08 22:32:30 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011.02.08 22:32:30 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011.02.08 22:32:21 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011.02.08 22:32:21 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2011.02.08 22:32:20 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011.02.08 22:32:19 | 005,510,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2011.02.08 22:32:19 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2011.02.08 22:32:19 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2011.02.08 22:32:19 | 001,739,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2011.02.08 22:31:41 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2011.02.08 22:31:41 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2011.02.08 22:31:41 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2011.02.08 22:31:41 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2011.02.06 23:55:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3Tag
[2011.02.02 16:25:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2011.01.25 13:01:16 | 000,000,000 | ---D | C] -- C:\Users\lutz\AppData\Roaming\Juniper Networks
 
========== Files - Modified Within 30 Days ==========
 
[2011.02.11 10:27:01 | 000,022,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.02.11 10:27:01 | 000,022,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.02.11 10:23:58 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.02.11 10:23:58 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.02.11 10:23:58 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.02.11 10:23:58 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.02.11 10:23:58 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.02.11 10:19:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.02.11 10:19:35 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2011.02.09 16:08:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\lutz\Desktop\OTL.exe
[2011.02.09 14:42:57 | 000,000,932 | ---- | M] () -- C:\Users\lutz\Desktop\Trillian.lnk
[2011.02.09 14:36:48 | 000,003,008 | ---- | M] () -- C:\Users\lutz\Desktop\Star.java
[2011.02.09 14:27:16 | 000,289,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.02.06 23:59:35 | 000,000,337 | ---- | M] () -- C:\Users\lutz\AppData\Local\Perfmon.PerfmonCfg
[2011.01.28 01:42:39 | 001,202,119 | ---- | M] () -- C:\Users\lutz\Desktop\Engel, The Immorality of Eating Meat (2000).pdf
[2011.01.24 23:01:19 | 006,465,810 | ---- | M] () -- C:\Users\lutz\Desktop\Probability_Theory_The_Logic_Of_Science_-_E._T._Jaynes.pdf
[2011.01.17 01:29:28 | 000,120,674 | ---- | M] () -- C:\Users\lutz\Desktop\stundenplan.png
 
========== Files Created - No Company Name ==========
 
[2011.02.09 14:36:47 | 000,003,008 | ---- | C] () -- C:\Users\lutz\Desktop\Star.java
[2011.02.06 23:59:35 | 000,000,337 | ---- | C] () -- C:\Users\lutz\AppData\Local\Perfmon.PerfmonCfg
[2011.01.28 01:42:31 | 001,202,119 | ---- | C] () -- C:\Users\lutz\Desktop\Engel, The Immorality of Eating Meat (2000).pdf
[2011.01.24 23:01:19 | 006,465,810 | ---- | C] () -- C:\Users\lutz\Desktop\Probability_Theory_The_Logic_Of_Science_-_E._T._Jaynes.pdf
[2010.09.01 20:51:23 | 000,017,408 | ---- | C] () -- C:\Users\lutz\AppData\Local\WebpageIcons.db
[2010.06.13 18:26:10 | 000,000,600 | ---- | C] () -- C:\Users\lutz\AppData\Local\PUTTY.RND
[2010.04.04 16:14:05 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.02.18 20:05:27 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2004.03.30 21:47:44 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\nl_msgs.dll
[2004.03.30 21:47:41 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\nl_msgc.dll
 
========== LOP Check ==========
 
[2010.09.26 10:53:55 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\.minecraft
[2010.12.18 14:33:41 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Audacity
[2011.02.11 10:20:14 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Dropbox
[2010.09.08 14:23:49 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\gnupg
[2010.05.18 00:20:54 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\gtk-2.0
[2011.01.25 13:01:18 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Juniper Networks
[2010.03.23 12:30:03 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Leadertech
[2010.03.27 22:55:38 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\LockTime
[2010.03.27 19:31:17 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Mp3tag
[2010.04.15 22:20:29 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\nltk_data
[2010.03.29 20:34:07 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Notepad++
[2010.02.19 21:11:50 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\OpenOffice.org
[2010.04.17 22:32:11 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\SWI-Prolog
[2010.02.19 21:17:21 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\Thunderbird
[2010.02.21 14:31:46 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\TrueCrypt
[2011.02.09 02:03:00 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\uTorrent
[2010.05.02 22:09:55 | 000,000,000 | ---D | M] -- C:\Users\lutz\AppData\Roaming\xpce
[2010.11.08 11:38:58 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 11.02.2011 10:27:06 - Run 1
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Users\lutz\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 69,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 29,20 Gb Total Space | 6,50 Gb Free Space | 22,24% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 180,78 Gb Free Space | 92,56% Space Free | Partition Type: NTFS
Drive E: | 195,31 Gb Total Space | 68,03 Gb Free Space | 34,83% Space Free | Partition Type: NTFS
Drive F: | 177,31 Gb Total Space | 82,75 Gb Free Space | 46,67% Space Free | Partition Type: NTFS
Drive G: | 144,29 Gb Total Space | 129,24 Gb Free Space | 89,57% Space Free | Partition Type: NTFS
 
Computer Name: DESKTOP | User Name: lutz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java(TM) 6 Update 20 (64-bit)
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5F94D3B9-2B02-9C37-740B-A59C7B8D17CC}" = ATI Catalyst Install Manager
"{64A3A4F4-B792-11D6-A78A-00B0D0160200}" = Java(TM) SE Development Kit 6 Update 20 (64-bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{A792E67C-FDA4-A301-0C3C-53BA86EFBB5A}" = ccc-utility64
"nbi-nb-base-6.8.0.0.0" = NetBeans IDE 6.8
"SP6" = Logitech SetPoint 6.0
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{3D6A24EA-A543-6C84-351E-D7646E7AB86E}" = Catalyst Control Center InstallProxy
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{47CAFF95-C3D8-ABF2-70BC-89DE00D8FB19}" = Catalyst Control Center Graphics Light
"{4962EBAC-AE7C-1B22-1EA0-0916A7E40954}" = Catalyst Control Center Graphics Full Existing
"{49A62E2B-B35C-941D-DF48-601207CF14C0}" = Catalyst Control Center Graphics Previews Common
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{6A490E11-6C8A-777C-4E00-43F3CC16A1EC}" = CCC Help English
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77919701-C3E7-09AA-D2F7-DBF42CD7C13D}" = Catalyst Control Center HydraVision Full
"{78B2F09F-BDC7-7865-CF4C-233B64A3BE51}" = Catalyst Control Center Graphics Full New
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller  Driver
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.2 - Deutsch
"{D241BBEC-B1C7-7953-EDDE-D90A654A8D2C}" = ccc-core-static
"{D5C24E77-099E-9B84-5BE2-708E70B938A9}" = Catalyst Control Center Core Implementation
"{DC4757E2-BAE3-0BFE-C6E5-576CB911FF52}" = Catalyst Control Center Graphics Previews Vista
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{e7394a0f-3f80-45b1-87fc-abcd51893246}" = Python 2.6.4
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.11 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CDex" = CDex extraction audio
"Dia" = Dia (nur entfernen)
"EvilLyrics" = EvilLyrics
"Exifer_is1" = Exifer
"GnuPG" = GNU Privacy Guard
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"GSview 4.9" = GSview 4.9
"HijackThis" = HijackThis 1.99.1
"IrfanView" = IrfanView (remove only)
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR2009b" = MATLAB R2009b
"MiKTeX 2.8" = MiKTeX 2.8
"mIRC" = mIRC
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mozilla Thunderbird (3.0.1)" = Mozilla Thunderbird (3.0.1)
"Mp3tag" = Mp3tag v2.48
"NetLimiter" = NetLimiter 1.30 (remove only)
"nltk-py2.6" = Python 2.6 nltk-2.0b8
"Notepad++" = Notepad++
"Steam App 400" = Portal
"Steam App 630" = Alien Swarm
"SWI-Prolog" = SWI-Prolog (remove only)
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"Trillian" = Trillian
"TrueCrypt" = TrueCrypt
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.6
"Winamp" = Winamp
"Zattoo4" = Zattoo4 4.0.5
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3917745244-3809735353-2045529254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"PyYAML-py2.6" = Python 2.6 PyYAML-3.09
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 08.02.2011 17:02:33 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AdobeARM.exe, Version: 1.4.7.0, Zeitstempel:
 0x4c98fb16  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften Prozesses:
 0xbc8  Startzeit der fehlerhaften Anwendung: 0x01cbc7d37fc3bdde  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe  Pfad des
 fehlerhaften Moduls: unknown  Berichtskennung: bf2fcb71-33c6-11e0-862a-00241ddda067
 
Error - 08.02.2011 17:03:55 | Computer Name = desktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3989 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: ef4    Startzeit: 
01cbc7d3897417b9    Endzeit: 0    Anwendungspfad: D:\Programme\Mozilla Firefox\firefox.exe

Berichts-ID:
 eec21983-33c6-11e0-862a-00241ddda067  
 
Error - 08.02.2011 17:16:26 | Computer Name = desktop | Source = Application Hang | ID = 1002
Description = Programm plugin-container.exe, Version 1.9.2.3989 kann nicht mehr 
unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
 in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: c04    Startzeit: 01cbc7d3c89289a1    Endzeit: 6    Anwendungspfad: D:\Programme\Mozilla
 Firefox\plugin-container.exe    Berichts-ID: ae72dffc-33c8-11e0-862a-00241ddda067  
 
Error - 09.02.2011 09:39:37 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften
 Prozesses: 0x7d0  Startzeit der fehlerhaften Anwendung: 0x01cbc85ecb41ef09  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 094a1869-3452-11e0-949e-00241ddda067
 
Error - 09.02.2011 09:41:04 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften
 Prozesses: 0x1098  Startzeit der fehlerhaften Anwendung: 0x01cbc85eff782d3f  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 3d282335-3452-11e0-949e-00241ddda067
 
Error - 09.02.2011 09:47:45 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften
 Prozesses: 0xe08  Startzeit der fehlerhaften Anwendung: 0x01cbc85fede2661f  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 2c10407c-3453-11e0-949e-00241ddda067
 
Error - 09.02.2011 09:54:25 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften
 Prozesses: 0x119c  Startzeit der fehlerhaften Anwendung: 0x01cbc860dc6fb7e2  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 1a7d86a7-3454-11e0-949e-00241ddda067
 
Error - 09.02.2011 10:14:25 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf7838  ID des fehlerhaften
 Prozesses: 0x1090  Startzeit der fehlerhaften Anwendung: 0x01cbc863a7e7c2d7  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: e5bcf498-3456-11e0-949e-00241ddda067
 
Error - 09.02.2011 10:21:05 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc637  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf4d15  ID des fehlerhaften
 Prozesses: 0x6e4  Startzeit der fehlerhaften Anwendung: 0x01cbc8649634af49  Pfad der
 fehlerhaften Anwendung: C:\Windows\SysWOW64\rundll32.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: d428db2e-3457-11e0-949e-00241ddda067
 
Error - 09.02.2011 10:35:08 | Computer Name = desktop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogitechUpdate.exe, Version: 1.80.114.0,
 Zeitstempel: 0x4b03a998  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0baf7838  ID des fehlerhaften
 Prozesses: 0xd48  Startzeit der fehlerhaften Anwendung: 0x01cbc8668bad3ee0  Pfad der
 fehlerhaften Anwendung: D:\Programme\Logitech\SetPointP\LU\LogitechUpdate.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: cac13989-3459-11e0-a260-00241ddda067
 
[ System Events ]
Error - 26.01.2011 21:39:29 | Computer Name = desktop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 27.01.2011 16:34:33 | Computer Name = desktop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 27.01.2011 16:34:33 | Computer Name = desktop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 27.01.2011 17:20:15 | Computer Name = desktop | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 28.01.2011 10:26:36 | Computer Name = desktop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 28.01.2011 10:26:36 | Computer Name = desktop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 29.01.2011 11:26:55 | Computer Name = desktop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 29.01.2011 11:26:55 | Computer Name = desktop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 30.01.2011 09:25:26 | Computer Name = desktop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 30.01.2011 09:25:26 | Computer Name = desktop | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >