Trojaner-Board - TR/Crypt.ZPACK.Gen2 in TR/Crypt.ZPACK.Gen2

Hallöchen,

ich habe heute 2 meldungen (identisch) von avira bekommen. Pfad und Bezeichnung siehe Titel.

ich habe beide male auf löschen geklickt, bin mir aber natürlich nicht sicher, ob ich die seuche wirklich los bin. Avira sagt, dass keine Funde mehr da sind.

Logfiles sind auch fertig:
zuerst die DDS.txt

Code:

 .

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 8.0.6001.19190

Run by FeelDaPain at 21:51:58 on 2012-02-26

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1795 [GMT 1:00]

.

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: FireWall *Enabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\System32\svchost.exe -k Cognizance

C:\Windows\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Windows\system32\agrsmsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Windows\system32\hasplms.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Generic\Network Printer Wizard\NPWService.exe

C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\Windows\System32\svchost.exe -k Update-Service

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe

C:\Windows\Explorer.EXE

C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

C:\Program Files\ASUS\ATK Hotkey\HControl.exe

C:\Program Files\Wireless Console 2\wcourier.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Program Files\ASUS\Splendid\ACMON.exe

C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Windows\AsScrPro.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Synaptics\SynTP\SynAsus.exe

D:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

C:\Program Files\Razer\Naga Epic\NagaEpicSysTray.exe

C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

C:\Windows\System32\ACEngSvr.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

C:\Program Files\ASUS\ATK Hotkey\WDC.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\Windows\ehome\ehmsas.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Users\FeelDaPain\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\FeelDaPain\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uDefault_Page_URL = hxxp://www.asus.com

mDefault_Page_URL = hxxp://www.asus.com

uInternet Settings,ProxyServer = 192.168.10.15:8080

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

BHO: ASUS Security Protect Manager: {df21f1db-80c6-11d3-9483-b03d0ec10000} - c:\program files\asus security center\asus security protect manager\bin\ItIEAddIn.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Alexa: {ea582743-9076-4178-9aa6-7393fdf4d5ce} - c:\program files\alexa toolbar\AlxTB2.9.39.dll

TB: Gutscheinmieze: {dfefcdee-cf1a-4fc8-88ad-48514e463b27} - c:\users\feeldapain\appdata\roaming\gutscheinmieze\toolbar.dll

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

uRun: [Google Update] "c:\users\feeldapain\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [HControlUser] c:\program files\asus\atk hotkey\HControlUser.exe

mRun: [ATKOSD2] c:\program files\asus\atkosd2\ATKOSD2.exe

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [CognizanceTS] rundll32.exe c:\progra~1\asusse~1\asusse~1\bin\ASTSVCC.dll,RegisterModule

mRun: [ATKMEDIA] c:\program files\asus\atk media\DMedia.exe

mRun: [ASUS Screen Saver Protector] c:\windows\AsScrPro.exe

mRun: [ASUS Camera ScreenSaver] c:\windows\AsScrProlog.exe

mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [<NO NAME>] 

mRun: [Acrobat Assistant 8.0] "d:\programme\adobe\acrobat 9.0\acrobat\Acrotray.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [Razer Naga Driver] c:\program files\razer\naga epic\NagaEpicSysTray.exe

mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe

mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: An vorhandene PDF-Datei anfügen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: In Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\windows\web\related.htm

IE: {1009C944-97D5-44A9-9E32-DFF54F498968} - {1009C944-97D5-44A9-9E32-DFF54F498968} - c:\program files\asus security center\asus security protect manager\bin\ASWallet.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

LSP: c:\program files\avira\antivir desktop\avsda.dll

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{92E553DB-5726-4C4E-8A8B-E2F2BABFF17D} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{AB64F343-2364-46EE-A8EB-AEEE685B5568} : DhcpNameServer = 192.168.1.1

AppInit_DLLs: APSHook.dll acaptuser32.dll

LSA: Notification Packages = scecli ASWLNPkg

LSA: Authentication Packages = msv1_0 relog_ap

.

============= SERVICES / DRIVERS ===============

.

R0 lullaby;lullaby;c:\windows\system32\drivers\lullaby.sys [2008-8-13 15416]

R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2011-12-1 111160]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-12-1 36000]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-2-24 185472]

R2 AntiVirFirewallService;Avira FireWall;c:\program files\avira\antivir desktop\avfwsvc.exe [2011-12-1 616400]

R2 AntiVirMailService;Avira Email Schutz;c:\program files\avira\antivir desktop\avmailc.exe [2011-12-1 342480]

R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2011-12-1 86224]

R2 AntiVirService;Avira Echtzeit Scanner;c:\program files\avira\antivir desktop\avguard.exe [2011-12-1 110032]

R2 AntiVirWebService;Avira Browser Schutz;c:\program files\avira\antivir desktop\avwebgrd.exe [2011-12-1 463824]

R2 ASBroker;Logon Session Broker;c:\windows\system32\svchost.exe -k Cognizance [2008-1-21 21504]

R2 ASChannel;Local Communication Channel;c:\windows\system32\svchost.exe -k Cognizance [2008-1-21 21504]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-12-1 74640]

R2 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]

R2 hasplms;Sentinel HASP License Manager;c:\windows\system32\hasplms.exe  -run --> c:\windows\system32\hasplms.exe  -run [?]

R2 NPWService;NPWService;c:\program files\generic\network printer wizard\NPWService.exe [2010-9-29 458752]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2012-1-2 2253120]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-10-15 381248]

R2 Update-Service;Update-Service;c:\windows\system32\svchost.exe -k Update-Service [2008-1-21 21504]

R2 XHASP;XHASP;c:\windows\system32\drivers\XHASP.sys [2011-7-6 259584]

R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2011-12-1 91096]

R3 DCamUSBET;USB2.0 1.3M UVC WebCam;c:\windows\system32\drivers\etDevice.sys [2007-9-6 474624]

R3 FiltUSBET;ET USB Device Lower Filter;c:\windows\system32\drivers\etFilter.sys [2008-2-5 206464]

R3 itecir;ITECIR Infrared Receiver;c:\windows\system32\drivers\itecir.sys [2008-8-13 54784]

R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2010-2-28 4233728]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2012-1-2 139880]

R3 RzSynapse;Razer Driver;c:\windows\system32\drivers\RzSynapse.sys [2010-12-16 103424]

R3 ScanUSBET;ET USB Still Image Capture Device;c:\windows\system32\drivers\etScan.sys [2008-1-31 6528]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-8-13 29736]

S3 JmtFltr;n52te;c:\windows\system32\drivers\JmtFltr.sys [2011-2-4 48896]

S3 lowcdc;USB-LINK-CFG Transfer Interface;c:\windows\system32\drivers\lowcdc.sys [2010-7-18 6400]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== File Associations ===============

.

.scr=AutoCADScriptFile

.

=============== Created Last 30 ================

.

2012-02-26 19:45:39        6552120        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{a4dd1031-9c0f-4ea4-8c49-2d983b66dede}\mpengine.dll

.

==================== Find3M  ====================

.

2012-02-18 22:53:56        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2012-01-29 04:10:42        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-24 01:57:10        212992        ----a-w-        c:\windows\system32\aptwag9fq.dll

2012-01-12 19:52:56        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-01-11 18:25:30        684032        ----a-w-        c:\windows\system32\xptfhyji.tsp

2012-01-01 20:23:02        281760        ----a-w-        c:\windows\system32\drivers\atksgt.sys

2012-01-01 20:23:01        25888        ----a-w-        c:\windows\system32\drivers\lirsgt.sys

2011-12-15 06:22:01        916992        ----a-w-        c:\windows\system32\wininet.dll

2011-12-15 06:18:03        43520        ----a-w-        c:\windows\system32\licmgr10.dll

2011-12-15 06:17:51        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-12-15 06:17:35        71680        ----a-w-        c:\windows\system32\iesetup.dll

2011-12-15 06:17:35        109056        ----a-w-        c:\windows\system32\iesysprep.dll

2011-12-15 05:21:27        385024        ----a-w-        c:\windows\system32\html.iec

2011-12-15 04:45:13        133632        ----a-w-        c:\windows\system32\ieUnatt.exe

2011-12-15 04:43:48        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2011-12-14 16:17:47        680448        ----a-w-        c:\windows\system32\msvcrt.dll

2008-07-02 02:28:38        61440        ----a-w-        c:\program files\common files\CPInstallAction.dll

.

============= FINISH: 22:00:45,12 ===============

Hier noch die Attach.txt

Code:

 .

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium 

Boot Device: \Device\HarddiskVolume2

Install Date: 13.08.2008 18:30:24

System Uptime: 26.02.2012 21:41:26 (1 hours ago)

.

Motherboard: ASUSTeK Computer Inc.         |  | M70Vm     

Processor: Intel(R) Core(TM)2 Duo CPU     T9400  @ 2.53GHz | Socket 478 | 2534/267mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 233 GiB total, 106,672 GiB free.

D: is FIXED (NTFS) - 223 GiB total, 92,894 GiB free.

Z: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1083: 18.02.2012 16:46:36 - Windows Update

RP1084: 18.02.2012 16:55:09 - Sprachpaketdeinstallation

RP1085: 19.02.2012 00:08:57 - Sprachpaketdeinstallation

RP1086: 20.02.2012 01:04:10 - Geplanter Prüfpunkt

RP1087: 21.02.2012 00:32:23 - Geplanter Prüfpunkt

RP1088: 22.02.2012 00:26:13 - Windows Update

RP1089: 23.02.2012 00:00:02 - Geplanter Prüfpunkt

RP1090: 26.02.2012 20:42:51 - Windows Update

RP1092: 26.02.2012 21:17:24 - Sprachpaketdeinstallation

.

==== Installed Programs ======================

.

Acronis*True*Image*Home

Adobe Acrobat 9 Pro Extended - English, Français, Deutsch

Adobe Flash Player 11 Plugin

Adobe Reader 8.1.2 - Deutsch

Agere Systems HDA Modem

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS CopyProtect

ASUS LifeFrame3

ASUS Power4Gear eXtreme

ASUS Security Protect Manager

ASUS SmartLogon

ASUS Splendid Video Enhancement Technology

ASUS Virtual Camera

Asus_Camera_ScreenSaver

ATK Generic Function Service

ATK Hotkey

ATK Media

ATKOSD2

AuthenTec Fingerprint Sensor Minimum Install

AutoCAD 2008 - Deutsch

Avira Internet Security 2012

BloodRayne

Bonjour

Brink

CCleaner

Compatibility Pack für 2007 Office System

Dead Block

Dolby Control Center

EPLAN Electric P8 2.0

EPLAN License Client

eReg

Express Gate

FileZilla Client 3.3.4.1

Google Chrome

Guitar Hero III

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

ImagXpress

iPhone Explorer 2.100

ITECIR

iTunes

Java Auto Updater

JDownloader

League of Legends

Microsoft .NET Framework 3.5 Language Pack SP1 - deu

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170)

Microsoft Choice Guard

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Office File Validation Add-In

Microsoft Office Live Add-in 1.5

Microsoft Office Outlook Connector

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

MobileMe Control Panel

MSVC80_x86_v2

MSVC90_x86

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NB Probe

neroxml

Network Printer Wizard

Notepad++

NVIDIA 3D Vision Treiber 285.62

NVIDIA Grafiktreiber 285.62

NVIDIA HD-Audiotreiber 1.2.24.0

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX-Systemsoftware 9.11.0621

NVIDIA Stereoscopic 3D Driver

NVIDIA Systemsteuerung 285.62

NVIDIA Update 1.5.20

NVIDIA Update Components

Pando Media Booster

PC Connectivity Solution

PhoenixRC

Power2Go

ProtectDisc Driver, Version 11

QuickTime

Razer Naga

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

redist

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Skype™ 5.5

SPCA1528 PC Driver

StarCraft II

Steam

Synaptics Pointing Device Driver

System Requirements Lab

TeamSpeak 3 Client

Ubisoft Game Launcher

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

USB2.0 1.3M UVC WebCam

VC80CRTRedist - 8.0.50727.6195

WIDCOMM Bluetooth Software

Windows Live-Uploadtool

Windows Live ID-Anmelde-Assistent

Windows Media Player Firefox Plugin

WinFlash

WinRAR

Wireless Console 2

World of Warcraft

Yahoo! Detect

.

==== End Of File ===========================

so und hier noch die Gmer.log

Code:

 GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-02-27 18:52:28

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.BKFO

Running: sj34jok3.exe; Driver: C:\Users\FEELDA~1\AppData\Local\Temp\uxriraog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT                                                                                                                                  8BB26236                                                                                                             ZwCreateSymbolicLinkObject

SSDT                                                                                                                                  8BB2623B                                                                                                             ZwLoadDriver

SSDT                                                                                                                                  8BB26231                                                                                                             ZwOpenSection

SSDT                                                                                                                                  8BB26240                                                                                                             ZwSetSystemInformation

SSDT                                                                                                                                  8BB261FF                                                                                                             ZwTerminateProcess

SSDT                                                                                                                                  \SystemRoot\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)                                         ZwCreateKey [0x8263CFEC]

SSDT                                                                                                                                  \SystemRoot\system32\ntkrnlpa.exe[unknown section] [8263CFEC]                                                        ZwCreateKey [0x8263CFEC]

SSDT                                                                                                                                  \SystemRoot\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)                                         ZwOpenKey [0x8263CFF1]

SSDT                                                                                                                                  \SystemRoot\system32\ntkrnlpa.exe[unknown section] [8263CFF1]                                                        ZwOpenKey [0x8263CFF1]
 

INT 0x03                                                                                                                              \SystemRoot\system32\ntkrnlpa.exe[unknown section]                                                                   8263CFF6
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text                                                                                                                                 ntkrnlpa.exe!KeSetEvent + 1E9                                                                                        826E896C 3 Bytes  [EC, CF, 63]

.text                                                                                                                                 ntkrnlpa.exe!KeSetEvent + 21D                                                                                        826E89A0 4 Bytes  [36, 62, B2, 8B]

.text                                                                                                                                 ntkrnlpa.exe!KeSetEvent + 37D                                                                                        826E8B00 4 Bytes  [3B, 62, B2, 8B]

.text                                                                                                                                 ntkrnlpa.exe!KeSetEvent + 3DD                                                                                        826E8B60 3 Bytes  [F1, CF, 63]

.text                                                                                                                                 ntkrnlpa.exe!KeSetEvent + 3FD                                                                                        826E8B80 4 Bytes  [31, 62, B2, 8B]

.text                                                                                                                                 ...                                                                                                                  

.vmp2                                                                                                                                 C:\Windows\system32\drivers\acedrv11.sys                                                                             entry point in ".vmp2" section [0xA3BCC69D]

.text                                                                                                                                 C:\Windows\system32\drivers\aksfridge.sys                                                                            section is writeable [0xA5606000, 0x49379, 0xE0000020]

.init                                                                                                                                 C:\Windows\system32\drivers\aksfridge.sys                                                                            entry point in ".init" section [0xA565C224]

.init                                                                                                                                 C:\Windows\system32\drivers\aksfridge.sys                                                                            unknown last code section [0xA565C000, 0x4000, 0xE20000E0]

.text                                                                                                                                 C:\Windows\system32\DRIVERS\atksgt.sys                                                                               section is writeable [0xA5660300, 0x3B6D8, 0xE8000020]

.text                                                                                                                                 C:\Windows\system32\drivers\hardlock.sys                                                                             section is writeable [0xA56A6400, 0x6EB98, 0xE8000020]

.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA5730C20]  C:\Windows\system32\drivers\hardlock.sys                                                                             entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA5730C20]

.protectÿÿÿÿhardlockunknown last code section [0xA5730A00, 0x50CA, 0xE0000020]                                                        C:\Windows\system32\drivers\hardlock.sys                                                                             unknown last code section [0xA5730A00, 0x50CA, 0xE0000020]

.text                                                                                                                                 C:\Windows\system32\DRIVERS\lirsgt.sys                                                                               section is writeable [0xA5736300, 0x1BEE, 0xE8000020]
 

---- User code sections - GMER 1.0.15 ----
 

.text                                                                                                                                 C:\Program Files\Pando Networks\Media Booster\PMB.exe[4212] kernel32.dll!SetUnhandledExceptionFilter                 7648A8C5 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                [744C7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                 [7451A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                             [744CBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                       [744BF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                 [744C75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                              [744BE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]                  [744F8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                     [744CDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                             [744BFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                              [744BFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                               [744B71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                       [7454CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                          [744EC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                             [744BD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                       [744B6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                      [744B687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT                                                                                                                                   C:\Windows\Explorer.EXE[2196] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                         [744C2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0015aff88197                                          

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  D:\Programme\DAEMON Tools Lite\

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x66 0x54 0x4A 0x1D ...

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x78 0xCF 0x29 0x6B ...

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0xF3 0xB2 0xAF 0x07 ...

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                      

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                0xC8 0xDE 0x70 0x9A ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0015aff88197 (not active ControlSet)                      

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      D:\Programme\DAEMON Tools Lite\

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x66 0x54 0x4A 0x1D ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x78 0xCF 0x29 0x6B ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xF3 0xB2 0xAF 0x07 ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)  

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0xC8 0xDE 0x70 0x9A ...
 

---- EOF - GMER 1.0.15 ----

So, ich hoffe damit hab ich nichts vergessen. und viel mehr hoff ich jemand kann mir hier noch helfen ;)
Danke schonmal

so bin durch, aber ich bin grad ned sicher, ob ich auf scan oder qickscan geklickt hab.

wenns falsch war, sag bescheid, dann mach ich nochmal ;)

OTL EXTRAS Logfile:

Code:

OTL logfile created on: 27.02.2012 20:25:36 - Run 1

OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\FeelDaPain\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19190)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,93 Gb Available Physical Memory | 64,39% Memory free

6,19 Gb Paging File | 4,98 Gb Available in Paging File | 80,32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 232,88 Gb Total Space | 107,42 Gb Free Space | 46,12% Space Free | Partition Type: NTFS

Drive D: | 223,11 Gb Total Space | 92,89 Gb Free Space | 41,64% Space Free | Partition Type: NTFS

 

Computer Name: A-SCHREINER | User Name: FeelDaPain | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.02.27 20:20:52 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\FeelDaPain\Desktop\OTL.exe

PRC - [2011.12.08 16:09:02 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.10.19 16:48:39 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.10.19 16:48:23 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.10.19 16:48:11 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

PRC - [2011.10.19 16:48:09 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.10.19 16:48:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.10.19 16:48:08 | 000,616,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe

PRC - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.10.15 09:53:00 | 001,328,960 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

PRC - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2010.12.30 17:59:56 | 000,957,840 | ---- | M] (Razer USA Ltd) -- C:\Program Files\Razer\Naga Epic\NagaEpicSysTray.exe

PRC - [2010.09.29 17:29:48 | 000,458,752 | ---- | M] () -- C:\Program Files\Generic\Network Printer Wizard\NPWService.exe

PRC - [2009.12.16 15:44:36 | 003,750,400 | ---- | M] (SafeNet Inc.) -- C:\Windows\System32\hasplms.exe

PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.08.13 19:19:49 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.08.12 16:21:12 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe

PRC - [2008.06.18 06:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008.06.11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- D:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.21 22:27:06 | 000,498,952 | ---- | M] () -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

PRC - [2008.04.21 22:00:36 | 000,911,168 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

PRC - [2008.04.21 21:54:38 | 002,622,296 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

PRC - [2008.04.20 23:07:26 | 000,136,472 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

PRC - [2008.04.20 23:07:18 | 000,431,384 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.16 05:33:05 | 000,172,032 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynAsus.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2007.02.06 18:29:59 | 000,065,536 | R--- | M] (Cognizance Corporation) -- C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.08.15 23:08:44 | 000,094,208 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll

MOD - [2009.10.09 01:22:56 | 000,053,760 | ---- | M] () -- C:\Program Files\Notepad++\NppShell.dll

MOD - [2008.09.16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll

MOD - [2008.04.21 21:43:20 | 001,336,600 | ---- | M] () -- C:\Program Files\Acronis\TrueImageHome\fox.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.01.24 02:57:10 | 000,212,992 | ---- | M] (Works Ltd.) [Auto | Running] -- C:\Windows\System32\aptwag9fq.dll -- (LanmanWorkstation)

SRV - [2012.01.01 20:59:21 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.12.08 16:09:02 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2011.11.10 17:45:17 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service)

SRV - [2011.10.19 16:48:23 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.10.19 16:48:11 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.10.19 16:48:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.10.19 16:48:08 | 000,616,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)

SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.09.29 17:29:48 | 000,458,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Generic\Network Printer Wizard\NPWService.exe -- (NPWService)

SRV - [2010.04.11 14:21:50 | 000,085,096 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)

SRV - [2010.01.26 11:41:08 | 000,652,800 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2009.12.16 15:44:36 | 003,750,400 | ---- | M] (SafeNet Inc.) [Auto | Running] -- C:\Windows\System32\hasplms.exe -- (hasplms)

SRV - [2009.12.07 14:11:13 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2008.04.21 22:27:06 | 000,498,952 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- (TryAndDecideService)

SRV - [2008.04.20 23:07:18 | 000,431,384 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

SRV - [2007.02.06 18:29:59 | 000,074,240 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll -- (ASBroker)

SRV - [2007.01.24 12:21:24 | 000,375,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.01.24 12:21:14 | 000,177,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2006.06.21 11:13:59 | 000,131,584 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsChnl.dll -- (ASChannel)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2012.01.01 21:23:02 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2012.01.01 21:23:01 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2011.12.08 16:09:03 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.10.19 16:48:39 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.10.19 16:48:38 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.10.19 16:48:37 | 000,111,160 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avfwot.sys -- (avfwot)

DRV - [2011.10.19 16:48:37 | 000,091,096 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avfwim.sys -- (avfwim)

DRV - [2011.10.15 09:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011.07.08 00:21:28 | 000,139,880 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2011.07.06 17:51:29 | 000,259,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XHASP.sys -- (XHASP)

DRV - [2011.05.06 10:35:43 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\timntr.sys -- (timounter)

DRV - [2011.05.06 10:35:43 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\Windows\System32\drivers\tifsfilt.sys -- (tifsfilter)

DRV - [2011.05.06 10:35:29 | 000,132,224 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\snapman.sys -- (snapman)

DRV - [2011.05.06 10:35:24 | 000,368,480 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tdrpman.sys -- (tdrpman)

DRV - [2010.12.16 09:23:14 | 000,103,424 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RzSynapse.sys -- (RzSynapse)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.02.24 11:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)

DRV - [2009.12.20 10:53:32 | 000,234,016 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2009.12.09 20:27:18 | 000,588,800 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hardlock.sys -- (hardlock)

DRV - [2009.11.10 12:55:08 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)

DRV - [2009.11.10 12:54:52 | 000,035,984 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)

DRV - [2009.10.29 08:53:26 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.09.07 07:39:26 | 000,006,400 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lowcdc.sys -- (lowcdc)

DRV - [2009.08.20 06:01:50 | 000,356,864 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\aksfridge.sys -- (aksfridge)

DRV - [2009.05.28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.27 14:46:12 | 000,048,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\JmtFltr.sys -- (JmtFltr)

DRV - [2007.09.19 17:01:06 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vhidmini.sys -- (vhidmini)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.10.15:8080

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found

FF - HKCU\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\FeelDaPain\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\FeelDaPain\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

 

[2011.12.20 20:39:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2010.06.22 20:49:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.08.31 21:26:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.01 20:49:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.05 21:27:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.02.17 20:48:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.19 08:23:30 | 000,686,592 | ---- | M] (Synatix GmbH) -- C:\Program Files\mozilla firefox\plugins\npmieze.dll

[2006.08.09 11:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npWebLaunch.dll

[2010.09.05 13:13:13 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Google Update (Enabled) = C:\Users\FeelDaPain\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\

CHR - Extension: Google Mail = C:\Users\FeelDaPain\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2011.12.22 16:11:00 | 000,000,759 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.

O2 - BHO: (ASUS Security Protect Manager) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll (Bioscrypt Inc.)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\FeelDaPain\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O3 - HKLM\..\Toolbar: (Alexa) - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files\Alexa Toolbar\AlxTB2.9.39.dll (Alexa Internet, Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\FeelDaPain\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)

O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule File not found

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [Razer Naga Driver] C:\Program Files\Razer\Naga Epic\NagaEpicSysTray.exe (Razer USA Ltd)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found

O9 - Extra Button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll (Bioscrypt Inc.)

O9 - Extra 'Tools' menuitem : ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll (Bioscrypt Inc.)

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Windows\web\related.htm File not found

O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Windows\web\related.htm File not found

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Generic\Network Printer Wizard\NPWprint.dll (Elite Silicon Technology Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Windows\system32\d3dy5stgc.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O13 - gopher Prefix: missing

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92E553DB-5726-4C4E-8A8B-E2F2BABFF17D}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB64F343-2364-46EE-A8EB-AEEE685B5568}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (APSHook.dll) - C:\Windows\System32\APSHook.dll (Cognizance Corporation)

O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\System32\acaptuser32.dll (Adobe Systems, Inc.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg

O30 - LSA: Authentication Packages - (relog_ap) - C:\Windows\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {33E23149-601A-B277-2543-7DC9C29BC586} - Browser Customizations

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5A604D2C-E968-429B-8327-62B5CE52126D} - .NET Framework

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {663A1449-B75E-B72D-B035-2155E84BC1F9} - 

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {78310121-036D-427A-9FAA-A9D8135E5F8F} - .NET Framework

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {86ACABB3-BC27-9222-72AA-E1E562514350} - Microsoft Windows Media Player 11.0

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E37D5697-1E74-93B7-9993-38B868C3E693} - 

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.27 20:20:50 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\FeelDaPain\Desktop\OTL.exe

[2012.02.27 19:37:14 | 000,000,000 | ---D | C] -- C:\Users\FeelDaPain\Desktop\120227_Logfiles Virus

[2012.02.26 21:51:00 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\FeelDaPain\Desktop\dds.com

[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

File not found -- C:\Windows\System32\drivers\mshcmd.sys.

[2012.02.27 20:20:52 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\FeelDaPain\Desktop\OTL.exe

[2012.02.27 20:00:04 | 000,001,140 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3591586906-2870755568-3652179915-1000UA.job

[2012.02.27 18:56:04 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.02.27 18:55:43 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.27 18:55:43 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.27 18:55:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.27 18:53:57 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.02.27 18:53:06 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.02.27 02:47:17 | 583,154,916 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.02.27 00:00:00 | 000,000,396 | ---- | M] () -- C:\Windows\tasks\NeroLiveEpgUpdate-A-Schreiner_FeelDaPain.job

[2012.02.26 22:01:22 | 000,302,592 | ---- | M] () -- C:\Users\FeelDaPain\Desktop\sj34jok3.exe

[2012.02.26 21:51:03 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\FeelDaPain\Desktop\dds.com

[2012.02.26 21:17:44 | 000,050,477 | ---- | M] () -- C:\Users\FeelDaPain\Desktop\Defogger.exe

[2012.02.26 21:00:01 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3591586906-2870755568-3652179915-1000Core.job

[2012.02.26 20:36:20 | 000,669,680 | ---- | M] () -- C:\Windows\System32\perfh013.dat

[2012.02.26 20:36:20 | 000,665,324 | ---- | M] () -- C:\Windows\System32\perfh010.dat

[2012.02.26 20:36:20 | 000,599,188 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.02.26 20:36:20 | 000,130,728 | ---- | M] () -- C:\Windows\System32\perfc013.dat

[2012.02.26 20:36:20 | 000,124,020 | ---- | M] () -- C:\Windows\System32\perfc010.dat

[2012.02.26 20:36:20 | 000,105,202 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.02.26 20:36:19 | 000,632,530 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.02.26 20:36:19 | 000,127,760 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.02.16 00:41:47 | 002,407,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.02.14 00:03:33 | 000,207,872 | ---- | M] () -- C:\Users\FeelDaPain\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

File not found -- C:\Windows\System32\drivers\mshcmd.sys.

[2012.02.27 02:47:17 | 583,154,916 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2012.02.26 22:01:22 | 000,302,592 | ---- | C] () -- C:\Users\FeelDaPain\Desktop\sj34jok3.exe

[2012.02.26 21:17:44 | 000,050,477 | ---- | C] () -- C:\Users\FeelDaPain\Desktop\Defogger.exe

[2012.01.01 21:23:02 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2012.01.01 21:23:01 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2011.12.08 16:10:41 | 000,000,039 | ---- | C] () -- C:\Windows\Settings.ini

[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.07.06 17:57:03 | 000,000,043 | ---- | C] () -- C:\Windows\W3u.INI

[2011.07.06 17:51:17 | 000,004,856 | ---- | C] () -- C:\Windows\System32\drivers\F4DB3596.bin

[2011.07.06 17:50:20 | 000,259,584 | ---- | C] () -- C:\Windows\System32\drivers\XHASP.sys

[2011.06.24 01:00:24 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf07a.dat

[2011.06.24 00:48:56 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011.06.24 00:48:56 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.06.04 22:31:36 | 000,000,525 | ---- | C] () -- C:\Windows\QIII.INI

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2011.02.04 20:59:23 | 000,048,896 | ---- | C] () -- C:\Windows\System32\drivers\JmtFltr.sys

[2011.01.06 18:04:05 | 000,186,904 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat

[2010.09.10 20:46:02 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini

[2010.07.10 20:20:46 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll

[2010.07.01 20:53:12 | 000,065,536 | ---- | C] () -- C:\Windows\IFinst27.exe

[2010.06.16 19:06:10 | 000,014,115 | ---- | C] () -- C:\Windows\twspmm.ini

[2010.05.26 17:20:45 | 000,000,635 | ---- | C] () -- C:\Windows\Sta2.INI

[2010.04.12 19:32:45 | 000,000,680 | ---- | C] () -- C:\Users\FeelDaPain\AppData\Local\d3d9caps.dat

 
 ========== LOP Check ==========

 

[2010.04.13 21:01:52 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Autodesk

[2010.02.21 14:27:43 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Bioshock2

[2010.04.06 19:47:06 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\CrystalButton

[2009.10.29 08:53:25 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\DAEMON Tools

[2011.05.20 16:50:03 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\FileZilla

[2010.09.05 13:13:12 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Gutscheinmieze

[2010.04.11 00:52:24 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Leadertech

[2011.09.14 18:15:48 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\LolClient

[2010.07.10 20:21:39 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\MAGIX

[2010.04.10 16:45:07 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Nokia

[2010.04.07 17:24:34 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Notepad++

[2011.09.22 17:41:09 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Opera

[2010.04.10 16:34:34 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\PC Suite

[2010.07.10 22:02:10 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\ProtectDISC

[2009.11.16 18:48:58 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\thriXXX

[2012.01.26 23:13:38 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\TS3Client

[2010.05.14 21:42:51 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\TuneUp Software

[2011.07.08 13:47:15 | 000,000,000 | ---D | M] -- C:\Users\FeelDaPain\AppData\Roaming\Unity

[2012.02.27 18:53:06 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011.12.01 23:38:30 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2011.12.01 19:29:44 | 000,000,000 | ---D | M] -- C:\111201_Backup XP Laptop Natalie

[2008.08.13 19:22:01 | 000,000,000 | -H-D | M] -- C:\ASUS.SYS

[2010.05.14 22:26:17 | 000,000,000 | -HSD | M] -- C:\Boot

[2011.12.08 19:38:20 | 000,000,000 | ---D | M] -- C:\CONFIG

[2012.02.16 00:30:03 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.12.15 03:23:28 | 000,000,000 | ---D | M] -- C:\EVENTDB

[2010.07.03 23:17:16 | 000,000,000 | ---D | M] -- C:\Games

[2008.08.13 18:29:23 | 000,000,000 | ---D | M] -- C:\Intel

[2011.12.08 16:09:32 | 000,000,000 | ---D | M] -- C:\LOGFILES

[2012.01.02 21:38:43 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.01.02 21:32:03 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.01.02 21:43:07 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.02.27 20:28:16 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.12.08 19:40:33 | 000,000,000 | ---D | M] -- C:\TEMP

[2012.01.02 21:45:45 | 000,000,000 | R--D | M] -- C:\Users

[2012.02.27 02:47:17 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2007.12.02 00:06:36 | 022,286,026 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.12.31 14:03:41 | 023,898,261 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2007.12.02 00:06:36 | 022,286,026 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys

[2008.12.31 14:03:41 | 023,898,261 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\drivers\agp440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2004.08.04 07:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\agp440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2002.08.29 13:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys

[2007.12.02 00:06:36 | 022,286,026 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.12.31 14:03:41 | 023,898,261 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2007.12.02 00:06:36 | 022,286,026 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys

[2008.12.31 14:03:41 | 023,898,261 | ---- | M] () .cab file -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.02.22 05:59:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=76D70915EB81608DC6ACA87887FAB38F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_ddac250d3ab7a648\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_dd25892021975283\atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\drivers\atapi.sys

[2004.08.04 06:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\eventlog.dll

[2004.08.04 08:57:18 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2007.06.13 14:21:45 | 001,554,944 | ---- | M] (Microsoft Corporation) MD5=14B0B1999FCA97A232465246E5CE3F10 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\explorer.exe

[2004.08.04 08:57:53 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtUninstallKB938828$\explorer.exe

[2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\explorer.exe

[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\explorer.exe

[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

[2004.08.04 08:57:30 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\scecli.dll

[2004.08.04 08:57:33 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$hf_mig$\KB890859\SP2GDR\user32.dll

[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.04 08:57:36 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2002.08.29 13:00:00 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=E3DAFFDB1C86C1AEAC1B205F6CF67009 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtUninstallKB890859_0$\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\userinit.exe

[2004.08.04 08:58:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

[2004.08.04 08:58:19 | 000,546,816 | ---- | M] (Microsoft Corporation) MD5=CAEF653D55CC8D7A173E4E63BC58D7F2 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2002.08.29 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\dllcache\ws2ifsl.sys

[2002.08.29 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\111201_Backup XP Laptop Natalie\Lokaler Datenträger\WINDOWS\system32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2009.10.29 08:53:26 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2012.02.27 20:25:13 | 002,883,584 | ---- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT

[2012.02.27 20:25:13 | 000,262,144 | -H-- | M] () -- C:\Users\FeelDaPain\ntuser.dat.LOG1

[2009.10.27 17:32:56 | 000,000,000 | -H-- | M] () -- C:\Users\FeelDaPain\ntuser.dat.LOG2

[2010.05.14 22:26:14 | 000,000,000 | -H-- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT_tureg_new.LOG1

[2010.05.14 22:26:14 | 000,000,000 | -H-- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT_tureg_new.LOG2

[2010.05.14 22:26:19 | 002,359,296 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT_tureg_old

[2010.05.14 22:26:19 | 000,065,536 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2010.05.14 22:26:18 | 000,524,288 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2009.10.27 19:07:32 | 000,524,288 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms

[2012.02.27 18:53:04 | 000,065,536 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{f4488235-5f9e-11df-b62e-806e6f6e6963}.TM.blf

[2012.02.27 18:53:04 | 000,524,288 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{f4488235-5f9e-11df-b62e-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms

[2010.05.16 20:48:34 | 000,524,288 | -HS- | M] () -- C:\Users\FeelDaPain\NTUSER.DAT{f4488235-5f9e-11df-b62e-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms

[2009.10.27 17:32:57 | 000,000,020 | -HS- | M] () -- C:\Users\FeelDaPain\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 

< End of report >

--- --- ---

hier noch die Extras.txt

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 27.02.2012 20:25:36 - Run 1

OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\FeelDaPain\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19190)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,93 Gb Available Physical Memory | 64,39% Memory free

6,19 Gb Paging File | 4,98 Gb Available in Paging File | 80,32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 232,88 Gb Total Space | 107,42 Gb Free Space | 46,12% Space Free | Partition Type: NTFS

Drive D: | 223,11 Gb Total Space | 92,89 Gb Free Space | 41,64% Space Free | Partition Type: NTFS

 

Computer Name: A-SCHREINER | User Name: FeelDaPain | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3591586906-2870755568-3652179915-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{05F7B3EF-1310-479C-8A50-E170C4FAF4AB}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{1A3BED2B-9C92-44EF-8FCF-997A0CBBFF05}" = rport=445 | protocol=6 | dir=out | app=system | 

"{2D4B9582-A321-45FD-B060-BA160B8169DE}" = rport=137 | protocol=17 | dir=out | app=system | 

"{35A1EFFD-6CAE-487D-9181-0CBBE841E681}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 | 

"{45943C4D-3DD1-4475-A410-D46417E70361}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 | 

"{5319E6D0-0C67-4ED4-B294-DA1CD0210A8D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{5342CF6C-EA41-491B-8739-348DEEA1B156}" = rport=139 | protocol=6 | dir=out | app=system | 

"{5768E224-A707-4AC3-81CD-AB1E9CFA28E8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{61844849-7621-4822-B557-FB6147605EC4}" = lport=137 | protocol=17 | dir=in | app=system | 

"{6FDC4F65-CD47-4C0F-8C36-CD9E5496A9B1}" = rport=138 | protocol=17 | dir=out | app=system | 

"{9EDA8ABC-87DF-4761-9500-F2AB21917197}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{9FB7655A-BC40-42E6-BACD-B7A488DCDF75}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 | 

"{A67BDB69-1DF7-473D-BD14-A8DB847EDD00}" = lport=138 | protocol=17 | dir=in | app=system | 

"{B1E9EB97-6D1A-483D-AC57-596021AE3B63}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{B2904D19-F6E3-45B6-AE94-746FACB3EA19}" = lport=139 | protocol=6 | dir=in | app=system | 

"{B473F4C4-F709-493B-AF11-F70A844B5C49}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{E8FC8E5B-8A44-4F05-8DFD-C95D16A59045}" = lport=445 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{06EE92F8-4810-40D3-9A11-6B1F353AC744}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{0700C0D0-FA85-4EAD-84E1-D5F90DA57DDA}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{21CE5D3F-8A00-459A-A2B2-4583ACEB781E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{262B8C1E-A7FD-422C-8A58-81B16582307C}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{26506057-58A7-4043-9E4C-2877F142820B}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{3417EDD2-FB37-4C64-964B-51CED1E317A6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bloodrayne\rayne.exe | 

"{414C923B-B3CD-4630-8DC7-48CDC2D17C7C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{541EA21F-EC3D-4301-B02D-9C4BBA08198D}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{6AC99E47-7769-4EA2-9E75-B97946B21991}" = protocol=6 | dir=in | app=c:\windows\system32\hasplms.exe | 

"{7233B5B3-F4BF-4337-8FF7-06ED903418BC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{96CDE7CF-0BC5-4E26-97A4-4848DE8BCCDB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bloodrayne\rayne.exe | 

"{A5D76269-71FC-4271-9F49-27B39090C286}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\brink\brink.exe | 

"{B09479FB-90FA-4834-AF8F-24A263C427AF}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\brink\brink.exe | 

"{BB2276E3-8B86-4A5D-9E8E-C6C75D8CDC40}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{BC325FC2-3CA6-482D-AA75-E25AC470BD2C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{BF56B7C7-7061-44C9-B0C9-CB52CD01C3A5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{C6416A6A-8F48-4C04-A69B-FB468FB22927}" = protocol=17 | dir=in | app=c:\windows\system32\hasplms.exe | 

"{E108C0A5-F9C0-4412-B855-742090AC624A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EF2D3A7A-7FB4-4485-AFD0-11821BCD5D3A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{F0A7E63C-C491-449B-83C5-F263C0A3DE8F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{F58C1443-C17C-4A41-A747-1F3B0332FF69}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{F6C516C4-716F-4C39-9DDB-F1DD29203DD6}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{FF448234-5DCE-438A-9D50-5ABD602DBB7E}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0100BD88-3990-431F-9175-AB60E31AFFDE}" = EPLAN License Client

"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent

"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology

"{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}" = Guitar Hero III

"{153C7D89-9CF4-4719-A551-C5BF45236DB5}" = redist

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{27D51A76-371D-48B6-B06E-4137A15B7583}" = Express Gate

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

"{40580068-9B10-40B5-9548-536CE88AB23C}" = ITECIR

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{5279DB81-189E-43AC-928C-9BC70433B365}_is1" = Dead Block

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{570C2A84-A145-4DF0-AE9D-012584DF09DC}" = SPCA1528 PC Driver

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5783F2D7-6001-0407-0002-0060B0CE6BBA}" = AutoCAD 2008 - Deutsch

"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01

"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support

"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe

"{633A06C3-B709-479A-AAB3-5EE94AD9EE4B}" = Acronis*True*Image*Home

"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7397EDED-F38A-4654-B669-BF61065803D0}" = PC Connectivity Solution

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7A8985B1-3936-49B1-8F58-4B826A497155}" = PhoenixRC

"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey

"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX

"{7FD8B0C1-CDDA-4B4D-A577-B2E3570EA3A3}_is1" = iPhone Explorer 2.100

"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends

"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195

"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear eXtreme

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A23E5590-6799-437B-9723-2627BA800B6F}" = Dolby Control Center

"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel

"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress

"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5

"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes

"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch

"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media

"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service

"{D8D4AF9A-6ADE-4B14-A7F5-BA858792729E}" = ASUS Security Protect Manager

"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash

"{DE66EFAD-B9CC-4FD4-9157-6C18E5100161}" = Dolby Control Center

"{E10E44A8-7650-4C4F-A689-E4AF2655FD5E}" = EPLAN Electric P8 2.0

"{EB4DF30B-102B-4F0C-927A-D50E037A325D}" = AuthenTec Fingerprint Sensor Minimum Install

"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera

"{ED4108A9-60FD-4F18-AF42-122219977773}" = Razer Naga

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FD2D70B9-BF5D-45B8-80B1-CF83AC73ACFE}" = Network Printer Wizard

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver

"AutoCAD 2008 - Deutsch" = AutoCAD 2008 - Deutsch

"Avira AntiVir Desktop" = Avira Internet Security 2012

"CCleaner" = CCleaner

"FileZilla Client" = FileZilla Client 3.3.4.1

"InstallShield_{FD2D70B9-BF5D-45B8-80B1-CF83AC73ACFE}" = Network Printer Wizard

"JDownloader" = JDownloader

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Notepad++" = Notepad++

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11

"StarCraft II" = StarCraft II

"Steam App 22350" = Brink

"Steam App 3810" = BloodRayne

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"USB2.0 1.3M UVC WebCam" = USB2.0 1.3M UVC WebCam

"WinRAR archiver" = WinRAR

"World of Warcraft" = World of Warcraft

"YTdetect" = Yahoo! Detect

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 11.01.2012 17:41:23 | Computer Name = A-Schreiner | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung rads_user_kernel.exe, Version 0.0.0.0, Zeitstempel

 0x4e65c1ac, fehlerhaftes Modul rads_user_kernel.exe, Version 0.0.0.0, Zeitstempel

 0x4e65c1ac, Ausnahmecode 0xc0000005, Fehleroffset 0x00019362,  Prozess-ID 0x1264,

 Anwendungsstartzeit 01ccd0a3a1ca874b.

 

Error - 11.01.2012 22:22:33 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.01.2012 07:59:30 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.01.2012 16:52:47 | Computer Name = A-Schreiner | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung mDNSResponder.exe, Version 2.0.4.0, Zeitstempel

 0x4cae1be1, fehlerhaftes Modul mDNSResponder.exe, Version 2.0.4.0, Zeitstempel 

0x4cae1be1, Ausnahmecode 0xc0000005, Fehleroffset 0x0000110a,  Prozess-ID 0x988, Anwendungsstartzeit

 01ccd3c7a02aeceb.

 

Error - 15.01.2012 16:53:31 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 20.01.2012 19:01:57 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 22.01.2012 15:57:38 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 26.01.2012 22:19:00 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 30.01.2012 14:35:13 | Computer Name = A-Schreiner | Source = WinMgmt | ID = 10

Description = 

 

Error - 30.01.2012 14:37:37 | Computer Name = A-Schreiner | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung nvcplui.exe, Version 3.9.731.0, Zeitstempel 

0x4e991d0e, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,

 Ausnahmecode 0xc0000005, Fehleroffset 0x006ae478,  Prozess-ID 0x1440, Anwendungsstartzeit

 01ccdf7e19f7ceaa.

 

[ ASUS Security Protect Manager Events ]

Error - 23.05.2010 10:00:16 | Computer Name = A-Schreiner | Source = AuthWiz | ID = 100796068

Description = The submitted credentials were rejected.    User: FeelDaPain@A-SCHREINER

Credentials:

 Password   Error: (0xC516020B) The system could not log you on.  Verify your user

 name and domain are correct and then type your password again.  Letters in passwords

 must be typed using the correct case.  Verify that Caps Lock is off.

 

[ Media Center Events ]

Error - 02.12.2009 00:00:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:05:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:10:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:15:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:20:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:25:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:30:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:35:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:40:44 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

Error - 02.12.2009 00:44:01 | Computer Name = A-Schreiner | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerAccumulate failed;

 Win32 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center

 Guide 

 

[ System Events ]

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:40 | Computer Name = A-Schreiner | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 27.02.2012 14:58:43 | Computer Name = A-Schreiner | Source = Microsoft-Windows-LanguagePackSetup | ID = 1003

Description = 

 

[ TuneUp Events ]

Error - 23.06.2010 19:47:01 | Computer Name = A-Schreiner | Source = TuneUp.UtilitiesSvc | ID = 300

Description = 

 

 

< End of report >

--- --- ---

danke schonmal!