Trojaner-Board - Trojaner / Windowslizens ist abgelaufen

Guten morgen Zusammen,

ich hab einen Tojaner auf meinem Rechnr.
Habe die OTLPE schon gemacht wie beschrieben und hab nun hier die Files
Mein Rechner hat den Virus - Ihre Windows-Liyens ist abgelaufen.....etc.

OTL logfile created on: 5/9/2012 11:28:50 AM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 97.65 Gb Total Space | 80.88 Gb Free Space | 82.83% Space Free | Partition Type: NTFS
Drive D: | 368.10 Gb Total Space | 361.23 Gb Free Space | 98.13% Space Free | Partition Type: NTFS
Drive E: | 46.58 Gb Total Space | 42.09 Gb Free Space | 90.37% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - [2012/05/08 05:45:18 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 05:45:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/04/27 04:10:56 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINXP\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/28 15:54:21 | 003,417,376 | ---- | M] () [Auto] -- C:\programme\gemeinsame dateien\akamai/netsession_win_6c825ce.dll -- (Akamai)
SRV - [2011/08/01 12:24:00 | 003,889,424 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- C:\WINXP\System32\GameMon.des -- (npggsvc)
SRV - [2011/06/17 03:33:46 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/09/11 16:04:12 | 001,488,128 | ---- | M] (O&O Software GmbH) [Auto] -- C:\Programme\OO Software\Defrag\oodag.exe -- (O&O Defrag)
SRV - [2009/02/03 19:38:36 | 000,095,896 | ---- | M] (SiSoftware) [On_Demand] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP2\RpcAgentSrv.exe -- (SandraAgentSrv)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2012/05/08 05:45:19 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/08 05:45:19 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINXP\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/09/16 03:24:40 | 000,020,032 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2011/09/15 15:25:04 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/08/21 10:13:45 | 000,019,720 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV - [2011/08/21 10:13:45 | 000,014,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\LGVirHid.sys -- (LGVirHid)
DRV - [2011/06/02 01:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 01:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/06/02 01:47:22 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)
DRV - [2011/06/02 01:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2011/04/30 08:00:20 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011/04/30 08:00:18 | 000,039,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011/04/30 08:00:06 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011/04/30 07:59:56 | 000,012,184 | ---- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINXP\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2010/12/21 01:55:02 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2010/12/21 01:55:02 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2010/12/21 01:55:02 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010/12/21 01:55:02 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2010/06/17 06:44:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/08/17 10:46:06 | 001,390,976 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2009/08/07 17:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP2\WNt500x86\sandra.sys -- (SANDRA)
DRV - [2008/07/17 14:10:32 | 000,109,952 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2004/08/13 02:26:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ASACPI.sys -- (MTsensor)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

IE - HKU\Tuppi_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKU\Tuppi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Tuppi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Tuppi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\WINXP\system32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/08/21 10:47:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

[2011/10/07 15:22:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011/08/21 10:55:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/08/12 02:13:04 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011/08/12 00:19:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/08/12 00:14:12 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011/08/12 00:19:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/12 00:19:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/08/12 00:19:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/08/12 00:19:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2008/04/14 05:00:00 | 000,000,820 | ---- | M]) - C:\WINXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EvtMgr6] C:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Launch LCore] C:\Programme\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINXP\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINXP\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\Tuppi_ON_C..\Run: [24C4E241] C:\WINXP\system32\58345A0A24C4E241431D.exe (cola coca cia)
O4 - HKU\Tuppi_ON_C..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\Tuppi\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Tuppi_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Tuppi_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Tuppi_ON_C..\Run: [LightScribe Control Panel] File not found
O4 - HKU\.DEFAULT..\RunOnce: [_nltide_2] File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [_nltide_2] File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [_nltide_2] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Tuppi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\Tuppi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Tuppi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\Tuppi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Tuppi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINXP\system32\58345A0A24C4E241431D.exe) - C:\WINXP\system32\58345A0A24C4E241431D.exe (cola coca cia)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/08/21 05:01:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINXP\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINXP\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINXP\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - DOTNETFRAMEWORKS
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINXP\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINXP\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINXP\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINXP\system32\rundll32.exe" "C:\WINXP\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Tuppi^Startmenü^Programme^Autostart^Logitech . Produktregistrierung.lnk - C:\Programme\Gemeinsame Dateien\Logishrd\eReg\SetPoint\eReg.exe - (Leader Technologies/Logitech)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Tuppi^Startmenü^Programme^Autostart^OpenOffice.org 3.2.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

========== Files/Folders - Created Within 30 Days ==========

[2012/05/08 16:40:18 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Tuppi\Recent
[2012/05/08 16:10:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Ohvfrakry
[2012/05/08 16:10:15 | 000,065,536 | -H-- | C] (cola coca cia) -- C:\WINXP\System32\58345A0A24C4E241431D.exe
[2012/05/05 10:01:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\TS3Client
[2012/05/05 10:01:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeamSpeak 3 Client
[2012/05/02 01:08:27 | 000,000,000 | ---D | C] -- C:\WINXP\SxsCaPendDel
[2012/05/02 01:07:37 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/04/30 05:22:35 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Tuppi\PrivacIE
[2012/04/27 04:10:56 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerApp.exe
[2012/04/18 17:53:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Eigene Dateien\FILSHtray
[2012/04/18 17:53:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Lokale Einstellungen\Anwendungsdaten\FILSH_Media_GmbH
[2012/04/18 17:53:29 | 000,000,000 | ---D | C] -- C:\Programme\FILSHtray
[2012/04/18 17:53:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FILSHtray
[2012/04/18 17:18:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\ts3overlay
[2012/04/18 17:18:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\ts3overlay
[2012/04/16 03:07:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Apple Computer
[3 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ]
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/09 03:31:48 | 000,000,664 | ---- | M] () -- C:\WINXP\System32\d3d9caps.dat
[2012/05/09 03:30:55 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat
[2012/05/09 03:30:52 | 000,475,948 | ---- | M] () -- C:\WINXP\System32\oodbs.lor
[2012/05/08 16:40:27 | 000,071,400 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/05/08 16:40:25 | 000,129,254 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012/05/08 16:10:15 | 000,065,536 | -H-- | M] (cola coca cia) -- C:\WINXP\System32\58345A0A24C4E241431D.exe
[2012/05/08 05:45:19 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINXP\System32\drivers\avipbb.sys
[2012/05/08 05:45:19 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINXP\System32\drivers\avgntflt.sys
[2012/05/07 14:06:55 | 000,012,136 | ---- | M] () -- C:\Dokumente und Einstellungen\Tuppi\Desktop\Filmprojekt.odt
[2012/05/07 06:37:46 | 000,070,108 | ---- | M] () -- C:\Dokumente und Einstellungen\Tuppi\Eigene Dateien\ts3_clientui-win32-1334913258-2012-05-07 12_37_45.937500.dmp
[2012/05/06 05:18:00 | 000,030,720 | ---- | M] () -- C:\Dokumente und Einstellungen\Tuppi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/05 10:01:01 | 000,000,815 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamSpeak 3 Client.lnk
[2012/05/05 10:01:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeamSpeak 3 Client
[2012/05/04 03:42:39 | 000,002,206 | ---- | M] () -- C:\WINXP\System32\wpa.dbl
[2012/05/03 23:52:20 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh325
[2012/05/03 23:41:54 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh324
[2012/05/03 23:27:28 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh323
[2012/05/03 23:26:12 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh322
[2012/05/03 23:23:16 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh321
[2012/05/03 23:20:38 | 000,481,078 | ---- | M] () -- C:\WINXP\System32\winsh320
[2012/05/03 17:17:02 | 000,922,132 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1644491937-1935655697-1801674531-1003-0.dat
[2012/04/27 04:10:57 | 000,000,880 | ---- | M] () -- C:\WINXP\tasks\Adobe Flash Player Updater.job
[2012/04/27 04:10:56 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerApp.exe
[2012/04/27 04:10:56 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerCPLApp.cpl
[2012/04/21 04:29:13 | 000,517,438 | ---- | M] () -- C:\WINXP\System32\perfh007.dat
[2012/04/21 04:29:13 | 000,494,106 | ---- | M] () -- C:\WINXP\System32\perfh009.dat
[2012/04/21 04:29:13 | 000,101,590 | ---- | M] () -- C:\WINXP\System32\perfc007.dat
[2012/04/21 04:29:13 | 000,084,650 | ---- | M] () -- C:\WINXP\System32\perfc009.dat
[2012/04/18 18:35:08 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
[2012/04/18 17:53:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FILSHtray
[2012/04/15 03:05:37 | 000,274,212 | ---- | M] () -- C:\WINXP\System32\nvdrsdb1.bin
[2012/04/15 03:05:37 | 000,274,212 | ---- | M] () -- C:\WINXP\System32\nvdrsdb0.bin
[2012/04/15 03:05:37 | 000,000,001 | ---- | M] () -- C:\WINXP\System32\nvdrssel.bin
[2012/04/11 11:02:02 | 000,000,755 | ---- | M] () -- C:\Dokumente und Einstellungen\Tuppi\Desktop\Verknüpfung mit camtest.exe.lnk
[2012/04/11 05:26:51 | 000,001,374 | ---- | M] () -- C:\WINXP\imsins.BAK
[2012/04/11 02:26:29 | 000,002,333 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader X.lnk
[3 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ]
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/09 03:14:10 | 000,000,664 | ---- | C] () -- C:\WINXP\System32\d3d9caps.dat
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh325
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh324
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh323
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh322
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh321
[2012/05/08 16:10:34 | 000,481,078 | ---- | C] () -- C:\WINXP\System32\winsh320
[2012/05/07 14:06:54 | 000,012,136 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Desktop\Filmprojekt.odt
[2012/05/07 06:37:45 | 000,070,108 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Eigene Dateien\ts3_clientui-win32-1334913258-2012-05-07 12_37_45.937500.dmp
[2012/05/05 10:01:01 | 000,000,815 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamSpeak 3 Client.lnk
[2012/04/27 04:10:57 | 000,000,880 | ---- | C] () -- C:\WINXP\tasks\Adobe Flash Player Updater.job
[2012/04/19 18:07:50 | 000,000,023 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Desktop\daoc.bat
[2012/04/11 11:02:05 | 000,000,755 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Desktop\Verknüpfung mit camtest.exe.lnk
[2012/03/23 15:47:09 | 000,000,754 | ---- | C] () -- C:\WINXP\WORDPAD.INI
[2012/03/04 06:32:42 | 1799,350,784 | ---- | C] () -- C:\WINXP\System32\MAESTIA_SETUP-1.bin
[2012/03/04 06:30:34 | 1257,667,440 | ---- | C] () -- C:\WINXP\System32\MAESTIA_SETUP-2.bin
[2012/02/29 06:35:25 | 011,304,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Sandra.mdb
[2012/02/17 16:30:08 | 000,003,072 | ---- | C] () -- C:\WINXP\System32\iacenc.dll
[2012/02/13 18:32:57 | 000,071,400 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/01/29 11:36:54 | 000,018,604 | -H-- | C] () -- C:\WINXP\System32\mlfcache.dat
[2011/10/23 01:07:14 | 000,000,258 | ---- | C] () -- C:\WINXP\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/10/01 08:15:52 | 000,922,132 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1644491937-1935655697-1801674531-1003-0.dat
[2011/10/01 08:15:52 | 000,129,254 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011/09/16 03:24:48 | 000,030,568 | ---- | C] () -- C:\WINXP\MusiccityDownload.exe
[2011/09/16 03:24:44 | 000,974,848 | ---- | C] () -- C:\WINXP\System32\cis-2.4.dll
[2011/09/16 03:24:44 | 000,081,920 | ---- | C] () -- C:\WINXP\System32\issacapi_bs-2.3.dll
[2011/09/16 03:24:44 | 000,065,536 | ---- | C] () -- C:\WINXP\System32\issacapi_pe-2.3.dll
[2011/09/16 03:24:44 | 000,057,344 | ---- | C] () -- C:\WINXP\System32\issacapi_se-2.3.dll
[2011/09/02 03:16:03 | 000,030,720 | ---- | C] () -- C:\Dokumente und Einstellungen\Tuppi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/21 10:32:16 | 000,004,212 | -H-- | C] () -- C:\WINXP\System32\zllictbl.dat
[2011/08/21 08:36:09 | 000,274,212 | ---- | C] () -- C:\WINXP\System32\nvdrsdb1.bin
[2011/08/21 08:36:09 | 000,274,212 | ---- | C] () -- C:\WINXP\System32\nvdrsdb0.bin
[2011/08/21 08:36:09 | 000,000,001 | ---- | C] () -- C:\WINXP\System32\nvdrssel.bin
[2011/08/21 08:35:52 | 002,123,582 | ---- | C] () -- C:\WINXP\System32\nvdata.data
[2011/08/21 05:52:36 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI
[2011/08/21 05:51:34 | 000,120,544 | ---- | C] () -- C:\WINXP\System32\FNTCACHE.DAT
[2011/08/21 05:03:41 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat
[2011/08/21 04:58:45 | 000,021,740 | ---- | C] () -- C:\WINXP\System32\emptyregdb.dat
[2011/08/21 03:10:19 | 000,005,810 | ---- | C] () -- C:\WINXP\System32\drivers\ASACPI.sys
[2011/08/21 02:52:40 | 000,001,769 | ---- | C] () -- C:\WINXP\Language_trs.ini
[2008/04/14 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINXP\System32\oembios.bin
[2008/04/14 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINXP\System32\mlang.dat
[2008/04/14 05:00:00 | 000,517,438 | ---- | C] () -- C:\WINXP\System32\perfh007.dat
[2008/04/14 05:00:00 | 000,494,106 | ---- | C] () -- C:\WINXP\System32\perfh009.dat
[2008/04/14 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINXP\System32\perfi009.dat
[2008/04/14 05:00:00 | 000,269,480 | ---- | C] () -- C:\WINXP\System32\perfi007.dat
[2008/04/14 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINXP\System32\dssec.dat
[2008/04/14 05:00:00 | 000,101,590 | ---- | C] () -- C:\WINXP\System32\perfc007.dat
[2008/04/14 05:00:00 | 000,084,650 | ---- | C] () -- C:\WINXP\System32\perfc009.dat
[2008/04/14 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINXP\System32\mib.bin
[2008/04/14 05:00:00 | 000,034,478 | ---- | C] () -- C:\WINXP\System32\perfd007.dat
[2008/04/14 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINXP\System32\perfd009.dat
[2008/04/14 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINXP\System32\secupd.dat
[2008/04/14 05:00:00 | 000,004,463 | ---- | C] () -- C:\WINXP\System32\oembios.dat
[2008/04/14 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINXP\System32\Dcache.bin
[2008/04/14 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINXP\System32\noise.dat

========== LOP Check ==========

[2012/04/18 17:18:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\ts3overlay
[2011/08/27 13:26:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\DaocTB
[2011/08/21 09:42:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Electronic Arts
[2011/08/21 13:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Leadertech
[2012/05/08 16:10:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Ohvfrakry
[2011/08/21 10:56:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\OpenOffice.org
[2012/03/24 05:28:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Oracle
[2011/10/01 06:31:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Samsung
[2012/03/12 14:12:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Themes
[2011/08/21 14:02:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\Thunderbird
[2012/05/06 02:34:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\TS3Client
[2012/04/18 17:18:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tuppi\Anwendungsdaten\ts3overlay
[2011/08/24 03:57:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011/10/01 06:32:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2012/01/29 11:34:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2012/05/03 03:31:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011/08/21 05:05:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2012/01/10 05:46:56 | 000,000,000 | -HSD | M] -- C:\found.000
[2011/08/21 02:52:49 | 000,000,000 | ---D | M] -- C:\Intel
[2011/12/25 09:48:31 | 000,000,000 | ---D | M] -- C:\Program Files
[2012/05/02 01:09:02 | 000,000,000 | R--D | M] -- C:\Programme
[2011/08/21 05:11:21 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/05/09 03:13:50 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/02/29 06:33:52 | 000,000,000 | ---D | M] -- C:\Temp
[2012/05/02 01:08:27 | 000,000,000 | ---D | M] -- C:\WINXP

< %PROGRAMFILES%\*.exe >

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

< %systemroot%\*. /mp /s >

< MD5 for: AGP440.SYS >
[2008/12/10 10:36:09 | 017,815,374 | ---- | M] () .cab file -- C:\WINXP\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/12/10 10:36:09 | 017,815,374 | ---- | M] () .cab file -- C:\WINXP\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINXP\system32\dllcache\atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINXP\system32\drivers\atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINXP\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2008/04/13 14:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINXP\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINXP\system32\dllcache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINXP\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008/04/14 05:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINXP\explorer.exe
[2008/04/14 05:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINXP\system32\dllcache\explorer.exe

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINXP\system32\dllcache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINXP\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINXP\system32\dllcache\scecli.dll
[2008/04/14 05:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINXP\system32\scecli.dll

< MD5 for: USER32.DLL >
[2008/04/14 05:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINXP\system32\dllcache\user32.dll
[2008/04/14 05:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINXP\system32\user32.dll

< MD5 for: USERINIT.EXE >
[2008/04/14 05:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINXP\system32\dllcache\userinit.exe
[2008/04/14 05:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINXP\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/14 05:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINXP\system32\dllcache\winlogon.exe
[2008/04/14 05:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINXP\system32\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2008/04/14 05:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINXP\system32\dllcache\ws2ifsl.sys
[2008/04/14 05:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINXP\system32\drivers\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2011/08/21 06:50:43 | 000,094,208 | ---- | M] () -- C:\WINXP\System32\config\default.sav
[2011/08/21 06:50:43 | 001,093,632 | ---- | M] () -- C:\WINXP\System32\config\software.sav
[2011/08/21 06:50:43 | 000,454,656 | ---- | M] () -- C:\WINXP\System32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2011/03/03 02:53:44 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\dnsapi.dll
[2012/03/02 00:00:10 | 011,082,752 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\ieframe.dll
[2012/03/01 07:00:08 | 002,000,384 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\iertutil.dll
[2008/04/14 05:00:00 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\mstask.dll
[2008/04/14 05:00:00 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\ntdsapi.dll
[2011/01/21 10:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\shell32.dll
[1 C:\WINXP\system32\*.tmp files -> C:\WINXP\system32\*.tmp -> ]

Invalid Environment Variable: %USERPROFILE%\*.*

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >

Ich hoffe sehr, ihr koennt mir helfen, denn ich muss dringend arbeiten