| baerle97 | 25.04.2011 10:02 |
PC langsam und hängt / Desktop verändert / öfter Bluescreens / vermutlich TR/Kazy.19785.2
Hallo,
erst mal großes Kompliment für Eure tolle Arbeit. Hat mir schon öfter weiter geholfen nur durch mitlesen.
Mein PC macht mir leider schon seit einiger Zeit Sorgen. Er stürzt immer mal wieder mit einem Bluescreen "URL_LESS_OR_EQUAL..." ab. Da ich das schon mal hatte, als die Graphikkarte defekt war, dachte ich, es liegt vielleicht daran, dass mal wieder was kaputt geht.
Dann ging es weiter mit plötzlichen Hängern. Dann ging gar nix mehr. Keine Taste, keine Maus - nur mit dem Hauptschalter war der PC neu zu starten. Außerdem ist er immer langsamer geworden.
Ich lasse immer über Nacht den Virenscanner laufen und da der bis letzten Donnerstag nichts gemeldet hat, bin ich weiterhin von Hardwareproblemen ausgegangen. Dann hat Avira am 21.04. 2 Funde gemeldet und in Quarantäne verschoben. Ich habe beide dann gelöscht. Beim nächsten Scan gab es keine Meldung mehr aber der PC hing immer nach dem Scandurchlauf.
Dann waren plötzlich alle Icons auf dem Desktop verschoben. Ich habe daraufhin einen Wiederherstellungspunkt vor dem 21.04 hergestellt vorauf die Icons wieder normal waren. Allerdings meine ich, dass die Taskleiste leicht verändert wirkt.
Dann hat es angefangen, dass die Links von Google-Suchen verändert waren und ich auf völlig andere Seiten geleitet worden bin. Auch konnte man teilweise keine Tabs im Firefox oder IE mehr schließen. Auch Outlook hat sich immer öfter mit der Meldung "Keine Rückmeldung" verabschiedet.
Seit neuestem kann es sein, dass der PC ohne explorer.exe startet. Man kann diese auch nicht über den Taskmanager aufrufen. Bei einem 2. Kaltstart fährt er aber normal hoch. Aber dann erscheint ein Fenster mit dem Titel: "SetIcon" und der Meldung: "Fialed to Register hNotification - Application exiting". (kein Schreibfehler - es heißt wirklich Fialed!)
Hier ist das Log von Malwarebytes: Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6439
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
25.04.2011 10:58:55
mbam-log-2011-04-25 (10-58-55).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 176902
Laufzeit: 5 Minute(n), 34 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Und hier noch die Ergebnisse von OTL: Code:
OTL logfile created on: 25.04.2011 10:09:05 - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = H:\_Install\Tools_Security
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 13,60 Gb Free Space | 27,86% Space Free | Partition Type: NTFS
Drive F: | 3,08 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive H: | 249,25 Gb Total Space | 12,81 Gb Free Space | 5,14% Space Free | Partition Type: NTFS
Computer Name: ZEUSS | User Name: THP | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.04.25 10:04:38 | 000,580,608 | ---- | M] (OldTimer Tools) -- H:\_Install\Tools_Security\OTL.exe
PRC - [2011.04.21 18:22:15 | 002,146,496 | ---- | M] (Lavasoft Limited) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011.03.17 01:33:22 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.02 16:45:33 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.03.17 00:29:56 | 000,300,992 | ---- | M] (LG Electronics) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.09.05 17:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2009.01.19 14:27:19 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\bgsvcgen.exe
PRC - [2008.12.16 22:59:50 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2008.08.28 19:34:14 | 013,145,448 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\Adobe\Adobe Photoshop CS4\Adobe Bridge CS4\Bridge.exe
PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.10.26 10:38:58 | 000,061,440 | ---- | M] (Deutsche Post AG) -- C:\Programme\STAMPIT\Binary\STRAY.EXE
PRC - [2007.07.03 03:04:00 | 000,491,520 | ---- | M] (AVM Berlin) -- C:\Programme\avmclient\AvmObex.exe
PRC - [2007.07.03 03:04:00 | 000,221,184 | ---- | M] (AVM Berlin) -- C:\Programme\avmclient\AvmObexService.exe
PRC - [2006.10.26 14:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
PRC - [2006.04.24 15:25:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
========== Modules (SafeList) ==========
MOD - [2011.04.25 10:04:38 | 000,580,608 | ---- | M] (OldTimer Tools) -- H:\_Install\Tools_Security\OTL.exe
MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- -- (Microsoft Office Groove Audit Service)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Disabled | Stopped] -- -- (hasplms)
SRV - [2011.04.21 18:22:15 | 002,146,496 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011.03.17 01:33:22 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.02 16:45:36 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.04.15 04:09:10 | 000,822,560 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Temp\0059341303374958mcinst.exe -- (0059341303374958mcinstcleanup) McAfee Application Installer Cleanup (0059341303374958)
SRV - [2009.10.12 12:13:24 | 000,671,368 | ---- | M] (Acunetix Ltd.) [Disabled | Stopped] -- C:\Programme\Acunetix\Web Vulnerability Scanner 6\WVSScheduler.exe -- (AcuWVSSchedulerv6)
SRV - [2009.02.23 16:33:39 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.01.19 14:27:19 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\WINDOWS\System32\bgsvcgen.exe -- (bgsvcgen)
SRV - [2008.12.16 22:59:50 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.11.07 15:28:16 | 000,132,424 | ---- | M] (Apple Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2008.10.30 18:59:06 | 001,650,782 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Programme\VMware\VMware Server\vmserverdWin32.exe -- (vmserverdWin32)
SRV - [2008.10.30 18:59:06 | 000,147,548 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Programme\VMware\VMware Server\vmware-authd.exe -- (VMAuthdService)
SRV - [2008.10.30 18:59:06 | 000,135,168 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\WINDOWS\system32\vmnat.exe -- (VMware NAT Service)
SRV - [2008.10.30 18:59:06 | 000,106,496 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\WINDOWS\system32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2007.08.24 04:19:12 | 000,443,776 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.07.03 03:04:00 | 000,405,504 | ---- | M] (AVM Berlin) [On_Demand | Stopped] -- C:\Programme\avmclient\avmbtservice.exe -- (AVM BT Connection Service)
SRV - [2007.07.03 03:04:00 | 000,221,184 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmclient\AvmObexService.exe -- (AvmObexService)
SRV - [2007.05.01 13:28:46 | 000,269,104 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\VMware\VMware Virtual Image Editing\vmount2.exe -- (vmount2)
SRV - [2007.01.31 15:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Stopped] -- C:\Programme\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.10.26 14:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM)
SRV - [2006.04.24 15:25:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
========== Driver Services (SafeList) ==========
DRV - [2011.04.19 02:00:29 | 000,064,512 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2011.04.19 02:00:28 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2011.03.17 01:33:22 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.23 01:33:26 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.10.12 21:24:56 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Programme\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009.10.12 21:24:54 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009.10.12 21:24:52 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.08.06 15:43:22 | 000,013,359 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SYDEXFDD.SYS -- (SydexFDD)
DRV - [2009.07.09 15:18:56 | 000,587,776 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (hardlock)
DRV - [2009.06.22 11:06:32 | 000,016,384 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aksusb.sys -- (aksusb)
DRV - [2009.05.12 15:53:04 | 000,016,896 | ---- | M] (Danish Wireless Design A/S) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\FlashUsb.sys -- (FlashUSB)
DRV - [2009.05.11 12:31:32 | 000,102,664 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2009.05.11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.05.05 09:59:02 | 000,022,168 | R--- | M] (VIA Technologies,Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\xfilt.sys -- (xfilt)
DRV - [2009.05.05 09:58:30 | 000,013,976 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32)
DRV - [2009.03.30 03:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009.03.13 12:55:26 | 000,238,208 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshasp.sys -- (akshasp)
DRV - [2009.01.19 14:27:19 | 000,033,408 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
DRV - [2009.01.17 02:42:25 | 000,103,488 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2009.01.16 13:42:28 | 000,352,256 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008.12.17 08:01:20 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008.12.17 08:00:12 | 000,768,024 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2008.12.17 07:53:44 | 002,686,104 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.12.17 07:53:22 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2008.12.16 22:58:54 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2008.11.19 17:09:10 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 17:09:08 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 17:09:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.10.30 18:59:06 | 000,097,152 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\vmx86.sys -- (vmx86)
DRV - [2008.10.30 18:59:06 | 000,023,296 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2008.10.30 18:59:06 | 000,022,016 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hcmon.sys -- (hcmon)
DRV - [2008.10.30 18:59:06 | 000,021,888 | R--- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmusb.sys -- (vmusb)
DRV - [2008.10.30 18:59:06 | 000,015,872 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2008.10.30 18:59:06 | 000,009,600 | R--- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2008.10.30 18:59:06 | 000,009,216 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\vmparport.sys -- (VMparport)
DRV - [2008.09.28 05:09:50 | 000,027,544 | ---- | M] (simonowen.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fdrawcmd.sys -- (fdrawcmd)
DRV - [2008.05.07 20:21:40 | 004,739,072 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.04.14 01:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2007.10.25 17:07:24 | 000,334,640 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Netfritz.sys -- (NETFRITZ)
DRV - [2007.07.23 16:12:44 | 000,046,336 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshhl.sys -- (akshhl)
DRV - [2007.07.03 03:04:00 | 000,882,688 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bfubase.sys -- (BFUBASE)
DRV - [2007.07.03 03:04:00 | 000,374,144 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\capi_cip.sys -- (CAPI_CIP)
DRV - [2007.07.03 03:04:00 | 000,033,354 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\netbfpan.sys -- (NETBFPAN)
DRV - [2007.07.03 03:04:00 | 000,006,656 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bfhu_cfg.sys -- (BFHU_CFG)
DRV - [2007.07.03 02:04:00 | 000,061,952 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmbtpar.sys -- (AVMBTPARALLEL)
DRV - [2007.07.03 02:04:00 | 000,060,928 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmbtser.sys -- (AVMBTSERIAL)
DRV - [2007.07.03 02:04:00 | 000,052,352 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmbtsnd.sys -- (AVMBTSND)
DRV - [2007.05.03 12:19:16 | 000,066,472 | ---- | M] (AVM Berlin) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\avmport.sys -- (AVMPORT)
DRV - [2007.05.01 13:28:24 | 000,018,480 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\Gemeinsame Dateien\VMware\VMware Virtual Image Editing\vstor2.sys -- (vstor2)
DRV - [2006.10.10 09:16:24 | 001,105,664 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\3xHybrid.sys -- (3xHybrid)
DRV - [2005.05.19 17:52:58 | 000,017,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2004.05.02 10:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv)
DRV - [2004.04.20 03:00:00 | 000,547,840 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fxusbase.sys -- (fxusbase) BlueFRITZ! AP-X (WinXP/2000)
DRV - [2004.04.20 03:00:00 | 000,053,120 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2001.08.17 13:13:48 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {62760FD6-B943-48C9-AB09-F99C6FE96088}:2.1.6
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 8888
FF - prefs.js..network.proxy.type: 2
FF - HKLM\software\mozilla\Firefox\Extensions\\fiddlerhook@fiddler2.com: C:\Programme\Fiddler2\FiddlerHook [2009.10.20 11:31:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.03.23 15:20:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.03.23 15:20:15 | 000,000,000 | ---D | M]
[2009.01.14 21:43:03 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Extensions
[2011.04.24 13:28:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions
[2011.01.10 16:02:36 | 000,000,000 | ---D | M] ("Garmin Communicator") -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010.04.28 10:31:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.06 17:46:52 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.12.17 12:05:36 | 000,000,000 | ---D | M] (eBay Sidebar for Firefox) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}
[2011.02.10 10:19:44 | 000,000,000 | ---D | M] (Sage) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{a6ca9b3b-5e52-4f47-85d8-cca35bb57596}
[2010.12.17 12:05:38 | 000,000,000 | ---D | M] (FireFTP) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2009.03.31 17:02:41 | 000,000,000 | ---D | M] (Fiddler Switch) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{c3db65d3-44a2-4fd6-9a3b-cbb9691c7dfe}
[2011.02.10 10:19:43 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.21 10:15:19 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2009.10.19 16:11:51 | 000,000,000 | ---D | M] (Acunetix Web Scanner (Free Edition)) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\acunetixwebscanner@attila.gerendi
[2011.02.10 10:20:01 | 000,000,000 | ---D | M] (Firebug) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\firebug@software.joehewitt.com
[2011.02.23 12:54:29 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Mozilla\Firefox\Profiles\pa41hxy6.default\extensions\inspector@mozilla.org
[2011.04.24 13:28:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.05.03 12:58:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.27 10:29:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.10.21 16:21:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.19 09:41:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010.05.03 12:58:31 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009.10.26 18:25:14 | 000,027,976 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\atgpcdec.dll
[2009.10.26 18:25:15 | 000,126,360 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\atgpcext.dll
[2009.10.26 18:25:30 | 000,098,712 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\ieatgpc.dll
[2008.06.19 10:16:24 | 000,118,784 | ---- | M] (CANON INC.) -- C:\Programme\Mozilla Firefox\plugins\MyCamera.dll
[2009.10.26 18:25:13 | 000,060,824 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\npatgpc.dll
[2008.06.19 10:16:24 | 000,053,248 | ---- | M] (CANON INC.) -- C:\Programme\Mozilla Firefox\plugins\NPCIG.dll
[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.05.13 17:22:15 | 000,000,849 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMBLUEOBEX] C:\Programme\avmclient\AvmObex.exe (AVM Berlin)
O4 - HKLM..\Run: [B2C_AGENT] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SetIcon] File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [AdobeBridge] C:\Program Files\Adobe\Adobe Photoshop CS4\Adobe Bridge CS4\Bridge.exe (Adobe Systems, Inc.)
O4 - HKCU..\Run: [STAMPIT-Tray] C:\Programme\STAMPIT\Binary\STRAY.EXE (Deutsche Post AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O8 - Extra context menu item: &Download by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O15 - HKCU\..Trusted Domains: ksieben-coaching.de ([www] https in Vertrauenswürdige Sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab (DLM Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1232394491015 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.dll - C:\Programme\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.14 20:56:21 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{3feb2236-b963-11de-a79b-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{3feb2236-b963-11de-a79b-005056c00008}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3feb2236-b963-11de-a79b-005056c00008}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
O33 - MountPoints2\{82b4ff77-71fd-11df-a7d4-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{82b4ff77-71fd-11df-a7d4-005056c00008}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{82b4ff77-71fd-11df-a7d4-005056c00008}\Shell\AutoRun\command - "" = E:\DPFMate.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.04.24 14:04:10 | 000,064,512 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2011.04.24 14:04:06 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011.04.24 14:02:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Anwendungsdaten\Sunbelt Software
[2011.04.24 13:57:24 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{AA5544E4-9BBC-419B-9204-40B5924D26AA}
[2011.04.24 13:57:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Lavasoft
[2011.04.20 10:34:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\THP\Desktop\ENBW
[2011.04.19 14:16:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Embird 2010
[2011.04.19 14:01:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2011.04.19 14:01:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2011.04.19 11:40:34 | 000,000,000 | ---D | C] -- C:\Programme\EMBIRD32
[2011.04.18 22:02:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\EMBIRD32_STUDIO_N
[2011.04.18 21:58:54 | 000,052,306 | ---- | C] (Simon Owen) -- C:\WINDOWS\FdUninstall.exe
[2011.04.08 08:04:07 | 000,000,000 | ---D | C] -- C:\Programme\Free PDF to Word Doc Converter
[2011.04.08 08:04:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Free PDF to Word Doc Converter
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 H:\Eigene Dateien\*.tmp files -> H:\Eigene Dateien\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.04.25 10:09:44 | 000,000,623 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\OTL.exe.lnk
[2011.04.25 10:00:33 | 000,250,364 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2011.04.25 10:00:26 | 000,000,484 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011.04.25 10:00:23 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.25 10:00:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.25 08:24:02 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.25 07:56:21 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.04.24 14:23:48 | 000,001,078 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.24 14:04:32 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2011.04.24 14:04:32 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2011.04.24 14:04:03 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011.04.24 13:57:23 | 000,000,865 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\Ad-Aware.lnk
[2011.04.24 13:57:23 | 000,000,847 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ad-Aware.lnk
[2011.04.21 11:00:50 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\Outlook 2007.lnk
[2011.04.21 10:41:50 | 000,003,972 | ---- | M] () -- C:\WINDOWS\sounder.his
[2011.04.19 14:16:23 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\Embird 2010 Build 8.8 C.lnk
[2011.04.19 14:16:20 | 000,013,899 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2011.04.19 09:57:21 | 000,000,039 | ---- | M] () -- C:\WINDOWS\System32\mscandc.ini
[2011.04.19 02:00:29 | 000,064,512 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2011.04.18 21:58:54 | 000,052,306 | ---- | M] (Simon Owen) -- C:\WINDOWS\FdUninstall.exe
[2011.04.18 12:23:39 | 000,016,432 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2011.04.16 03:42:08 | 002,476,600 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.16 03:22:14 | 000,672,010 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.16 03:22:14 | 000,613,112 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.16 03:22:14 | 000,162,054 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.16 03:22:14 | 000,129,386 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.04.14 14:17:55 | 000,000,069 | ---- | M] () -- C:\WINDOWS\Ulead32.INI
[2011.04.14 11:41:53 | 000,401,020 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\Shopanbieter-Ratgeber_DDoS_oB.pdf
[2011.04.14 11:40:38 | 000,002,675 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\ratgeber_ddos_print.php
[2011.04.14 10:31:59 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.04.11 14:23:36 | 000,086,016 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.08 08:04:07 | 000,000,720 | ---- | M] () -- C:\Dokumente und Einstellungen\THP\Desktop\Free PDF to Word Doc Converter.lnk
[2011.04.04 11:19:47 | 2145,824,768 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 H:\Eigene Dateien\*.tmp files -> H:\Eigene Dateien\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.04.25 10:09:44 | 000,000,623 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\OTL.exe.lnk
[2011.04.24 21:48:32 | 000,016,432 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2011.04.24 14:07:00 | 000,000,865 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\Ad-Aware.lnk
[2011.04.24 14:04:32 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011.04.24 14:04:32 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2011.04.24 14:04:23 | 000,000,484 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011.04.24 13:57:23 | 000,000,847 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ad-Aware.lnk
[2011.04.24 13:27:06 | 000,001,710 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\HijackThis.lnk
[2011.04.21 10:58:16 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.04.20 11:01:42 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\Embird 2010 Build 8.8 C.lnk
[2011.04.19 14:15:39 | 000,013,899 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2011.04.14 11:41:53 | 000,401,020 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\Shopanbieter-Ratgeber_DDoS_oB.pdf
[2011.04.14 11:40:34 | 000,002,675 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\ratgeber_ddos_print.php
[2011.04.08 08:04:07 | 000,000,720 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Desktop\Free PDF to Word Doc Converter.lnk
[2010.07.15 03:23:05 | 000,579,088 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-790525478-1532298954-839522115-1003-0.dat
[2010.07.15 03:22:58 | 000,542,682 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.04.13 16:08:10 | 000,221,291 | ---- | C] () -- C:\WINDOWS\Imei_dll.dll
[2010.04.13 16:08:10 | 000,040,960 | ---- | C] () -- C:\WINDOWS\Sublock.dll
[2010.04.13 11:45:51 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\CommonDL.dll
[2010.04.13 11:45:51 | 000,002,412 | ---- | C] () -- C:\WINDOWS\System32\lgAxconfig.ini
[2010.03.30 16:37:40 | 000,000,315 | ---- | C] () -- C:\WINDOWS\PDFLetter.INI
[2010.03.30 15:52:50 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2010.03.30 15:31:51 | 000,080,896 | ---- | C] () -- C:\WINDOWS\cadkasdeinst01.exe
[2010.01.18 17:06:18 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\lfkodak.dll
[2010.01.18 17:06:17 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[2009.12.23 19:38:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PURREC.INI
[2009.12.23 19:38:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DEFMERGE.INI
[2009.12.16 17:19:34 | 000,000,120 | ---- | C] () -- C:\WINDOWS\WINRESAZ.INI
[2009.12.11 08:35:05 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009.10.19 16:11:01 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\ptlx55.dat.{5728B11F-B697-47AA-9C1B-8ECB545B5193}
[2009.07.07 22:46:22 | 000,000,164 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009.07.07 22:43:22 | 000,000,769 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009.06.29 14:03:46 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND
[2009.05.27 08:04:41 | 000,413,696 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Anwendungsdaten\filesync.metadata
[2009.05.27 07:56:47 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\$_hpcst$.hpc
[2009.04.30 22:02:00 | 001,604,482 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2009.04.10 20:50:14 | 000,088,036 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009.03.12 16:02:57 | 000,000,212 | ---- | C] () -- C:\WINDOWS\bctester_de.INI
[2009.03.11 14:59:31 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2009.03.11 11:02:53 | 000,032,446 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Tabulatorgetrennte Werte (Windows).ADR
[2009.03.10 18:44:12 | 000,000,364 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.03.10 18:38:45 | 000,021,892 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Kommagetrennte Werte (Windows).ADR
[2009.02.19 01:49:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009.01.31 14:03:58 | 000,086,016 | ---- | C] () -- C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.29 01:20:07 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.01.19 18:46:38 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2009.01.15 14:32:41 | 000,000,069 | ---- | C] () -- C:\WINDOWS\Ulead32.INI
[2009.01.15 13:43:00 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\mscandc.ini
[2009.01.15 13:42:00 | 000,285,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\Onsio.sys
[2009.01.15 13:42:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\Onsreged.sys
[2009.01.15 13:06:29 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2009.01.15 13:06:29 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2009.01.14 23:50:13 | 000,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys
[2009.01.14 23:32:57 | 000,000,028 | R--- | C] () -- C:\WINDOWS\System32\drivers\VERSION.DAT
[2009.01.14 22:46:00 | 000,026,112 | R--- | C] () -- C:\WINDOWS\RunUnDrv.exe
[2009.01.14 21:58:46 | 000,044,491 | ---- | C] () -- C:\WINDOWS\System32\MiiIniFile13.ini
[2009.01.14 21:43:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.01.14 20:58:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.01.14 20:53:29 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.01.14 18:30:12 | 000,004,362 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.01.14 18:29:10 | 002,476,600 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008.12.16 22:58:54 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008.12.16 22:50:56 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLgFT.dll
[2008.07.26 15:42:52 | 000,081,110 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008.06.30 17:09:55 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2008.06.15 18:40:52 | 000,168,960 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2008.05.26 23:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008.05.26 23:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008.05.26 23:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008.05.26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008.05.26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008.02.04 19:23:10 | 000,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007.11.08 23:48:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2007.11.08 23:48:33 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2007.11.08 23:48:33 | 000,672,010 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2007.11.08 23:48:33 | 000,613,112 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2007.11.08 23:48:33 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2007.11.08 23:48:33 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2007.11.08 23:48:33 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2007.11.08 23:48:33 | 000,162,054 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2007.11.08 23:48:33 | 000,129,386 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2007.11.08 23:48:33 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2007.11.08 23:48:33 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2007.11.08 23:48:33 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2007.11.08 23:48:33 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2007.11.08 23:48:33 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2007.11.08 23:48:33 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2007.11.08 23:48:33 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.10.26 10:13:54 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\SBSPAIN2.DLL
[2006.06.23 15:37:50 | 000,070,144 | ---- | C] () -- C:\WINDOWS\System32\ENCODE32.DLL
[2006.06.23 15:37:08 | 000,249,856 | ---- | C] () -- C:\WINDOWS\System32\SBSPAIN3.DLL
[2006.06.23 15:37:08 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\SBSPAINT.DLL
[2006.01.25 18:24:04 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005.12.07 13:30:34 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\TAL12832.DLL
[2005.12.07 13:30:34 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\TALDM32A.dll
[2005.12.07 13:30:34 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\TALDM32.DLL
[2005.07.01 14:14:48 | 000,000,966 | ---- | C] () -- C:\WINDOWS\System32\Generic.ini
[2005.07.01 11:38:06 | 000,000,232 | ---- | C] () -- C:\WINDOWS\SwapDrvrSP3.ini
[2005.07.01 11:37:46 | 000,000,233 | ---- | C] () -- C:\WINDOWS\SwapDrvrSP2.ini
[2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
========== LOP Check ==========
[2009.05.26 14:01:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Altova
[2009.02.17 11:56:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avery
[2009.01.19 13:32:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ElsterFormular
[2010.08.12 11:09:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2009.01.19 18:15:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FRITZ!
[2011.02.21 16:18:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GNU
[2009.01.19 18:20:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ISDNWatch
[2010.10.05 12:41:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jtl-software
[2010.04.13 16:14:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LGMOBILEAX
[2009.09.07 09:39:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PS hard- & software GmbH
[2009.01.19 18:46:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2009.01.19 14:05:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony
[2009.12.03 18:40:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\STAMPIT
[2011.03.15 12:54:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.02.15 19:06:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2009.01.28 19:05:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011.04.24 13:57:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{AA5544E4-9BBC-419B-9204-40B5924D26AA}
[2010.05.20 16:43:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\AniVed_-_Tierheilpraxis_&
[2009.05.09 14:37:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Canon
[2009.05.13 15:38:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\com.adobe.ExMan
[2009.09.08 09:38:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\COMPAREIT
[2010.05.03 12:51:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\diginet
[2011.04.20 11:02:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\EMBIRD32
[2009.12.16 20:58:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\EMBIRD32_STUDIO
[2011.04.18 22:02:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\EMBIRD32_STUDIO_N
[2010.06.29 14:51:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Facebook
[2011.04.22 11:21:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\FileZilla
[2009.01.19 19:11:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\FRITZ!
[2011.01.10 17:09:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\GARMIN
[2011.04.21 10:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\gnupg
[2009.12.28 10:18:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\GrabPro
[2011.02.22 11:21:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\gtk-2.0
[2009.01.15 13:11:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Helios
[2009.02.17 10:46:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\HERMA
[2010.07.16 09:46:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\IcoFX
[2009.01.15 16:13:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\ICQ
[2009.01.15 13:04:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Leadertech
[2009.01.19 14:33:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\LEAPS
[2010.04.12 16:12:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\LG Electronics
[2010.03.03 10:36:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\MyPhoneExplorer
[2010.06.28 12:13:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Notepad++
[2010.08.16 12:20:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Orbit
[2010.01.18 16:37:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Participatory Culture Foundation
[2010.10.22 11:08:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Pegasys Inc
[2011.02.21 17:04:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\PhotoScape
[2010.05.21 11:19:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\PKSoft_-_Petra_Kosok
[2011.04.21 10:20:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\PriceGong
[2009.01.19 14:16:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Publish Providers
[2009.01.19 14:15:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Sony
[2009.01.19 13:49:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Sony Setup
[2010.08.19 11:39:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\TeamViewer
[2009.01.15 15:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Windows Desktop Search
[2009.01.19 14:34:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\THP\Anwendungsdaten\Windows Search
[2011.04.25 10:00:26 | 000,000,484 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:7C4835313D7890C4
@Alternate Data Stream - 144 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
@Alternate Data Stream - 110 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:888AFB86
< End of report >
Code:
OTL Extras logfile created on: 25.04.2011 10:09:05 - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = H:\_Install\Tools_Security
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 13,60 Gb Free Space | 27,86% Space Free | Partition Type: NTFS
Drive F: | 3,08 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive H: | 249,25 Gb Total Space | 12,81 Gb Free Space | 5,14% Space Free | Partition Type: NTFS
Computer Name: ZEUSS | User Name: THP | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
jsfile [edit] -- "C:\Programme\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Digital Photo Professional] -- C:\Programme\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Programme\Pixum\Pixum EasyBook\Fotoschau.exe" -d "%1" ()
Directory [Pixum EasyBook] -- "C:\Programme\Pixum\Pixum EasyBook\Pixum EasyBook.exe" "%1" ()
Directory [Pixum Fotobuch] -- "C:\Programme\Pixum\Pixum EasyBook\Pixum Fotobuch.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 4
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"2799:UDP" = 2799:UDP:*:Enabled:Altova License Metering Port (UDP)
"2799:TCP" = 2799:TCP:*:Enabled:Altova License Metering Port (TCP)
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"1947:TCP" = 1947:TCP:*:Enabled:HASP SRM
"1947:UDP" = 1947:UDP:*:Enabled:HASP SRM
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Assistent zum Übertragen von Dateien und Einstellungen -- (Microsoft Corporation)
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\Programme\Macromedia\Dreamweaver 8\Dreamweaver.exe" = C:\Programme\Macromedia\Dreamweaver 8\Dreamweaver.exe:*:Enabled:Dreamweaver 8 -- (Macromedia, Inc.)
"C:\Programme\Orbitdownloader\orbitdm.exe" = C:\Programme\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Programme\Orbitdownloader\orbitnet.exe" = C:\Programme\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Programme\XAMPP\apache\bin\httpd.exe" = C:\Programme\XAMPP\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\QuickTime\QuickTimePlayer.exe" = C:\Programme\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player -- (Apple Inc.)
"C:\WINDOWS\system32\hasplms.exe" = C:\WINDOWS\system32\hasplms.exe:*:Enabled:HASP LLM
"C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Notepad++\notepad++.exe" = C:\Programme\Notepad++\notepad++.exe:*:Enabled:Notepad++ : a free (GNU) source code editor -- (Don HO don.h@free.fr)
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\EnBW\StromRadar\StromRadar.exe" = C:\Programme\EnBW\StromRadar\StromRadar.exe:*:Enabled:EnBW StromRadar -- (EnBW AG)
"C:\WINDOWS\system32\ftp.exe" = C:\WINDOWS\system32\ftp.exe:*:Disabled:Programm zur Dateiübertragung -- (Microsoft Corporation)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (JTLWAWI)
"{03CAB33F-D1C2-48C6-8766-DAE84DFC25FE}" = Microsoft Sync Framework Services v1.0 (x86)
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{065D5505-3821-4C2E-BB6C-FE66A7E7CB4F}" = USB Flash Port Driver
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0837A661-FEC3-48B3-876C-91E7D32048A9}" = Macromedia Dreamweaver 8
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CAE9E5B-14BC-4E8C-A2AF-18B9BC020E49}_is1" = Pixum ContextUpload V0.9.2 beta
"{0D16E648-DA10-4566-AED2-5FA3BF58C21B}" = DigitizerJr
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F53B203-C6A9-4FB0-9086-A2D61396BE5F}" = STRATO Backup Manager
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1C2B3CEA-482E-4453-B3E2-C9731337828A}" = Microsoft SQL Server 2008 Native Client
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{247A11CA-F5CE-4DD6-85E2-64850E64E064}" = USB2.0 CARD READER
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26881D3C-F2A7-4BD4-80DF-D7B35AD01B69}" = DigitizerJr
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 23
"{2792F12C-3515-4D69-8083-B557AF35F06F}" = LightScribe 1.4.89.1
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{32A3A4F4-B792-11D6-A78A-00B0D0160220}" = Java(TM) SE Development Kit 6 Update 22
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{37610A60-136F-4621-9370-BDF521C365F1}" = TMPGEnc DVD Author 3 with DivX Authoring
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3BEB39C1-E448-45D2-97E2-A9B2A2DE7A54}" = EnBW StromRadar
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{42CC40A6-332E-4F53-8FB8-BD6D77D764FB}_is1" = Photo to Sketch 4.0
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A58B2B0-B52B-4E67-B526-618DCD338125}" = bcTester 4.7 (de)
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4D670C4C-5288-4011-BCA7-2211F952F110}" = DigitizerJr
"{51FEDE8F-663B-41E4-902E-FF314F02822B}" = Wilcom TrueSizer
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5B8072B3-A576-4C0B-99BC-FAA7145A1031}" = Nero 7 Essentials
"{5BD39911-A12F-4562-98BA-A6E03E3370B1}" = Microsoft SQL Server 2008 Database Engine Services
"{5F4B9958-F507-449A-A6E1-FD223314AF5A}" = TMPGEnc 4.0 XPress Testversion
"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 6.3.2
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6561ED15-266D-4838-8F40-F08C595E9956}" = Wilcom TrueSizer
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}" = DesignPro 5.4 Limited Edition
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7975B64E-5509-4395-919E-0294C4A9F661}" = STAMPIT
"{7C9AD221-994C-45B2-B46D-26F5735158CF}" = Sony Vegas Pro 8.0
"{7CBD8A89-45F4-4203-9923-673F72603747}" = Adobe Photoshop Lightroom 2.3
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{8CE08C3C-8FF4-45D9-925E-4F3CE2D7FA7D}" = Adobe Setup
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{937B232D-9776-471E-92BD-D424E514EF14}" = Logitech QuickCam
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8BD5A60-E843-46DC-8271-ABF20756BE0F}" = Microsoft Sync Framework Runtime v1.0 (x86)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABD7DBE3-E344-4BCA-B8AD-4360494DD1D9}" = LG MC USB U330 driver
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}" = LG Bluetooth Drivers
"{AFDFC350-C142-4790-BE12-8357AECD028F}" = SyncToy 2.0 (x86)
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B202B201-5D15-4CA7-A978-047AB4A28960}" = PE-DESIGN Ver.6
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B480BD2A-F1BA-4FE6-8C8E-34C6111B72C9}" = ElsterFormular 2007/2008
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6EC7388-E277-4A5B-8C8F-71067A41BA64}" = TextPad 5
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB3AB664-D92B-4CB5-8B3E-D841841F4E68}" = Canon Camera WIA Driver
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBAAAD82-6242-420F-86D4-BD72BB5E6C86}" = Tools für Microsoft SQL Server 2005 Express Edition
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer
"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater
"{DED3ECE2-93EB-4E33-BD55-AE5A1F95627A}" = Microsoft Office 2007 Custom UI Editor
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E1640DA5-89B4-4F52-B15D-5DA3D14F29D4}" = LG USB Modem Drivers
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E60BFE17-F44C-4A28-9ACF-1DD7362B0278}_is1" = Acunetix Web Vulnerability Scanner 6.5
"{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F10D4D11-7403-4F91-85D2-CB58AAF021AC}" = SewWhat-Pro
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}" = iTunes
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FEE84D71-7FF0-46C1-AED4-1BD821D53A9F}" = VMware Server
"{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB (04/16/2009 1.0.0.6)
"7-Zip" = 7-Zip 9.14 beta
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe SVG Viewer" = Adobe SVG Viewer
"Adobe_2a31ae7a5c43ff52d8577782dd34e04" = Adobe Illustrator CS4
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"AnyDVD" = AnyDVD
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVM ISDN CAPI Port" = AVM ISDN CAPI Port
"AVMBLUECLI" = AVM BlueFRITZ! USB
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CCleaner" = CCleaner (remove only)
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"CSCLIB" = Canon Camera Support Core Library
"DPP" = Canon Utilities Digital Photo Professional 3.4
"Embird 2010" = Embird 2010
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS Utility" = Canon Utilities EOS Utility
"EURACOM" = EURACOM
"fdrawcmd" = Fdrawcmd.sys 1.0.1.10
"Fiddler2" = Fiddler2
"FiddlerSyntaxAddons" = Fiddler Syntax-Highlighting Addons
"FileZilla Client" = FileZilla Client 3.3.5.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"FreePDF_XP" = FreePDF (Remove only)
"FRITZ! 2.0" = AVM FRITZ!
"FRITZ!X" = AVM FRITZ!X
"GPL Ghostscript 8.62" = GPL Ghostscript 8.62
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"HijackThis" = HijackThis 2.0.2
"IcoFX_is1" = IcoFX 1.6.4
"ie8" = Windows Internet Explorer 8
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}" = DesignPro 5.4 Limited Edition
"InstallShield_{BB3AB664-D92B-4CB5-8B3E-D841841F4E68}" = Canon EOS 5D WIA-Treiber
"IrfanView" = IrfanView (remove only)
"JTL-Wawi_is1" = JTL-Wawi
"lvdrivers_11.90" = Logitech QuickCam-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"MPE" = MyPhoneExplorer
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"nLite_is1" = nLite 1.4.9.1
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"Orbit_is1" = Orbit Downloader
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoScape" = PhotoScape
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"Picture Style Editor" = Canon Utilities Picture Style Editor
"Pixum EasyBook" = Pixum EasyBook
"Pixum ePrint" = Pixum ePrint 1.2
"Pixum Fotobuch" = Pixum Fotobuch
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"ST6UNST #1" = Herma Etiketten Assistent 3.1
"SystemRequirementsLab" = System Requirements Lab
"TeamViewer 5" = TeamViewer 5
"THSport für Windows" = THSport für Windows
"Uninstall_is1" = Uninstall 1.0.0.1
"Vector Magic" = Vector Magic
"VLC media player" = VLC media player 1.1.4
"Watcher Web Security Tool" = Watcher Web Security Tool
"WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
"Wild Things! by Wild Ginger Software, Inc." = Wild Things! by Wild Ginger Software, Inc.
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR Archivierer
"xp-AntiSpy" = xp-AntiSpy 3.96-8
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Facebook Plug-In" = Facebook Plug-In
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 25.04.2011 04:01:34 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:34 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:35 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:35 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:36 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:36 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:37 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:52 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:53 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
Error - 25.04.2011 04:01:53 | Computer Name = ZEUSS | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
[ OSession Events ]
Error - 24.05.2010 14:43:09 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 380203
seconds with 2820 seconds of active time. This session ended with a crash.
Error - 30.06.2010 03:02:00 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 153955
seconds with 3900 seconds of active time. This session ended with a crash.
Error - 06.07.2010 06:23:17 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 172212
seconds with 3420 seconds of active time. This session ended with a crash.
Error - 31.07.2010 03:31:15 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 52471
seconds with 300 seconds of active time. This session ended with a crash.
Error - 26.10.2010 04:43:58 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 57952
seconds with 120 seconds of active time. This session ended with a crash.
Error - 30.10.2010 08:31:38 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 359195
seconds with 5640 seconds of active time. This session ended with a crash.
Error - 12.11.2010 13:07:33 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 1135867
seconds with 16320 seconds of active time. This session ended with a crash.
Error - 11.01.2011 18:13:36 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 1764664
seconds with 18600 seconds of active time. This session ended with a crash.
Error - 27.01.2011 05:45:04 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 1300962
seconds with 20820 seconds of active time. This session ended with a crash.
Error - 24.02.2011 06:17:42 | Computer Name = ZEUSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6215.1000. This session lasted 84273
seconds with 2760 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 25.04.2011 04:00:23 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "winmgmt"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
Error - 25.04.2011 04:00:25 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "winmgmt"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
Error - 25.04.2011 04:00:26 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error - 25.04.2011 04:00:28 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error - 25.04.2011 04:00:28 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
Error - 25.04.2011 04:00:37 | Computer Name = ZEUSS | Source = ParVdm | ID = 458754
Description = Zeiger für Geräteobjekt lässt sich nicht für Anschlussobjekt ermitteln.
Error - 25.04.2011 04:01:12 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error - 25.04.2011 04:04:28 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 25.04.2011 04:05:45 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 25.04.2011 04:09:14 | Computer Name = ZEUSS | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
< End of report >
Ich hoffe, ich habe alles richtig gemacht und Ihr könnt mir helfen.
Fast vergessen - hier ist noch der Avira-Report mit dem Fund: Code:
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1230' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Dokumente und Einstellungen\THP'
C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Temp\7B.tmp
[FUND] Ist das Trojanische Pferd TR/Kazy.19785.2
C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Temp\7C.tmp
[FUND] Ist das Trojanische Pferd TR/Kazy.19785.2
Beginne mit der Suche in 'C:\WINDOWS'
Beginne mit der Suche in 'C:\Dokumente und Einstellungen\All Users'
Beginne mit der Suche in 'C:\Programme'
Beginne mit der Desinfektion:
C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Temp\7C.tmp
[FUND] Ist das Trojanische Pferd TR/Kazy.19785.2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ea94008.qua' verschoben!
C:\Dokumente und Einstellungen\THP\Lokale Einstellungen\Temp\7B.tmp
[FUND] Ist das Trojanische Pferd TR/Kazy.19785.2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '563e6fae.qua' verschoben!
|
