Trojaner-Board - WORM/Conficker.Y.14

Antivir hat WORM/Conficker.Y.14 in c:\windows\system32\wgdcen.dll entdeckt.
Bei der Bearbeitung der einzelnen Punkte hab ich mich an folgendem Thread orientiert:
http://www.trojaner-board.de/88234-a...ne-erfolg.html

1)

Zitat:

"HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 03:46:55, on 26.04.2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Programme\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe

C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Programme\iTunes\iTunesHelper.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Creative\MediaSource\Detector\CTDetect.exe

C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe

C:\Programme\OpenOffice.org 2.0\program\soffice.exe

C:\Programme\OpenOffice.org 2.0\program\soffice.BIN

C:\Programme\iPod\bin\iPodService.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Mozilla Firefox\plugin-container.exe

C:\Programme\Creative\MediaSource\CTCMS.exe

C:\WINDOWS\system32\CPdeSrvU.exe

C:\Dokumente und Einstellungen\Basta\Eigene Dateien\Downloads\HiJackThis204(2).exe
 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [D-Link AirPlus G DWL-G510] C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe 

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WebEQ XP] "C:\Programme\Blaze Audio\WebEQ Trial\WebEQ.exe"

O4 - HKCU\..\Run: [Creative Detector] "C:\Programme\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Efficient Sticky Notes.lnk = C:\Programme\Efficient Sticky Notes\EfficientStickyNotes.exe

O4 - Startup: Notmad Manager.lnk = C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programme\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Orga-Nicer.lnk = C:\Programme\ASCOMP Software\Orga-Nicer\organicer.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package 1) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe

O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe
 

--

End of file - 6858 bytes

--- --- ---
"

Zitat:

Code:

 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 

                        º                                    º 

                                    hjtscanlist v2.0              

                        º                                    º 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 
 

Microsoft Windows XP [Version 5.1.2600]

 

 

C:
 

  26.04.2011 01:05      C:\WINDOWS --------- 0 

        C:\pagefile.sys ---------  

  26.04.2011 00:33      C:\CTSUFile.txt --------- 217737 

  26.04.2011 00:19      C:\Programme --------- 0 

  25.04.2011 21:50      C:\System Volume Information --------- 0 

  13.06.2010 02:52      C:\LiveCam --------- 0 

  10.06.2010 15:38      C:\Program Files --------- 0 

  10.06.2010 03:06      C:\Dokumente und Einstellungen --------- 0 

  13.11.2009 02:46      C:\computec --------- 0 

  13.11.2009 02:24      C:\RECYCLER --------- 0 

  13.11.2009 01:48      C:\NVIDIA --------- 0 

  13.11.2009 00:55      C:\DELL --------- 0 

  13.11.2009 00:55      C:\CONFIG.SYS --------- 0 

  13.11.2009 00:55      C:\IO.SYS --------- 0 

  13.11.2009 00:55      C:\MSDOS.SYS --------- 0 

  13.11.2009 00:55      C:\AUTOEXEC.BAT --------- 0 

  13.11.2009 00:52      C:\boot.ini --------- 211 

  14.04.2008 00:01      C:\ntldr --------- 251712 

  13.04.2008 22:13      C:\NTDETECT.COM --------- 47564 

  04.08.2004 11:00      C:\bootfont.bin --------- 4952 

----------------------------------------
 

 

C:\WINDOWS
 

  26.04.2011 03:58     C:\WINDOWS\WindowsUpdate.log --------- 2019530 

  26.04.2011 01:06     C:\WINDOWS\wmsetup.log --------- 19666 

  26.04.2011 01:06     C:\WINDOWS\setupapi.log --------- 936245 

  26.04.2011 01:06     C:\WINDOWS\wiadebug.log --------- 187 

  26.04.2011 01:05     C:\WINDOWS\0.log --------- 0 

  26.04.2011 01:05     C:\WINDOWS\wiaservc.log --------- 50 

  26.04.2011 01:05     C:\WINDOWS\bootstat.dat --------- 2048 

  26.04.2011 01:04     C:\WINDOWS\SchedLgU.Txt --------- 18648 

  26.04.2011 00:52     C:\WINDOWS\_delis32.ini --------- 260 

  25.04.2011 23:49     C:\WINDOWS\WMSysPr9.prx --------- 316640 

  25.04.2011 22:35     C:\WINDOWS\JB3DRV.LOG --------- 21292 

  25.04.2011 20:18     C:\WINDOWS\graeq22.ini --------- 476 

  20.07.2010 23:33     C:\WINDOWS\tsoc.log --------- 189476 

  20.07.2010 23:33     C:\WINDOWS\comsetup.log --------- 174411 

  20.07.2010 23:33     C:\WINDOWS\iis6.log --------- 74764 

  20.07.2010 23:33     C:\WINDOWS\KB2229593.log --------- 6269 

  20.07.2010 23:33     C:\WINDOWS\imsins.log --------- 1374 

  20.07.2010 23:33     C:\WINDOWS\ocmsn.log --------- 26795 

  20.07.2010 23:33     C:\WINDOWS\ntdtcsetup.log --------- 105519 

  20.07.2010 23:33     C:\WINDOWS\msgsocm.log --------- 24356 

  20.07.2010 23:33     C:\WINDOWS\ocgen.log --------- 254616 

  20.07.2010 23:33     C:\WINDOWS\FaxSetup.log --------- 480537 

  17.07.2010 22:54     C:\WINDOWS\setupact.log --------- 218769 

  15.06.2010 02:07     C:\WINDOWS\KB970430.log --------- 13133 

  15.06.2010 02:07     C:\WINDOWS\imsins.BAK --------- 1374 

  15.06.2010 02:07     C:\WINDOWS\updspapi.log --------- 15243 

  15.06.2010 02:07     C:\WINDOWS\KB971737.log --------- 11610 

  14.06.2010 11:25     C:\WINDOWS\spupdsvc.log --------- 1913 

  14.06.2010 00:19     C:\WINDOWS\KB980218.log --------- 28471 

  14.06.2010 00:19     C:\WINDOWS\KB951376-v2.log --------- 28604 

  14.06.2010 00:19     C:\WINDOWS\KB952954.log --------- 28468 

  14.06.2010 00:19     C:\WINDOWS\KB959426.log --------- 35086 

  14.06.2010 00:19     C:\WINDOWS\KB946648.log --------- 28454 

  14.06.2010 00:19     C:\WINDOWS\KB956803.log --------- 29198 

  14.06.2010 00:19     C:\WINDOWS\KB960859.log --------- 36314 

  14.06.2010 00:19     C:\WINDOWS\KB971468.log --------- 29213 

  14.06.2010 00:19     C:\WINDOWS\KB979683.log --------- 30762 

  14.06.2010 00:18     C:\WINDOWS\KB958869.log --------- 26592 

  14.06.2010 00:18     C:\WINDOWS\KB980195.log --------- 28692 

  14.06.2010 00:18     C:\WINDOWS\KB980232.log --------- 29287 

  14.06.2010 00:18     C:\WINDOWS\KB979402.log --------- 27149 

  14.06.2010 00:18     C:\WINDOWS\KB955759.log --------- 29982 

  14.06.2010 00:18     C:\WINDOWS\KB974318.log --------- 36138 

  14.06.2010 00:18     C:\WINDOWS\KB951978.log --------- 35809 

  14.06.2010 00:18     C:\WINDOWS\KB969059.log --------- 27525 

  14.06.2010 00:18     C:\WINDOWS\KB981349.log --------- 34622 

  14.06.2010 00:18     C:\WINDOWS\KB950974.log --------- 33979 

  14.06.2010 00:18     C:\WINDOWS\KB978037.log --------- 34489 

  14.06.2010 00:18     C:\WINDOWS\KB975713.log --------- 34308 

  14.06.2010 00:18     C:\WINDOWS\KB971657.log --------- 33612 

  14.06.2010 00:18     C:\WINDOWS\KB978338.log --------- 33430 

  14.06.2010 00:18     C:\WINDOWS\KB954155.log --------- 25413 

  14.06.2010 00:18     C:\WINDOWS\KB960225.log --------- 33797 

  14.06.2010 00:18     C:\WINDOWS\KB972270.log --------- 27244 

  14.06.2010 00:18     C:\WINDOWS\KB956744.log --------- 27473 

  14.06.2010 00:17     C:\WINDOWS\KB974112.log --------- 33802 

  14.06.2010 00:17     C:\WINDOWS\KB956572.log --------- 30194 

  14.06.2010 00:17     C:\WINDOWS\KB956844.log --------- 23899 

  14.06.2010 00:17     C:\WINDOWS\KB961501.log --------- 29875 

  14.06.2010 00:17     C:\WINDOWS\KB975561.log --------- 23608 

  14.06.2010 00:17     C:\WINDOWS\KB973869.log --------- 23634 

  14.06.2010 00:17     C:\WINDOWS\KB975025.log --------- 30191 

  14.06.2010 00:17     C:\WINDOWS\KB952004.log --------- 31554 

  14.06.2010 00:17     C:\WINDOWS\KB974571.log --------- 30020 

  14.06.2010 00:17     C:\WINDOWS\KB975560.log --------- 29526 

  14.06.2010 00:17     C:\WINDOWS\KB973507.log --------- 29609 

  14.06.2010 00:17     C:\WINDOWS\KB977816.log --------- 28297 

  14.06.2010 00:17     C:\WINDOWS\KB973687.log --------- 23749 

  14.06.2010 00:17     C:\WINDOWS\KB950762.log --------- 22991 

  14.06.2010 00:17     C:\WINDOWS\KB981793.log --------- 18326 

  14.06.2010 00:17     C:\WINDOWS\KB978601.log --------- 27244 

  14.06.2010 00:17     C:\WINDOWS\KB979559.log --------- 28708 

  14.06.2010 00:17     C:\WINDOWS\KB952287.log --------- 21978 

  14.06.2010 00:16     C:\WINDOWS\KB978695.log --------- 19306 

  14.06.2010 00:16     C:\WINDOWS\KB973904.log --------- 23025 

  14.06.2010 00:16     C:\WINDOWS\KB967715.log --------- 27751 

  14.06.2010 00:16     C:\WINDOWS\KB973540.log --------- 19611 

  14.06.2010 00:16     C:\WINDOWS\KB950760.log --------- 21335 

  14.06.2010 00:16     C:\WINDOWS\KB974392.log --------- 21841 

  14.06.2010 00:16     C:\WINDOWS\KB976002-v5.log --------- 16059 

  14.06.2010 00:16     C:\WINDOWS\KB954459.log --------- 26398 

  14.06.2010 00:16     C:\WINDOWS\KB952069.log --------- 20158 

  14.06.2010 00:16     C:\WINDOWS\KB977914.log --------- 28097 

  14.06.2010 00:16     C:\WINDOWS\KB951748.log --------- 27236 

  14.06.2010 00:16     C:\WINDOWS\KB978542.log --------- 21951 

  14.06.2010 00:16     C:\WINDOWS\KB970238.log --------- 22839 

  14.06.2010 00:16     C:\WINDOWS\KB979309.log --------- 21220 

  14.06.2010 00:16     C:\WINDOWS\KB979482.log --------- 22107 

  14.06.2010 00:16     C:\WINDOWS\KB978706.log --------- 17232 

  14.06.2010 00:16     C:\WINDOWS\KB960803.log --------- 22415 

  14.06.2010 00:16     C:\WINDOWS\KB973815.log --------- 16937 

  14.06.2010 00:16     C:\WINDOWS\KB975562.log --------- 21597 

  14.06.2010 00:15     C:\WINDOWS\KB958644.log --------- 17224 

  14.06.2010 00:15     C:\WINDOWS\KB955069.log --------- 16702 

  14.06.2010 00:15     C:\WINDOWS\KB956802.log --------- 20869 

  14.06.2010 00:15     C:\WINDOWS\KB982381.log --------- 17192 

  14.06.2010 00:15     C:\WINDOWS\KB923561.log --------- 14202 

  14.06.2010 00:15     C:\WINDOWS\KB971961.log --------- 12633 

  14.06.2010 00:15     C:\WINDOWS\KB975467.log --------- 17800 

  14.06.2010 00:15     C:\WINDOWS\KB968389.log --------- 18393 

  12.06.2010 16:28     C:\WINDOWS\KB898461.log --------- 7002 

  12.06.2010 09:20     C:\WINDOWS\setuplog.txt --------- 801437 

  10.06.2010 02:46     C:\WINDOWS\nsreg.dat --------- 0 

  10.02.2010 23:27     C:\WINDOWS\DirectX.log --------- 91755 

  13.12.2009 14:07     C:\WINDOWS\OEWABLog.txt --------- 1174 

  13.11.2009 00:58     C:\WINDOWS\oobeact.log --------- 52 

  13.11.2009 00:58     C:\WINDOWS\REGLOCS.OLD --------- 8192 

  13.11.2009 00:55     C:\WINDOWS\control.ini --------- 0 

  13.11.2009 00:55     C:\WINDOWS\win.ini --------- 477 

  13.11.2009 00:55     C:\WINDOWS\ODBCINST.INI --------- 4161 

  13.11.2009 00:54     C:\WINDOWS\WindowsShell.Manifest --------- 749 

  13.11.2009 00:53     C:\WINDOWS\vb.ini --------- 36 

  13.11.2009 00:53     C:\WINDOWS\vbaddin.ini --------- 37 

  13.11.2009 00:53     C:\WINDOWS\DtcInstall.log --------- 130 

  13.11.2009 00:53     C:\WINDOWS\sessmgr.setup.log --------- 1023 

  13.11.2009 00:52     C:\WINDOWS\cmsetacl.log --------- 200 

  13.11.2009 00:50     C:\WINDOWS\regopt.log --------- 2602 

  13.11.2009 00:50     C:\WINDOWS\system.ini --------- 231 

  13.11.2009 00:48     C:\WINDOWS\Sti_Trace.log --------- 0 

  13.11.2009 00:46     C:\WINDOWS\setuperr.log --------- 0 

  13.11.2009 00:21     C:\WINDOWS\SOUNDMAN.EXE --------- 65024 

  14.04.2008 08:51     C:\WINDOWS\SET3.tmp --------- 1246537 

  14.04.2008 08:51     C:\WINDOWS\SET1E.tmp --------- 1246537 

  14.04.2008 08:44     C:\WINDOWS\SET21.tmp --------- 1088840 

  14.04.2008 08:44     C:\WINDOWS\SET4.tmp --------- 1088840 

  14.04.2008 08:44     C:\WINDOWS\SET8.tmp --------- 16825 

  14.04.2008 08:44     C:\WINDOWS\SET2D.tmp --------- 16825 

  14.04.2008 07:53     C:\WINDOWS\winhlp32.exe --------- 288768 

  14.04.2008 07:53     C:\WINDOWS\regedit.exe --------- 153600 

  14.04.2008 07:52     C:\WINDOWS\NOTEPAD.EXE --------- 70144 

  14.04.2008 07:52     C:\WINDOWS\hh.exe --------- 10752 

  14.04.2008 07:52     C:\WINDOWS\explorer.exe --------- 1036800 

  14.04.2008 07:52     C:\WINDOWS\twain_32.dll --------- 50688 

  16.06.2006 11:30     C:\WINDOWS\CtDrvIns.exe --------- 90112 

  13.04.2006 18:27     C:\WINDOWS\VF0260.uns --------- 4352 

  28.03.2006 01:00     C:\WINDOWS\V0260Cfg.exe --------- 32874 

  19.01.2006 02:01     C:\WINDOWS\ctpdusb.uns --------- 3635 

  04.08.2004 11:00     C:\WINDOWS\Santa Fe-Stuck.bmp --------- 65832 

  04.08.2004 11:00     C:\WINDOWS\TASKMAN.EXE --------- 15872 

  04.08.2004 11:00     C:\WINDOWS\Rhododendron.bmp --------- 17362 

  04.08.2004 11:00     C:\WINDOWS\twain.dll --------- 94800 

  04.08.2004 11:00     C:\WINDOWS\Pr„riewind.bmp --------- 65954 

  04.08.2004 11:00     C:\WINDOWS\twunk_16.exe --------- 49680 

  04.08.2004 11:00     C:\WINDOWS\twunk_32.exe --------- 25600 

  04.08.2004 11:00     C:\WINDOWS\_default.pif --------- 707 

  04.08.2004 11:00     C:\WINDOWS\Zapotek.bmp --------- 9522 

  04.08.2004 11:00     C:\WINDOWS\F„cher.bmp --------- 26680 

  04.08.2004 11:00     C:\WINDOWS\Seifenblase.bmp --------- 65978 

  04.08.2004 11:00     C:\WINDOWS\desktop.ini --------- 2 

  04.08.2004 11:00     C:\WINDOWS\Granit.bmp --------- 26582 

  04.08.2004 11:00     C:\WINDOWS\Feder.bmp --------- 16730 

  04.08.2004 11:00     C:\WINDOWS\vmmreg32.dll --------- 18944 

  04.08.2004 11:00     C:\WINDOWS\msdfmap.ini --------- 1405 

  04.08.2004 11:00     C:\WINDOWS\clock.avi --------- 82944 

  04.08.2004 11:00     C:\WINDOWS\Angler.bmp --------- 17336 

  04.08.2004 11:00     C:\WINDOWS\wmprfDEU.prx --------- 34818 

  04.08.2004 11:00     C:\WINDOWS\Blaue Spitzen 16.bmp --------- 1272 

  04.08.2004 11:00     C:\WINDOWS\winhelp.exe --------- 257568 

  04.08.2004 11:00     C:\WINDOWS\Kaffeetasse.bmp --------- 17062 

  04.08.2004 11:00     C:\WINDOWS\winnt.bmp --------- 48680 

  04.08.2004 11:00     C:\WINDOWS\winnt256.bmp --------- 48680 

  04.08.2004 11:00     C:\WINDOWS\explorer.scf --------- 80 

  26.09.2000 21:52     C:\WINDOWS\UninstallLegend.exe --------- 37888 

  26.09.2000 21:41     C:\WINDOWS\gerL.uni --------- 167 

  25.06.1999 10:55     C:\WINDOWS\UNWISE.EXE --------- 149504 

  17.11.1998 14:44     C:\WINDOWS\IsUn0407.exe --------- 328704 

  29.10.1998 16:45     C:\WINDOWS\IsUninst.exe --------- 306688 

----------------------------------------
 

 

C:\WINDOWS\System
 

 13.11.2009 00:20    C:\WINDOWS\System\crlds3d.dll --------- 765952 

 14.04.2008 07:53    C:\WINDOWS\System\WINSPOOL.DRV --------- 146944 

 14.04.2008 07:19    C:\WINDOWS\System\MMSYSTEM.DLL --------- 69632 

 04.08.2004 11:00    C:\WINDOWS\System\WFWNET.DRV --------- 13600 

 04.08.2004 11:00    C:\WINDOWS\System\COMMDLG.DLL --------- 33744 

 04.08.2004 11:00    C:\WINDOWS\System\VGA.DRV --------- 2176 

 04.08.2004 11:00    C:\WINDOWS\System\AVIFILE.DLL --------- 109504 

 04.08.2004 11:00    C:\WINDOWS\System\KEYBOARD.DRV --------- 2000 

 04.08.2004 11:00    C:\WINDOWS\System\LZEXPAND.DLL --------- 9936 

 04.08.2004 11:00    C:\WINDOWS\System\MCIAVI.DRV --------- 73760 

 04.08.2004 11:00    C:\WINDOWS\System\MCISEQ.DRV --------- 25296 

 04.08.2004 11:00    C:\WINDOWS\System\MCIWAVE.DRV --------- 28160 

 04.08.2004 11:00    C:\WINDOWS\System\OLECLI.DLL --------- 82944 

 04.08.2004 11:00    C:\WINDOWS\System\MMTASK.TSK --------- 1152 

 04.08.2004 11:00    C:\WINDOWS\System\VER.DLL --------- 9200 

 04.08.2004 11:00    C:\WINDOWS\System\AVICAP.DLL --------- 70368 

 04.08.2004 11:00    C:\WINDOWS\System\MSVIDEO.DLL --------- 127104 

 04.08.2004 11:00    C:\WINDOWS\System\MOUSE.DRV --------- 2032 

 04.08.2004 11:00    C:\WINDOWS\System\OLESVR.DLL --------- 24064 

 04.08.2004 11:00    C:\WINDOWS\System\setup.inf --------- 59167 

 04.08.2004 11:00    C:\WINDOWS\System\SHELL.DLL --------- 5120 

 04.08.2004 11:00    C:\WINDOWS\System\SOUND.DRV --------- 1744 

 04.08.2004 11:00    C:\WINDOWS\System\stdole.tlb --------- 5532 

 04.08.2004 11:00    C:\WINDOWS\System\SYSTEM.DRV --------- 3360 

 04.08.2004 11:00    C:\WINDOWS\System\TAPI.DLL --------- 19200 

 04.08.2004 11:00    C:\WINDOWS\System\TIMER.DRV --------- 4048 

 14.08.2000 02:15    C:\WINDOWS\System\mmxImage.dll --------- 61440 

 27.01.1999 06:15    C:\WINDOWS\System\bcbsmp40.bpl --------- 193536 

 27.01.1999 06:15    C:\WINDOWS\System\cp3245mt.dll --------- 908800 

 27.01.1999 06:15    C:\WINDOWS\System\borlndmm.dll --------- 24064 

 07.01.1999 06:17    C:\WINDOWS\System\vcl40.bpl --------- 1888232 

 18.06.1998 06:15    C:\WINDOWS\System\vclx40.bpl --------- 252408 

----------------------------------------
 

 

C:\WINDOWS\System32
 

 26.04.2011 01:06     C:\WINDOWS\system32\ANIWZCSUSERNAME{81303AAA-62CD-41CF-9605-0BFA935955A6} --------- 6 

 26.04.2011 01:06     C:\WINDOWS\system32\ANIWZCSUSERNAME --------- 7 

 26.04.2011 01:06     C:\WINDOWS\system32\NvApps.xml --------- 253748 

 26.04.2011 01:06     C:\WINDOWS\system32\lvcoinst.log --------- 1205 

 26.04.2011 01:06     C:\WINDOWS\system32\drivers --------- 0 

 26.04.2011 01:05     C:\WINDOWS\system32\CatRoot2 --------- 0 

 26.04.2011 01:05     C:\WINDOWS\system32\wpa.dbl --------- 12598 

 26.04.2011 01:00     C:\WINDOWS\system32\CatRoot --------- 0 

 26.04.2011 01:00     C:\WINDOWS\system32\Installer.log --------- 487 

 26.04.2011 00:58     C:\WINDOWS\system32\dllcache --------- 0 

 25.04.2011 23:01     C:\WINDOWS\system32\deimos_archive.dei --------- 0 

 25.04.2011 21:42     C:\WINDOWS\system32\NtmsData --------- 0 

 25.04.2011 19:42     C:\WINDOWS\system32\SYSWQDRV.SYS --------- 60 

 24.04.2011 10:40     C:\WINDOWS\system32\d3d9caps.dat --------- 664 

 23.07.2010 21:50     C:\WINDOWS\system32\wmpheadphones.dll --------- 430080 

 21.07.2010 11:03     C:\WINDOWS\system32\Restore --------- 0 

 02.07.2010 06:26     C:\WINDOWS\system32\javaw.exe --------- 145184 

 02.07.2010 06:26     C:\WINDOWS\system32\javacpl.cpl --------- 73728 

 02.07.2010 06:26     C:\WINDOWS\system32\java.exe --------- 145184 

 02.07.2010 06:26     C:\WINDOWS\system32\javaws.exe --------- 153376 

 02.07.2010 06:26     C:\WINDOWS\system32\deployJava1.dll --------- 411368 

 15.06.2010 21:31     C:\WINDOWS\system32\perfh009.dat --------- 311604 

 15.06.2010 21:31     C:\WINDOWS\system32\perfc009.dat --------- 39992 

 15.06.2010 21:31     C:\WINDOWS\system32\perfh007.dat --------- 316594 

 15.06.2010 21:31     C:\WINDOWS\system32\perfc007.dat --------- 48156 

 15.06.2010 21:31     C:\WINDOWS\system32\PerfStringBackup.INI --------- 723744 

 14.06.2010 11:25     C:\WINDOWS\system32\FNTCACHE.DAT --------- 99048 

 14.06.2010 11:25     C:\WINDOWS\system32\wbem --------- 0 

 14.06.2010 00:17     C:\WINDOWS\system32\TZLog.log --------- 3968 

 13.06.2010 02:19     C:\WINDOWS\system32\ReinstallBackups --------- 0 

 12.06.2010 16:28     C:\WINDOWS\system32\PreInstall --------- 0 

 12.06.2010 09:20     C:\WINDOWS\system32\wpa.bak --------- 12598 

 10.06.2010 15:46     C:\WINDOWS\system32\SIntfNT.dll --------- 21840 

 10.06.2010 15:46     C:\WINDOWS\system32\SIntf32.dll --------- 17212 

 10.06.2010 15:46     C:\WINDOWS\system32\SIntf16.dll --------- 12067 

 10.06.2010 04:11     C:\WINDOWS\system32\DRVSTORE --------- 0 

 02.05.2010 10:05     C:\WINDOWS\system32\win32k.sys --------- 1851392 

 21.04.2010 15:28     C:\WINDOWS\system32\tzchange.exe --------- 46080 

 20.04.2010 07:29     C:\WINDOWS\system32\atmfd.dll --------- 285696 

 16.04.2010 18:06     C:\WINDOWS\system32\shdocvw.dll --------- 1509888 

 16.04.2010 18:06     C:\WINDOWS\system32\tdc.ocx --------- 61952 

 16.04.2010 18:06     C:\WINDOWS\system32\wininet.dll --------- 672768 

 16.04.2010 18:06     C:\WINDOWS\system32\urlmon.dll --------- 628736 

 16.04.2010 18:06     C:\WINDOWS\system32\mshtml.dll --------- 3094016 

 16.04.2010 18:06     C:\WINDOWS\system32\iepeers.dll --------- 251904 

 16.04.2010 18:06     C:\WINDOWS\system32\browseui.dll --------- 1025024 

 16.04.2010 18:06     C:\WINDOWS\system32\ieencode.dll --------- 81920 

 16.04.2010 17:53     C:\WINDOWS\system32\html.iec --------- 371200 

 08.04.2010 13:20     C:\WINDOWS\system32\dnssd.dll --------- 91424 

 08.04.2010 13:20     C:\WINDOWS\system32\dns-sd.exe --------- 107808 

 19.03.2010 18:05     C:\WINDOWS\system32\wmp.dll --------- 4874240 

 17.03.2010 21:53     C:\WINDOWS\system32\QuickTime.qts --------- 69632 

 17.03.2010 21:53     C:\WINDOWS\system32\QuickTimeVR.qtx --------- 94208 

 09.03.2010 13:09     C:\WINDOWS\system32\vbscript.dll --------- 430080 

 05.03.2010 16:37     C:\WINDOWS\system32\asycfilt.dll --------- 65536 

 17.02.2010 14:04     C:\WINDOWS\system32\ntoskrnl.exe --------- 2192256 

 16.02.2010 21:04     C:\WINDOWS\system32\ntkrnlpa.exe --------- 2069120 

 12.02.2010 12:03     C:\WINDOWS\system32\browserchoice.exe --------- 293376 

 12.02.2010 06:33     C:\WINDOWS\system32\6to4svc.dll --------- 100864 

 10.02.2010 23:13     C:\WINDOWS\system32\SoftwareDistribution --------- 0 

 05.02.2010 20:25     C:\WINDOWS\system32\quartz.dll --------- 1297408 

 29.01.2010 16:59     C:\WINDOWS\system32\inetcomm.dll --------- 691712 

 29.01.2010 16:43     C:\WINDOWS\system32\l3codecx.ax --------- 143422 

 29.01.2010 16:43     C:\WINDOWS\system32\l3codeca.acm --------- 307260 

 13.01.2010 16:00     C:\WINDOWS\system32\cabview.dll --------- 86528 

 28.12.2009 17:31     C:\WINDOWS\system32\DirectX --------- 0 

 24.12.2009 08:59     C:\WINDOWS\system32\wintrust.dll --------- 177664 

 17.12.2009 09:40     C:\WINDOWS\system32\mspaint.exe --------- 346624 

 14.12.2009 09:08     C:\WINDOWS\system32\csrsrv.dll --------- 33280 

 13.12.2009 14:11     C:\WINDOWS\system32\BuzzingBee.wav --------- 146650 

 13.12.2009 14:11     C:\WINDOWS\system32\LoopyMusic.wav --------- 125690 

 13.12.2009 14:11     C:\WINDOWS\system32\Lang --------- 0 

 08.12.2009 11:23     C:\WINDOWS\system32\shlwapi.dll --------- 474624 

 27.11.2009 19:11     C:\WINDOWS\system32\msyuv.dll --------- 17920 

 27.11.2009 18:08     C:\WINDOWS\system32\iyuv_32.dll --------- 48128 

 27.11.2009 18:08     C:\WINDOWS\system32\tsbyuv.dll --------- 8704 

 27.11.2009 18:08     C:\WINDOWS\system32\msvidc32.dll --------- 28672 

 27.11.2009 18:08     C:\WINDOWS\system32\avifil32.dll --------- 85504 

 27.11.2009 18:08     C:\WINDOWS\system32\msrle32.dll --------- 11264 

 13.11.2009 02:47     C:\WINDOWS\system32\initdebug.nfo --------- 45 

 13.11.2009 02:21     C:\WINDOWS\system32\Futuremark --------- 0 

 13.11.2009 01:45     C:\WINDOWS\system32\Setup --------- 0 

 13.11.2009 01:45     C:\WINDOWS\system32\npp --------- 0 

 13.11.2009 01:44     C:\WINDOWS\system32\1031 --------- 0 

 13.11.2009 01:43     C:\WINDOWS\system32\ras --------- 0 

 13.11.2009 01:42     C:\WINDOWS\system32\icsxml --------- 0 

 13.11.2009 01:42     C:\WINDOWS\system32\1033 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\3com_dmi --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\IME --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\3076 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\2052 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1041 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1042 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1025 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1037 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1028 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\1054 --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\inetsrv --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\mui --------- 0 

 13.11.2009 01:41     C:\WINDOWS\system32\export --------- 0 

----------------------------------------
 

 

C:\WINDOWS\Prefetch
 

 26.04.2011 03:59     C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf --------- 39900 

 26.04.2011 03:56     C:\WINDOWS\Prefetch\7ZFM.EXE-24800234.pf --------- 24326 

 26.04.2011 03:54     C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf --------- 42522 

 26.04.2011 03:49     C:\WINDOWS\Prefetch\ITUNES.EXE-15E88941.pf --------- 67114 

 26.04.2011 03:47     C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf --------- 25950 

 26.04.2011 03:45     C:\WINDOWS\Prefetch\HIJACKTHIS204(2).EXE-2A1A2DB0.pf --------- 84814 

 26.04.2011 03:44     C:\WINDOWS\Prefetch\JQSNOTIFY.EXE-1E60A522.pf --------- 10448 

 26.04.2011 01:14     C:\WINDOWS\Prefetch\CPDESRVU.EXE-2A575911.pf --------- 20850 

 26.04.2011 01:12     C:\WINDOWS\Prefetch\PLUGIN-CONTAINER.EXE-170C935C.pf --------- 68236 

 26.04.2011 01:12     C:\WINDOWS\Prefetch\HELPER.EXE-244ABC1F.pf --------- 17124 

 26.04.2011 01:12     C:\WINDOWS\Prefetch\FIREFOX.EXE-1D57670A.pf --------- 137806 

 26.04.2011 01:07     C:\WINDOWS\Prefetch\SOFFICE.BIN-13DC9FB8.pf --------- 69104 

 26.04.2011 01:06     C:\WINDOWS\Prefetch\SOFFICE.EXE-0BED0A91.pf --------- 8234 

 26.04.2011 01:06     C:\WINDOWS\Prefetch\AVGNT.EXE-39CD89BF.pf --------- 55724 

 26.04.2011 01:06     C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf --------- 16324 

 26.04.2011 01:06     C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf --------- 1299956 

 26.04.2011 01:02     C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf --------- 22626 

 26.04.2011 00:58     C:\WINDOWS\Prefetch\RUNONCE.EXE-2803F297.pf --------- 18696 

 26.04.2011 00:58     C:\WINDOWS\Prefetch\GRPCONV.EXE-111CD845.pf --------- 11958 

 26.04.2011 00:52     C:\WINDOWS\Prefetch\_INS5576._MP-21EB8DC3.pf --------- 18622 

 26.04.2011 00:37     C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf --------- 22158 

 26.04.2011 00:32     C:\WINDOWS\Prefetch\CTREGSVR.EXE-34549CFE.pf --------- 21766 

 26.04.2011 00:32     C:\WINDOWS\Prefetch\7ZG.EXE-189F3F41.pf --------- 41770 

 25.04.2011 23:50     C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf --------- 71860 

 25.04.2011 23:49     C:\WINDOWS\Prefetch\LOGAGENT.EXE-027AF92B.pf --------- 13650 

 25.04.2011 23:49     C:\WINDOWS\Prefetch\DRMUPGDS.EXE-00832A1D.pf --------- 10170 

 25.04.2011 23:49     C:\WINDOWS\Prefetch\WMSETSDK.EXE-33CEFB1A.pf --------- 24324 

 25.04.2011 23:49     C:\WINDOWS\Prefetch\WMFDIST95.EXE-2F43E90C.pf --------- 6376 

 25.04.2011 23:49     C:\WINDOWS\Prefetch\WMFDIST95WP.EXE-258DC4F5.pf --------- 42460 

 25.04.2011 23:47     C:\WINDOWS\Prefetch\INSTALL.EXE-13C0DC7F.pf --------- 25214 

 25.04.2011 23:47     C:\WINDOWS\Prefetch\IKERNEL.EXE-092EF074.pf --------- 20630 

 25.04.2011 23:47     C:\WINDOWS\Prefetch\CMS_PCAPP_LB_3_30_21.EXE-23591A1D.pf --------- 52618 

 25.04.2011 23:46     C:\WINDOWS\Prefetch\DISTNOTED.EXE-39D1AA37.pf --------- 20680 

 25.04.2011 23:46     C:\WINDOWS\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-00DBDC2B.pf --------- 53436 

 25.04.2011 23:01     C:\WINDOWS\Prefetch\BADAPPLE.EXE-170F5834.pf --------- 19692 

 25.04.2011 23:01     C:\WINDOWS\Prefetch\BADAPPLESETUP.EXE-2D18395A.pf --------- 40252 

 25.04.2011 22:35     C:\WINDOWS\Prefetch\RUNDLL32.EXE-14E5B301.pf --------- 48012 

 25.04.2011 22:35     C:\WINDOWS\Prefetch\JB3MV2_PCWDRV_US_2_01_00.EXE-2CF926C8.pf --------- 57856 

 25.04.2011 22:35     C:\WINDOWS\Prefetch\CTDRVSTP.EXE-156D8D48.pf --------- 20762 

 25.04.2011 22:35     C:\WINDOWS\Prefetch\SECURITY.EXE-2DBC2615.pf --------- 4182 

 25.04.2011 22:35     C:\WINDOWS\Prefetch\CHECKOS.EXE-1754EC5B.pf --------- 4794 

 25.04.2011 22:33     C:\WINDOWS\Prefetch\CTDRVINS.EXE-2483839D.pf --------- 62982 

 25.04.2011 22:23     C:\WINDOWS\Prefetch\SETUP_WM.EXE-19AC5A9B.pf --------- 61856 

 25.04.2011 22:23     C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf --------- 17308 

 25.04.2011 22:23     C:\WINDOWS\Prefetch\OSPITRAY.EXE-0B34713A.pf --------- 44144 

 25.04.2011 22:22     C:\WINDOWS\Prefetch\WMPLAYER.EXE-09969333.pf --------- 53648 

 25.04.2011 22:22     C:\WINDOWS\Prefetch\RUNDLL32.EXE-3960AE65.pf --------- 14148 

 25.04.2011 22:20     C:\WINDOWS\Prefetch\RUNDLL32.EXE-191EEEE4.pf --------- 15210 

 25.04.2011 22:20     C:\WINDOWS\Prefetch\UNWISE.EXE-35C8757A.pf --------- 11982 

 25.04.2011 22:20     C:\WINDOWS\Prefetch\DRVUNINS.EXE-2AF66646.pf --------- 11784 

 25.04.2011 22:19     C:\WINDOWS\Prefetch\CPDESRVU.EXE-159771C0.pf --------- 10566 

 25.04.2011 22:16     C:\WINDOWS\Prefetch\DRIVERUPDATERSETUP-1.2.3.2267-245FD07C.pf --------- 15796 

 25.04.2011 22:10     C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf --------- 7342 

 25.04.2011 21:41     C:\WINDOWS\Prefetch\RSMSINK.EXE-032F2BAB.pf --------- 64070 

 25.04.2011 21:41     C:\WINDOWS\Prefetch\RUNDLL32.EXE-2B96DDC7.pf --------- 14138 

 25.04.2011 21:41     C:\WINDOWS\Prefetch\AVNOTIFY.EXE-31D7686A.pf --------- 73826 

 25.04.2011 21:36     C:\WINDOWS\Prefetch\MSDTC.EXE-0E6E4AF7.pf --------- 21972 

 25.04.2011 21:36     C:\WINDOWS\Prefetch\DLLHOST.EXE-5353C76C.pf --------- 33006 

 25.04.2011 21:36     C:\WINDOWS\Prefetch\DLLHOST.EXE-20DCBC21.pf --------- 20928 

 25.04.2011 21:36     C:\WINDOWS\Prefetch\VSSVC.EXE-0F74375A.pf --------- 40398 

 25.04.2011 21:35     C:\WINDOWS\Prefetch\AVSCAN.EXE-25724B6E.pf --------- 54284 

 25.04.2011 21:35     C:\WINDOWS\Prefetch\AVCENTER.EXE-1D2DB8A2.pf --------- 61072 

 25.04.2011 20:51     C:\WINDOWS\Prefetch\Layout.ini --------- 400572 

 25.04.2011 20:29     C:\WINDOWS\Prefetch\FOXIT READER.EXE-3625D925.pf --------- 65504 

 25.04.2011 20:23     C:\WINDOWS\Prefetch\RTLCPL.EXE-08F51F45.pf --------- 38958 

 25.04.2011 20:23     C:\WINDOWS\Prefetch\RUNDLL32.EXE-3A262C99.pf --------- 20392 

 25.04.2011 20:19     C:\WINDOWS\Prefetch\SYSTRAY.EXE-345DCC1C.pf --------- 10502 

 25.04.2011 20:18     C:\WINDOWS\Prefetch\RUNDLL32.EXE-24DBE541.pf --------- 18334 

 25.04.2011 20:18     C:\WINDOWS\Prefetch\OSPINST.EXE-0872EC80.pf --------- 7730 

 25.04.2011 20:18     C:\WINDOWS\Prefetch\GRAEQ22.EXE-22424D30.pf --------- 16078 

 25.04.2011 20:16     C:\WINDOWS\Prefetch\RUNDLL32.EXE-24060C3D.pf --------- 16494 

 25.04.2011 20:12     C:\WINDOWS\Prefetch\HIJACKTHIS204.EXE-0801027D.pf --------- 12776 

 25.04.2011 20:08     C:\WINDOWS\Prefetch\UPDATE.EXE-3398FCD6.pf --------- 75730 

 25.04.2011 20:05     C:\WINDOWS\Prefetch\AVCONFIG.EXE-18FA6095.pf --------- 54178 

 25.04.2011 20:03     C:\WINDOWS\Prefetch\SCHED.EXE-3062DD8B.pf --------- 61236 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\AVSHADOW.EXE-285D90E4.pf --------- 11554 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\AVGUARD.EXE-16DEE89A.pf --------- 54608 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\AVWSC.EXE-24612965.pf --------- 12486 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\RUNDLL32.EXE-2CBA7525.pf --------- 16774 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\RUNDLL32.EXE-26C2C861.pf --------- 16774 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\RUNDLL32.EXE-3F22660F.pf --------- 16802 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\FACT.EXE-365AE6E4.pf --------- 22748 

 25.04.2011 20:02     C:\WINDOWS\Prefetch\SETUP.EXE-3AA1CFD6.pf --------- 30208 

 25.04.2011 20:01     C:\WINDOWS\Prefetch\VCREDIST_X86.EXE-02DE4556.pf --------- 49066 

 25.04.2011 20:01     C:\WINDOWS\Prefetch\PRESETUP.EXE-070C9E14.pf --------- 14610 

 25.04.2011 20:01     C:\WINDOWS\Prefetch\INSTALL.EXE-0037545E.pf --------- 18962 

 25.04.2011 20:01     C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf --------- 45690 

 25.04.2011 20:01     C:\WINDOWS\Prefetch\AVIRA_ANTIVIR_635PERSONAL_DE.-20E8534C.pf --------- 60982 

 25.04.2011 20:00     C:\WINDOWS\Prefetch\JAVA.EXE-2167859B.pf --------- 62104 

 25.04.2011 20:00     C:\WINDOWS\Prefetch\HELPER.EXE-04F5B6A7.pf --------- 18028 

 25.04.2011 19:59     C:\WINDOWS\Prefetch\UPDATER.EXE-0B66421F.pf --------- 63038 

 25.04.2011 19:59     C:\WINDOWS\Prefetch\THUNDERBIRD.EXE-031A6371.pf --------- 135318 

 25.04.2011 19:52     C:\WINDOWS\Prefetch\GRAEQ22.EXE-2F8D851F.pf --------- 17554 

 25.04.2011 19:51     C:\WINDOWS\Prefetch\IEXPLORE.EXE-2CA9778D.pf --------- 67668 

 25.04.2011 19:49     C:\WINDOWS\Prefetch\ISUNINST.EXE-21B3FA6E.pf --------- 17066 

 25.04.2011 19:43     C:\WINDOWS\Prefetch\WEBEQ.EXE-2A0C4FC3.pf --------- 19564 

 25.04.2011 19:42     C:\WINDOWS\Prefetch\MERCOR~1.EXE-06CAB99F.pf --------- 28252 

 25.04.2011 19:42     C:\WINDOWS\Prefetch\_ISDEL.EXE-21167127.pf --------- 6600 

 25.04.2011 19:42     C:\WINDOWS\Prefetch\SETUP.EXE-2DC835D6.pf --------- 17554 

 25.04.2011 19:42     C:\WINDOWS\Prefetch\WEBEQTRIAL.EXE-2B2DD51D.pf --------- 55540 

 25.04.2011 14:44     C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf --------- 93780 

 24.04.2011 10:40     C:\WINDOWS\Prefetch\JAUCHECK.EXE-2D8C9795.pf --------- 31560 

 24.04.2011 10:40     C:\WINDOWS\Prefetch\JAVAW.EXE-0159D575.pf --------- 80694 

 24.04.2011 10:40     C:\WINDOWS\Prefetch\JAVAWS.EXE-1714DD62.pf --------- 15514 

 23.04.2011 23:50     C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf --------- 55034 

 23.04.2011 23:50     C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf --------- 15614 

 23.04.2011 13:59     C:\WINDOWS\Prefetch\WIAACMGR.EXE-212ED878.pf --------- 25984 

 23.04.2011 13:58     C:\WINDOWS\Prefetch\RUNDLL32.EXE-268BFF96.pf --------- 11800 

 21.04.2011 21:15     C:\WINDOWS\Prefetch\JUCHECK.EXE-219F257F.pf --------- 28340 

 20.04.2011 20:11     C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf --------- 11836 

 20.04.2011 20:11     C:\WINDOWS\Prefetch\WMPLAYER.EXE-0996933B.pf --------- 47194 

 20.04.2011 20:09     C:\WINDOWS\Prefetch\I_VIEW32.EXE-0B6C3BA4.pf --------- 17220 

 20.04.2011 19:51     C:\WINDOWS\Prefetch\ORGANICER.EXE-38CBC32C.pf --------- 51094 

 20.04.2011 16:45     C:\WINDOWS\Prefetch\DLLHOST.EXE-205D880D.pf --------- 17410 

 20.04.2011 16:45     C:\WINDOWS\Prefetch\SOFTWAREUPDATE.EXE-1E90DF1F.pf --------- 39574 

 12.08.2010 01:53     C:\WINDOWS\Prefetch\RUNDLL32.EXE-3C57CC61.pf --------- 15326 

 12.08.2010 01:53     C:\WINDOWS\Prefetch\RUNDLL32.EXE-188DF14E.pf --------- 18206 

 02.08.2010 11:24     C:\WINDOWS\Prefetch\RUNDLL32.EXE-2C59DBB2.pf --------- 21434 

 02.08.2010 11:24     C:\WINDOWS\Prefetch\RUNDLL32.EXE-210D7E2A.pf --------- 17672 

 02.08.2010 11:21     C:\WINDOWS\Prefetch\MOZBACKUP.EXE-00BC3D32.pf --------- 16790 

 01.08.2010 23:59     C:\WINDOWS\Prefetch\REG.EXE-0D2A95F7.pf --------- 11776 

 01.08.2010 21:35     C:\WINDOWS\Prefetch\TBBACKUP.EXE-0AB5E367.pf --------- 31056 

 01.08.2010 21:35     C:\WINDOWS\Prefetch\OPERA.EXE-24550E7A.pf --------- 92968 

 01.08.2010 21:28     C:\WINDOWS\Prefetch\TBBACKUP SETUP.EXE-2E246AA5.pf --------- 15798 

 01.08.2010 21:25     C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf --------- 23504 

 23.07.2010 22:51     C:\WINDOWS\Prefetch\FOOBAR2000.EXE-1D515AA1.pf --------- 71486 

 21.07.2010 11:03     C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf --------- 7104 

 21.07.2010 11:02     C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf --------- 57632 

----------------------------------------
 

 

C:\WINDOWS\Tasks
 

 26.04.2011 01:05     C:\WINDOWS\Tasks\SA.DAT --------- 6 

 04.08.2004 11:00     C:\WINDOWS\Tasks\desktop.ini --------- 65 

----------------------------------------
 

 

C:\WINDOWS\Temp
 

 26.04.2011 01:11     C:\WINDOWS\Temp\CamServr.log --------- 963 

 26.04.2011 01:11     C:\WINDOWS\Temp\CamWizrd.log --------- 167852 

 26.04.2011 01:05     C:\WINDOWS\Temp\Perflib_Perfdata_728.dat --------- 16384 

 26.04.2011 00:58     C:\WINDOWS\Temp\InstVid.log --------- 1332 

 26.04.2011 00:58     C:\WINDOWS\Temp\Instmed.log --------- 1077 

 26.04.2011 00:53     C:\WINDOWS\Temp\LgDSetup.txt --------- 15587 

 25.04.2011 23:47     C:\WINDOWS\Temp\{DABD554A-7DA6-4763-BF17-D3CAFB55E5A6} --------- 0 

 25.04.2011 21:41     C:\WINDOWS\Temp\Cookies --------- 0 

 25.04.2011 21:41     C:\WINDOWS\Temp\Verlauf --------- 0 

 25.04.2011 21:41     C:\WINDOWS\Temp\Temporary Internet Files --------- 0 

 25.04.2011 20:11     C:\WINDOWS\Temp\AVSETUP_4db5b711 --------- 0 

 28.07.2010 19:18     C:\WINDOWS\Temp\Perflib_Perfdata_5b4.dat --------- 16384 

 25.07.2010 19:50     C:\WINDOWS\Temp\Perflib_Perfdata_5d0.dat --------- 16384 

 04.07.2010 07:38     C:\WINDOWS\Temp\Perflib_Perfdata_5c0.dat --------- 16384 

 13.06.2010 02:51     C:\WINDOWS\Temp\CRF000 --------- 0 

 10.06.2010 15:45     C:\WINDOWS\Temp\directx --------- 0 

 10.06.2010 15:38     C:\WINDOWS\Temp\Run.ini --------- 2 

 13.11.2009 03:14     C:\WINDOWS\Temp\JETBA47.tmp --------- 0 

 13.11.2009 02:33     C:\WINDOWS\Temp\JET7408.tmp --------- 0 

 04.10.2000 06:39     C:\WINDOWS\Temp\gerL.lan --------- 1943 

 26.09.2000 21:42     C:\WINDOWS\Temp\gerL.lis --------- 1555 

 22.09.2000 19:15     C:\WINDOWS\Temp\CleanupLegend.exe --------- 28672 

 14.09.2000 18:37     C:\WINDOWS\Temp\fl.ini --------- 392 

 14.08.2000 02:15     C:\WINDOWS\Temp\dsetup.dll --------- 127488 

 14.08.2000 02:15     C:\WINDOWS\Temp\dsetup32.dll --------- 51712 

 14.08.2000 02:15     C:\WINDOWS\Temp\dsetup16.dll --------- 63248 

 14.08.2000 02:15     C:\WINDOWS\Temp\mmxImage.dll --------- 61440 

 27.01.1999 06:15     C:\WINDOWS\Temp\cp3245mt.dll --------- 908800 

 27.01.1999 06:15     C:\WINDOWS\Temp\borlndmm.dll --------- 24064 

 07.01.1999 06:17     C:\WINDOWS\Temp\vcl40.bpl --------- 1888232 

----------------------------------------
 

 

C:\DOKUME~1\Basta\LOKALE~1\Temp
 

 26.04.2011 03:59      C:\DOKUME~1\Basta\LOKALE~1\Temp\flaE1.tmp --------- 2527429 

 26.04.2011 03:58      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-6 --------- 0 

 26.04.2011 03:58      C:\DOKUME~1\Basta\LOKALE~1\Temp\flaE0.tmp --------- 2553566 

 26.04.2011 03:49      C:\DOKUME~1\Basta\LOKALE~1\Temp\pitch black - transient transmission (deep fried dub s battered mix).mp3 --------- 8601632 

 26.04.2011 03:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\~DF1EAA.tmp --------- 114688 

 26.04.2011 03:39      C:\DOKUME~1\Basta\LOKALE~1\Temp\flaB7.tmp --------- 12273006 

 26.04.2011 03:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\flaA7.tmp --------- 14118461 

 26.04.2011 01:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\JETD472.tmp --------- 0 

 26.04.2011 01:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET7CE9.tmp --------- 0 

 26.04.2011 01:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET796F.tmp --------- 0 

 26.04.2011 01:12      C:\DOKUME~1\Basta\LOKALE~1\Temp\LVCOMSX.LOG --------- 685 

 26.04.2011 01:11      C:\DOKUME~1\Basta\LOKALE~1\Temp\jusched.log --------- 29463 

 26.04.2011 01:06      C:\DOKUME~1\Basta\LOKALE~1\Temp\svbd5.tmp --------- 0 

 26.04.2011 01:06      C:\DOKUME~1\Basta\LOKALE~1\Temp\$Notmad Explorer$ --------- 0 

 26.04.2011 01:06      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss1.tmp --------- 0 

 26.04.2011 01:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss376.tmp --------- 0 

 26.04.2011 00:54      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss371.tmp --------- 0 

 26.04.2011 00:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\_ISTMP1.DIR --------- 0 

 26.04.2011 00:44      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss305.tmp --------- 0 

 26.04.2011 00:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss2FF.tmp --------- 0 

 26.04.2011 00:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss2B7.tmp --------- 0 

 26.04.2011 00:02      C:\DOKUME~1\Basta\LOKALE~1\Temp\browshui64.dll --------- 1 

 26.04.2011 00:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\redchair_installer --------- 0 

 25.04.2011 23:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\iss225.tmp --------- 0 

 25.04.2011 23:50      C:\DOKUME~1\Basta\LOKALE~1\Temp\{0E63EAA3-3001-496B-AAA5-4A0DD7DD3EFF} --------- 0 

 25.04.2011 23:04      C:\DOKUME~1\Basta\LOKALE~1\Temp\schizoid-psy.pls --------- 228 

 25.04.2011 22:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\GLG1CD.tmp --------- 3278 

 25.04.2011 22:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\GLC1CB.tmp --------- 153600 

 25.04.2011 22:23      C:\DOKUME~1\Basta\LOKALE~1\Temp\control.xml --------- 12818 

 25.04.2011 22:19      C:\DOKUME~1\Basta\LOKALE~1\Temp\DRVUNINS --------- 0 

 25.04.2011 21:50      C:\DOKUME~1\Basta\LOKALE~1\Temp\JB3MV2_PCWDRV_US_2_01_00.zip --------- 21661528 

 25.04.2011 21:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\jar_cache261638564843225373.tmp --------- 114688 

 25.04.2011 20:29      C:\DOKUME~1\Basta\LOKALE~1\Temp\AC97-Installation Guide-(English).pdf --------- 1369170 

 25.04.2011 20:12      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-5 --------- 0 

 25.04.2011 20:01      C:\DOKUME~1\Basta\LOKALE~1\Temp\dd_vcredistUI00BB.txt --------- 13178 

 25.04.2011 20:01      C:\DOKUME~1\Basta\LOKALE~1\Temp\dd_vcredistMSI00BB.txt --------- 528152 

 25.04.2011 20:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\hsperfdata_Basta --------- 0 

 25.04.2011 19:59      C:\DOKUME~1\Basta\LOKALE~1\Temp\jar_cache6126321292963053493.tmp --------- 111436 

 24.04.2011 10:40      C:\DOKUME~1\Basta\LOKALE~1\Temp\AUCHECK_PARSER.txt --------- 817 

 24.04.2011 10:40      C:\DOKUME~1\Basta\LOKALE~1\Temp\AUCHECK_CORE.txt --------- 2416 

 24.04.2011 10:40      C:\DOKUME~1\Basta\LOKALE~1\Temp\AUCHECK_DL_MANAGER.txt --------- 308 

 20.04.2011 16:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET6EB7.tmp --------- 0 

 20.04.2011 16:29      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET7687.tmp --------- 0 

 01.08.2010 21:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\CProgrammeOpera --------- 0 

 01.08.2010 18:16      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET7B1B.tmp --------- 0 

 28.07.2010 19:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\Konzept_Ausstellung.doc --------- 26112 

 28.07.2010 19:18      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET786C.tmp --------- 0 

 27.07.2010 20:12      C:\DOKUME~1\Basta\LOKALE~1\Temp\AMB55_2006b.pdf --------- 186693 

 27.07.2010 20:08      C:\DOKUME~1\Basta\LOKALE~1\Temp\100310_LeistnachwBASowiSS10.pdf --------- 30330 

 27.07.2010 07:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\8a24_appcompat.txt --------- 4312 

 23.07.2010 22:10      C:\DOKUME~1\Basta\LOKALE~1\Temp\EujtIWIH.htm.part --------- 0 

 23.07.2010 22:02      C:\DOKUME~1\Basta\LOKALE~1\Temp\D6qmWokc.htm.part --------- 0 

 23.07.2010 21:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\foo_ui_columns-0.3.8.6.7z --------- 565938 

 23.07.2010 21:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\foo_feelings_by_Tw4rk.rar --------- 354952 

 19.07.2010 16:32      C:\DOKUME~1\Basta\LOKALE~1\Temp\G04HQ2t3.doc.part --------- 26624 

 19.07.2010 15:35      C:\DOKUME~1\Basta\LOKALE~1\Temp\8xw26.tmp --------- 0 

 17.07.2010 12:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\fla30.tmp --------- 456834570 

 17.07.2010 09:22      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-4 --------- 0 

 17.07.2010 09:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\y0y25.tmp --------- 0 

 17.07.2010 09:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\fla1B.tmp --------- 15081732 

 17.07.2010 08:55      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET63DA.tmp --------- 0 

 09.07.2010 19:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\9Mz3pKIp.doc.part --------- 65536 

 09.07.2010 19:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\oCwuiyA7.doc.part --------- 65536 

 09.07.2010 19:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\nlbRZTv9.doc.part --------- 65536 

 09.07.2010 19:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\sftSktqT.doc.part --------- 65536 

 06.07.2010 00:03      C:\DOKUME~1\Basta\LOKALE~1\Temp\sKKTad0J.doc.part --------- 76288 

 05.07.2010 23:46      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO4E.tmp --------- 0 

 05.07.2010 23:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO4D.tmp --------- 0 

 05.07.2010 23:44      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO4C.tmp --------- 0 

 05.07.2010 23:43      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO4B.tmp --------- 0 

 05.07.2010 22:59      C:\DOKUME~1\Basta\LOKALE~1\Temp\020__a,templateId=raw,property=publicationFile.pdf --------- 83387 

 05.07.2010 22:59      C:\DOKUME~1\Basta\LOKALE~1\Temp\020__b,templateId=raw,property=publicationFile.pdf --------- 27857 

 05.07.2010 18:35      C:\DOKUME~1\Basta\LOKALE~1\Temp\22_oper.pdf --------- 10455 

 03.07.2010 19:36      C:\DOKUME~1\Basta\LOKALE~1\Temp\~DF725.tmp --------- 16384 

 02.07.2010 06:27      C:\DOKUME~1\Basta\LOKALE~1\Temp\JAUReg.log --------- 297 

 02.07.2010 06:26      C:\DOKUME~1\Basta\LOKALE~1\Temp\java_install_reg.log --------- 1993 

 02.07.2010 06:26      C:\DOKUME~1\Basta\LOKALE~1\Temp\java_install.log --------- 27128 

 02.07.2010 06:26      C:\DOKUME~1\Basta\LOKALE~1\Temp\java_install_sp.log --------- 1841 

 02.07.2010 06:26      C:\DOKUME~1\Basta\LOKALE~1\Temp\1a0f853.mst --------- 5097472 

 02.07.2010 06:23      C:\DOKUME~1\Basta\LOKALE~1\Temp\jinstall.cfg --------- 1217 

 01.07.2010 11:17      C:\DOKUME~1\Basta\LOKALE~1\Temp\nscopy.tmp --------- 95688 

 01.07.2010 11:17      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsemail.eml --------- 95504 

 01.07.2010 11:17      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-4.pdf --------- 68355 

 01.07.2010 11:17      C:\DOKUME~1\Basta\LOKALE~1\Temp\Projektbeschreibung Hochschulstrukturen.pdf --------- 68355 

 01.07.2010 10:58      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET662C.tmp --------- 0 

 30.06.2010 01:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-3.doc --------- 37888 

 30.06.2010 01:33      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-2.tmp --------- 32768 

 30.06.2010 01:32      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-1.doc --------- 37888 

 30.06.2010 01:32      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail.tmp --------- 32768 

 24.06.2010 15:29      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET4F29.tmp --------- 0 

 24.06.2010 15:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET5D33.tmp --------- 0 

 24.06.2010 12:58      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET71E4.tmp --------- 0 

 24.06.2010 12:32      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET517B.tmp --------- 0 

 24.06.2010 12:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET53BD.tmp --------- 0 

 24.06.2010 00:23      C:\DOKUME~1\Basta\LOKALE~1\Temp\Expos‚-IR-1.pdf --------- 619001 

 23.06.2010 23:43      C:\DOKUME~1\Basta\LOKALE~1\Temp\holgerburner.jpg --------- 17432 

 23.06.2010 23:35      C:\DOKUME~1\Basta\LOKALE~1\Temp\Expos‚-IR.pdf --------- 619001 

 23.06.2010 23:24      C:\DOKUME~1\Basta\LOKALE~1\Temp\conference program.pdf --------- 93694 

 23.06.2010 23:02      C:\DOKUME~1\Basta\LOKALE~1\Temp\MozillaMailnews --------- 0 

 23.06.2010 22:46      C:\DOKUME~1\Basta\LOKALE~1\Temp\etilqs_0eReMwScNE3bIBKq3OWA-journal --------- 0 

 23.06.2010 22:46      C:\DOKUME~1\Basta\LOKALE~1\Temp\etilqs_0eReMwScNE3bIBKq3OWA --------- 1024 

 23.06.2010 22:43      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET6198.tmp --------- 0 

 23.06.2010 22:15      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET6590.tmp --------- 0 

 23.06.2010 22:10      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET5C68.tmp --------- 0 

 19.06.2010 12:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\foo_uie_wsh_panel_mod.dll --------- 667136 

 17.06.2010 00:51      C:\DOKUME~1\Basta\LOKALE~1\Temp\~DFF45D.tmp --------- 65536 

 17.06.2010 00:51      C:\DOKUME~1\Basta\LOKALE~1\Temp\Informationsblatt zum Modul 7 - ausfhrliche Fassung.pdf --------- 23653 

 14.06.2010 22:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\Sehr geehrte Frau Kostica.doc --------- 26624 

 14.06.2010 11:59      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-3 --------- 0 

 14.06.2010 11:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-3.pdf --------- 1452954 

 14.06.2010 11:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-2.pdf --------- 347303 

 14.06.2010 11:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail-1.pdf --------- 134849 

 14.06.2010 11:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail.doc --------- 29696 

 14.06.2010 00:05      C:\DOKUME~1\Basta\LOKALE~1\Temp\nsmail.pdf --------- 68355 

 13.06.2010 03:08      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-2 --------- 0 

 13.06.2010 03:01      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp-1 --------- 0 

 13.06.2010 02:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\mmc204CD8A2.xml --------- 0 

 13.06.2010 01:48      C:\DOKUME~1\Basta\LOKALE~1\Temp\JET93B4.tmp --------- 0 

 13.06.2010 01:25      C:\DOKUME~1\Basta\LOKALE~1\Temp\~DFE053.tmp --------- 65536 

 12.06.2010 10:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO168.tmp --------- 0 

 12.06.2010 10:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO167.tmp --------- 0 

 12.06.2010 10:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO166.tmp --------- 0 

 12.06.2010 10:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO165.tmp --------- 0 

 12.06.2010 10:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO164.tmp --------- 0 

 12.06.2010 10:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO163.tmp --------- 0 

 12.06.2010 10:29      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zO162.tmp --------- 0 

 10.06.2010 16:05      C:\DOKUME~1\Basta\LOKALE~1\Temp\udDownload.tmp --------- 1907606 

 10.06.2010 16:02      C:\DOKUME~1\Basta\LOKALE~1\Temp\Spielentwuerfe.pdf --------- 125826 

 10.06.2010 04:11      C:\DOKUME~1\Basta\LOKALE~1\Temp\SetupAdmin9A8.log --------- 3337007 

 10.06.2010 04:11      C:\DOKUME~1\Basta\LOKALE~1\Temp\QTInstallCode.log --------- 2025 

 10.06.2010 04:11      C:\DOKUME~1\Basta\LOKALE~1\Temp\qtplugin.log --------- 4446 

 10.06.2010 04:10      C:\DOKUME~1\Basta\LOKALE~1\Temp\plugtmp --------- 0 

 10.06.2010 03:37      C:\DOKUME~1\Basta\LOKALE~1\Temp\FP_PL_PFS_INSTALLER.exe --------- 1924992 

 10.06.2010 03:31      C:\DOKUME~1\Basta\LOKALE~1\Temp\7zSF.tmp --------- 0 

 10.06.2010 03:26      C:\DOKUME~1\Basta\LOKALE~1\Temp\Tempor„res Verzeichnis 1 fr FoxitReader331_enu.zip --------- 0 

 08.04.2010 14:03      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb4.tmp --------- 2113536 

 28.12.2009 21:37      C:\DOKUME~1\Basta\LOKALE~1\Temp\{5D2A588C-5BB4-4905-8476-8617F1C2685A} --------- 0 

 28.12.2009 21:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\{A9AB6B67-2FD5-40AD-A879-66EC4850FACE} --------- 0 

 28.12.2009 21:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\mmc0A76B7E8.xml --------- 0 

 28.12.2009 21:18      C:\DOKUME~1\Basta\LOKALE~1\Temp\mmc1CA56C46.xml --------- 0 

 28.12.2009 21:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\Tempor„res Verzeichnis 4 fr dwlg510_driver_100.zip --------- 0 

 28.12.2009 21:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\{5E84AE3E-9191-4774-8783-9931825943A3} --------- 0 

 28.12.2009 21:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\Tempor„res Verzeichnis 3 fr dwlg510_driver_100.zip --------- 0 

 28.12.2009 21:14      C:\DOKUME~1\Basta\LOKALE~1\Temp\Tempor„res Verzeichnis 2 fr dwlg510_driver_100.zip --------- 0 

 28.12.2009 21:13      C:\DOKUME~1\Basta\LOKALE~1\Temp\Tempor„res Verzeichnis 1 fr dwlg510_driver_100.zip --------- 0 

 28.12.2009 17:41      C:\DOKUME~1\Basta\LOKALE~1\Temp\Setup Log 2009-12-28 #001.txt --------- 33104 

 13.11.2009 02:48      C:\DOKUME~1\Basta\LOKALE~1\Temp\Jgl_Rt --------- 0 

 13.11.2009 02:30      C:\DOKUME~1\Basta\LOKALE~1\Temp\Jgl_Rt1 --------- 0 

 13.11.2009 02:21      C:\DOKUME~1\Basta\LOKALE~1\Temp\{A53F9801-ED7E-4264-8CEA-46866C043258} --------- 0 

 13.11.2009 01:22      C:\DOKUME~1\Basta\LOKALE~1\Temp\Leadtek --------- 0 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSZHT.dll --------- 174696 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSZHC.dll --------- 170600 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSTR.dll --------- 309864 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSTH.dll --------- 297576 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSSV.dll --------- 301672 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSSL.dll --------- 309864 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSPTB.dll --------- 326248 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSSK.dll --------- 305768 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSRU.dll --------- 322152 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSPT.dll --------- 330344 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSPL.dll --------- 301672 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSNO.dll --------- 305768 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSNL.dll --------- 326248 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSJA.dll --------- 219752 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSKO.dll --------- 203368 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSIT.dll --------- 330344 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSHU.dll --------- 322152 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSHE.dll --------- 285288 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSFI.dll --------- 309864 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSFR.dll --------- 334440 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSESM.dll --------- 334440 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSES.dll --------- 342632 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSENG.dll --------- 293480 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSEL.dll --------- 342632 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSENU.dll --------- 293480 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSDE.dll --------- 318056 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSDA.dll --------- 301672 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSCS.dll --------- 293480 

 24.09.2009 00:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWRSAR.dll --------- 289384 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvwimg.dll --------- 1108584 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvShell.dll --------- 473704 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvwdmcpl.dll --------- 1731176 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nView.dll --------- 1624680 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvnt4cpl.dll --------- 293480 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nwiz.exe --------- 1657448 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvTaskBar.exe --------- 268392 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nViewSetup.exe --------- 261224 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvDspSch.exe --------- 1346152 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvAppBar.exe --------- 449128 

 24.09.2009 00:45      C:\DOKUME~1\Basta\LOKALE~1\Temp\keystone.exe --------- 510568 

 24.09.2009 00:41      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPLEN.HLP --------- 55444 

 24.09.2009 00:40      C:\DOKUME~1\Basta\LOKALE~1\Temp\nvTUICpl.cpl --------- 73728 

 24.09.2009 00:40      C:\DOKUME~1\Basta\LOKALE~1\Temp\nView.cpl --------- 73728 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPTR.HLP --------- 64401 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPSV.HLP --------- 59562 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPPTB.HLP --------- 58928 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPPL.HLP --------- 63426 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPIT.HLP --------- 57372 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPHU.HLP --------- 65285 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPSL.HLP --------- 59645 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPRU.HLP --------- 59167 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPPT.HLP --------- 59312 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPNO.HLP --------- 57530 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPESM.HLP --------- 56860 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPSK.HLP --------- 61937 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPES.HLP --------- 57161 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPEL.HLP --------- 58663 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPDE.HLP --------- 60795 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPDA.HLP --------- 58597 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPENU.HLP --------- 55444 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPFI.HLP --------- 59875 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPFR.HLP --------- 59626 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPNL.HLP --------- 58290 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPENG.HLP --------- 55637 

 24.09.2009 00:38      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPCS.HLP --------- 57326 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPZHT.HLP --------- 76236 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPZHC.HLP --------- 79786 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPKO.HLP --------- 124094 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPJA.HLP --------- 109051 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPTH.HLP --------- 90709 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPHE.HLP --------- 59064 

 06.05.2009 17:34      C:\DOKUME~1\Basta\LOKALE~1\Temp\NVWCPAR.HLP --------- 56964 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\generic.tvp --------- 30902 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\DCC.tvp --------- 31186 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\Advanced.tvp --------- 32846 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\Finance.tvp --------- 33032 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\default.tvp --------- 53768 

 11.03.2009 23:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\CAD.tvp --------- 29892 

 10.06.2008 06:11      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb3.tmp --------- 1053696 

 14.04.2008 07:53      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb0.tmp --------- 299520 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb1.tmp --------- 230912 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb2.tmp --------- 151552 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb7.tmp --------- 23552 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb8.tmp --------- 27136 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb6.tmp --------- 201728 

 14.04.2008 07:52      C:\DOKUME~1\Basta\LOKALE~1\Temp\setb5.tmp --------- 246272 

 29.06.2006 01:03      C:\DOKUME~1\Basta\LOKALE~1\Temp\CTOSChk.exe --------- 49152 

 19.01.2006 02:01      C:\DOKUME~1\Basta\LOKALE~1\Temp\ctpdusb.sys --------- 17280 

 15.06.2005 17:27      C:\DOKUME~1\Basta\LOKALE~1\Temp\sfextra.dll --------- 54784 

 13.04.2005 01:00      C:\DOKUME~1\Basta\LOKALE~1\Temp\ChkWin64.dll --------- 45056 

 12.04.2005 11:47      C:\DOKUME~1\Basta\LOKALE~1\Temp\graeq22.exe --------- 290816 

 10.11.2003 19:55      C:\DOKUME~1\Basta\LOKALE~1\Temp\set370.tmp --------- 116880 

 04.07.2003 13:49      C:\DOKUME~1\Basta\LOKALE~1\Temp\setup.exe --------- 815822 

 04.07.2003 12:54      C:\DOKUME~1\Basta\LOKALE~1\Temp\FILE_ID.DIZ --------- 594 

 25.03.2003 19:18      C:\DOKUME~1\Basta\LOKALE~1\Temp\00_INDEX.TXT --------- 97 

 15.09.2002 11:32      C:\DOKUME~1\Basta\LOKALE~1\Temp\graeq22.hlp --------- 157374 

 15.09.2002 00:07      C:\DOKUME~1\Basta\LOKALE~1\Temp\readme.txt --------- 9788 

 25.07.2002 02:07      C:\DOKUME~1\Basta\LOKALE~1\Temp\IEC2.tmp --------- 346602 

 25.07.2002 02:07      C:\DOKUME~1\Basta\LOKALE~1\Temp\IEC1.tmp --------- 346602 

 03.07.2002 01:01      C:\DOKUME~1\Basta\LOKALE~1\Temp\CTWseAPI.dll --------- 53248 

 04.11.2001 19:42      C:\DOKUME~1\Basta\LOKALE~1\Temp\player.dll --------- 73728 

 20.10.2001 12:18      C:\DOKUME~1\Basta\LOKALE~1\Temp\graeq22.prs --------- 7658 

 01.06.1998 11:56      C:\DOKUME~1\Basta\LOKALE~1\Temp\geq.dll --------- 39424 

 30.03.1998 19:07      C:\DOKUME~1\Basta\LOKALE~1\Temp\fittings.dll --------- 50176 

----------------------------------------
 

 

C:\Programme
 

 26.04.2011 03:46     C:\Programme\Mozilla Firefox --------- 0 

 26.04.2011 00:32     C:\Programme\Creative --------- 0 

 26.04.2011 00:32     C:\Programme\InstallShield Installation Information --------- 0 

 26.04.2011 00:28     C:\Programme\Gemeinsame Dateien --------- 0 

 26.04.2011 00:28     C:\Programme\Logitech --------- 0 

 26.04.2011 00:00     C:\Programme\Red Chair Software --------- 0 

 25.04.2011 23:50     C:\Programme\Windows Media Player --------- 0 

 25.04.2011 23:01     C:\Programme\BadApple --------- 0 

 25.04.2011 20:02     C:\Programme\Avira --------- 0 

 25.04.2011 20:00     C:\Programme\Mozilla Thunderbird --------- 0 

 25.04.2011 19:42     C:\Programme\Blaze Audio --------- 0 

 01.08.2010 21:28     C:\Programme\TBBackup --------- 0 

 23.07.2010 21:53     C:\Programme\foobar2000 --------- 0 

 23.07.2010 21:50     C:\Programme\4front-headphones-1 --------- 0 

 02.07.2010 06:26     C:\Programme\Java --------- 0 

 01.07.2010 23:25     C:\Programme\IrfanView --------- 0 

 24.06.2010 19:03     C:\Programme\Black Mirror 2 --------- 0 

 14.06.2010 00:19     C:\Programme\Messenger --------- 0 

 14.06.2010 00:17     C:\Programme\Movie Maker --------- 0 

 14.06.2010 00:16     C:\Programme\Outlook Express --------- 0 

 12.06.2010 10:27     C:\Programme\OpenOffice.org 2.0 --------- 0 

 12.06.2010 09:26     C:\Programme\ASCOMP Software --------- 0 

 12.06.2010 09:24     C:\Programme\Efficient Sticky Notes --------- 0 

 10.06.2010 04:11     C:\Programme\iTunes --------- 0 

 10.06.2010 04:11     C:\Programme\iPod --------- 0 

 10.06.2010 04:11     C:\Programme\Internet Explorer --------- 0 

 10.06.2010 04:11     C:\Programme\QuickTime --------- 0 

 10.06.2010 04:10     C:\Programme\Apple Software Update --------- 0 

 10.06.2010 04:05     C:\Programme\Bonjour --------- 0 

 10.06.2010 04:02     C:\Programme\7-Zip --------- 0 

 10.06.2010 03:31     C:\Programme\Opera --------- 0 

 10.06.2010 02:52     C:\Programme\MozBackup --------- 0 

 10.02.2010 23:23     C:\Programme\NMG --------- 0 

 10.02.2010 23:17     C:\Programme\directx --------- 0 

 28.12.2009 21:31     C:\Programme\ANI --------- 0 

 28.12.2009 21:31     C:\Programme\D-Link --------- 0 

 28.12.2009 21:16     C:\Programme\Carambis --------- 0 

 13.12.2009 20:14     C:\Programme\JoWood --------- 0 

 13.11.2009 02:57     C:\Programme\Lavalys --------- 0 

 13.11.2009 02:48     C:\Programme\RivaTuner v2.0 RC 16 --------- 0 

 13.11.2009 02:47     C:\Programme\SpeedFan --------- 0 

 13.11.2009 02:33     C:\Programme\SiSoftware --------- 0 

 13.11.2009 02:26     C:\Programme\Xider --------- 0 

 13.11.2009 02:22     C:\Programme\AIDA32 - Enterprise System Information --------- 0 

 13.11.2009 02:20     C:\Programme\Futuremark --------- 0 

 13.11.2009 01:51     C:\Programme\NVIDIA Corporation --------- 0 

 13.11.2009 00:58     C:\Programme\Uninstall Information --------- 0 

 13.11.2009 00:55     C:\Programme\xerox --------- 0 

 13.11.2009 00:55     C:\Programme\microsoft frontpage --------- 0 

 13.11.2009 00:54     C:\Programme\WindowsUpdate --------- 0 

 13.11.2009 00:54     C:\Programme\Online-Dienste --------- 0 

 13.11.2009 00:54     C:\Programme\NetMeeting --------- 0 

 13.11.2009 00:53     C:\Programme\ComPlus Applications --------- 0 

 13.11.2009 00:53     C:\Programme\Online Services --------- 0 

 13.11.2009 00:53     C:\Programme\MSN Gaming Zone --------- 0 

 13.11.2009 00:53     C:\Programme\Windows NT --------- 0 

 13.11.2009 00:52     C:\Programme\MSN --------- 0 

----------------------------------------
 

 

C:\Dokumente und Einstellungen\All Users\.. 
 

Basta    

LocalService    

Basti    

Besitzer    

NetworkService    

Default User    

All Users    

----------------------------------------
 

 

C:\WINDOWS\system32\drivers\etc\hosts
 

127.0.0.1       localhost
 

----------------------------------------
 

 
 

Abbildname                  PID Sitzungsname      Sitz.-Nr. Speichernutzung

========================= ===== ================ ========== ===============

System Idle Process           0 Console                   0            28 K

System                        4 Console                   0            72 K

smss.exe                    420 Console                   0           148 K

csrss.exe                   476 Console                   0         2.596 K

winlogon.exe                500 Console                   0         1.068 K

services.exe                544 Console                   0         3.064 K

lsass.exe                   556 Console                   0         1.528 K

nvsvc32.exe                 724 Console                   0         1.568 K

svchost.exe                 748 Console                   0         2.148 K

svchost.exe                 800 Console                   0         2.176 K

svchost.exe                 840 Console                   0        11.436 K

svchost.exe                 908 Console                   0         1.864 K

svchost.exe                1068 Console                   0         1.172 K

explorer.exe               1140 Console                   0        21.844 K

spoolsv.exe                1260 Console                   0         1.624 K

sched.exe                  1304 Console                   0           248 K

svchost.exe                1384 Console                   0           824 K

avguard.exe                1528 Console                   0        13.208 K

AppleMobileDeviceService.  1748 Console                   0         1.028 K

mDNSResponder.exe          1760 Console                   0         1.172 K

CTSVCCDA.EXE               1788 Console                   0           364 K

jqs.exe                    1832 Console                   0         1.384 K

svchost.exe                1904 Console                   0         1.904 K

wdfmgr.exe                 2028 Console                   0           416 K

avshadow.exe                948 Console                   0           768 K

alg.exe                     920 Console                   0         1.016 K

rundll32.exe               1324 Console                   0         1.104 K

AirGCFG.exe                1664 Console                   0         2.208 K

WZCSLDR2.exe               1592 Console                   0         2.024 K

iTunesHelper.exe           1676 Console                   0         5.036 K

SOUNDMAN.EXE               1672 Console                   0         1.064 K

jusched.exe                1092 Console                   0           672 K

avgnt.exe                  1008 Console                   0         1.644 K

LVCOMSX.EXE                1172 Console                   0         1.552 K

ctfmon.exe                  400 Console                   0         1.420 K

CTDetect.exe               1552 Console                   0         1.232 K

notmgr.exe                 2456 Console                   0         2.692 K

soffice.exe                2820 Console                   0           428 K

soffice.bin                2936 Console                   0         7.348 K

iPodService.exe            3144 Console                   0         2.364 K

firefox.exe                3248 Console                   0       169.784 K

plugin-container.exe       1232 Console                   0       185.092 K

CTCMS.exe                   656 Console                   0        40.820 K

CPdeSrvU.exe               2212 Console                   0         4.276 K

HiJackThis204(2).exe       2788 Console                   0        11.976 K

notepad.exe                3868 Console                   0         3.528 K

iTunes.exe                 3604 Console                   0       105.080 K

wmiprvse.exe               3752 Console                   0         6.184 K

cmd.exe                    1648 Console                   0         2.236 K

tasklist.exe               3784 Console                   0         4.528 K
 

 

***** Ende des Scans 26.04.2011 um  3:59:54,70 ***

nächster scan ist vom ccleaner.

alles was load.exe betrifft

OTL:

OTL Logfile:

Code:

OTL logfile created on: 26.04.2011 06:15:07 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\***\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1.023,00 Mb Total Physical Memory | 629,00 Mb Available Physical Memory | 61,00% Memory free

2,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,04 Gb Total Space | 67,37 Gb Free Space | 45,20% Space Free | Partition Type: NTFS

 

Computer Name: *** | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.04.26 06:05:20 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe

PRC - [2011.04.26 01:12:20 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2011.03.04 14:36:20 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.04 14:36:11 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.03.04 14:36:11 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2010.04.16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010.02.18 11:43:18 | 000,248,040 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.11.13 00:21:05 | 000,065,024 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2008.10.20 13:22:48 | 001,556,480 | ---- | M] (D-Link) -- C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe

PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.08.06 01:08:46 | 001,282,100 | ---- | M] (Red Chair Software, Inc.) -- C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe

PRC - [2007.01.19 12:49:04 | 000,049,152 | ---- | M] (Wireless Service) -- C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe

PRC - [2006.06.22 20:28:46 | 002,334,720 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.0\program\soffice.exe

PRC - [2006.06.22 09:34:14 | 002,478,080 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.0\program\soffice.bin

PRC - [2004.12.02 18:23:34 | 000,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Programme\Creative\MediaSource\Detector\CTDetect.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.04.26 06:05:20 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe

MOD - [2008.04.14 07:50:12 | 001,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)

SRV - [2011.03.04 14:36:20 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.04 14:36:11 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.04.16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2007.01.19 12:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto | Stopped] -- C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService)

SRV - [2006.06.05 15:22:34 | 001,129,000 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe -- (SandraTheSrv)

SRV - [2006.06.05 15:18:30 | 000,117,288 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe -- (SandraDataSrv)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.03.04 16:11:12 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.03.04 14:36:34 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.06.17 14:26:52 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.11.13 00:21:07 | 000,077,312 | ---- | M] (VIA Technologies inc,.ltd) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viasraid.sys -- (viasraid)

DRV - [2009.11.13 00:20:37 | 000,613,244 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2009.11.13 00:20:35 | 000,400,384 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2008.03.05 12:46:04 | 000,491,648 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61)

DRV - [2007.05.12 17:39:32 | 000,028,195 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\ANIO.sys -- (ANIO)

DRV - [2006.11.04 06:45:48 | 000,178,913 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0260Vid.sys -- (V0260VID)

DRV - [2006.05.21 19:00:00 | 000,008,320 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\RivaTuner v2.0 RC 16\RivaTuner32.sys -- (RivaTuner32)

DRV - [2006.01.19 02:01:00 | 000,017,280 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3)

DRV - [2005.10.10 10:24:24 | 000,019,416 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\sandra.sys -- (SANDRA)

DRV - [2005.08.18 01:00:00 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavalys\EVEREST Home Edition\kerneld.wnt -- (EverestDriver)

DRV - [2005.06.15 16:55:53 | 000,004,096 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Ask"

FF - prefs.js..browser.search.order.1: "Ask"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.forestle.org"

FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.13

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10

FF - prefs.js..extensions.enabledItems: {F3281C6A-29E3-405D-BD66-614E70C0B6B9}:0.3.5

FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7

FF - prefs.js..keyword.URL: "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q="

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.04.26 01:12:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.04.26 01:12:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.04.25 20:00:00 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins

 

[2010.06.10 03:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.06.10 02:46:27 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.04.25 20:00:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions

[2010.06.29 21:19:59 | 000,000,000 | ---D | M] (Flashblock) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

[2010.06.10 03:22:34 | 000,000,000 | ---D | M] (ShowIP) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}

[2010.06.10 03:22:34 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}

[2010.06.10 03:22:36 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}

[2010.07.23 22:05:51 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}

[2010.06.10 03:22:36 | 000,000,000 | ---D | M] (Fox!Box) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}

[2010.07.23 23:08:25 | 000,000,000 | ---D | M] (Foobar Controls) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\{F3281C6A-29E3-405D-BD66-614E70C0B6B9}

[2010.06.10 03:22:34 | 000,000,000 | ---D | M] (GameTap) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\GameTap@gametap.com

[2011.04.25 20:00:26 | 000,000,000 | ---D | M] (YouTube to MP3) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\extensions\youtube2mp3@mondayx.de

[2009.01.13 17:22:40 | 000,000,682 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\searchplugins\ask.xml

[2011.04.25 20:02:20 | 000,001,632 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\searchplugins\firefox-add-ons.xml

[2009.12.12 11:06:32 | 000,002,314 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\gx66htdz.default\searchplugins\forestle-de.xml

[2011.04.25 20:00:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.07.02 06:26:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.07.02 06:26:41 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2010.07.02 06:26:41 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2011.04.26 01:12:25 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.04.26 01:12:25 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.04.26 01:12:25 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.04.26 01:12:25 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.04.26 01:12:25 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2004.08.04 11:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O4 - HKLM..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [D-Link AirPlus G DWL-G510] C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe (D-Link)

O4 - HKLM..\Run: [EfficientStickyNotes]  File not found

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz]  File not found

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [Creative Detector] C:\Programme\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)

O4 - HKCU..\Run: [WebEQ XP]  File not found

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Orga-Nicer.lnk = C:\Programme\ASCOMP Software\Orga-Nicer\organicer.exe (ASCOMP Software GmbH)

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Efficient Sticky Notes.lnk = C:\Programme\Efficient Sticky Notes\EfficientStickyNotes.exe (Efficient Software)

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Notmad Manager.lnk = C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe (Red Chair Software, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\OpenOffice.org 2.0.lnk = C:\Programme\OpenOffice.org 2.0\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab (Creative Software AutoUpdate)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab (Creative Software AutoUpdate Support Package 1)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - CLSID or File not found.

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.11.13 00:55:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{d1904d02-94a6-11df-a817-00179a7d21a1}\Shell - "" = AutoRun

O33 - MountPoints2\{d1904d02-94a6-11df-a817-00179a7d21a1}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{d1904d02-94a6-11df-a817-00179a7d21a1}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: AppMgmt -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: voooli -  File not found

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.04.26 06:14:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2011.04.26 06:14:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ERUNT

[2011.04.26 06:14:01 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2011.04.26 06:11:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2011.04.26 06:08:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Logitech-LS

[2011.04.26 06:04:36 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Dokumente und Einstellungen\***\Desktop\Erunt-setup.exe

[2011.04.26 06:04:36 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe

[2011.04.26 06:04:36 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\TFC.exe

[2011.04.26 04:30:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene Videos

[2011.04.26 04:07:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner

[2011.04.26 04:07:40 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2011.04.26 00:30:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Logitech

[2011.04.26 00:28:46 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Logitech

[2011.04.26 00:19:36 | 000,000,000 | ---D | C] -- C:\Programme\Logitech

[2011.04.26 00:00:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Startmenü\Programme\Red Chair Software

[2011.04.26 00:00:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Application Data

[2011.04.26 00:00:37 | 000,000,000 | ---D | C] -- C:\Programme\Red Chair Software

[2011.04.25 23:54:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Creative

[2011.04.25 23:51:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Creative

[2011.04.25 23:49:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages

[2011.04.25 23:01:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Startmenü\Programme\BadApple

[2011.04.25 23:01:47 | 000,000,000 | ---D | C] -- C:\Programme\BadApple

[2011.04.25 22:23:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Creative

[2011.04.25 22:16:21 | 000,000,000 | ---D | C] -- C:\Programme\Creative

[2011.04.25 21:36:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData

[2011.04.25 20:05:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Avira

[2011.04.25 20:02:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira

[2011.04.25 20:02:12 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2011.04.25 20:02:09 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2011.04.25 20:02:09 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2011.04.25 20:02:09 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2011.04.25 20:02:09 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2011.04.25 20:02:08 | 000,000,000 | ---D | C] -- C:\Programme\Avira

[2011.04.25 20:02:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

[2011.04.25 19:57:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun

[2011.04.25 19:42:20 | 000,000,000 | ---D | C] -- C:\Programme\Blaze Audio

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.04.26 06:14:02 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2011.04.26 06:14:02 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2011.04.26 06:11:42 | 000,000,520 | ---- | M] () -- C:\WINDOWS\_delis32.ini

[2011.04.26 06:08:38 | 000,000,006 | ---- | M] () -- C:\WINDOWS\System32\ANIWZCSUSERNAME{81303AAA-62CD-41CF-9605-0BFA935955A6}

[2011.04.26 06:08:07 | 000,253,748 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml

[2011.04.26 06:08:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.04.26 06:05:28 | 000,301,568 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\g2m3e4r.exe

[2011.04.26 06:05:20 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe

[2011.04.26 06:05:14 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Dokumente und Einstellungen\***\Desktop\Erunt-setup.exe

[2011.04.26 06:05:08 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\TFC.exe

[2011.04.26 05:45:37 | 000,070,417 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Planspiel.jpg

[2011.04.26 05:42:20 | 000,435,069 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 019.jpg

[2011.04.26 05:41:47 | 000,434,681 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 015.jpg

[2011.04.26 05:41:32 | 000,359,221 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 014.jpg

[2011.04.26 05:41:16 | 000,368,749 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 013.jpg

[2011.04.26 05:41:03 | 000,355,042 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 012.jpg

[2011.04.26 05:40:35 | 000,294,941 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 010.jpg

[2011.04.26 05:40:18 | 000,373,347 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 009.jpg

[2011.04.26 05:39:55 | 000,412,723 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 007.jpg

[2011.04.26 05:38:15 | 000,522,200 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 023.jpg

[2011.04.26 05:23:13 | 000,192,603 | R--- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Entwurf_Triple_M.pdf

[2011.04.26 04:07:44 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk

[2011.04.26 01:06:31 | 000,000,007 | ---- | M] () -- C:\WINDOWS\System32\ANIWZCSUSERNAME

[2011.04.26 01:05:22 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.04.26 00:00:43 | 000,001,788 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Notmad Manager.lnk

[2011.04.25 23:49:57 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx

[2011.04.25 23:02:27 | 000,002,121 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk

[2011.04.25 23:01:50 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\deimos_archive.dei

[2011.04.25 20:18:09 | 000,000,476 | ---- | M] () -- C:\WINDOWS\graeq22.ini

[2011.04.25 19:42:50 | 000,000,060 | ---- | M] () -- C:\WINDOWS\System32\SYSWQDRV.SYS

[2011.04.24 10:40:06 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011.04.20 20:11:07 | 000,007,168 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.04.20 16:31:53 | 000,598,016 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\MyStickyNotes.esn

 
 ========== Files Created - No Company Name ==========

 

[2011.04.26 06:14:02 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2011.04.26 06:14:02 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2011.04.26 06:04:37 | 000,301,568 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\g2m3e4r.exe

[2011.04.26 05:45:37 | 000,070,417 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Planspiel.jpg

[2011.04.26 05:42:20 | 000,435,069 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 019.jpg

[2011.04.26 05:41:46 | 000,434,681 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 015.jpg

[2011.04.26 05:41:31 | 000,359,221 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 014.jpg

[2011.04.26 05:41:15 | 000,368,749 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 013.jpg

[2011.04.26 05:41:02 | 000,355,042 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 012.jpg

[2011.04.26 05:40:35 | 000,294,941 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 010.jpg

[2011.04.26 05:40:17 | 000,373,347 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 009.jpg

[2011.04.26 05:39:54 | 000,412,723 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 007.jpg

[2011.04.26 05:38:14 | 000,522,200 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\restliche Fotos PT 023.jpg

[2011.04.26 05:24:39 | 000,192,603 | R--- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Entwurf_Triple_M.pdf

[2011.04.26 04:07:44 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk

[2011.04.26 00:52:11 | 000,000,520 | ---- | C] () -- C:\WINDOWS\_delis32.ini

[2011.04.26 00:14:38 | 000,007,062 | ---- | C] () -- C:\WINDOWS\System32\audiopid.vxd

[2011.04.26 00:00:43 | 000,001,788 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Notmad Manager.lnk

[2011.04.25 23:01:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\deimos_archive.dei

[2011.04.25 22:35:02 | 000,003,635 | ---- | C] () -- C:\WINDOWS\ctpdusb.uns

[2011.04.25 22:20:53 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\PdeSrvps.dll

[2011.04.25 22:16:21 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE

[2011.04.25 19:54:29 | 000,000,476 | ---- | C] () -- C:\WINDOWS\graeq22.ini

[2011.04.25 19:42:50 | 000,000,060 | ---- | C] () -- C:\WINDOWS\System32\SYSWQDRV.SYS

[2010.07.23 21:50:31 | 000,430,080 | ---- | C] () -- C:\WINDOWS\System32\wmpheadphones.dll

[2010.07.23 21:50:31 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\ospitray.exe

[2010.07.04 10:40:24 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010.06.10 15:46:05 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll

[2010.06.10 15:46:05 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll

[2010.06.10 15:46:05 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll

[2010.06.10 15:38:39 | 000,037,888 | ---- | C] () -- C:\WINDOWS\UninstallLegend.exe

[2010.06.10 03:27:52 | 000,007,168 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.06.10 02:46:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009.12.28 21:31:40 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\wlanapp.dll

[2009.12.28 21:31:40 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\JJAKEn.dll

[2009.12.28 21:15:42 | 000,004,940 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mtbjfghn.xbe

[2009.11.13 00:57:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009.11.13 00:53:39 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2009.11.13 00:47:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009.11.13 00:46:43 | 000,099,048 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009.11.13 00:20:56 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2009.09.27 17:12:22 | 001,604,482 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin

[2008.04.14 08:06:26 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2006.12.31 07:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2005.03.29 21:02:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2005.03.29 21:02:01 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004.08.04 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004.08.04 11:00:00 | 000,316,594 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2004.08.04 11:00:00 | 000,311,604 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004.08.04 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004.08.04 11:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004.08.04 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004.08.04 11:00:00 | 000,048,156 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2004.08.04 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004.08.04 11:00:00 | 000,039,992 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004.08.04 11:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004.08.04 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004.08.04 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2010.06.10 04:11:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010.06.12 09:26:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ASCOMP Software

[2010.06.12 09:24:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Efficient Sticky Notes

[2010.07.23 23:09:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\foobar2000

[2010.06.10 03:31:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Opera

[2010.06.10 02:46:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Thunderbird

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2009.11.13 02:46:43 | 000,000,000 | ---D | M] -- C:\computec

[2009.11.13 00:55:43 | 000,000,000 | ---D | M] -- C:\DELL

[2010.06.10 03:06:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2010.06.13 02:52:56 | 000,000,000 | ---D | M] -- C:\Live!Cam

[2009.11.13 01:48:31 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2010.06.10 15:38:37 | 000,000,000 | ---D | M] -- C:\Program Files

[2011.04.26 06:14:01 | 000,000,000 | R--D | M] -- C:\Programme

[2009.11.13 02:24:19 | 000,000,000 | -HSD | M] -- C:\RECYCLER

[2011.04.26 05:57:07 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.04.26 06:14:16 | 000,000,000 | ---D | M] -- C:\WINDOWS

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: LOCALAPPDATA

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: EXPLORER.EXE  >

[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe

[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\system32\dllcache\explorer.exe

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-20 21:33:54
 

< End of report >

--- --- ---

Extras:

OTL Logfile:

Code:

OTL Extras logfile created on: 26.04.2011 06:15:07 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\***\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1.023,00 Mb Total Physical Memory | 629,00 Mb Available Physical Memory | 61,00% Memory free

2,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,04 Gb Total Space | 67,37 Gb Free Space | 45,20% Space Free | Partition Type: NTFS

 

Computer Name: SEBA-A8V | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"8823:TCP" = 8823:TCP:*:Enabled:pmudqz

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\sandra.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\sandra.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\sandra.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\sandra.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Sandra Lite -- (SiSoftware)

"C:\Programme\NMG\Ghost Recon\GhostRecon.exe" = C:\Programme\NMG\Ghost Recon\GhostRecon.exe:*:Disabled:GhostRecon -- ()

"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)

"C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe" = C:\Programme\Red Chair Software\Notmad Explorer\notmgr.exe:*:Enabled:Notmad Xtreamer -- (Red Chair Software, Inc.)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource

"{2F5B0382-8269-4A86-9568-05542CA0CC39}_is1" = Edna bricht aus Demo

"{33D6723B-DE6B-4E86-A6BC-CD1F3E42DD26}" = OpenOffice.org 2.0

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service

"{4FB120F8-622C-4260-AB49-0F43A59CCF2A}" = iTunes

"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support

"{70312451-0D00-4A84-B9B1-0D59B5180A4F}" = Opera 10.53

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service

"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour

"{8B128562-681D-4FFA-BEBF-A825985B2CB9}" = AirPlus G DWL-G510

"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support

"{9F78DB3D-4F90-4A10-AD0A-85C271C88106}" = Gothic 3

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{FA1DB6E6-2549-11D6-8D2A-004005249918}" = Ghost Recon

"{FF35F637-72B9-43BE-A281-06EB2854393A}" = 3DMark03

"4Front Headphones Plugin 1.0c_is1" = 4Front Headphones Plugin 1.0c

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"AIDA32_is1" = AIDA32 v3.60

"AndrewLabs ATSurround for foobar2000" = AndrewLabs ATSurround for foobar2000

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"BadApple" = BadApple 1.0 (remove only)

"Black Mirror 2_is1" = Black Mirror 2

"CCleaner" = CCleaner

"Creative Jukebox Driver" = Creative Jukebox Driver

"Creative VF0260" = Creative Live! Cam Vista IM Driver (1.01.03.1104)

"DED9B6BE-2B04-4799-A88F-8BBF4D114AAF_is1" = TBBackup 2 (Freiversion)

"Efficient Sticky Notes_is1" = Efficient Sticky Notes 1.60

"ERUNT_is1" = ERUNT 1.1j

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"foobar2000" = foobar2000 v1.1 beta 1

"G3QP231012008_is1" = Questpaket 4 Update 1 Deinstallation

"IrfanView" = IrfanView (remove only)

"MozBackup" = MozBackup 1.4.10

"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)

"Mozilla Thunderbird (3.0.11)" = Mozilla Thunderbird (3.0.11)

"Notmad Explorer" = Notmad Explorer (remove only)

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager

"Orga-Nicer_is1" = Orga-Nicer v3.0

"RivaTuner" = RivaTuner v2.0 RC 16

"SiSoftware Sandra Lite 2007_is1" = SiSoftware Sandra Lite 2007 (Win64/32/CE)

"SpeedFan" = SpeedFan (remove only)

"Windows Media Format Runtime" = Windows Media Format Runtime

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 21.04.2011 16:17:49 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 396: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 21.04.2011 16:17:49 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 408: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 14:02:56 | Computer Name = SEBA-A8V | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte

 nicht verarbeitet werden.  .

 

Error - 25.04.2011 18:07:48 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 236: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 18:07:48 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 244: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 18:07:48 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 400: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 18:07:48 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 412: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 18:07:48 | Computer Name = SEBA-A8V | Source = Bonjour Service | ID = 100

Description = 224: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde

 vom Remotehost geschlossen.)

 

Error - 25.04.2011 18:48:22 | Computer Name = SEBA-A8V | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung ctcms.exe, Version 3.0.37.0, fehlgeschlagenes

 Modul ctpmsman.dll, Version 1.4.15.0, Fehleradresse 0x0001ea8d.

 

Error - 25.04.2011 19:02:07 | Computer Name = SEBA-A8V | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3855,

 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b.

 

[ System Events ]

Error - 16.06.2010 19:58:01 | Computer Name = SEBA-A8V | Source = Print | ID = 6161

Description = Das Dokument Zeitplan, im Besitz von ***, konnte nicht auf dem Drucker

 HP PSC 500 gedruckt werden. Datentyp: NT EMF 1.008. Größe der Warteschlangendatei

 in Bytes: 26552. Anzahl der gedruckten Bytes: 0. Gesamtanzahl der Seiten des Dokuments:

 1. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\SEBA-A8V. Vom Druckprozessor

 zurückgelieferter Win32-Fehlercode: 2 (0x2). 

 

Error - 16.06.2010 19:58:26 | Computer Name = SEBA-A8V | Source = Print | ID = 6161

Description = Das Dokument Testseite, im Besitz von ***, konnte nicht auf dem 

Drucker HP DeskJet 520 gedruckt werden. Datentyp: NT EMF 1.008. Größe der Warteschlangendatei

 in Bytes: 74816. Anzahl der gedruckten Bytes: 0. Gesamtanzahl der Seiten des Dokuments:

 1. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\SEBA-A8V. Vom Druckprozessor

 zurückgelieferter Win32-Fehlercode: 2 (0x2). 

 

Error - 16.06.2010 19:58:36 | Computer Name = SEBA-A8V | Source = Print | ID = 6161

Description = Das Dokument Testseite, im Besitz von ***, konnte nicht auf dem 

Drucker HP DeskJet 520 gedruckt werden. Datentyp: NT EMF 1.008. Größe der Warteschlangendatei

 in Bytes: 74816. Anzahl der gedruckten Bytes: 0. Gesamtanzahl der Seiten des Dokuments:

 1. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\SEBA-A8V. Vom Druckprozessor

 zurückgelieferter Win32-Fehlercode: 2 (0x2). 

 

Error - 23.06.2010 16:10:55 | Computer Name = SEBA-A8V | Source = Print | ID = 54

Description = Dokument Testseite war beschädigt und wurde gelöscht. Der zugewiesene

 Treiber ist: HP DeskJet 520.

 

Error - 23.06.2010 16:43:30 | Computer Name = SEBA-A8V | Source = Service Control Manager | ID = 7034

Description = Dienst "ANIWZCSd Service" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 23.06.2010 18:23:57 | Computer Name = SEBA-A8V | Source = Print | ID = 6161

Description = Das Dokument C:\DOKUME~1\***\LOKALE~1\Temp\Exposé-IR-1.pdf, im Besitz

 von ***, konnte nicht auf dem Drucker HP DeskJet 520 gedruckt werden. Datentyp:

 NT EMF 1.008. Größe der Warteschlangendatei in Bytes: 3260592. Anzahl der gedruckten

 Bytes: 0. Gesamtanzahl der Seiten des Dokuments: 1. Anzahl der gedruckten Seiten:

 0. Clientcomputer: \\SEBA-A8V. Vom Druckprozessor zurückgelieferter Win32-Fehlercode:

 2 (0x2). 

 

Error - 24.06.2010 06:58:57 | Computer Name = SEBA-A8V | Source = Print | ID = 54

Description = Dokument C:\DOKUME~1\***\LOKALE~1\Temp\Exposé-IR-1.pdf war beschädigt

 und wurde gelöscht. Der zugewiesene Treiber ist: HP DeskJet 520.

 

Error - 24.06.2010 09:30:38 | Computer Name = SEBA-A8V | Source = Service Control Manager | ID = 7034

Description = Dienst "ANIWZCSd Service" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 01.07.2010 16:51:09 | Computer Name = SEBA-A8V | Source = Service Control Manager | ID = 7034

Description = Dienst "ANIWZCSd Service" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 17.07.2010 16:47:09 | Computer Name = SEBA-A8V | Source = viasraid | ID = 262153

Description = Das Gerät \Device\Scsi\viasraid1 hat innerhalb der Fehlerwartezeit

 nicht geantwortet.

 

 

< End of report >

--- --- ---

gmer:

GMER Logfile:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-26 07:17:02

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Scsi\viasraid1Port2Path0Target0Lun0 SAMSUNG_ rev.SW10

Running: g2m3e4r.exe; Driver: C:\DOKUME~1\Basta\LOKALE~1\Temp\kwdcypow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT   ED4E5D56                                                                      ZwCreateKey

SSDT   ED4E5D4C                                                                      ZwCreateThread

SSDT   ED4E5D5B                                                                      ZwDeleteKey

SSDT   ED4E5D65                                                                      ZwDeleteValueKey

SSDT   ED4E5D6A                                                                      ZwLoadKey

SSDT   ED4E5D38                                                                      ZwOpenProcess

SSDT   ED4E5D3D                                                                      ZwOpenThread

SSDT   ED4E5D74                                                                      ZwReplaceKey

SSDT   ED4E5D6F                                                                      ZwRestoreKey

SSDT   ED4E5D60                                                                      ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                      section is writeable [0xF6B86360, 0x3E57A5, 0xE8000020]

init   C:\WINDOWS\system32\drivers\ALCXSENS.SYS                                      entry point in "init" section [0xED2DA900]
 

---- Registry - GMER 1.0.15 ----
 

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@DisplayName                         Update Center

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@Type                                32

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@Start                               2

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@ErrorControl                        0

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@ImagePath                           %SystemRoot%\system32\svchost.exe -k netsvcs

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@ObjectName                          LocalSystem

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli@Description                         Bietet allen Computern in Heim- und kleinen Firmennetzwerken Dienste f?r die Netzwerkadress?bersetzung, Adressierung, Namensaufl?sung und Eindringsschutz.

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli\Parameters (not active ControlSet)  

Reg    HKLM\SYSTEM\ControlSet002\Services\voooli\Parameters@ServiceDll               C:\WINDOWS\system32\wgdcen.dll
 

---- EOF - GMER 1.0.15 ----

--- --- ---