Trojaner-Board - HTML/infected.Webpage.Gen und AntiVir 2010

moin arne,

erledigt:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4191

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

13.06.2010 22:51:25
mbam-log-2010-06-13 (22-51-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 254600
Laufzeit: 49 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files\DVDFab 6\dbghelp.dll (Trojan.FakeMS) -> No action taken.

habe es löschen lassen, aber nach dem reboot kamen die gleichen meldungen von antivir und die IE und "user"-meldung

dann:

OTL Logfile:

Code:

OTL logfile created on: 13.06.2010 19:28:04 - Run 1

OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\mc\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 44,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 116,44 Gb Total Space | 85,06 Gb Free Space | 73,05% Space Free | Partition Type: NTFS

Drive D: | 104,72 Gb Total Space | 102,29 Gb Free Space | 97,68% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: MC-KISTE

Current User Name: mc

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\mc\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)

PRC - C:\Windows\System32\rpcnet.exe (Absolute Software Corp.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Program Files\OpenOffice.org 3\program\scalc.exe (OpenOffice.org)

PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (Logitech, Inc.)

PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Windows\ehome\mcupdate.exe (Microsoft Corporation)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe (SRS Labs, Inc.)

PRC - C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe (SRS Labs, Inc.)

PRC - C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program files\P4G\BatteryLife.exe (ATK)

PRC - C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)

PRC - C:\Program Files\ASUS\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\Program Files\ASUS\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)

PRC - C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)

PRC - C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe (ASUS)

PRC - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()

PRC - C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

PRC - C:\Program Files\ASUS\ASUS Live Update\ALU.exe ()

PRC - C:\Program Files\RocketDock\RocketDock.exe ()

PRC - C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

PRC - C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe (Mediafour Corporation)

PRC - C:\Windows\System32\ACEngSvr.exe (ASUSTeK)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\mc\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

MOD - C:\Program Files\Elantech\ETDApix.dll (ELAN Microelectronic Corp.)

MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (rpcnet) Remote Procedure Call (RPC) -- C:\Windows\System32\rpcnet.exe (Absolute Software Corp.)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe (Logitech, Inc.)

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)

SRV - (SRS_VolSync_Service) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe (SRS Labs, Inc.)

SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)

SRV - (ASLDRService) -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()

SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

SRV - (MacDriveService) -- C:\Program Files\Mediafour\MacDrive 7\MacDriveService.exe (Mediafour Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)

DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)

DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (SRS_PremiumSound_Service) -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys ()

DRV - (ETD) -- C:\Windows\System32\drivers\ETD.sys (ELAN Microelectronic Corp.)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)

DRV - (fssfltr) -- C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)

DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )

DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)

DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )

DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)

DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()

DRV - (CRFILTER) -- C:\Windows\System32\drivers\CRFILTER.sys (Generic)

DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)

DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)

DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)

DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)

DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)

DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)

DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)

DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)

DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)

DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)

DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)

DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)

DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)

DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)

DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)

DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)

DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)

DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)

DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)

DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)

DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)

DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)

DRV - (MDFSYSNT) -- C:\Windows\System32\drivers\MDFSYSNT.SYS (Mediafour Corporation)

DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()

DRV - (MDPMGRNT) -- C:\Windows\System32\drivers\MDPMGRNT.sys (Mediafour Corporation)

DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)

DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)

DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)

DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)

DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)

DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)

DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)

DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)

DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)

DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)

DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)

DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)

DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)

DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)

DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "google.de"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2

FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10

FF - prefs.js..extensions.enabledItems: {F8A55C97-3DB6-4961-A81D-0DE0080E53CB}:0.9.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.1.0521

FF - prefs.js..extensions.enabledItems: {113c2360-15a3-11de-8c30-0800200c9a66}:0.9

FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.20 19:29:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.24 10:08:02 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.04.20 19:29:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2010.03.25 15:23:40 | 000,000,000 | ---D | M] -- C:\Users\mc\AppData\Roaming\mozilla\Extensions

[2010.03.25 15:23:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mc\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2010.06.13 10:40:55 | 000,000,000 | ---D | M] -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions

[2010.03.25 15:52:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{113c2360-15a3-11de-8c30-0800200c9a66}

[2010.03.25 15:54:35 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}

[2010.05.23 12:03:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}

[2010.04.30 20:52:25 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.05.31 09:22:01 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}

[2010.04.26 23:32:26 | 000,000,000 | ---D | M] (Download Manager Tweak) -- C:\Users\mc\AppData\Roaming\mozilla\Firefox\Profiles\c26x4znh.default\extensions\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}

[2010.03.26 12:22:43 | 000,002,256 | ---- | M] () -- C:\Users\mc\AppData\Roaming\Mozilla\FireFox\Profiles\c26x4znh.default\searchplugins\askcom.xml

[2010.04.16 11:10:47 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions

[2010.04.16 11:10:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.04.16 11:10:39 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.16 20:28:04 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.03.16 20:28:04 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2010.03.16 20:28:04 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.03.16 20:28:04 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.03.16 20:28:04 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe ()

O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()

O4 - HKCU..\Run: [SRS Premium Sound] C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe (SRS Labs, Inc.)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\mc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegUser.lnk = C:\Windows\System32\reguser.exe (Microsoft Corporation)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\262809.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\262809.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.06.13 19:26:49 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Users\mc\Desktop\OTL.exe

[2010.06.12 17:47:39 | 000,000,000 | ---D | C] -- C:\Users\mc\AppData\Roaming\Malwarebytes

[2010.06.12 17:47:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.06.12 17:47:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010.06.12 17:47:20 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.06.12 17:47:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010.06.12 09:48:48 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Users\mc\Desktop\HiJackThis.exe

[2010.06.11 14:37:40 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll

[2010.06.11 14:37:39 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[2010.06.11 14:37:38 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2010.06.11 14:37:36 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2010.06.11 14:37:33 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2010.06.11 14:37:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2010.06.11 14:37:32 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2010.06.11 14:37:32 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2010.06.11 14:37:31 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2010.06.11 14:37:31 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2010.06.11 14:37:31 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2010.06.11 14:37:31 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2010.06.11 14:37:31 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2010.06.11 14:37:31 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2010.06.11 14:37:31 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2010.06.11 14:37:31 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2010.06.11 14:37:31 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2010.06.11 14:37:31 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2010.06.11 14:37:31 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2010.06.07 11:52:21 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\reguser.exe

[2010.06.04 19:58:49 | 000,000,000 | ---D | C] -- C:\Users\mc\Desktop\Jamie Cullum

[2010.05.26 09:16:32 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2010.05.25 12:07:54 | 000,000,000 | ---D | C] -- C:\Users\mc\AppData\Local\Deployment

[2010.05.25 12:07:54 | 000,000,000 | ---D | C] -- C:\Users\mc\AppData\Local\Apps

[2010.05.25 12:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\EURO I AG

[2010.05.25 12:06:50 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Windows Media Center-Verknüpfungen

[2010.05.25 12:02:17 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\MCE Logs

[2010.05.24 10:13:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Mediafour

[2010.05.24 10:13:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Mediafour

[2010.05.24 09:59:44 | 000,000,000 | ---D | C] -- C:\Program Files\Mediafour

[2008.11.03 09:03:27 | 000,013,880 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.06.13 19:27:23 | 001,835,008 | -HS- | M] () -- C:\Users\mc\NTUSER.DAT

[2010.06.13 19:26:51 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Users\mc\Desktop\OTL.exe

[2010.06.13 19:17:56 | 000,048,354 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2010.06.13 19:17:56 | 000,048,354 | ---- | M] () -- C:\ProgramData\nvModes.001

[2010.06.13 19:17:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010.06.13 19:17:44 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe

[2010.06.13 11:05:47 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010.06.13 11:05:47 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010.06.12 20:29:25 | 000,021,504 | ---- | M] () -- C:\Users\mc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.06.12 20:20:57 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010.06.12 20:20:57 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2010.06.12 20:20:57 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010.06.12 20:20:57 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2010.06.12 20:20:57 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010.06.12 17:05:56 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2010.06.12 17:05:51 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll

[2010.06.12 17:05:47 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010.06.12 17:05:41 | 3220,381,696 | -HS- | M] () -- C:\hiberfil.sys

[2010.06.12 17:04:38 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2010.06.12 17:04:34 | 000,524,288 | -HS- | M] () -- C:\Users\mc\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2010.06.12 17:04:34 | 000,065,536 | -HS- | M] () -- C:\Users\mc\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2010.06.12 17:04:28 | 003,000,446 | -H-- | M] () -- C:\Users\mc\AppData\Local\IconCache.db

[2010.06.12 09:48:49 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Users\mc\Desktop\HiJackThis.exe

[2010.06.11 15:11:39 | 000,391,320 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010.06.09 20:09:12 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE

[2010.06.07 11:52:21 | 000,000,732 | ---- | M] () -- C:\Users\mc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegUser.lnk

[2010.06.04 16:30:37 | 233,518,514 | ---- | M] () -- C:\Users\mc\Desktop\Jamie Cullum.zip

[2010.06.01 15:09:19 | 000,069,960 | ---- | M] () -- C:\Users\mc\Desktop\maik verdickt.jpg

[2010.06.01 15:09:04 | 000,051,282 | ---- | M] () -- C:\Users\mc\Desktop\lea verdickt.jpg

[2010.05.26 19:06:41 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2010.05.26 16:47:41 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[2010.05.26 09:35:03 | 000,020,843 | ---- | M] () -- C:\Users\mc\Documents\mu-sik.odp

[2010.05.25 13:04:48 | 064,720,419 | ---- | M] () -- C:\Users\mc\Desktop\Citroen_trade_fair_dvd.mp4

[2010.05.24 10:13:09 | 000,697,328 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys

[2010.05.23 14:05:27 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf

 
 ========== Files Created - No Company Name ==========

 

[2010.06.09 20:09:12 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE

[2010.06.07 11:52:21 | 000,000,732 | ---- | C] () -- C:\Users\mc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegUser.lnk

[2010.06.04 16:23:58 | 233,518,514 | ---- | C] () -- C:\Users\mc\Desktop\Jamie Cullum.zip

[2010.06.01 15:09:19 | 000,069,960 | ---- | C] () -- C:\Users\mc\Desktop\maik verdickt.jpg

[2010.06.01 15:09:04 | 000,051,282 | ---- | C] () -- C:\Users\mc\Desktop\lea verdickt.jpg

[2010.05.27 12:41:30 | 064,720,419 | ---- | C] () -- C:\Users\mc\Desktop\Citroen_trade_fair_dvd.mp4

[2010.05.26 09:34:54 | 000,020,843 | ---- | C] () -- C:\Users\mc\Documents\mu-sik.odp

[2010.05.23 14:05:27 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf

[2010.03.27 14:21:30 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2010.03.26 12:29:14 | 000,697,328 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys

[2009.07.31 20:11:19 | 000,233,128 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys

[2009.07.31 19:10:03 | 000,017,408 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll

[2008.08.11 04:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys

[2008.05.12 05:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys

[2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2008.04.07 08:00:45 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

< End of report >

--- --- ---
OTL Logfile:

Code:

OTL Extras logfile created on: 13.06.2010 19:28:04 - Run 1

OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\mc\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 44,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 116,44 Gb Total Space | 85,06 Gb Free Space | 73,05% Space Free | Partition Type: NTFS

Drive D: | 104,72 Gb Total Space | 102,29 Gb Free Space | 97,68% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: MC-KISTE

Current User Name: mc

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1CAC1EB6-C07A-4DB1-B441-78CA23958BAE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{43861A79-F545-4931-94EE-619069BF8F49}" = lport=2869 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0C134940-46DB-48A5-9C9A-55E66E59F3E9}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{0FCAFC26-EFAE-48BC-836B-67B2AD39349D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{11B280C9-CB21-40AA-971B-6734ECD75E75}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{244D0863-8547-4A4A-B120-4FB13ABC1CC2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{2670FA61-BB2A-4A6C-ABD1-E4E15D10C4B4}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{69395C36-A36F-4B33-A4B8-BAB2AE6A8E20}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{A8B42E6A-7437-4FD1-9ADC-08F1C704B37B}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 

"{C8514013-F8CB-48AE-A33C-D3C93CB4B62F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{DC680644-6919-49ED-BC3E-129DCC8B6548}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 

"{EB11314A-9B34-4E3F-9E2A-B014DF96318B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"TCP Query User{1105B2CC-BFC0-448B-88D6-54AC858AD04A}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 

"UDP Query User{69FF84EB-4E7E-480C-B17C-D39F3DDD12C5}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology

"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3

"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{3A608351-5980-4A47-AE08-3742C55B4016}" = Windows Live Family Safety

"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update

"{4B6B024F-F6D4-4A7B-8ADA-F9F8370320CC}" = SRS Premium Sound

"{4C3EF687-803F-4825-B815-04AE32DDEB41}" = YAVIDO

"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support

"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail

"{5BACA8C1-909F-4AA4-90EB-6CAE5241FA96}" = MacDrive 7

"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes

"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey

"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer

"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call

"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger

"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour

"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync

"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash

"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid

"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame

"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support

"{A9FEB6D7-9C52-49FC-B956-7AB275B78890}" = ASUS FancyStart

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch

"{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media

"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service

"{DA41F9E9-B878-467F-95E7-27E4D1943533}" = Multimedia Card Reader

"{DC35EF73-C7BD-4452-A793-4269990E1EA3}" = Windows Live Movie Maker-Betaversion

"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash

"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials

"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update

"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0

"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform

"{FA36757F-EF60-499D-8568-1A6249405B6A}" = Jalbum

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"BitTorrent" = BitTorrent

"CCleaner" = CCleaner

"DVD Shrink_is1" = DVD Shrink 3.2

"DVDFab 6 by TEAM AHCU_is1" = DVDFab 6.0.2.2 by TEAM AHCU(June 26, 2009)

"Elantech" = ETDWare PS/2-x86 7.0.5.2 WHQL

"FormatFactory" = FormatFactory 2.30

"FoxyTunesForFirefox" = FoxyTunes for Firefox

"Galactic Civilizations II - Ultimate Edition" = Galactic Civilizations II - Ultimate Edition

"HijackThis" = HijackThis 2.0.2

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go

"InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun

"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)

"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)

"NVIDIA Drivers" = NVIDIA Drivers

"Picasa 3" = Picasa 3

"RealPlayer 12.0" = RealPlayer

"RocketDock_is1" = RocketDock 1.3.5

"SolSuite_is1" = SolSuite 2009 v9.5

"SP6" = Logitech SetPoint 6.0

"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

"USB Mass Storage Filter Driver" = Multimedia Card Reader

"VLC media player" = VLC media player 1.0.5

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 09.06.2010 19:32:14 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 09.06.2010 19:32:14 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 18015323

 

Error - 09.06.2010 19:32:14 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 18015323

 

Error - 10.06.2010 01:18:57 | Computer Name = mc-kiste | Source = System Restore | ID = 8193

Description = 

 

Error - 10.06.2010 02:55:29 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 10.06.2010 02:55:29 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 5404576

 

Error - 10.06.2010 02:55:29 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 5404576

 

Error - 10.06.2010 08:33:20 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 10.06.2010 08:33:20 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 1544425

 

Error - 10.06.2010 08:33:20 | Computer Name = mc-kiste | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 1544425

 

[ System Events ]

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 08:18:43 | Computer Name = mc-kiste | Source = Microsoft-Windows-Servicing | ID = 4375

Description = 

 

Error - 26.03.2010 13:07:54 | Computer Name = mc-kiste | Source = Service Control Manager | ID = 7011

Description = 

 

Error - 27.03.2010 04:13:06 | Computer Name = mc-kiste | Source = HTTP | ID = 15016

Description = 

 

Error - 27.03.2010 04:15:33 | Computer Name = mc-kiste | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description = 

 

 

< End of report >

--- --- ---