Trojaner-Board - Vista PC mit "Trojanfakealert" infiziert

otl dateiOTL Logfile:

Code:

OTL logfile created on: 01.09.2010 17:52:25 - Run 1

OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\christian\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 51,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 56,80 Gb Free Space | 38,11% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 58,72 Gb Free Space | 42,16% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

Drive F: | 6,31 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive G: | 993,72 Mb Total Space | 787,25 Mb Free Space | 79,22% Space Free | Partition Type: FAT

H: Drive not present or media not loaded

Drive I: | 1,86 Gb Total Space | 0,11 Gb Free Space | 5,81% Space Free | Partition Type: FAT

 

Computer Name: CHRISTIAN-PC

Current User Name: christian

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

PRC - C:\Users\christian\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Opera\Opera.exe (Opera Software)

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

PRC - C:\Program Files\winamp\winampa.exe (Nullsoft, Inc.)

PRC - C:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)

PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()

PRC - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()

PRC - C:\Windows\ASScrPro.exe ()

PRC - C:\Garmin\gStart.exe (GARMIN Corp.)

PRC - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

PRC - C:\Program Files\P4G\BatteryLife.exe (ATK)

PRC - C:\Program Files\ATK Hotkey\Hcontrol.exe (ATK0100)

PRC - C:\Program Files\ATK Hotkey\WDC.exe ()

PRC - C:\Program Files\ATK Hotkey\KBFiltr.exe ()

PRC - C:\Program Files\ATK Hotkey\ATKOSD.exe ()

PRC - C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

PRC - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()

PRC - C:\Program Files\P4P\P4P.exe ()

PRC - C:\Program Files\ASUS\ASUS Live Update\ALU.exe ()

PRC - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

PRC - C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)

PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

PRC - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe ()

PRC - C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()

PRC - C:\Program Files\ATKOSD2\ATKOSD2.exe ()

PRC - C:\Program Files\Wireless Console 2\wcourier.exe ()

PRC - C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE (Microsoft Corporation)

PRC - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

PRC - C:\Windows\System32\BRSS01A.EXE (brother Industries Ltd)

PRC - C:\Windows\System32\ACEngSvr.exe (ASUSTeK)

PRC - C:\Windows\System32\BRSVC01A.EXE (brother Industries Ltd)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\christian\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()

SRV - (AAV UpdateService) -- C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()

SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

SRV - (spmgr) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()

SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

SRV - (ADSMService) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe ()

SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()

SRV - (Brother XP spl Service) -- C:\Windows\System32\BRSVC01A.EXE (brother Industries Ltd)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found

DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)

DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)

DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)

DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)

DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)

DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)

DRV - (MODEMCSA) -- C:\Windows\System32\drivers\MODEMCSA.sys (Microsoft Corporation)

DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)

DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)

DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)

DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)

DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)

DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)

DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)

DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)

DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)

DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)

DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)

DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)

DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)

DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)

DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)

DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)

DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)

DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (Windows (R) Codename Longhorn DDK provider)

DRV - (ghaio) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()

DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)

DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)

DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()

DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)

DRV - (JRAID) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)

DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)

DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)

DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)

DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )

DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)

DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)

DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)

DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)

DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)

DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)

DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)

DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)

DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)

DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)

DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)

DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)

DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)

DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)

DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)

DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

DRV - (JGOGO) -- C:\Windows\system32\DRIVERS\JGOGO.sys (JMicron )

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\christian-PC_Administrator\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKU\christian-PC_Administrator\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.asus.com

IE - HKU\christian-PC_Administrator\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

[2010.09.01 15:55:29 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions

[2010.09.01 12:02:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)

O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\P4P\P4P.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\christian-PC_Administrator..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000..\Run: [Getdo]  File not found

O4 - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)

O4 - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O4 - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

O4 - HKU\S-1-5-21-2366973304-1417200682-1194841944-1000..\Run: [Locfla] C:\Users\christian\AppData\Roaming\Adobe\Update\32cli.exe ()

O7 - HKU\christian-PC_Administrator\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.50.140.178 192.168.0.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Eigene Dateien\Fotos\Hintergrund Foto Ironman einlauf.jpg

O24 - Desktop BackupWallPaper: C:\Eigene Dateien\Fotos\Hintergrund Foto Ironman einlauf.jpg

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2007.10.23 09:22:58 | 000,000,283 | R--- | M] () - F:\autorun.inf -- [ CDFS ]

O33 - MountPoints2\{e7126931-913b-11dd-9c57-002215ec554d}\Shell - "" = AutoRun

O33 - MountPoints2\{e7126931-913b-11dd-9c57-002215ec554d}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found

O33 - MountPoints2\H\Shell - "" = AutoRun

O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2B538E28-5768-7F08-6082-1710EA49821A} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: VIDC.ACDV - ACDV.dll File not found

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.09.01 17:10:26 | 000,000,000 | ---D | C] -- C:\Users\christian\AppData\Local\AOL

[2010.09.01 17:10:08 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.2

[2010.09.01 17:04:27 | 002,788,816 | ---- | C] (Adobe Systems, Inc.) -- C:\Users\christian\Desktop\install_flash_player.exe

[2010.09.01 16:35:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES

[2010.09.01 16:35:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES

[2010.09.01 16:35:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN

[2010.09.01 16:12:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders

[2010.09.01 16:11:37 | 000,000,000 | ---D | C] -- C:\Users\christian\AppData\Roaming\Opera

[2010.09.01 16:11:37 | 000,000,000 | ---D | C] -- C:\Users\christian\AppData\Local\Opera

[2010.09.01 16:11:22 | 000,000,000 | ---D | C] -- C:\Program Files\Opera

[2010.09.01 15:46:57 | 013,319,008 | ---- | C] (Opera Software ASA) -- C:\Users\christian\Desktop\Opera_1061_int_Setup.exe

[2010.09.01 13:48:56 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\christian\Desktop\OTL.exe

[2010.09.01 13:46:41 | 000,000,000 | ---D | C] -- C:\Users\christian\Desktop\PC CLEAN

[2010.09.01 12:03:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun

[2010.09.01 12:03:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2010.09.01 12:01:31 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll

[2010.09.01 12:01:31 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2010.09.01 12:01:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2010.09.01 12:01:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2010.08.29 15:52:42 | 000,000,000 | ---D | C] -- C:\Users\christian\Desktop\UPP vom stick

[2010.08.29 14:03:58 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2010.08.29 13:21:49 | 008,408,392 | ---- | C] (Mozilla) -- C:\Users\christian\Desktop\Firefox Setup 3.6.8.exe

[2010.08.28 22:32:49 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010.08.28 21:01:23 | 000,000,000 | ---D | C] -- C:\Users\christian\AppData\Roaming\Malwarebytes

[2010.08.28 21:01:15 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.08.28 21:01:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010.08.28 21:01:12 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.08.28 21:01:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010.08.21 00:49:35 | 000,000,000 | ---D | C] -- C:\Users\christian\Desktop\Lanza

[2010.08.17 14:54:43 | 000,000,000 | ---D | C] -- C:\Users\christian\Documents\ASUS

[2010.08.17 14:54:28 | 000,000,000 | ---D | C] -- C:\Users\christian\AppData\Local\ASUS

[2010.08.13 10:10:36 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll

[2010.08.13 10:10:30 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll

[2010.08.13 10:10:24 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2010.08.13 10:10:24 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll

[2010.08.13 10:10:04 | 002,037,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2010.08.13 10:10:02 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll

[2010.08.13 10:09:59 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2010.08.13 10:09:58 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2007.01.24 12:08:39 | 000,005,632 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

[2 C:\Users\christian\Desktop\*.tmp files -> C:\Users\christian\Desktop\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.09.01 17:56:35 | 004,456,448 | -HS- | M] () -- C:\Users\christian\NTUSER.DAT

[2010.09.01 17:10:59 | 000,001,616 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.2.lnk

[2010.09.01 17:07:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2010.09.01 17:04:27 | 002,788,816 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\christian\Desktop\install_flash_player.exe

[2010.09.01 16:50:38 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job

[2010.09.01 16:49:35 | 001,453,910 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010.09.01 16:49:35 | 000,632,252 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2010.09.01 16:49:35 | 000,598,900 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010.09.01 16:49:35 | 000,127,464 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2010.09.01 16:49:35 | 000,104,914 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010.09.01 16:46:39 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2010.09.01 16:46:15 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2010.09.01 16:45:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010.09.01 16:45:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010.09.01 16:41:55 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010.09.01 16:41:45 | 000,428,992 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010.09.01 16:41:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010.09.01 16:40:17 | 3220,430,848 | -HS- | M] () -- C:\hiberfil.sys

[2010.09.01 16:29:27 | 000,524,288 | -HS- | M] () -- C:\Users\christian\NTUSER.DAT{1c941285-d33b-11dd-bca2-002215ec554d}.TMContainer00000000000000000001.regtrans-ms

[2010.09.01 16:29:27 | 000,065,536 | -HS- | M] () -- C:\Users\christian\NTUSER.DAT{1c941285-d33b-11dd-bca2-002215ec554d}.TM.blf

[2010.09.01 16:29:25 | 003,761,834 | -H-- | M] () -- C:\Users\christian\AppData\Local\IconCache.db

[2010.09.01 16:11:29 | 000,000,721 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk

[2010.09.01 16:03:09 | 000,001,024 | ---- | M] () -- C:\Users\christian\.rnd

[2010.09.01 16:02:23 | 000,000,000 | ---- | M] () -- C:\Windows\Irremote.ini

[2010.09.01 15:47:34 | 013,319,008 | ---- | M] (Opera Software ASA) -- C:\Users\christian\Desktop\Opera_1061_int_Setup.exe

[2010.09.01 13:53:09 | 003,830,025 | ---- | M] () -- C:\Users\christian\Desktop\Combo-Fix neu.exe

[2010.09.01 13:49:21 | 000,293,376 | ---- | M] () -- C:\Users\christian\Desktop\gamer.exe

[2010.09.01 13:49:03 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\christian\Desktop\OTL.exe

[2010.09.01 13:19:40 | 000,002,828 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys

[2010.09.01 12:32:11 | 000,051,200 | ---- | M] () -- C:\Users\christian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.09.01 11:38:31 | 000,000,426 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{06426CF2-576B-4CDF-B52A-DC0DCC99C638}.job
 
 

[2 C:\Users\christian\Desktop\*.tmp files -> C:\Users\christian\Desktop\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.09.01 17:10:59 | 000,001,616 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.2.lnk

[2010.09.01 16:11:29 | 000,000,721 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk

[2010.09.01 16:02:23 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini

[2010.03.08 17:43:42 | 000,126,976 | ---- | C] () -- C:\Windows\System32\EEBAPI.dll

[2010.03.08 17:43:42 | 000,094,208 | ---- | C] () -- C:\Windows\System32\EEBDSCVR.dll

[2010.03.08 17:43:42 | 000,049,152 | ---- | C] () -- C:\Windows\System32\EBAPI.dll

[2010.02.08 16:11:18 | 000,000,023 | ---- | C] () -- C:\Windows\wiso.ini

[2009.09.24 09:31:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.01.24 14:05:53 | 000,000,353 | ---- | C] () -- C:\Windows\Uninstall Rätsel-Generator.ini

[2009.01.21 15:08:37 | 000,000,082 | ---- | C] () -- C:\Windows\GraphicsDesk.INI

[2009.01.07 20:44:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll

[2009.01.07 18:45:24 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll

[2009.01.07 18:45:01 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini

[2008.10.27 23:54:18 | 000,000,680 | ---- | C] () -- C:\Users\christian\AppData\Local\d3d9caps.dat

[2008.10.13 11:55:03 | 000,011,567 | ---- | C] () -- C:\Windows\HL-1230.INI

[2008.10.13 11:55:03 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI

[2008.10.13 11:55:03 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini

[2008.10.13 11:55:03 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini

[2008.10.13 11:55:03 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini

[2008.10.13 11:54:56 | 000,000,030 | ---- | C] () -- C:\Windows\System32\brss01a.ini

[2008.10.13 11:54:55 | 000,000,641 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2008.10.13 11:54:55 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2008.10.12 01:09:26 | 000,038,449 | ---- | C] () -- C:\Users\christian\AppData\Roaming\Kommagetrennte Werte (Windows).ADR

[2008.10.12 00:16:31 | 000,038,438 | ---- | C] () -- C:\Users\christian\AppData\Roaming\Kommagetrennte Werte (DOS).ADR

[2008.10.10 10:31:52 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2008.10.10 10:31:52 | 000,000,088 | RHS- | C] () -- C:\ProgramData\075796FB3D.sys

[2008.10.08 15:20:40 | 000,051,200 | ---- | C] () -- C:\Users\christian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.10.07 15:58:18 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2008.10.07 15:55:04 | 000,000,027 | ---- | C] () -- C:\Windows\CDE DX4400DEFGIPS.ini

[2008.10.06 14:43:16 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2008.08.26 12:55:01 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll

[2008.08.26 12:37:57 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

[2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.09.20 18:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2007.05.25 04:15:15 | 001,743,232 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys

[2007.05.09 09:16:39 | 000,028,160 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.03.09 04:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2004.08.26 07:13:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL

 
 ========== LOP Check ==========

 

[2009.02.05 17:40:26 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\ACD Systems

[2010.02.08 15:21:27 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Buhl Data Service

[2010.03.01 13:37:08 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Canon

[2009.03.01 14:46:08 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\GARMIN

[2009.01.21 15:05:37 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Hemera

[2010.09.01 17:11:07 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\ICQ

[2010.09.01 16:11:37 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Opera

[2009.01.24 14:06:09 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\pics

[2009.12.01 14:04:56 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\SecondLife

[2009.09.23 19:37:42 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\sl5_de

[2008.10.04 00:18:13 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Thunderbird

[2010.09.01 15:48:51 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\uTorrent

[2010.03.08 19:26:39 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\WordToPDF

[2010.09.01 16:38:34 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2010.09.01 11:38:31 | 000,000,426 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{06426CF2-576B-4CDF-B52A-DC0DCC99C638}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2009.02.05 17:40:26 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\ACD Systems

[2010.08.28 17:27:32 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Adobe

[2009.09.27 12:45:27 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Apple Computer

[2008.10.03 13:39:11 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\ATI

[2008.10.13 15:03:07 | 000,000,000 | R--D | M] -- C:\Users\christian\AppData\Roaming\Brother

[2010.02.08 15:21:27 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Buhl Data Service

[2010.03.01 13:37:08 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Canon

[2010.03.01 23:58:15 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Corel

[2010.09.01 12:33:59 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\DivX

[2009.03.01 14:46:08 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\GARMIN

[2009.01.21 15:05:37 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Hemera

[2010.09.01 17:11:07 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\ICQ

[2008.10.03 13:38:26 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Identities

[2008.10.07 15:58:16 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\InstallShield

[2008.10.03 13:38:52 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Macromedia

[2010.08.28 21:01:23 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Media Center Programs

[2009.07.08 19:34:52 | 000,000,000 | --SD | M] -- C:\Users\christian\AppData\Roaming\Microsoft

[2008.10.03 22:35:30 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Nero

[2010.09.01 16:11:37 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Opera

[2009.01.24 14:06:09 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\pics

[2009.12.04 14:26:57 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Real

[2009.12.01 14:04:56 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\SecondLife

[2010.09.01 15:12:41 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Skype

[2010.09.01 12:55:42 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\skypePM

[2009.09.23 19:37:42 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\sl5_de

[2008.10.03 13:38:58 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Symantec

[2008.10.04 00:18:19 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Talkback

[2008.10.04 00:18:13 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Thunderbird

[2008.10.04 01:14:11 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\U3

[2010.09.01 15:48:51 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\uTorrent

[2010.05.14 19:05:53 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\vlc

[2010.08.30 15:06:56 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\Winamp

[2008.10.03 22:27:21 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\WinRAR

[2010.03.08 19:26:39 | 000,000,000 | ---D | M] -- C:\Users\christian\AppData\Roaming\WordToPDF

 
 < %APPDATA%\*.exe /s >

[2010.08.30 21:16:05 | 000,155,136 | ---- | M] () -- C:\Users\christian\AppData\Roaming\Adobe\Update\32cli.exe

[2009.10.31 18:55:07 | 001,924,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\christian\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2010.03.31 19:43:47 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\christian\AppData\Roaming\Microsoft\Installer\{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}\ARPPRODUCTICON.exe

[2010.02.19 18:37:46 | 000,439,816 | ---- | M] (RealNetworks, Inc.) -- C:\Users\christian\AppData\Roaming\Real\Update\setup3.09\setup.exe

[2010.05.25 18:11:43 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\christian\AppData\Roaming\Real\Update\setup3.10\setup.exe

[2010.08.23 20:54:53 | 000,456,200 | ---- | M] (RealNetworks, Inc.) -- C:\Users\christian\AppData\Roaming\Real\Update\setup3.12\setup.exe

[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Users\christian\AppData\Roaming\U3\temp\cleanup.exe

[2007.10.23 09:22:56 | 003,350,528 | -H-- | M] (SanDisk Corporation) -- C:\Users\christian\AppData\Roaming\U3\temp\Launchpad Removal.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.09.29 17:03:11 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys

[2007.09.29 17:03:11 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys

[2007.09.29 17:03:11 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_41af7b1f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2007.09.20 18:43:57 | 000,352,256 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll

[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll

[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

< End of report >

--- --- ---

extra dateiOTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 01.09.2010 17:52:25 - Run 1

OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\christian\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 51,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 56,80 Gb Free Space | 38,11% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 58,72 Gb Free Space | 42,16% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

Drive F: | 6,31 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive G: | 993,72 Mb Total Space | 787,25 Mb Free Space | 79,22% Space Free | Partition Type: FAT

H: Drive not present or media not loaded

Drive I: | 1,86 Gb Total Space | 0,11 Gb Free Space | 5,81% Space Free | Partition Type: FAT

 

Computer Name: CHRISTIAN-PC

Current User Name: christian

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = Opera.HTML] -- C:\Program Files\Opera\opera.exe (Opera Software)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software)

https [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [ACDSee 11.0.Browse] -- "C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" "%1" (ACD Systems)

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" File not found

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files\winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "C:\Program Files\winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "C:\Program Files\winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{04B75FF3-5050-4C36-B510-C3CA81E7F60E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00F8C384-9501-48AE-AEFF-857BF7C870FD}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{051D5E7F-E282-4015-A1A3-00FCAC582F46}" = protocol=17 | dir=in | app=c:\programme\itunes\itunes.exe | 

"{05826E9E-E707-4F70-A955-6782342E436F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{0EEDCB0A-4FA9-4564-9B07-F2E92EB5CE76}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{175B819C-F887-487A-BDFF-455139EA5150}" = protocol=6 | dir=in | app=c:\programme\itunes\itunes.exe | 

"{29347577-6351-434D-AE9B-91924843EBB5}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{2A05A7D4-82E1-480B-8364-C677796B4A09}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{2BD74B2B-123C-4E42-B843-2CBD3E7E53B2}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{3A0C4DB8-D4C3-4026-BC18-B758E76F33E7}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{452FAC8C-DA30-4D55-B217-6706F7DCE314}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{47A5D6E2-0EC1-4692-A46D-3B1BC6FF4755}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{55AA32E0-5D10-4D0E-A02B-CAC77AD1AFA5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{60CF00F8-14F4-444C-B76E-67EED9525493}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 

"{67C53361-6CBA-4DEC-AF10-3BC6006B86B0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{790AEF0E-964B-44FD-BBFF-F1B5B319B94F}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{7AA1A9C0-7F33-4452-B96F-ABC96E64B888}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{8BFCA765-9954-4C42-8005-EFAC99CEEA85}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{9E2DFF77-BCD4-4FB3-9EB8-9AB52B278133}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{A35352F4-5F94-4795-B93B-56EFDB322D2A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A7F650DC-7B54-40A2-ADEF-A4AF52EE8844}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 

"{B779301F-B000-4CA4-8DAF-191CD1A29689}" = protocol=6 | dir=in | app=c:\programme\utorrent\utorrent.exe | 

"{CA68DEDC-0520-497C-B2D2-7B187B77A6D1}" = protocol=17 | dir=in | app=c:\programme\utorrent\utorrent.exe | 

"{D927E06F-2ABF-4BD8-9B6B-BE1E9B87DD82}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{DA6A0CCC-CB92-487B-BFCD-687C980CF639}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{E57875B7-2B55-4F00-802A-F66DE92A1F75}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"TCP Query User{1E5BFEB8-4471-4098-A881-B407FE0A30C7}C:\programme\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\programme\icq6.5\icq.exe | 

"TCP Query User{2C0D9230-0D25-4BD3-940C-6144996E6CCB}C:\program files\secondlife\slvoice.exe" = protocol=6 | dir=in | app=c:\program files\secondlife\slvoice.exe | 

"TCP Query User{33217D9B-3584-487C-B241-745721A5B253}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 

"TCP Query User{432FAD0E-E607-4758-96B2-532CB13A431C}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{81504103-6418-40FD-AF7F-5DC6F6394EE0}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe | 

"TCP Query User{B3EE43C4-9975-4C11-BB2E-FA2A3F85A09C}C:\programme\icq6\icq.exe" = protocol=6 | dir=in | app=c:\programme\icq6\icq.exe | 

"TCP Query User{F03BEE38-76AD-4F41-81EE-C94BBB29B500}C:\program files\epsonnet\epsonnet setupmanager\imanager.exe" = protocol=6 | dir=in | app=c:\program files\epsonnet\epsonnet setupmanager\imanager.exe | 

"UDP Query User{0B3FFB0E-00A1-46FB-A72F-464765595141}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 

"UDP Query User{246BEB34-2BEA-4152-9F0A-B640FA330BBF}C:\program files\epsonnet\epsonnet setupmanager\imanager.exe" = protocol=17 | dir=in | app=c:\program files\epsonnet\epsonnet setupmanager\imanager.exe | 

"UDP Query User{2C7CE8D6-A107-48F6-873B-079B4565FC2D}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe | 

"UDP Query User{321C2C87-9F75-4DDF-A783-30FAB15961FF}C:\program files\secondlife\slvoice.exe" = protocol=17 | dir=in | app=c:\program files\secondlife\slvoice.exe | 

"UDP Query User{467DF2ED-B083-4624-A034-BA069108276A}C:\programme\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\programme\icq6.5\icq.exe | 

"UDP Query User{B50B5CCC-BFAF-41DE-A5BA-CAFB85E74381}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{EFF58D2C-A344-4A61-B135-8DCE02CA3187}C:\programme\icq6\icq.exe" = protocol=17 | dir=in | app=c:\programme\icq6\icq.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4

"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension

"{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Steuer 2009

"{02E588F3-C0E2-8E60-5548-AF2D220C54E6}" = Catalyst Control Center Localization Portuguese

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{0AFFEE39-A796-855D-D3D5-5E8A6C1D7F31}" = CCC Help English

"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour

"{0D9A9A4E-97C6-0C9D-3769-35D687F8390A}" = Catalyst Control Center Localization French

"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1

"{0F7EB932-89FD-CF7B-8078-46627F4DA154}" = CCC Help Swedish

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series" = Canon MP550 series MP Drivers

"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter

"{159D0063-4F15-594B-8047-08CC418A0560}" = CCC Help Italian

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{19C8C9BB-38D1-5BE5-56BC-0C2766C4F815}" = CCC Help Spanish

"{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}" = ASUS Data Security Manager

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame3

"{201A4851-E53B-CD2A-B571-EAEBA3220887}" = CCC Help Chinese Traditional

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 21

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2CC332F9-A16B-02D2-02C1-7C515D610692}" = Catalyst Control Center Graphics Previews Vista

"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite

"{300578F9-9EFF-4B93-9AB1-C0E5707EF463}" = ACDSee Photo Manager 2009

"{3596567E-9DEB-9972-FAAC-DCD87C4E5C46}" = Catalyst Control Center Graphics Full Existing

"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey

"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3C6F5BF7-FEDC-65A2-5957-E3E26DF94DDE}" = Catalyst Control Center Graphics Full New

"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime

"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print

"{3E63594C-F02C-B8D3-4A7D-EC9818120AC1}" = Catalyst Control Center Localization Chinese Standard

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go

"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4

"{498F57AA-94AE-4056-9D1C-595CE4C9405B}" = Brother HL-1230

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{545C1252-BAEB-3CAF-C866-DF6EC55184DE}" = CCC Help Portuguese

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01

"{5AA54722-4C48-8E46-6E12-04A7D7DAA1FC}" = CCC Help Korean

"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe

"{6444D3EB-1309-24AD-6AA1-28BCEF70B17C}" = Catalyst Control Center Localization Swedish

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{690C7041-50C2-12E9-2E49-DA9C1076DC7A}" = ccc-core-static

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6D482078-8D15-4FD3-B838-C7B49174650F}" = Opera 10.61

"{6E32B134-CA8D-49DD-B94C-0DB155CE70B5}" = ccc-Branding

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2

"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com

"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7CE43781-6B3B-2587-3385-EA65829D181E}" = Skins

"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA

"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture

"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw

"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP

"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content

"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters

"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav

"{80AE93FE-B532-F8C2-833F-808AD34FFB43}" = Catalyst Control Center Localization Korean

"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2

"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support

"{8976103E-0279-E7ED-C2E4-D472512AE728}" = Catalyst Control Center Localization Chinese Traditional

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme

"{8F8FF30C-DBC7-48AF-2142-ABBA952EDCDC}" = CCC Help Japanese

"{8FE3E4B9-5382-4037-96A0-E3F6B3592DE1}" = CCC Help German

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{932B2039-B9A2-6C36-7664-5ED6C59F0780}" = Catalyst Control Center Graphics Previews Common

"{9629D0D1-D2E3-16AF-5072-2DD36392BED7}" = Catalyst Control Center Core Implementation

"{97FD6DB1-E8D4-AC1D-34B4-623A3CE3AD3A}" = Catalyst Control Center Localization Italian

"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars

"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM

"{9D804F06-CF4A-2982-E3CF-D4FF9775D65B}" = Catalyst Control Center Localization Spanish

"{9F8E8FB0-30C8-9FA5-0F74-0EE5ABE86F56}" = Catalyst Control Center Graphics Light

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder

"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter

"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9

"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder

"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE

"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter

"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support

"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{BE282C23-5484-47FF-B2C1-EBEA5C891031}" = Nero 8

"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA

"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology

"{C2D129C0-7508-11DF-9F1B-005056806466}" = Google Earth

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser

"{C83110F7-2CF6-F888-5A23-A8B6030DB57E}" = CCC Help French

"{CB0C0733-381A-EC1B-800B-24119D05E6A7}" = CCC Help Dutch

"{CD83D613-086E-FCA7-211E-141DBD3AD06D}" = Catalyst Control Center Localization Japanese

"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension

"{CEAAADDF-01F5-F6EC-F77E-373B391FE700}" = Catalyst Control Center Localization Dutch

"{CEAEEFA6-DEBC-4B16-8F04-84C81440CA32}" = Garmin Training Center 3.4.3

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater

"{D2A5AD3F-1B87-484C-7AA6-F580631E7234}" = Catalyst Control Center Localization German

"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service

"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010

"{D9209AB6-61D2-F160-6923-EFFB4E6CA9C8}" = CCC Help Chinese Standard

"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core

"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash

"{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}" = AAVUpdateManager

"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update

"{ECC5B1E6-E4C0-9FDC-598D-209B17A313F3}" = ATI Catalyst Install Manager

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm

"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = P4P

"{FE645582-89FD-C252-11CC-C61A7F3F1E97}" = ccc-utility

"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Canon MP550 series Benutzerregistrierung" = Canon MP550 series Benutzerregistrierung

"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program

"CanonMyPrinter" = Canon Utilities My Printer

"CanonSolutionMenu" = Canon Utilities Solution Menu

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"CX4300_5500_DX4400 Handbuch" = CX4300_5500_DX4400 Handbuch

"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters

"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX

"ENTERPRISE" = Microsoft Office Enterprise 2007

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2

"Google Updater" = Google Updater

"GPL Ghostscript 8.63" = GPL Ghostscript 8.63

"HijackThis" = HijackThis 2.0.2

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Movies" = Movies

"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0

"Picasa 3" = Picasa 3

"RealPlayer 6.0" = RealPlayer

"Samplitude Music Studio 2008 D" = Samplitude Music Studio 2008 14.0.0.0 (D)

"Steinberg WaveLab 5.01b" = Steinberg WaveLab 5.01b

"Syncrosoft's License Control" = Syncrosofts Lizenz Kontrolle

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Uninstall_is1" = Uninstall 1.0.0.1

"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

"VLC media player" = VLC media player 1.0.5

"Winamp" = Winamp

"WinRAR archiver" = WinRAR

"WordToPDF_is1" = WordToPDF 2.4

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-2366973304-1417200682-1194841944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"uTorrent" = µTorrent

"Winamp Detect" = Winamp Erkennungs-Plug-in

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 15.08.2010 04:34:36 | Computer Name = christian-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.08.2010 09:03:22 | Computer Name = christian-PC | Source = Application Hang | ID = 1002

Description = Programm firefox.exe, Version 1.9.2.3743 arbeitet nicht mehr mit Windows

 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

 zu suchen.  Prozess-ID: 145c  Anfangszeit: 01cb3c56e1ca2e5e  Zeitpunkt der Beendigung:

 97

 

Error - 16.08.2010 06:45:32 | Computer Name = christian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 16.08.2010 06:45:32 | Computer Name = christian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 16.08.2010 06:46:39 | Computer Name = christian-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.08.2010 09:41:08 | Computer Name = christian-PC | Source = EventSystem | ID = 4621

Description = 

 

Error - 16.08.2010 12:57:48 | Computer Name = christian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 16.08.2010 12:57:49 | Computer Name = christian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 16.08.2010 12:58:56 | Computer Name = christian-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.08.2010 13:29:30 | Computer Name = christian-PC | Source = EventSystem | ID = 4621

Description = 

 

[ OSession Events ]

Error - 01.09.2009 06:11:45 | Computer Name = christian-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1155

 seconds with 660 seconds of active time.  This session ended with a crash.

 

Error - 03.09.2009 13:38:31 | Computer Name = christian-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 34133

 seconds with 8760 seconds of active time.  This session ended with a crash.

 

Error - 03.02.2010 12:53:18 | Computer Name = christian-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2243

 seconds with 60 seconds of active time.  This session ended with a crash.

 

Error - 28.08.2010 13:08:01 | Computer Name = christian-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4656

 seconds with 180 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 26.03.2009 04:39:17 | Computer Name = christian-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 26.03.2009 08:44:19 | Computer Name = christian-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 26.03.2009 08:44:37 | Computer Name = christian-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description = 

 

Error - 26.03.2009 12:57:18 | Computer Name = christian-PC | Source = Print | ID = 6161

Description = Das Dokument Microsoft Word - 2 Güter im Besitz von christian konnte

 nicht auf dem Drucker Brother HL-1230 series (Kopie 2) gedruckt werden. Versuchen

 Sie erneut, das Dokument zu drucken, oder starten Sie den Druckspooler erneut. 

  Datentyp: NT EMF 1.008. Größe der Spooldatei in Bytes: 0. Anzahl der gedruckten 

Bytes: 0. Gesamtanzahl der Seiten des Dokuments: 0. Anzahl der gedruckten Seiten:

 0. Clientcomputer: \\CHRISTIAN-PC. Vom Druckprozessor zurückgegebener Win32-Fehlercode:

 259. Es sind keine Daten mehr verfügbar.  

 

Error - 26.03.2009 18:48:10 | Computer Name = christian-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 27.03.2009 01:23:29 | Computer Name = christian-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 27.03.2009 01:23:47 | Computer Name = christian-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description = 

 

Error - 27.03.2009 01:53:29 | Computer Name = christian-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 27.03.2009 02:01:45 | Computer Name = christian-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 27.03.2009 02:02:03 | Computer Name = christian-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description = 

 

 

< End of report >

--- --- ---

Neu ist jetzt, dass sich eben mein PC komplett runterfährt.
Die Nachricht "Der PC wird in weniger als einer Minute heruntergefahren" erscheint und dann ist auch nach kurzer Zeit feierabend.

Hat das auch etwas damit zu tun?