Hallo trojaner-board.de,
ich benötige Eure Hilfe, um meinen Rechner wieder zu säubern. Vor ca. 2 Wochen wurde mein Rechner langsamer brach des Öfteren bei einem Facebook-Game zusammen. Meine Freundin klickte im Internet herum, um "automatische Hilfsprogramme" zu nutzen. Dabei (oder vielleicht auch schon vorher) ging wohl was schief ;-(
BEVOR ich auf Eurem Forum nach Hilfe gesucht habe, habe ich folgendes getan:
Ich habe Malwarebytes Anti-Malware (MBAM) mit dem aktuellsten Update am 05.02.2011 ein Full System Scan laufen lassen, wobei 2 Infektionen mit Trojan.Agent gefunden, quarantiert und gelöscht wurden. Ich werde den Log-File dazu unten anhängen.
Im nächsten Schritt fuhr ich meinen Rechner runter und wieder hoch.
Außerdem verwende ich "Avira Antivirus Personal - Free Antivirus" mit dem aktuellsten Update. Auch dieses Programm habe ich einen Scan durchlaufen lassen und es hat 2 Infektionen mit TR/Trash.Gen gefunden - obwohl MBAM nichts mehr gefunden hatte. Das lässt mich vermuten, dass vermutlich noch mehr auf dem Rechner ist, das weder von MBAM noch Avira gefunden werden kann. Ich werde auch diesen Log weiter unten anhängen.
Nach erneutem runter- und wieder hochfahren, hörte ich den Rechner (noch vor dem passwortgeschützten Log-In) auf der Festplatte wie wild schreiben, was auch durch die gelbe LED am Gehäuse des Rechners angezeigt wurde. Normalerweise fängt mein Rechner erst nach dem Windows-Log-In an, die benötigten Programme hoch zu laden und dementsprechend auf der Festplatte rum zu knuspern. Wie gesagt, dies geschah noch vor dem Log-In und da nach 8 Minuten noch immer nicht Schluss war damit, habe ich mich eingeloggt und im Windows Task Manager nachgeschaut, welcher Prozess dort außergewöhnlich viel Memory Usage verursacht. Es war mit über 90MB das Programm AVscan.exe. Da zu diesem Zeitpunkt Avira noch gar nicht gestartet hatte, habe ich SOFORT einen kompletten Systemscan mit Avira angefangen und avscan.exe gesellte sich mit ca. 35MB Mem Usage in den Windows Task Manager hinzu - welchen Prozess ich auch sofort wieder abbrach. Anschließend versuchte ich den AVscan.exe Prozess abzubrechen, was mir nicht gelang. Ich bekam eine "Access Denied"-Nachricht. Beim nächsten Hochfahren meines Rechners, schien alles wieder normal zu laufen, allerdings fehlte meine Schnellstartleiste, die ich dann wieder hergestellt habe - aber sie sieht jetzt nicht mehr so aus, wie ich sie vor dem Viren oder Trojaner Angriff eingerichtet hatte.
Wie gesagt, ich gehe davon aus, dass da noch was auf meinem Rechner ist, was da nicht so hingehört.
NACHDEM ich auf Eurem Forum nach Hilfe gesucht habe, habe ich die Anleitung Load.exe von Larusso befolgt. Ich habe MBAM geupdated, mit Quick Scan erneut laufen lassen - ohne Fund. Diesen Log werde ich hier aber nicht posten, sondern den Log vom 05.02. Ist das so in Ordnung?
Ein anderer Unterschied zur Anleitung ist, dass Defogger nachdem ich bei FINISHED auf OK geklickt habe mich nicht zu einem Neustart aufgefordert hatte. Ich habe daher manuell einen Neustart durchgeführt...
So, dann ging bei mir was schief!!! Da die Anleitung für Schritt 5 (Gmer) auf mehrere Seiten ausgedruckt wurde, habe ich den Hinweis, den Haken neben IAT/EAT zu entfernen erst ca. 45 Sekunden nach Programmstart gelesen :-( Autsch! Ich habe den Vorgang dann abgebrochen, den Haken entfernt und dann wieder auf Scan geklickt. Keine Ahnung, ob und was dabei passiert ist. Ich vermute aber, dass das, was da passiert ist, nicht gut war! Habe nach Speichern der Gmer.txt den Rechner runtergefahren und wieder gestartet. Normalerweise dauert das so um die 2 1/2 Minuten. Dieses mal hat es 17 Minuten gedauert - kam mir vor wie 2 Stunden!!! Der Rechner ist nun RICHTIG langsam... Der erneute reboot dauerte dann nur noch 14 Minuten. Irgendwas stimmt einfach nicht.
Beim Aufrufen von OTL dauert es etwas, bis es angezeigt wird. Wenn ich in das Fenster klicke werde ich nicht gefragt, ob ich eine Datei einfügen will. Ich habe daher manuell die Scan.txt-Datei geöffnet und den Text in die Box eingefügt und anschließend auf Quick Scan geklickt. Ich hoffe, dass das richtig war...
Wie ich jetzt auch noch feststllen muss, wurden die Sound-Einstellungen meines Rechenrs verstellt. Vielleicht ist das aber normal und soll so sein?
Ich würde mich über Eure Hilfe RIESIG freuen!!!
Opel-Vectra
PS: Mir faellt gerade noch ein, dass ich vor ca. 2 Wochen Skype installiert habe. Koennte es sein, dass mein Rechenr dadurch infiziert wurde???
PSS:
Mein System ist Win_XP 32 bit mit Service Pack 3
#############################################
###### MBAM logfile - Anfang ################
#############################################
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5682
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
05.02.2011 04:54:14
mbam-log-2011-02-05 (04-54-14).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 272944
Time elapsed: 1 hour(s), 11 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\system volume information\_restore{4e015214-6bb0-4181-b365-456cf1dec069}\RP69\A0015219.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\zz downloads\aviplayersetup_3-0.exe (Adware.Agent) -> Quarantined and deleted successfully.
#############################################
######## MBAM logfile - Ende ################
#############################################
#############################################
###### AVIRA logfile - Anfang ###############
#############################################
Avira AntiVir Personal
Report file date: Samstag, 5. Februar 2011 08:25
Scanning for 2456743 virus strains and unwanted programs.
The program is running as an unrestricted full version.
Online services are available:
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : EMACHINE
Version information:
BUILD.DAT : 10.0.0.611 31824 Bytes 1/14/2011 13:42:00
AVSCAN.EXE : 10.0.3.5 435368 Bytes 12/9/2010 22:10:59
AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/19/2010 11:55:10
LUKE.DLL : 10.0.3.2 104296 Bytes 12/9/2010 22:11:00
LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 15:06:20
VBASE002.VDF : 7.11.0.1 2048 Bytes 12/14/2010 15:06:20
VBASE003.VDF : 7.11.0.2 2048 Bytes 12/14/2010 15:06:20
VBASE004.VDF : 7.11.0.3 2048 Bytes 12/14/2010 15:06:21
VBASE005.VDF : 7.11.0.4 2048 Bytes 12/14/2010 15:06:21
VBASE006.VDF : 7.11.0.5 2048 Bytes 12/14/2010 15:06:21
VBASE007.VDF : 7.11.0.6 2048 Bytes 12/14/2010 15:06:21
VBASE008.VDF : 7.11.0.7 2048 Bytes 12/14/2010 15:06:21
VBASE009.VDF : 7.11.0.8 2048 Bytes 12/14/2010 15:06:21
VBASE010.VDF : 7.11.0.9 2048 Bytes 12/14/2010 15:06:22
VBASE011.VDF : 7.11.0.10 2048 Bytes 12/14/2010 15:06:22
VBASE012.VDF : 7.11.0.11 2048 Bytes 12/14/2010 15:06:22
VBASE013.VDF : 7.11.0.52 128000 Bytes 12/16/2010 15:06:23
VBASE014.VDF : 7.11.0.91 226816 Bytes 12/20/2010 15:06:26
VBASE015.VDF : 7.11.0.122 136192 Bytes 12/21/2010 15:06:27
VBASE016.VDF : 7.11.0.156 122880 Bytes 12/24/2010 15:06:28
VBASE017.VDF : 7.11.0.185 146944 Bytes 12/27/2010 15:06:30
VBASE018.VDF : 7.11.0.228 132608 Bytes 12/30/2010 15:06:31
VBASE019.VDF : 7.11.1.5 148480 Bytes 1/3/2011 04:22:30
VBASE020.VDF : 7.11.1.37 156672 Bytes 1/7/2011 04:22:32
VBASE021.VDF : 7.11.1.65 140800 Bytes 1/10/2011 04:22:33
VBASE022.VDF : 7.11.1.87 225280 Bytes 1/11/2011 04:22:35
VBASE023.VDF : 7.11.1.124 125440 Bytes 1/14/2011 04:22:37
VBASE024.VDF : 7.11.1.155 132096 Bytes 1/17/2011 10:19:18
VBASE025.VDF : 7.11.1.189 451072 Bytes 1/20/2011 14:18:44
VBASE026.VDF : 7.11.1.230 138752 Bytes 1/24/2011 14:18:45
VBASE027.VDF : 7.11.2.12 164352 Bytes 1/27/2011 14:18:47
VBASE028.VDF : 7.11.2.43 178176 Bytes 2/1/2011 14:18:49
VBASE029.VDF : 7.11.2.78 206336 Bytes 2/4/2011 14:18:51
VBASE030.VDF : 7.11.2.79 2048 Bytes 2/4/2011 14:18:51
VBASE031.VDF : 7.11.2.80 2048 Bytes 2/4/2011 14:18:51
Engineversion : 8.2.4.162
AEVDF.DLL : 8.1.2.1 106868 Bytes 8/3/2010 00:51:38
AESCRIPT.DLL : 8.1.3.53 1282427 Bytes 2/5/2011 14:19:18
AESCN.DLL : 8.1.7.2 127349 Bytes 11/24/2010 12:09:10
AESBX.DLL : 8.1.3.2 254324 Bytes 11/24/2010 12:09:15
AERDL.DLL : 8.1.9.2 635252 Bytes 9/22/2010 09:27:09
AEPACK.DLL : 8.2.4.9 512374 Bytes 2/5/2011 14:19:14
AEOFFICE.DLL : 8.1.1.16 205179 Bytes 2/5/2011 14:19:11
AEHEUR.DLL : 8.1.2.73 3207541 Bytes 2/5/2011 14:19:10
AEHELP.DLL : 8.1.16.1 246134 Bytes 2/5/2011 14:18:57
AEGEN.DLL : 8.1.5.2 397683 Bytes 2/5/2011 14:18:55
AEEMU.DLL : 8.1.3.0 393589 Bytes 11/24/2010 12:08:52
AECORE.DLL : 8.1.19.2 196983 Bytes 2/5/2011 14:18:53
AEBB.DLL : 8.1.1.0 53618 Bytes 5/3/2010 02:57:48
AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 17:03:38
AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 17:03:35
AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 21:47:40
AVREG.DLL : 10.0.3.2 53096 Bytes 11/7/2010 01:36:56
AVSCPLR.DLL : 10.0.3.2 84328 Bytes 12/9/2010 22:11:00
AVARKT.DLL : 10.0.22.6 231784 Bytes 12/9/2010 22:10:56
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 14:53:30
SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 17:57:58
AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 20:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 19:41:00
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 18:10:20
RCTEXT.DLL : 10.0.58.0 97128 Bytes 11/7/2010 01:36:54
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Start of the scan: Samstag, 5. Februar 2011 08:25
Starting search for hidden objects.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtmsSvc\Config\Standalone\drivelist
[NOTE] The registry entry is invisible.
The scan of running processes will be started
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '45' Module(s) have been scanned
Scan process 'vssvc.exe' - '48' Module(s) have been scanned
Scan process 'avscan.exe' - '65' Module(s) have been scanned
Scan process 'avcenter.exe' - '63' Module(s) have been scanned
Scan process 'TrayMin700.exe' - '24' Module(s) have been scanned
Scan process 'jusched.exe' - '22' Module(s) have been scanned
Scan process 'WrtProc.exe' - '18' Module(s) have been scanned
Scan process 'avgnt.exe' - '53' Module(s) have been scanned
Scan process 'vphc700.exe' - '17' Module(s) have been scanned
Scan process 'alg.exe' - '33' Module(s) have been scanned
Scan process 'WrtMon.exe' - '18' Module(s) have been scanned
Scan process 'OpwareSE4.exe' - '16' Module(s) have been scanned
Scan process 'dllhost.exe' - '59' Module(s) have been scanned
Scan process 'zHotkey.exe' - '33' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '36' Module(s) have been scanned
Scan process 'readericon45G.exe' - '26' Module(s) have been scanned
Scan process 'ehtray.exe' - '29' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '28' Module(s) have been scanned
Scan process 'svchost.exe' - '36' Module(s) have been scanned
Scan process 'svchost.exe' - '28' Module(s) have been scanned
Scan process 'jqs.exe' - '33' Module(s) have been scanned
Scan process 'ehSched.exe' - '19' Module(s) have been scanned
Scan process 'ehRecvr.exe' - '42' Module(s) have been scanned
Scan process 'Explorer.EXE' - '97' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '22' Module(s) have been scanned
Scan process 'sched.exe' - '50' Module(s) have been scanned
Scan process 'spoolsv.exe' - '55' Module(s) have been scanned
Scan process 'svchost.exe' - '32' Module(s) have been scanned
Scan process 'svchost.exe' - '157' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'svchost.exe' - '38' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '14' Module(s) have been scanned
Scan process 'avshadow.exe' - '25' Module(s) have been scanned
Scan process 'avguard.exe' - '54' Module(s) have been scanned
Scan process 'lsass.exe' - '58' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '68' Module(s) have been scanned
Scan process 'csrss.exe' - '12' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '1800' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP93\A0020735.exe
[DETECTION] Is the TR/Trash.Gen Trojan
Begin scan in 'D:\'
Beginning disinfection:
C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP93\A0020735.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '4e0fa985.qua'.
End of the scan: Samstag, 5. Februar 2011 20:52
Used time: 1:15:28 Hour(s)
The scan has been done completely.
10000 Scanned directories
447755 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
447754 Files not concerned
14759 Archives were scanned
0 Warnings
1 Notes
462764 Objects were scanned with rootkit scan
1 Hidden objects were found
#############################################
######## AVIRA logfile - Ende ###############
#############################################
#############################################
##### defogger_disable.log - Anfang #########
#############################################
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:17 on 08/02/2011 (Owner)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
#############################################
##### defogger_disable.log - Ende ###########
#############################################
#############################################
########### Gmer.txt - Anfang ###############
#############################################
GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-02-08 12:30:04
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-16 WDC_WD2000BB-22RDA0 rev.20.00K20
Running: g2m3e4r.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\fxlyapob.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xED6D9534]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xED6D3782]
SSDT F7D7ABAE ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xED6D9CC0]
SSDT F7D7ABA4 ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xED6D9DF6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xED6D4398]
SSDT F7D7ABB3 ZwDeleteKey
SSDT F7D7ABBD ZwDeleteValueKey
SSDT F7D7ABC2 ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xED6F4B44]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xED6D3FAA]
SSDT F7D7AB90 ZwOpenProcess
SSDT F7D7AB95 ZwOpenThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xED6F58D2]
SSDT F7D7ABCC ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xED6D90F4]
SSDT F7D7ABC7 ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xED6D475C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xED6F5E12]
SSDT F7D7ABB8 ZwSetValueKey
---- Devices - GMER 1.0.15 ----
Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
--- --- ---
#############################################
########### Gmer.txt - Ende #################
#############################################
#############################################
########### OTL.txt - Anfang ################
#############################################OTL Logfile:
Code:
OTL logfile created on: 08.02.2011 13:09:57 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Owner\Desktop\MFTools
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
893,00 Mb Total Physical Memory | 476,00 Mb Available Physical Memory | 53,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181,01 Gb Total Space | 141,30 Gb Free Space | 78,06% Space Free | Partition Type: NTFS
Drive D: | 5,28 Gb Total Space | 3,40 Gb Free Space | 64,43% Space Free | Partition Type: FAT32
Computer Name: EMACHINE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.02.08 09:54:33 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\MFTools\OTL.exe
PRC - [2010.12.09 16:10:57 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.06 19:36:56 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.11.06 19:36:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.06.28 12:01:30 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2010.06.28 11:59:52 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010.01.14 20:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.04.13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.11 11:45:12 | 000,075,304 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
PRC - [2006.09.20 07:35:26 | 000,020,480 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
PRC - [2006.09.19 15:05:32 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2005.12.09 19:44:40 | 000,139,264 | ---- | M] (Alcor Micro, Corp.) -- C:\Program Files\Digital Media Reader\readericon45G.exe
PRC - [2005.07.20 18:56:06 | 000,339,968 | ---- | M] (Sonix) -- C:\WINDOWS\vphc700.exe
PRC - [2005.07.12 19:04:04 | 000,278,528 | ---- | M] () -- C:\Program Files\Philips\SPC 700NC PC Camera\TrayMin700.exe
PRC - [2004.12.08 18:57:36 | 000,550,912 | ---- | M] () -- C:\WINDOWS\zHotkey.exe
========== Modules (SafeList) ==========
MOD - [2011.02.08 09:54:33 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\MFTools\OTL.exe
MOD - [2010.08.23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006.10.04 21:07:12 | 000,144,936 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
MOD - [2001.07.02 21:36:30 | 000,024,576 | ---- | M] () -- C:\WINDOWS\HKNTDLL.dll
========== Win32 Services (SafeList) ==========
SRV - [2010.12.09 16:10:57 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.06 19:36:56 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.08.13 08:13:32 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
SRV - [2010.06.28 12:01:30 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010.03.18 15:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
SRV - [2010.03.18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 12:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2009.12.17 16:36:24 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2006.08.19 01:48:24 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2005.10.03 11:04:04 | 000,102,400 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)
========== Driver Services (SafeList) ==========
DRV - [2011.01.01 09:06:57 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.24 06:09:17 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.05.13 09:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2009.05.11 10:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.25 05:29:52 | 000,130,432 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2008.11.20 13:19:06 | 000,009,200 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2008.11.20 13:19:06 | 000,009,072 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2008.04.13 12:56:49 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2008.04.13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008.04.13 12:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008.04.13 12:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008.04.13 10:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.06.18 19:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2007.05.02 19:06:32 | 000,131,456 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2007.05.02 19:06:32 | 000,038,448 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2007.05.02 19:06:32 | 000,032,352 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus)
DRV - [2006.04.17 02:31:26 | 004,262,912 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.01.15 00:48:08 | 001,477,632 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.10.21 07:25:32 | 000,013,396 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\MTictwl.sys -- (NCPro)
DRV - [2005.10.21 07:25:32 | 000,013,396 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MTictwl.sys -- (MagicTune)
DRV - [2005.07.22 11:02:12 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005.07.22 11:01:10 | 000,231,168 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2005.07.22 11:01:00 | 000,717,952 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005.06.07 13:21:18 | 000,541,568 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\phc700.sys -- (phc700) USB PC Camera (phc700)
DRV - [2004.08.03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003.01.10 15:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001.12.17 11:58:42 | 000,050,911 | ---- | M] (Virata) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvbususb.sys -- (VvBusUsb)
DRV - [2001.12.17 11:58:42 | 000,015,309 | ---- | M] (Virata) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvbetht.sys -- (VVBETHERNET)
DRV - [2001.08.17 22:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001.08.17 22:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001.08.17 22:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001.08.17 22:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001.08.17 22:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001.08.17 21:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001.08.17 21:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001.08.17 21:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001.08.17 21:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001.08.17 21:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001.08.17 21:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001.08.17 21:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001.08.17 21:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001.08.17 21:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001.08.17 21:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5212
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.16 19:31:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.10 10:44:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2011.02.02 14:48:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2010.11.19 14:25:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2010.11.19 14:25:03 | 000,000,000 | ---D | M]
[2009.02.03 21:28:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011.02.07 14:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions
[2009.10.24 11:44:14 | 000,000,000 | ---D | M] ("Garmin Communicator") -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010.04.28 23:03:39 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.01.05 20:43:49 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.09.10 17:25:24 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.09.06 06:02:46 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\z693kmx8.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011.02.07 14:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.04.22 00:00:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.05 12:54:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.10.13 19:48:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.12.19 14:22:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) -- C:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\AFCE93FC2E44C41-BRANDING@FLOCK.COM
File not found (No name found) -- C:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\NSE-BRANDING@FLOCK.COM
[2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2010.10.13 14:09:01 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\zHotkey.exe ()
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [phc700] C:\WINDOWS\vphc700.exe (Sonix)
O4 - HKLM..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TrayMin700.exe.lnk = C:\Program Files\Philips\SPC 700NC PC Camera\TrayMin700.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.06.17 03:41:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
MsConfig - StartUpReg: Avi Player - hkey= - key= - C:\Program Files\Avi Player\AviPlayer.exe ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)
========== Files/Folders - Created Within 30 Days ==========
[2011.02.08 10:03:23 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011.02.08 10:03:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011.02.08 09:54:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\MFTools
[2011.02.07 14:39:47 | 000,775,536 | ---- | C] (BillP Studios) -- C:\Documents and Settings\Owner\Desktop\wpsetup.exe
[2011.02.06 17:50:24 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2011.01.19 13:08:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\skypePM
[2011.01.19 13:07:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2011.01.19 13:07:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2011.01.19 13:07:26 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011.01.19 13:07:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Skype
[2011.01.19 13:07:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2011.01.19 08:07:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windows media
[2011.01.19 08:07:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Media
[2011.01.19 08:07:13 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media-Komponenten
[2006.11.27 22:58:34 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\cphc700.dll
========== Files - Modified Within 30 Days ==========
[2011.02.08 13:01:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.02.08 13:01:35 | 936,566,784 | -HS- | M] () -- C:\hiberfil.sys
[2011.02.08 10:17:36 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\defogger_reenable
[2011.02.08 10:03:24 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2011.02.08 10:03:24 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2011.02.08 09:54:45 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\g2m3e4r.exe
[2011.02.08 09:54:41 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\defogger.exe
[2011.02.08 09:51:13 | 000,471,802 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Load.exe
[2011.02.07 14:39:48 | 000,775,536 | ---- | M] (BillP Studios) -- C:\Documents and Settings\Owner\Desktop\wpsetup.exe
[2011.02.07 14:22:49 | 000,000,612 | ---- | M] () -- C:\WINDOWS\3DHOME.INI
[2011.02.02 15:05:19 | 000,063,488 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.01.27 15:10:01 | 000,002,216 | ---- | M] () -- C:\WINDOWS\winzip32.ini
[2011.01.24 17:48:23 | 000,009,662 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\anita-craigslist-index.html
[2011.01.19 13:07:30 | 000,001,880 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011.01.16 22:19:55 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.14 09:36:08 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\DishNetwork.doc
========== Files Created - No Company Name ==========
[2011.02.08 10:17:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\defogger_reenable
[2011.02.08 10:03:24 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2011.02.08 10:03:24 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2011.02.08 09:54:42 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\g2m3e4r.exe
[2011.02.08 09:54:40 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\defogger.exe
[2011.02.08 09:51:12 | 000,471,802 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Load.exe
[2011.02.07 13:51:53 | 936,566,784 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.19 13:07:30 | 000,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011.01.14 09:36:08 | 000,023,040 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\DishNetwork.doc
[2010.02.22 18:08:45 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.02.22 18:07:19 | 000,000,036 | -H-- | C] () -- C:\WINDOWS\System32\swk.ini
[2010.01.22 21:17:26 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009.06.14 15:15:50 | 000,000,222 | ---- | C] () -- C:\WINDOWS\System32\SunData.ini
[2009.06.14 14:13:52 | 000,000,085 | ---- | C] () -- C:\WINDOWS\TTL3Util.ini
[2009.06.14 14:13:40 | 000,000,120 | ---- | C] () -- C:\WINDOWS\TTL3.ini
[2009.04.22 00:26:19 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009.03.03 11:18:04 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2008.09.29 20:41:01 | 000,011,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\UimFIO.sys
[2008.09.29 20:40:59 | 000,247,824 | ---- | C] () -- C:\WINDOWS\System32\prgiso.dll
[2008.09.29 20:40:58 | 004,245,008 | ---- | C] () -- C:\WINDOWS\System32\qtp-mt334.dll
[2008.09.29 20:40:58 | 000,013,840 | ---- | C] () -- C:\WINDOWS\System32\wnaspi32.dll
[2008.03.25 19:51:47 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2008.01.18 11:45:58 | 000,000,105 | ---- | C] () -- C:\WINDOWS\fahrplan.ini
[2007.09.13 17:00:03 | 000,010,593 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2007.04.17 20:42:05 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IPPCPUID.DLL
[2007.04.17 20:41:04 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2007.04.17 20:39:36 | 000,000,416 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007.04.16 23:07:48 | 000,541,568 | ---- | C] () -- C:\WINDOWS\System32\drivers\phc700.sys
[2007.04.16 23:07:48 | 000,015,488 | ---- | C] () -- C:\WINDOWS\phc700.ini
[2007.01.26 00:59:41 | 000,000,067 | ---- | C] () -- C:\WINDOWS\StationRipper.INI
[2006.12.07 22:24:01 | 000,002,216 | ---- | C] () -- C:\WINDOWS\winzip32.ini
[2006.12.05 22:05:03 | 000,000,612 | ---- | C] () -- C:\WINDOWS\3DHOME.INI
[2006.12.05 21:29:15 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini
[2006.12.05 21:01:30 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
[2006.12.01 22:01:33 | 000,063,488 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.12.01 18:12:52 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2006.11.27 20:58:08 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2006.11.25 00:31:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.11.24 19:33:50 | 000,013,396 | ---- | C] () -- C:\WINDOWS\System32\drivers\MTictwl.sys
[2006.11.24 18:23:31 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006.08.19 02:02:27 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2006.08.19 02:02:27 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2006.08.19 02:02:27 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2006.08.19 02:01:20 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2006.08.19 01:54:25 | 000,001,125 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.06.21 03:48:15 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.06.17 03:24:58 | 000,001,442 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006.06.17 03:24:57 | 000,000,493 | ---- | C] () -- C:\WINDOWS\System32\emver.ini
[2006.06.16 20:31:45 | 000,004,348 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006.05.02 16:38:24 | 000,000,748 | ---- | C] () -- C:\WINDOWS\SetBrowser.ini
[2005.08.05 22:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005.06.23 10:24:30 | 000,035,328 | ---- | C] () -- C:\WINDOWS\System32\INETWH32.DLL
[1996.12.14 00:00:00 | 000,025,600 | ---- | C] () -- C:\WINDOWS\System32\VADE232.DLL
[1996.12.14 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
[1996.12.14 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1996.12.14 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
========== LOP Check ==========
[2007.04.22 13:48:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2008.07.13 13:51:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009.11.08 12:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2009.11.02 00:02:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2007.04.17 20:39:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2011.02.07 14:35:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009.12.13 20:48:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2008.11.08 11:38:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Amazon
[2009.08.19 22:48:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Antispyware
[2007.06.21 08:37:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Canon
[2009.05.26 07:20:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Flock
[2009.08.05 16:34:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\GARMIN
[2009.11.02 00:02:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\NCH Swift Sound
[2010.10.14 01:23:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Netscape
[2007.09.14 19:55:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\NewSoft
[2009.09.05 21:54:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\NoteCable
[2007.11.22 12:28:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Opera
[2006.08.19 02:13:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView
[2007.04.17 20:39:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\ScanSoft
[2009.09.08 00:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VirtuelleProbefahrt
[2009.07.07 10:42:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\W Photo Studio Viewer
[2008.01.23 01:06:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Walgreens
[2006.11.24 19:38:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\WildTangent
[2007.11.13 13:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\XnView
[2006.11.24 18:12:19 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP signup reminder 1.job
[2006.11.24 18:12:20 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP signup reminder 3.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2010.07.05 18:32:55 | 000,000,000 | ---D | M] -- C:\3DHAD3
[2010.04.01 03:16:31 | 000,000,000 | RHSD | M] -- C:\cmdcons
[2006.06.17 03:21:48 | 000,000,000 | ---D | M] -- C:\CMPNENTS
[2010.10.14 00:32:45 | 000,000,000 | --SD | M] -- C:\ComboFix
[2010.10.20 00:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings
[2006.06.16 20:30:04 | 000,000,000 | ---D | M] -- C:\Drivers
[2009.05.12 22:30:33 | 000,000,000 | ---D | M] -- C:\f947b47fc9b2d7e8ac65
[2008.11.10 21:54:35 | 000,000,000 | ---D | M] -- C:\Garmin_all-GPS-fodlers
[2009.09.04 21:44:29 | 000,000,000 | ---D | M] -- C:\I386
[2006.08.19 02:05:02 | 000,000,000 | ---D | M] -- C:\My Music
[2011.02.08 10:03:23 | 000,000,000 | ---D | M] -- C:\Program Files
[2010.10.19 23:26:17 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2009.10.24 13:15:33 | 000,000,000 | ---D | M] -- C:\Spiele
[2011.02.08 09:36:00 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.10.20 00:18:51 | 000,000,000 | -H-D | M] -- C:\test
[2009.06.14 14:13:43 | 000,000,000 | ---D | M] -- C:\TTL3
[2011.02.08 13:03:18 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2010.07.02 21:19:58 | 000,000,000 | ---D | M] -- C:\Wurzelimperium
[2011.01.19 16:18:40 | 000,000,000 | ---D | M] -- C:\zz Downloads
[2011.01.17 12:21:39 | 000,000,000 | ---D | M] -- C:\zz Fotos
[2011.01.19 09:43:13 | 000,000,000 | ---D | M] -- C:\zz tmp
[2011.02.06 00:33:24 | 000,000,000 | ---D | M] -- C:\zzz
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: LOCALAPPDATA
< %systemroot%\*. /mp /s >
< MD5 for: EXPLORER.EXE >
[2008.04.13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008.04.13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008.04.13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe
[2007.06.13 05:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 04:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
< MD5 for: USERINIT.EXE >
[2004.08.10 13:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008.04.13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
[2002.08.29 17:00:00 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=E931E0A2B8BF0019DB902E98D03662CB -- C:\I386\SYSTEM32\userinit.exe
< MD5 for: WINLOGON.EXE >
[2004.08.10 13:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2002.08.29 17:00:00 | 000,516,608 | ---- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB -- C:\I386\SYSTEM32\winlogon.exe
[2008.04.13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-19 22:18:47
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09DBCD87
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A9364E30
< End of report >
--- --- ---
#############################################
############### OTL.txt - Ende ############
#############################################
#############################################
######## Extras.txt Anfang #################
#############################################OTL Logfile:
Code:
OTL Extras logfile created on: 08.02.2011 13:09:57 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Owner\Desktop\MFTools
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
893,00 Mb Total Physical Memory | 476,00 Mb Available Physical Memory | 53,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181,01 Gb Total Space | 141,30 Gb Free Space | 78,06% Space Free | Partition Type: NTFS
Drive D: | 5,28 Gb Total Space | 3,40 Gb Free Space | 64,43% Space Free | Partition Type: FAT32
Computer Name: EMACHINE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = MozillaHTML] -- C:\Program Files\Netscape\Netscape\Netscp.exe (Mozilla, Netscape)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE -url "%1" (Mozilla, Netscape)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Application Loader -- (America Online, Inc.)
"C:\Program Files\Adobe\Photoshop Elements 4.0\AdobePhotoshopElementsMediaServer.exe" = C:\Program Files\Adobe\Photoshop Elements 4.0\AdobePhotoshopElementsMediaServer.exe:*:Disabled:Adobe Photoshop Elements Media Server -- ()
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon -- (Check Point Software Technologies LTD)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00020407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Standard
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{10F15459-C54E-41BA-AC83-F12ACAF24690}" = Moorfrosch XS
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4804" = CanoScan 8600F
"{15377C3E-9655-400F-B441-E69F0A6BEAFE}" = Recovery Software Suite eMachines
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Solution
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21BBAD12-C75F-4F06-A9B0-6F8BEEAF3846}" = Moorhuhn X - XS
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{269A4095-DB55-4D35-8FD0-39957D26BEEC}" = Philips VLounge
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 23
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 4.0
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AC55A61-BA20-4DF5-ABFF-8F4819E0C875}" = Digital Media Reader
"{5D95AD35-368F-47D5-B63A-A082DDF00111}" = Microsoft Digital Image Starter Edition 2006 Editor
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F9662B9-ED3F-4F02-9DEE-EFA1F95F629F}" = Paragon Drive Backup 2007
"{62BFB4C2-8C4E-4D91-BD7D-81C06EAAC3C0}" = Windows Rights Management Client with Service Pack 2
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{691F4068-81BF-49E3-B32E-FE3E16400111}" = Microsoft Digital Image Starter Edition 2006 Library
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C611DD2-2685-4A76-92B5-ECD237128582}" = Type to Learn 3
"{6E66ECBD-FCA7-4AE1-A8C5-1CA78BEEB057}" = Multimedia Keyboard Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C70BF2F2-2B54-4303-ABE6-82A20038A2EA}" = Philips SPC 700NC PC Camera
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.14
"{D6CB264F-88D2-43EA-BE36-DA86460A5FF9}" = MP3 Recorder 2008
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EBB7C1C1-D439-4D9B-9FDC-954C10F266B0}" = Adobe Photoshop Elements 4.0
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F92CDFEB-DB96-4589-B88C-BE181D153445}" = Moorhuhn WE AYCS
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FC2C7405-BC58-4E11-8F51-29671BEAC06B}" = Natural Color Pro
"3D Home Architect Deluxe 3.0" = 3D Home Architect(r) Deluxe 3.0
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 4" = Adobe Photoshop Elements 4.0
"Adobe Shockwave Player" = Adobe Shockwave Player
"AlbumWeb" = AlbumWeb
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3
"ATI Display Driver" = ATI Display Driver
"Avi Player" = Avi Player
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon CanoScan 8600F User Registration" = Canon CanoScan 8600F User Registration
"CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = Soft Data Fax Modem with SmartCP
"ERUNT_is1" = ERUNT 1.1j
"ffdshow_is1" = ffdshow [rev 918] [2007-02-12]
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{4AC55A61-BA20-4DF5-ABFF-8F4819E0C875}" = Digital Media Reader
"M4P MP3 Converter_is1" = M4P MP3 Converter 1.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom" = Nero - Burning Rom
"Netscape (7.2)" = Netscape (7.2)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office8.0" = Microsoft Office 97, Professional Edition
"PictureItSuiteTrial_v11" = Microsoft Digital Image Starter Edition 2006
"RealPlayer 6.0" = RealPlayer
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"VLC media player" = VLC media player 0.9.4
"WavePad" = WavePad Sound Editor
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZoneAlarm" = ZoneAlarm
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 06.02.2011 10:13:31 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established
Error - 06.02.2011 16:00:29 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
Error - 07.02.2011 15:52:19 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
Error - 07.02.2011 16:42:52 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established
Error - 07.02.2011 19:19:31 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
Error - 08.02.2011 10:57:35 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established
Error - 08.02.2011 11:58:21 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established
Error - 08.02.2011 12:24:55 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
Error - 08.02.2011 14:43:06 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
Error - 08.02.2011 15:03:12 | Computer Name = EMACHINE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
[ System Events ]
Error - 08.02.2011 11:58:27 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
Error - 08.02.2011 12:24:59 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126
Error - 08.02.2011 12:25:04 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
Error - 08.02.2011 14:30:02 | Computer Name = EMACHINE | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 08.02.2011 14:44:20 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126
Error - 08.02.2011 14:44:27 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
Error - 08.02.2011 14:45:44 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Application Layer Gateway
Service service to connect.
Error - 08.02.2011 14:45:44 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7000
Description = The Application Layer Gateway Service service failed to start due
to the following error: %%1053
Error - 08.02.2011 15:03:20 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126
Error - 08.02.2011 15:03:23 | Computer Name = EMACHINE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
< End of report >
--- --- ---
#############################################
########## Extras.txt Ende #################
#############################################
