Trojaner-Board - IE öffnet eigenständig neue Fenster, tlw mit Media Player

So, mit Anwendung von hostxperts und anschließendem Scan mit OTL gab's folgende Ergebnisse:

OTL Logfile:

Code:

OTL logfile created on: 29.05.2011 11:12:57 - Run 5

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\User\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,00 Mb Total Physical Memory | 403,00 Mb Available Physical Memory | 53,00% Memory free

2,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): C:\pagefile.sys 1150 1890 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,05 Gb Total Space | 119,68 Gb Free Space | 80,29% Space Free | Partition Type: NTFS

 

Computer Name: USER-BF0A0EFD10 | User Name: User | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.04.29 20:21:47 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe

PRC - [2011.04.27 21:15:42 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.18 15:33:04 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.03.08 20:09:36 | 000,421,032 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.01.15 16:52:01 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.01.15 16:51:49 | 000,339,624 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.01.15 16:51:44 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.03.10 12:12:54 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2006.03.27 16:06:22 | 000,520,192 | ---- | M] () -- C:\Programme\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe

PRC - [2005.04.14 23:36:24 | 000,745,472 | ---- | M] () -- C:\Programme\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe

PRC - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

PRC - [2002.10.09 19:55:56 | 001,818,624 | R--- | M] (C-Media Electronic Inc. (www.cmedia.com.tw)) -- C:\WINDOWS\mixer.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.04.29 20:21:47 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe

MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - [2011.04.27 21:15:42 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.18 15:33:04 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.03.08 20:09:36 | 000,421,032 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.01.15 16:51:49 | 000,339,624 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.03.18 15:33:04 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.01.15 16:53:46 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2011.01.15 16:53:43 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.09.19 16:00:55 | 000,088,960 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Audio Controller (WDM)

DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2008.01.10 07:40:38 | 002,846,720 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2007.03.10 12:12:51 | 002,324,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2006.10.13 17:16:36 | 000,081,664 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)

DRV - [2006.03.15 19:39:10 | 000,167,808 | ---- | M] (NETGEAR Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wg111v2.sys -- (RTLWUSB)

DRV - [2004.08.04 00:38:56 | 000,327,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtaa.sys -- (ati2mtaa)

DRV - [2004.08.03 23:31:36 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)

DRV - [2004.08.03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)

DRV - [2002.10.15 14:04:00 | 000,379,854 | R--- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cmaudio.sys -- (cmpci) C-Media PCI Audio Driver (WDM)

DRV - [2002.10.01 16:57:12 | 000,013,532 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SjyPkt.sys -- (SjyPkt)

DRV - [2001.08.18 04:33:12 | 000,322,432 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\G400m.sys -- (G400)

DRV - [2001.08.17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

DRV - [2001.08.17 12:14:24 | 000,444,416 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fpcibase.sys -- (fpcibase)

DRV - [2001.08.17 12:13:48 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

O1 HOSTS File: ([2011.05.29 11:11:17 | 000,000,698 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.

O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)

O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)

O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [C-Media Mixer] C:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WG111v2 Smart Wizard Wireless Setting.lnk = C:\Programme\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000042 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1254147640196 (WUWebControl Class)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\huffodt: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll -  File not found

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.03.10 11:25:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.29 11:10:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Desktop\HostsXpert

[2011.05.20 16:09:34 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2011.05.14 21:34:14 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2011.05.13 16:16:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer

[2011.05.13 16:16:22 | 000,000,000 | ---D | C] -- C:\Programme\MSBuild

[2011.05.13 16:16:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US

[2011.05.13 16:16:12 | 000,000,000 | ---D | C] -- C:\Programme\Reference Assemblies

[2011.05.13 16:15:41 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\prntvpt.dll

[2011.05.13 16:15:41 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll

[2011.05.13 16:15:40 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpssvcs.dll

[2011.05.13 16:15:40 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpssvcs.dll

[2011.05.13 16:15:40 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe

[2011.05.13 16:15:40 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpsshhdr.dll

[2011.05.13 16:15:40 | 000,000,000 | ---D | C] -- C:\d9d027a28c06c5af10ad

[2011.05.10 21:44:22 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\User\Desktop\TDSSKiller.exe

[2011.04.29 20:21:45 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.29 11:10:22 | 000,357,766 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\HostsXpert.zip

[2011.05.29 09:55:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.05.29 09:55:32 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.27 23:40:13 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2011.05.26 19:28:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.05.20 16:09:34 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2011.05.14 21:41:03 | 000,541,054 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011.05.14 21:41:02 | 000,580,260 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2011.05.14 21:41:02 | 000,136,892 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2011.05.14 21:41:02 | 000,112,616 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011.05.14 16:11:27 | 000,129,024 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.13 18:19:44 | 000,244,720 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011.05.12 19:10:14 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011.05.10 21:43:51 | 001,280,815 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\tdsskiller.zip

[2011.05.09 18:38:17 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011.05.08 21:22:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\System32\mbr.exe

[2011.05.08 20:23:05 | 000,302,080 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\d970bjwn.exe

[2011.05.01 14:21:34 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\User\Desktop\TDSSKiller.exe

[2011.04.30 12:31:31 | 000,009,752 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\hjtscanlist.zip

[2011.04.30 12:31:11 | 000,006,902 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Extras.zip

[2011.04.30 12:30:47 | 000,007,614 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\OTL.zip

[2011.04.29 20:21:47 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe

 
 ========== Files Created - No Company Name ==========

 

[2011.05.29 11:10:22 | 000,357,766 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\HostsXpert.zip

[2011.05.12 19:05:12 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2011.05.10 21:43:49 | 001,280,815 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\tdsskiller.zip

[2011.05.08 21:22:24 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\mbr.exe

[2011.05.08 20:23:05 | 000,302,080 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\d970bjwn.exe

[2011.04.30 12:31:11 | 000,006,902 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Extras.zip

[2011.04.30 12:30:47 | 000,007,614 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\OTL.zip

[2011.04.29 20:50:59 | 000,030,259 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\hjtscanlist.bat

[2011.04.29 20:50:46 | 000,009,752 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\hjtscanlist.zip

[2011.01.28 20:08:11 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2010.12.28 19:55:33 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010.09.13 11:46:20 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.09.13 11:46:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.09.13 11:46:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.09.13 11:46:20 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.09.13 11:46:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.03.02 23:00:35 | 000,083,968 | ---- | C] () -- C:\WINDOWS\UnGins.exe

[2009.10.11 21:50:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI

[2009.10.11 12:39:02 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009.10.07 20:48:59 | 000,129,024 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.09.30 12:41:38 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2009.09.30 12:41:38 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat

[2009.09.30 12:41:38 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat

[2009.09.30 12:41:38 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2009.09.30 12:41:38 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat

[2009.09.30 12:41:38 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat

[2009.09.30 12:41:38 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat

[2009.09.30 12:41:38 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat

[2009.09.30 12:41:38 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat

[2009.09.30 12:41:38 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat

[2009.09.30 12:41:38 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat

[2009.09.30 12:41:38 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat

[2009.09.30 12:41:38 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat

[2009.09.30 12:41:38 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat

[2009.09.30 12:41:38 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat

[2009.09.30 12:41:38 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat

[2009.09.30 12:41:38 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat

[2009.09.30 12:41:38 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat

[2009.09.30 12:41:38 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2009.09.30 12:39:36 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4400DEFGIPS.ini

[2008.09.20 11:35:02 | 000,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini

[2008.09.20 11:34:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2008.09.20 11:33:45 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe

[2008.09.20 11:32:15 | 000,038,999 | R--- | C] () -- C:\WINDOWS\cmijack.dat

[2008.09.20 11:32:15 | 000,022,122 | R--- | C] () -- C:\WINDOWS\cmaudio.dat

[2008.09.19 16:03:09 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2008.08.21 03:37:54 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat

[2008.08.21 03:37:54 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2008.08.21 03:37:54 | 000,887,724 | R--- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2008.08.05 23:14:13 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE

[2008.07.17 14:23:36 | 000,165,782 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2007.09.04 10:10:36 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys

[2007.08.21 23:51:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe

[2007.08.21 21:36:12 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe

[2007.03.10 12:36:43 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll

[2007.03.10 12:36:43 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll

[2007.03.10 12:36:43 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll

[2007.03.10 12:36:43 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll

[2007.03.10 12:36:43 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll

[2007.03.10 12:36:43 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll

[2007.03.10 12:36:16 | 000,831,600 | ---- | C] () -- C:\WINDOWS\System32\Ctaa1.dat

[2007.03.10 12:36:16 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll

[2007.03.10 12:30:49 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2007.03.10 12:25:57 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.03.10 11:28:35 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2007.03.10 11:22:06 | 000,022,880 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2007.03.10 11:16:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007.03.10 11:15:01 | 000,244,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2004.09.07 15:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2004.08.08 20:59:59 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004.08.08 20:58:42 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004.08.08 20:56:36 | 000,580,260 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2004.08.08 20:56:36 | 000,541,054 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004.08.08 20:56:36 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004.08.08 20:56:36 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004.08.08 20:56:36 | 000,136,892 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2004.08.08 20:56:36 | 000,112,616 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004.08.08 20:56:36 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004.08.08 20:56:36 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004.08.08 20:56:31 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004.08.08 20:56:31 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004.08.08 20:56:19 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2004.08.08 20:55:48 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004.08.08 20:55:47 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004.08.08 20:54:25 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

 
 ========== LOP Check ==========

 

[2009.09.30 12:41:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON

[2009.09.30 12:44:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL

[2010.02.15 03:19:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Afdui

[2011.01.15 16:18:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Atlmod

[2010.01.05 22:29:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\EPSON

[2010.12.29 11:23:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Etxoto

[2009.10.08 23:48:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\FreeFLVConverter

[2010.07.12 05:01:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Icxid

[2010.12.29 11:06:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Igre

[2007.03.10 12:40:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\InterVideo

[2010.11.24 13:14:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Isyl

[2011.01.16 22:23:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Ypabfa

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 29.05.2011 11:12:57 - Run 5

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\User\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,00 Mb Total Physical Memory | 403,00 Mb Available Physical Memory | 53,00% Memory free

2,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): C:\pagefile.sys 1150 1890 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,05 Gb Total Space | 119,68 Gb Free Space | 80,29% Space Free | Partition Type: NTFS

 

Computer Name: USER-BF0A0EFD10 | User Name: User | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 1

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\InterVideo\DVD6\WinDVD.exe" = C:\Programme\InterVideo\DVD6\WinDVD.exe:*:Disabled:WinDVD -- (InterVideo Inc.)

"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer -- (Microsoft Corporation)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{053EC7D7-25D6-87DE-FB3C-21EDA3AC1B3D}" = CCC Help Japanese

"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center

"{09E03881-E349-18A2-2AFC-CADE51DF080E}" = CCC Help Thai

"{12C11D57-0E6B-64F2-B99E-E40E785AEB56}" = CCC Help Hungarian

"{152441C1-D4DA-EE78-7E4A-514DD0361256}" = CCC Help Dutch

"{16C291EE-B2F5-1636-D382-FEB776F677BE}" = CCC Help Italian

"{18941178-396B-0CC4-2168-17112315EBB8}" = ccc-utility

"{1B3D70BF-F1E5-1548-C1ED-22F0D47BDDD1}" = CCC Help Finnish

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{22CCA04F-DFE0-5337-770C-3CFD2CDCF2D9}" = ccc-core-static

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2DDBE461-3A0D-A6C2-6944-92D694AFB12A}" = Catalyst Control Center Localization French

"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager

"{3373AFA7-672F-407C-68F0-955FB5930A47}" = Catalyst Control Center Localization Turkish

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{35CB8AFB-0376-9D4F-24E5-1EEC1CEE1A4B}" = CCC Help Chinese Standard

"{36417A39-B6A6-BE0F-0AD0-6D9B116985D1}" = CCC Help Swedish

"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION

"{3FAFEF64-911D-8013-18B5-E0BDF223A5C0}" = CCC Help Korean

"{40E4166C-460E-65F8-F84B-88A2F9EA69F4}" = CCC Help Polish

"{421D1CB2-0C0B-AC1D-06E5-14B0974376B5}" = Catalyst Control Center Localization Korean

"{451CEE76-0FFE-802D-1F5E-615D69BC7007}" = Catalyst Control Center Localization Greek

"{4609F28C-0BDB-F2B2-9DC7-B35A28478312}" = Catalyst Control Center Localization Czech

"{46E1C9E1-9CC6-D432-F2BB-7CFC27B32EC9}" = Catalyst Control Center Localization Russian

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{519118EE-ACFD-16B7-7FEA-6B47D529B50C}" = Catalyst Control Center Core Implementation

"{5325AF31-8FEF-EEA6-084E-6784F834B5C0}" = Catalyst Control Center Graphics Full Existing

"{57105084-049B-008E-165A-92AF92B0C60F}" = ccc-core-preinstall

"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard

"{5DE136A9-DCAE-69D0-08CB-02F07CFC9398}" = CCC Help Spanish

"{5E7AD152-771A-52C9-8394-E2F3BA629E06}" = CCC Help Greek

"{6782B259-804B-301D-0DE9-13000375C2D2}" = Catalyst Control Center Localization Japanese

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6ACA2FD2-4C4A-42F3-AFB5-7B433BBDF6DB}" = InterVideo WinDVD 6

"{6D58E839-9E34-3979-7BFD-145BD5E9401C}" = CCC Help Norwegian

"{6FA439F8-EBD8-FF4D-8EE5-A52FE69A4248}" = Catalyst Control Center Localization Finnish

"{793E79A5-B52D-E287-37F2-398F530D74C7}" = Catalyst Control Center Localization Polish

"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page

"{7F2FF077-4A0C-0F26-717C-617DED010B33}" = CCC Help English

"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs

"{8BF103B8-8C8E-2246-8C0D-C6C256E5E428}" = CCC Help French

"{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}" = Camera RAW Plug-In for EPSON Creativity Suite

"{8E9BA9AF-6A06-C7AC-5863-4A40CF29CE05}" = Catalyst Control Center Localization German

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90E5D6A9-C373-357B-6659-8BF019E3C1D4}" = Catalyst Control Center Localization Dutch

"{9366C5C6-9434-C4C9-9804-FB4D7142874D}" = Catalyst Control Center Localization Portuguese

"{942DD738-A9F7-BBFA-3960-4558CB0EE272}" = Catalyst Control Center Localization Chinese Standard

"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A0857F54-AE2D-F453-4069-C7D65AE36426}" = Catalyst Control Center Localization Chinese Traditional

"{A2FA61E6-B46A-3489-BD5A-2991144A5BC4}" = CCC Help Portuguese

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{AA75AFFC-C5F3-2497-FE56-48AA163EFE2B}" = CCC Help Russian

"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch

"{B5C68E1B-A651-33AA-21A6-7CC2D69EEFA2}" = CCC Help Czech

"{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}" = EPSON Easy Photo Print

"{BE2686A1-ECF2-FF0E-9DF5-EC7A806AEED8}" = Catalyst Control Center Localization Thai

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CC2B8406-F144-3B99-F66E-8D1703C9A9C5}" = Catalyst Control Center Graphics Previews Common

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker

"{D4F3A4D4-84B1-3A40-14AA-422DE60EF96A}" = Skins

"{D51D9840-FABE-390B-24D2-D052332B311A}" = Catalyst Control Center Localization Spanish

"{D9E96902-5743-D105-BCB7-FBD3C0DF3989}" = Catalyst Control Center Localization Swedish

"{DCE27619-6822-0D22-1405-9D2899DC1896}" = Catalyst Control Center Localization Norwegian

"{DF80DB18-7179-EB18-5818-E7F761DA59AE}" = CCC Help Danish

"{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = WG111v2 Configuration Utility

"{E698F77C-216C-8409-F4DC-E4AAECF5DEFF}" = Catalyst Control Center Localization Italian

"{E7DAAF26-A0B0-1D77-0794-20D1314297F1}" = Catalyst Control Center Graphics Light

"{F16A317A-6128-39E2-9607-20B5C70132E6}" = Catalyst Control Center Localization Hungarian

"{F2B34A83-5345-910F-EC0F-0D92A00D6E3B}" = CCC Help Turkish

"{F2BDC47D-18FA-5B10-58C0-9FFBDBE0B031}" = Catalyst Control Center Graphics Full New

"{F3D677C8-612D-F5A8-A22F-2EF74F44000B}" = CCC Help Chinese Traditional

"{F9AB0D25-0085-8345-3F1A-5E5C714092B9}" = Catalyst Control Center Localization Danish

"{FEFE846E-DF0E-0AC6-0EA0-F85CE63CA275}" = CCC Help German

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Premium

"CCleaner" = CCleaner

"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series

"CX4300_5500_DX4400 Handbuch" = CX4300_5500_DX4400 Handbuch

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"Free FLV Converter_is1" = Free FLV Converter V 6.7.1

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie8" = Windows Internet Explorer 8

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"PCI Audio Driver" = PCI Audio Driver

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows XP Service Pack" = Windows XP Service Pack 3

"WMFDist11" = Windows Media Format 11 runtime

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 06.03.2011 13:53:34 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 06.03.2011 17:32:45 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: The connection with the server was terminated

 abnormally  .

 

Error - 06.03.2011 17:32:46 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 07.03.2011 07:12:38 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: The connection with the server was terminated

 abnormally  .

 

Error - 07.03.2011 07:12:38 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 07.03.2011 07:19:39 | Computer Name = USER-BF0A0EFD10 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung setup.exe, Version 0.0.0.0, fehlgeschlagenes

 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.

 

Error - 08.03.2011 16:44:18 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: The connection with the server was terminated

 abnormally  .

 

Error - 08.03.2011 16:44:18 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 09.03.2011 16:11:56 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: The connection with the server was terminated

 abnormally  .

 

Error - 09.03.2011 16:11:56 | Computer Name = USER-BF0A0EFD10 | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

[ System Events ]

Error - 24.05.2011 12:21:58 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 25.05.2011 11:51:23 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 26.05.2011 13:28:07 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 27.05.2011 02:36:12 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 27.05.2011 12:17:53 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 28.05.2011 03:00:40 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 28.05.2011 05:49:23 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 28.05.2011 10:57:37 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 28.05.2011 17:29:37 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

Error - 29.05.2011 03:55:42 | Computer Name = USER-BF0A0EFD10 | Source = Dhcp | ID = 1002

Description = Die IP-Adresslease 192.168.2.32 für die Netzwerkkarte mit der Netzwerkadresse

 00146CEF38D6 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 

hat eine DHCPNACK-Meldung gesendet).

 

 

< End of report >

--- --- ---