Log created by WinPatrol [Freeware Edition] version 16.1.2009.1:16.1.2009.1
Scan saved at 1:49:07 PM, on 9/15/2009
Platform: Windows XP SP3 Home Edition Service Pack 3 (Build 2600)
MSIE: Internet Explorer (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRAMME\GEMEINSAME DATEIEN\iS3\ANTI-SPYWARE\SZServer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\PROGRAMME\Avira\ANTIVIR DESKTOP\sched.exe
C:\PROGRAMME\Avira\ANTIVIR DESKTOP\avgnt.exe
C:\PROGRAMME\Logitech\G-SERIES SOFTWARE\LCDMon.exe
C:\PROGRAMME\MICROSOFT OFFICE\Office12\GROOVEMONITOR.EXE
C:\PROGRAMME\ScanSoft\PAPERPORT\pptd40nt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRAMME\Logitech\G-SERIES SOFTWARE\Applets\LCDCOUNTDOWN\LCDCOUNTDOWN.EXE
C:\PROGRAMME\Logitech\G-SERIES SOFTWARE\Applets\LCDPop3\LCDPOP3.exe
C:\PROGRAMME\Logitech\G-SERIES SOFTWARE\Applets\LCDMedia.exe
C:\PROGRAMME\Logitech\G-SERIES SOFTWARE\Applets\LCDClock.exe
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRAMME\GEMEINSAME DATEIEN\Ahead\Lib\NMBGMONITOR.EXE
C:\PROGRAMME\Stardock\OBJECTDOCK\OBJECTDOCK.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\Ahead\Lib\NMINDEXSTORESVR.EXE
C:\PROGRAMME\Avira\ANTIVIR DESKTOP\avguard.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\alg.exe
C:\PROGRAMME\GEMEINSAME DATEIEN\Ahead\Lib\NMINDEXINGSERVICE.EXE
C:\PROGRAMME\MOZILLA FIREFOX\firefox.exe
C:\PROGRAMME\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAMME\BILLP STUDIOS\WINPATROL\WINPATROLEX.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Programme\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Programme\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup]C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer]C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avgnt]C:\Programme\Avira\AntiVir Desktop\avgnt.exe /min
O4 - HKLM\..\Run: [Launch LCDMon]C:\Programme\Logitech\G-series Software\LCDMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher]C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [GrooveMonitor]C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [SSBkgdUpdate]C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD]C:\Programme\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch]C:\Programme\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [PPort11reminder]C:\Programme\ScanSoft\PaperPort\Ereg\Ereg.exe -r C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd]C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3]C:\Programme\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [NeroFilterCheck]C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL]RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneVI]C:\Programme\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [MSConfig]C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [KernelFaultCheck]%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinPatrol [Freeware Edition]]C:\Programme\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [CTFMON.EXE]C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
O4 - HKCU\..\Run: [Windows Video Drivers]C:\RECYCLER\S-1-5-21-5002545672-1944572287-974894590-2589\winlogon.exe
O4 - Global Startup: Stardock ObjectDock.lnk=C:\Programme\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [] -
O14 - IERESET.INF: START_PAGE_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O14 - IERESET.INF: SEARCH_PAGE_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O14 - IERESET.INF:HKCU, Start Page = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Page_URL = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Search_URL = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKLM, Search Page = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKCU, Search Page = %SEARCH_PAGE_URL%
O20 - AppInit_DLLs: cru629.dat
O21 - WPDShServiceObj - WPDShServiceObj Class - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Planer - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Anwendungsverwaltung - - C:\WINDOWS\System32\appmgmts.dll
O23 - Service: GEST Service for program management. - - C:\Programme\GIGABYTE\GEST\GSvr.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: STOPzilla Service - iS3, Inc. - C:\Programme\Gemeinsame Dateien\iS3\Anti-Spyware\SZServer.exe
O24 - Desktop Component 0: Die derzeitige Homepage - About:Home
--- Additional WinPatrol Info ---
Default Browser: Windows® Internet Explorer - Internet Explorer version 7.00.6000.16876
MSIE: Internet Explorer (7.00.6000.16876)
Firefox 3.5.3 installed in C:\Programme\Mozilla Firefox.
2 IE Cookies in Folder: C:\Dokumente und Einstellungen\Besitzer\Cookies\
0 Mozilla Cookies in Folder: C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\FireFox\Profiles\ehkkjrdp.default
WP00 - HKLM\CS1: BootExecute = autocheck autochk *
WP00 - HKLM\CCS: BootExecute = autocheck autochk *
WP00 - HKLM\CS2: BootExecute = autocheck autochk *
WP00 - HKLM\CS3: BootExecute = autocheck autochk *
WP01 - HKLM\CS1: PendingFileRenameOperations = \??\C:\WINDOWS\TEMP\gasfkyppfcqrnset.tmp
WP01 - HKLM\CCS: PendingFileRenameOperations = \??\c:\windows\system32\cru629.dat
WP01 - HKLM\CS3: PendingFileRenameOperations = \??\c:\windows\system32\cru629.dat
WP02 - HKLM\CCS: Command = C:\WINDOWS\system32\cmd.exe
WP03 - Windows Automatic Update = 4:Empfohlene Updates automatisch herunterladen und installieren.
WP08 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix: Default = http://
WP08 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes: www = http://
WP16 - ActiveX: {17492023-C23A-453E-A040-C7C580BBF700} [Windows Genuine Advantage Validation Tool] C:\WINDOWS\system32\LEGITCHECKCONTROL.DLL 1.7.0069.2
WP16 - ActiveX: {4eb89ff4-7f78-4a0f-8b8d-2bf02e94e4b2} [Microsoft Terminal Services Client Control (redist)] C:\WINDOWS\system32\mstscax.dll 6.0.6001.18266
WP16 - ActiveX: {6414512B-B978-451D-A0D8-FCFDF33E833C} [WUWebControl Class] C:\WINDOWS\system32\wuweb.dll 7.2.6001.788
WP16 - ActiveX: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} [MUWebControl Class] C:\WINDOWS\system32\muweb.dll 7.2.6001.788
WP16 - ActiveX: {7390f3d8-0439-4c05-91e3-cf5cb290c3d0} [Microsoft Terminal Services Client Control (redist)] C:\WINDOWS\system32\mstscax.dll 6.0.6001.18266
WP16 - ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} [Shockwave Flash Object] C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx 9,0,16,0
WP16 - ActiveX: {ED8C108E-4349-11D2-91A4-00C04F7969E8} [XML HTTP Request] C:\WINDOWS\system32\msxml3.dll 8.100.1048.0
WP16 - ActiveX: {00024522-0000-0000-C000-000000000046} [RefEdit.Ctrl] C:\Programme\Microsoft Office\Office12\REFEDIT.DLL 12.0.6413.1000
WP16 - ActiveX: {05589fa1-c356-11ce-bf01-00aa0055595a} [ActiveMovieControl Object] C:\WINDOWS\system32\wmpdxm.dll 11.0.5721.5268
WP16 - ActiveX: {0713E8A2-850A-101B-AFC0-4210102A8DA7} [Microsoft TreeView Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {0713E8D2-850A-101B-AFC0-4210102A8DA7} [Microsoft ProgressBar Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {1D2B4F40-1F10-11D1-9E88-00C04FDCAB92} [ThumbCtl Class] C:\WINDOWS\system32\webvw.dll 6.00.2900.5512
WP16 - ActiveX: {ECD0ECC6-DCA4-4013-A915-12355AB70999} [MSWebDVD Class] C:\WINDOWS\system32\mswebdvd.dll 6.05.2600.5857
WP16 - ActiveX: {52A2AAAE-085D-4187-97EA-8C30DB990436} [HHCtrl Object] C:\WINDOWS\system32\hhctrl.ocx 5.2.3790.4110
WP16 - ActiveX: {54CE37E0-9834-41ae-9896-4DAB69DC022B} [Microsoft Terminal Services Client Control (redist)] C:\WINDOWS\system32\mstscax.dll 6.0.6001.18266
WP16 - ActiveX: {58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} [Microsoft ListView Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} [Microsoft ImageList Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {6B7E638F-850A-101B-AFC0-4210102A8DA7} [Microsoft StatusBar Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {6A6F4B83-45C5-4ca9-BDD9-0D81C12295E4} [Microsoft Terminal Services Client Control (redist)] C:\WINDOWS\system32\mstscax.dll 6.0.6001.18266
WP16 - ActiveX: {8856F961-340A-11D0-A96B-00C04FD705A2} [Microsoft Web Browser] C:\WINDOWS\system32\ieframe.dll 7.00.6000.16890
WP16 - ActiveX: {8BD21D50-EC42-11CE-9E0D-00AA006002F3} [Microsoft Forms 2.0 OptionButton] C:\WINDOWS\system32\FM20.DLL 12.0.6415.1000
WP16 - ActiveX: {A3F2A195-0D11-463b-96BB-D2FF1B7490A1} [MSDVDAdm Class] C:\WINDOWS\system32\mswebdvd.dll 6.05.2600.5857
WP16 - ActiveX: {971127BB-259F-48c2-BD75-5F97A3331551} [Microsoft Terminal Services Client Control (redist)] C:\WINDOWS\system32\mstscax.dll 6.0.6001.18266
WP16 - ActiveX: {98828DED-A591-462F-83BA-D2F62A68B8B8} [STOPzilla] C:\PROGRAMME\STOPZILLA!\SZSG.DLL
WP16 - ActiveX: {AE24FDAE-03C6-11D1-8B76-0080C744F389} [Microsoft Scriptlet Component] C:\WINDOWS\system32\mshtml.dll 7.00.6000.16890
WP16 - ActiveX: {CA8A9780-280D-11CF-A24D-444553540000} [Adobe PDF Reader] C:\PROGRAMME\GEMEINSAME DATEIEN\Adobe\Acrobat\ActiveX\AcroPDF.dll
WP16 - ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} [Shockwave Flash Object] C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx 9,0,16,0
WP16 - ActiveX: {E5DF9D10-3B52-11D1-83E8-00A0C90DC849} [WebViewFolderIcon Class] C:\WINDOWS\system32\webvw.dll 6.00.2900.5512
WP32 - Hidden File: C:\boot.ini
WP32 - Hidden File: C:\bootfont.bin
WP32 - Hidden File: C:\IO.SYS
WP32 - Hidden File: C:\MSDOS.SYS
WP32 - Hidden File: C:\NTDETECT.COM
WP32 - Hidden File: C:\ntldr
WP32 - Hidden File: C:\pagefile.sys
WP32 - Hidden File: C:\WINDOWS\WindowsShell.Manifest
WP32 - Hidden File: C:\WINDOWS\winnt.bmp
WP32 - Hidden File: C:\WINDOWS\winnt256.bmp
WP32 - Hidden File: C:\WINDOWS\system32\cdplayer.exe.manifest
WP32 - Hidden File: C:\WINDOWS\system32\config\default.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\default.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\SAM.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\SECURITY.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\software.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\software.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\system.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\system.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\TempKey.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\userdiff.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\userdifr.LOG
WP32 - Hidden File: C:\WINDOWS\system32\logonui.exe.manifest
WP32 - Hidden File: C:\WINDOWS\system32\ncpa.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\nwc.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\Restore\filelist.xml
WP32 - Hidden File: C:\WINDOWS\system32\sapi.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\WindowsLogon.manifest
WP32 - Hidden File: C:\WINDOWS\system32\wuaucpl.cpl.manifest
WP32 - Hidden File: C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\etilqs_Jh4cGS0wG5Rw1FkywbnL
WP33 - File Type .BAT: [Stapelverarbeitungsdatei für MS-DOS]%1 %*
WP33 - File Type .CAB: [WinRAR archive]C:\Programme\WinRAR\WinRAR.exe %1
WP33 - File Type .CAT: [Sicherheitskatalog]rundll32.exe cryptext.dll,CryptExtOpenCAT %1
WP33 - File Type .CHM: [Kompilierte HTML-Hilfedatei]C:\WINDOWS\hh.exe %1
WP33 - File Type .COM: [Anwendung für MS-DOS]%1 %*
WP33 - File Type .CMD: [Befehlsskript von Windows NT]%1 %*
WP33 - File Type .DOC: [Microsoft Office Word 97 - 2003-Dokument]C:\Programme\Microsoft Office\Office12\WINWORD.EXE /n /dde
WP33 - File Type .EML: [Outlook Express-E-Mail-Nachricht]C:\Programme\Outlook Express\msimn.exe /eml:%1
WP33 - File Type .EXE: [Anwendung]%1 %*
WP33 - File Type .INF: [Setup-Informationen]C:\WINDOWS\System32\NOTEPAD.EXE %1
WP33 - File Type .JS: [JScript-Skriptdatei]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .LOG: [Textdatei]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .MSI: [Windows Installer Package]C:\WINDOWS\System32\msiexec.exe /i %1 %*
WP33 - File Type .MSG: [Outlook-Element]C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE /f %1
WP33 - File Type .MID: [MIDI-Sequenz]C:\Programme\Windows Media Player\wmplayer.exe /Open %L
WP33 - File Type .MP3: [MP3-Audioformat]C:\Programme\Windows Media Player\wmplayer.exe /prefetch:6 /Open %L
WP33 - File Type .PIF: [Verknüpfung mit einer Anwendung für MS-DOS]%1 %*
WP33 - File Type .REG: [Registrierungsdatei]regedit.exe %1
WP33 - File Type .RTF: [Rich Text Format]C:\Programme\Microsoft Office\Office12\WINWORD.EXE /n /dde
WP33 - File Type .SCR: [Bildschirmschoner]%1 /S
WP33 - File Type .TXT: [Textdatei]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .URL: [Internetverknüpfung]rundll32.exe ieframe.dll,OpenURL %l
WP33 - File Type .VBS: [VBScript-Skriptdatei]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .VBE: [Codierte VBScript-Skriptdatei]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSF: [Windows-Skriptdatei]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSH: [Windows Script Host-Einstellungsdatei]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .XLS: [Microsoft Office Excel 97-2003-Arbeitsblatt]C:\Programme\Microsoft Office\Office12\EXCEL.EXE /e
Memory currently in use: 18%
Physical Memory Free: 2,097,151 KB
Paging File Free: 4,194,303 KB
Virtual Memory Free: 2,054,764 KB
--
End of file
