Hey Leute, hab da ein Problem...
Also alles begann gestern: ich kam abends nach hasue und hab den pc hochgefahren...dann hab ich mein passowrt eigegeben und dann isser hängengeblieben (glaub ich zumindest).
Während da stand "Benutzereinstellungen werden geladen" blieb das bild stehen und nix hat sich getan, kann sein, dass er noch gerechnet hat, aber normalerweise is das ja ne sache von 2 sekunden und ich hab wirklich ne halbe minute gewartet.
Also einfach mal pc neugestartet.
Dannn gings, doch alles war anders...das war wie, als hätte ich mich unter einem neuen benutzer eingeloggt, denn:
-Mein Destophintergrund war verschwunden
-Alle Symbole auf dem Desktop waren weg, bis auf den mülleimer
-Im Startmenü waren mein Programme nicht zu sehen, obwohl sie installiert waren, wie ich herausgefunden habe
-Im Ordner eigene Datein war es leer...dann bin ich über Arbeitspaltz/c/ dokumente und einstellungen/ eigene datein und dort waren sie vorhanden
Alle meine EInstellungen im InternetBrowser waren weg.
ich konnte keine Mails im Outlook abrufen, da ich dort nicht eingeloggt war und die informationen fehlten
mein icq wolte nicht starten usw
Alle einstellungen waren weg!

Ich hatte keine ahnung, warum das so sein könnte, also habe ich über start/programme/zubehör/systemprogramme/systemwiederherstellung
mein system wiederhergestellt (auf den stand letzten monats)

Jetzt gehts wieder!

Würde trotzdem mal gerne wissen, was das war...vielleicht hatte des ja was damit zu tun, dass ich neugestartet hab, während er die benutzereinstellungen geladen hatte...ka..
Ein Viirus isses aber net oder?
Danke für eure Hilfe!

Wenn du wissen willst ob du Schädlinge drauf hast, solltest du mit Hijackthis scannen.

Lade/entpacke HijackThis in einem Ordner
-->None of the above,
just start the program --> Save--> Savelog -->es öffnet sich der
Editor -->
oder:
Do a system scan and save a logfile --> Save--> Savelog -->es öffnet sich der
Editor -->
nun das KOMPLETTE Log mit rechtem Mausklick abkopieren und ins
Forum mit rechtem Mausklick "einfügen"

Und wo krieg ich dieses HijackThis her?

Hi,

http://virus-protect.net/hjtkurz.html

Übrigens
Es ist nicht verboten die Suche zu benutzen!

prince

Okay sry, hab net danach gesucht...trotzdem danke

Hier die Log-File:

Logfile of HijackThis v1.99.1
Scan saved at 19:09:41, on 13.10.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Atguard\iamserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\Atguard\iamapp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\Java\jre1.5.0_02\bin\jucheck.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Save\Save.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\ObjectDock\ObjectDock.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\OpenOffice.org1.1.0\program\soffice.exe
C:\Programme\Winamp\Winamp.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Bernhard\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:3128
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\Atguard\iamapp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Programme\OpenOffice.org1.1.0\program\quickstart.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Stardock ObjectDock.lnk = F:\ObjectDock\ObjectDock.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: WRQ IAM (iamServ) - WRQ, Inc. - C:\Programme\Atguard\iamserv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Du solltest mal nen kompletten Virenscan machen und mit nem Spyware-scanner nochmal drüber huschen, sieht ganz stark danach aus das du dir nen Virus oder sogar nen Trojaner gefangen hast. Und Spyware is auch noch bissle was dabei.

SO, hab jetzt mal antivir suchen lassen, des hat einen virus gefunden und ich hban gelöscht...hier nun die neue logfile....
ich weiss leider auch nich, mit welchem programm ich die spyware entfernen kann?

Logfile of HijackThis v1.99.1
Scan saved at 10:34:57, on 15.10.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Atguard\iamserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\Atguard\iamapp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\Save\Save.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Java\jre1.5.0_02\bin\jucheck.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programme\OpenOffice.org1.1.0\program\soffice.exe
C:\Dokumente und Einstellungen\Bernhard\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:3128
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\Atguard\iamapp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Programme\OpenOffice.org1.1.0\program\quickstart.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Stardock ObjectDock.lnk = F:\ObjectDock\ObjectDock.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: WRQ IAM (iamServ) - WRQ, Inc. - C:\Programme\Atguard\iamserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

==============================

Hijack This Starten ==> Button: Noone of the above just start the programm ==> Button Scan ==> Die Checkbox vor folgenden Einträgen Aktiviren ==> Button Fix Checked ==> Neustart

O4 - HKLM\..\Run: [WhenUSave] "C:\Programme\Save\Save.exe"

==============================

Arbeite diese Anleitung bitte vollständig ab und poste das Ergebniss:
http://yourhighness.eddys-domain.de/escan.html

=======================

Führe den CrapCleaner aus und hake alles an:
http://virus-protect.net/temp.html

Lade dir Ewido, Scanne, poste den Report und deinsatlliere es nach getaener Arbeit (Virenentfernung)
http://virus-protect.net/ewido.html

========================

Okay vielen dank, marcell
ich denke es hat alles geklappt...ewido hat alle viren und spyware gelöscht (und das war einige)
Heißt das, dass ich jetzt komplett von schädlingen befreit bin? oder soll ich nochmal ne hijackthis logfile hier reinposten??

Poste noch den scanreport von Escan und warte auf Nikita. Ich habe ihr bescheidgesagt, wenn sie grünes Licht gibt ist alles oke.

okay, hab allerdings nochn paar frangen:
was bringt escan denn, wenn dieses ewido sowieso alle viren löscht??
und das problem was ich am anfang des threads beschrieben hatte, hatte nix mit den viren und der spyware zu tun oder?
--------------------------------------------------
-------------------- INFECTED --------------------
--------------------------------------------------

1: Sat Oct 15 14:39:10 2005 => System found infected with mybar Spyware/Adware ({014da6c9-189f-421a-88cd-07cfe51cff10})! Action taken: No Action Taken.
2: Sat Oct 15 14:39:10 2005 => System found infected with gain.gator Spyware/Adware ({21ffb6c0-0da1-11d5-a9d5-00500413153c})! Action taken: No Action Taken.
3: Sat Oct 15 14:39:10 2005 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
4: Sat Oct 15 14:39:41 2005 => System found infected with myway Spyware/Adware ({0494d0d4-f8e0-41ad-92a3-14154ece70ac})! Action taken: No Action Taken.
5: Sat Oct 15 14:39:41 2005 => System found infected with whenu.savenow Spyware/Adware ({c285d18d-43a2-4aef-83fb-bf280e660a97})! Action taken: No Action Taken.
6: Sat Oct 15 14:39:41 2005 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
7: Sat Oct 15 14:39:43 2005 => Offending file found: C:\WINDOWS\smdat32a.sys
8: Sat Oct 15 14:39:43 2005 => System found infected with altnet Spyware/Adware (smdat32a.sys)! Action taken: No Action Taken.
9: Sat Oct 15 14:39:51 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Startmenü\programme\autostart\powerreg scheduler v3.exe
10: Sat Oct 15 14:39:51 2005 => System found infected with powerreg scheduler Spyware/Adware (powerreg scheduler v3.exe)! Action taken: No Action Taken.
11: Sat Oct 15 14:39:51 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Startmenü\Programme\autostart\powerreg scheduler v3.exe
12: Sat Oct 15 14:39:51 2005 => System found infected with powerreg scheduler Spyware/Adware (powerreg scheduler v3.exe)! Action taken: No Action Taken.
13: Sat Oct 15 14:39:51 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Startmenü\Programme\Autostart\powerreg scheduler v3.exe
14: Sat Oct 15 14:39:51 2005 => System found infected with powerreg scheduler Spyware/Adware (powerreg scheduler v3.exe)! Action taken: No Action Taken.
15: Sat Oct 15 14:39:52 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temp\isp9.tmp\setup.dll
16: Sat Oct 15 14:39:52 2005 => System found infected with fastfind Spyware/Adware (setup.dll)! Action taken: No Action Taken.
17: Sat Oct 15 14:39:52 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temp\isp9a.tmp\setup.dll
18: Sat Oct 15 14:39:52 2005 => System found infected with fastfind Spyware/Adware (setup.dll)! Action taken: No Action Taken.
19: Sat Oct 15 14:39:52 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temp\temporary internet files\content.ie5\8lq7wt2n\adsend[1].js
20: Sat Oct 15 14:39:52 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
21: Sat Oct 15 14:39:54 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temp\temporary internet files\content.ie5\cd2zwxm7\show_ads[2].js
22: Sat Oct 15 14:39:54 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken.
23: Sat Oct 15 14:39:56 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temp\temporary internet files\content.ie5\whqbo9un\adswrapper[1].js
24: Sat Oct 15 14:39:56 2005 => System found infected with whenu.savenow Spyware/Adware (adswrapper[1].js)! Action taken: No Action Taken.
25: Sat Oct 15 14:39:58 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\0ls98f67\common[1].js
26: Sat Oct 15 14:39:58 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
27: Sat Oct 15 14:39:58 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\0ls98f67\index[1].html
28: Sat Oct 15 14:39:58 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
29: Sat Oct 15 14:39:58 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\0tmpgjk7\adsend[1].js
30: Sat Oct 15 14:39:58 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
31: Sat Oct 15 14:39:58 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\0tmpgjk7\index[1].html
32: Sat Oct 15 14:39:58 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
33: Sat Oct 15 14:39:59 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\c9ibyf49\index[1].html
34: Sat Oct 15 14:39:59 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
35: Sat Oct 15 14:39:59 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\ebc70lkd\adsend[1].js
36: Sat Oct 15 14:39:59 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
37: Sat Oct 15 14:39:59 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\ebc70lkd\adswrapper[1].js
38: Sat Oct 15 14:39:59 2005 => System found infected with whenu.savenow Spyware/Adware (adswrapper[1].js)! Action taken: No Action Taken.
39: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\temporary internet files\content.ie5\ebc70lkd\index[1].html
40: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
41: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\0ls98f67\common[1].js
42: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.
43: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\0ls98f67\index[1].html
44: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
45: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\0tmpgjk7\adsend[1].js
46: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
47: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\0tmpgjk7\index[1].html
48: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
49: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\c9ibyf49\index[1].html
50: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
51: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\ebc70lkd\adsend[1].js
52: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
53: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\ebc70lkd\adswrapper[1].js
54: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (adswrapper[1].js)! Action taken: No Action Taken.
55: Sat Oct 15 14:40:00 2005 => Offending file found: C:\Dokumente und Einstellungen\Bernhard\Lokale Einstellungen\Temporary Internet Files\content.ie5\ebc70lkd\index[1].html
56: Sat Oct 15 14:40:00 2005 => System found infected with whenu.savenow Spyware/Adware (index[1].html)! Action taken: No Action Taken.
57: Sat Oct 15 14:40:01 2005 => System found infected with altnetbde Spyware/Adware (adm.exe)! Action taken: No Action Taken.
58: Sat Oct 15 14:40:01 2005 => System found infected with altnetbde Spyware/Adware (altnet signing module.exe)! Action taken: No Action Taken.
59: Sat Oct 15 14:40:01 2005 => System found infected with altnetbde Spyware/Adware (adm.exe)! Action taken: No Action Taken.
60: Sat Oct 15 14:40:01 2005 => System found infected with altnetbde Spyware/Adware (altnet signing module.exe)! Action taken: No Action Taken.
61: Sat Oct 15 14:48:34 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
62: Sat Oct 15 15:06:28 2005 => Scanning File F:\hl2\hl2\sound\npc\combine_soldier\vo\infected.wav [**]

--------------------------------------------------
--------------------- TAGGED ---------------------
--------------------------------------------------

1: Sat Oct 15 14:38:59 2005 => File C:\Programme\Save\Save.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bc". Action Taken: No Action Taken.
2: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\CMEIIAPI.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
3: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GAppMgr.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
4: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GController.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
5: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GDwldEng.dll tagged as "not-a-virus:AdWare.Win32.Gator.3124". Action Taken: No Action Taken.
6: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GIocl.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
7: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GIoclClient.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
8: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GMTProxy.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
9: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GObjs.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
10: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GStore.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
11: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\GStoreServer.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
12: Sat Oct 15 14:48:48 2005 => File C:\Programme\Gemeinsame Dateien\CMEII\Gtools.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
13: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\EGGCEngine.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
14: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\egIEEngine.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
15: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\EGIEProcess.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
16: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\EGNSEngine.dll tagged as "not-a-virus:AdWare.Win32.Gator.5017". Action Taken: No Action Taken.
17: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\GatorRes.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
18: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\GatorStubSetup.exe tagged as "not-a-virus:AdWare.Win32.Gator.6034". Action Taken: No Action Taken.
19: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\gtrawbm.fil tagged as "not-a-virus:AdWare.Win32.Gator.a". Action Taken: No Action Taken.
20: Sat Oct 15 14:49:24 2005 => File C:\Programme\Gemeinsame Dateien\GMT\GUninstaller.exe tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.
21: Sat Oct 15 14:52:04 2005 => File C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL tagged as "not-a-virus:AdWare.Win32.MyWay.m". Action Taken: No Action Taken.
22: Sat Oct 15 14:53:22 2005 => File C:\Programme\Save\SaveUninst.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bc". Action Taken: No Action Taken.
23: Sat Oct 15 14:56:20 2005 => File C:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0276627.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bc". Action Taken: No Action Taken.
24: Sat Oct 15 14:56:20 2005 => File C:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0276635.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.bc". Action Taken: No Action Taken.
25: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\adm25.dll tagged as "not-a-virus:AdWare.Win32.Altnet.a". Action Taken: No Action Taken.
26: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\adm4.dll tagged as "not-a-virus:AdWare.Win32.Altnet.a". Action Taken: No Action Taken.
27: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\admdloader.dll tagged as "not-a-virus:AdWare.Win32.BrilliantDigital.3039". Action Taken: No Action Taken.
28: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\admfdi.dll tagged as "not-a-virus:AdWare.Win32.Altnet.j". Action Taken: No Action Taken.
29: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\admprog.dll tagged as "not-a-virus:AdWare.Win32.Altnet.i". Action Taken: No Action Taken.
30: Sat Oct 15 15:04:22 2005 => File C:\WINDOWS\Temp\Altnet\dmfiles.cab tagged as "not-a-virus:AdWare.Win32.Altnet.b". Action Taken: No Action Taken.
31: Sat Oct 15 15:04:23 2005 => File C:\WINDOWS\Temp\Altnet\pmfiles.cab tagged as "not-a-virus:AdWare.Win32.BrilliantDigital.1007". Action Taken: No Action Taken.
32: Sat Oct 15 15:04:23 2005 => File C:\WINDOWS\Temp\Altnet\Setup.exe tagged as "not-a-virus:AdWare.Win32.Altnet.b". Action Taken: No Action Taken.
33: Sat Oct 15 15:04:47 2005 => File F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0272773.exe tagged as not-a-virus:Server-Proxy.Win32.Hltv. No Action Taken.
34: Sat Oct 15 15:04:55 2005 => File F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0272988.exe tagged as not-a-virus:Server-Proxy.Win32.Hltv. No Action Taken.
35: Sat Oct 15 15:05:04 2005 => File F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0276518.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
36: Sat Oct 15 15:05:20 2005 => File F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP172\A0290383.exe tagged as not-a-virus:Server-Proxy.Win32.Hltv. No Action Taken.
37: Sat Oct 15 15:06:27 2005 => Scanning File F:\hl2\hl2\sound\npc\metropolice\vo\non-taggedviromeshere.wav [**]
38: Sat Oct 15 15:06:28 2005 => Scanning File F:\hl2\hl2\sound\npc\combine_soldier\vo\wehavenontaggedviromes.wav [**]
39: Sat Oct 15 15:09:09 2005 => File F:\Program Files\Altnet\Download Manager\asm.exe tagged as "not-a-virus:AdWare.Win32.Altnet.m". Action Taken: No Action Taken.
40: Sat Oct 15 15:09:57 2005 => File F:\Sierra\Half-Life\hltv.exe tagged as not-a-virus:Server-Proxy.Win32.Hltv. No Action Taken.
41: Sat Oct 15 15:10:04 2005 => File F:\Sierra\Counter-Strike\hltv.exe tagged as not-a-virus:Server-Proxy.Win32.Hltv. No Action Taken.

--------------------------------------------------
--------------------- ERRORS ---------------------
--------------------------------------------------

1: Sat Oct 15 14:38:46 2005 => ERROR!!! Invalid Entry SCRNSAVE.EXE = C:\WINDOWS\100HAP~1.SCR (in key Control Panel\Desktop). No Action Taken.
2: Sat Oct 15 14:39:04 2005 => ERROR!!! Invalid Entry \??\C:\DOKUME~1\Bernhard\LOKALE~1\Temp\jgameenp.sys in SYSTEM\CurrentControlSet\Services\jgameenp...
3: Sat Oct 15 14:39:05 2005 => ERROR!!! Invalid Entry System32\Drivers\CyFxUsb.sys in SYSTEM\CurrentControlSet\Services\MP3300AI...
4: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\InterVideo\Common\Bin\IVIPromotion.exe". Action Taken: No Action Taken.
5: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Proof\MSGRGE32.DLL". Action Taken: No Action Taken.
6: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Proof\msgr_ge.lex". Action Taken: No Action Taken.
7: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\logo.act". Action Taken: No Action Taken.
8: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\scribble.act". Action Taken: No Action Taken.
9: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\dot.act". Action Taken: No Action Taken.
10: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\mnature.act". Action Taken: No Action Taken.
11: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\hoverbot.act". Action Taken: No Action Taken.
12: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\will.act". Action Taken: No Action Taken.
13: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\powerpup.act". Action Taken: No Action Taken.
14: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Assistnt\genius.act". Action Taken: No Action Taken.
15: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "F:\tony hawk 2". Action Taken: No Action Taken.
16: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebUncoated.icc". Action Taken: No Action Taken.
17: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AppleRGB.icc". Action Taken: No Action Taken.
18: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\ColorMatchRGB.icc". Action Taken: No Action Taken.
19: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleCoated.icc". Action Taken: No Action Taken.
20: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleUncoated.icc". Action Taken: No Action Taken.
21: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\JapanStandard.icc". Action Taken: No Action Taken.
22: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\sRGB Color Space Profile.icm". Action Taken: No Action Taken.
23: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedCoated.icc". Action Taken: No Action Taken.
24: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedUncoated.icc". Action Taken: No Action Taken.
25: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebCoatedSWOP.icc". Action Taken: No Action Taken.
26: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AdobeRGB1998.icc". Action Taken: No Action Taken.
27: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\WideGamutRGB.icc". Action Taken: No Action Taken.
28: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\NTSC1953.icc". Action Taken: No Action Taken.
29: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\PAL_SECAM.icc". Action Taken: No Action Taken.
30: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\SMPTE-C.icc". Action Taken: No Action Taken.
31: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\CIERGB.icc". Action Taken: No Action Taken.
32: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop5DefaultCMYK.icc". Action Taken: No Action Taken.
33: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop4DefaultCMYK.icc". Action Taken: No Action Taken.
34: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Mozilla1.6\Plugins\NPSWF32.dll". Action Taken: No Action Taken.
35: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\AVSDAM.DLL". Action Taken: No Action Taken.
36: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "f:\GTA\gtados\Dos4gw.exe". Action Taken: No Action Taken.
37: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "f:\GTA\gtawin\Smackw32.dll". Action Taken: No Action Taken.
38: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "f:\GTA\gtawin\Mss32.dll". Action Taken: No Action Taken.
39: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\Bernhard\Desktop\mozilla-win32-1.7.2-deAT\mozilla\NPSWF32.dll". Action Taken: No Action Taken.
40: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\msxml3a.dll". Action Taken: No Action Taken.
41: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxsfs.dll". Action Taken: No Action Taken.
42: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\System32\cmmgr32.exe". Action Taken: No Action Taken.
43: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\EXCEL.EXE" refers to invalid object "C:\Programme\Microsoft Office\Office\EXCEL.EXE". Action Taken: No Action Taken.
44: Sat Oct 15 14:40:04 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\MSOFFICE.EXE" refers to invalid object "C:\Programme\Microsoft Office\Office\MSOFFICE.EXE". Action Taken: No Action Taken.
45: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\RegCloneCD" refers to invalid object "C:\Programme\SlySoft\CloneCD\RegCloneCD.exe". Action Taken: No Action Taken.
46: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "C:\Programme\Creative\EAX Unified\yourapp.Exe". Action Taken: No Action Taken.
47: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\America's Army\". Action Taken: No Action Taken.
48: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\America's Army\System\". Action Taken: No Action Taken.
49: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\America's Army\System\save\". Action Taken: No Action Taken.
50: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\America's Army\System\pb\". Action Taken: No Action Taken.
51: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\America's Army\System\pb\htm\". Action Taken: No Action Taken.
52: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\clippit.act" refers to invalid object "C:\Programme\Microsoft Office\Office\Actors\CLIPPIT.ACT". Action Taken: No Action Taken.
53: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\ffastlog.txt" refers to invalid object "C:\WINDOWS\System32\FFASTLOG.TXT". Action Taken: No Action Taken.
54: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\findfast.cpl" refers to invalid object "C:\WINDOWS\System32\FINDFAST.CPL". Action Taken: No Action Taken.
55: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\hlink.srg" refers to invalid object "C:\Programme\Microsoft Office\Office\HLINK.SRG". Action Taken: No Action Taken.
56: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\misc.srg" refers to invalid object "C:\Programme\Microsoft Office\Office\MISC.SRG". Action Taken: No Action Taken.
57: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\mso97.dll" refers to invalid object "C:\Programme\Microsoft Office\Office\MSO97.DLL". Action Taken: No Action Taken.
58: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\msroute.dll" refers to invalid object "C:\Programme\Microsoft Office\Office\MSROUTE.DLL". Action Taken: No Action Taken.
59: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\osa.exe" refers to invalid object "C:\Programme\Microsoft Office\Office\OSA.EXE". Action Taken: No Action Taken.
60: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Shared Tools\osaintl.dll" refers to invalid object "C:\Programme\Microsoft Office\Office\OSAINTL.DLL". Action Taken: No Action Taken.
61: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".000". Action Taken: No Action Taken.
62: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".020". Action Taken: No Action Taken.
63: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".1". Action Taken: No Action Taken.
64: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".2". Action Taken: No Action Taken.
65: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".39". Action Taken: No Action Taken.
66: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".4MMM". Action Taken: No Action Taken.
67: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".937". Action Taken: No Action Taken.
68: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".avd". Action Taken: No Action Taken.
69: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".b". Action Taken: No Action Taken.
70: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".BAK". Action Taken: No Action Taken.
71: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".bic". Action Taken: No Action Taken.
72: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".c25". Action Taken: No Action Taken.
73: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".c38". Action Taken: No Action Taken.
74: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".c59". Action Taken: No Action Taken.
75: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".c60". Action Taken: No Action Taken.
76: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ccl". Action Taken: No Action Taken.
77: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".CK4". Action Taken: No Action Taken.
78: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".cue". Action Taken: No Action Taken.
79: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".det". Action Taken: No Action Taken.
80: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dff". Action Taken: No Action Taken.
81: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".DMO". Action Taken: No Action Taken.
82: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".DN1". Action Taken: No Action Taken.
83: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dta". Action Taken: No Action Taken.
84: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dxf". Action Taken: No Action Taken.
85: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".err". Action Taken: No Action Taken.
86: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ffo". Action Taken: No Action Taken.
87: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".fgd". Action Taken: No Action Taken.
88: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".gxt". Action Taken: No Action Taken.
89: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".H0". Action Taken: No Action Taken.
90: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".H0°". Action Taken: No Action Taken.
91: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hdp". Action Taken: No Action Taken.
92: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".he4". Action Taken: No Action Taken.
93: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".kpl". Action Taken: No Action Taken.
94: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".lin". Action Taken: No Action Taken.
95: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".map". Action Taken: No Action Taken.
96: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".max". Action Taken: No Action Taken.
97: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MKB". Action Taken: No Action Taken.
98: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MM_". Action Taken: No Action Taken.
99: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mst". Action Taken: No Action Taken.
100: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".opt". Action Taken: No Action Taken.
101: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ovw". Action Taken: No Action Taken.
102: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".p0". Action Taken: No Action Taken.
103: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".p1". Action Taken: No Action Taken.
104: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".p2". Action Taken: No Action Taken.
105: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".p3". Action Taken: No Action Taken.
106: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".part". Action Taken: No Action Taken.
107: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".prt". Action Taken: No Action Taken.
108: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pts". Action Taken: No Action Taken.
109: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".q3d". Action Taken: No Action Taken.
110: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".r3t". Action Taken: No Action Taken.
111: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rep". Action Taken: No Action Taken.
112: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".RRS". Action Taken: No Action Taken.
113: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".scn". Action Taken: No Action Taken.
114: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sdp". Action Taken: No Action Taken.
115: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".spr". Action Taken: No Action Taken.
116: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".torrent". Action Taken: No Action Taken.
117: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".wic". Action Taken: No Action Taken.
118: Sat Oct 15 14:40:05 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
119: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "AltnetDM". Action Taken: No Action Taken.
120: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DivX Codec". Action Taken: No Action Taken.
121: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DivX Player". Action Taken: No Action Taken.
122: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Global Warfare Beta 1.2 Full". Action Taken: No Action Taken.
123: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{0B69DA57-BC7D-461D-B7D6-2AA9F08869CD}". Action Taken: No Action Taken.
124: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Office8.0". Action Taken: No Action Taken.
125: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "P2P Networking". Action Taken: No Action Taken.
126: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "RPG Maker 2003_is1". Action Taken: No Action Taken.
127: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SCDNAS". Action Taken: No Action Taken.
128: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SHOUTcastDSP". Action Taken: No Action Taken.
129: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SvenCoop". Action Taken: No Action Taken.
130: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "UT2003". Action Taken: No Action Taken.
131: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Valve Hammer Editor". Action Taken: No Action Taken.
132: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}". Action Taken: No Action Taken.
133: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7148F0A8-6813-11D6-A77B-00B0D0142040}". Action Taken: No Action Taken.
134: Sat Oct 15 14:40:05 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B575AC8F-EEDB-4B75-0091-17306783164E}". Action Taken: No Action Taken.
135: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{00020820-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Microsoft Office\Office\excel.exe". Action Taken: No Action Taken.
136: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{00020821-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Microsoft Office\Office\excel.exe". Action Taken: No Action Taken.
137: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{00020906-0000-0000-C000-000000000046}" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe"". Action Taken: No Action Taken.
138: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{00020907-0000-0000-C000-000000000046}" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe"". Action Taken: No Action Taken.
139: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{000209FF-0000-0000-C000-000000000046}" refers to invalid object "C:\PROGRA~1\MICROS~2\Office\Winword.exe /Automation". Action Taken: No Action Taken.
140: Sat Oct 15 14:40:05 2005 => Entry "HKCR\CLSID\{00024500-0000-0000-C000-000000000046}" refers to invalid object "C:\Programme\Microsoft Office\Office\excel.exe /automation". Action Taken: No Action Taken.
141: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{26AC39FE-F835-4D87-845D-D64D1AC0053A}" refers to invalid object ""f:\Söldner\portal\jwdcom.exe"". Action Taken: No Action Taken.
142: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{29F458BE-8866-11D5-A3DD-00B0D0F3BAA7}" refers to invalid object "C:\PROGRA~1\mozilla.org\Mozilla\Mozilla.exe /MAPIStartUp". Action Taken: No Action Taken.
143: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{2CE12F21-5377-4577-B78F-482FC7EEAFBB}" refers to invalid object ""f:\Söldner\portal\jwdcom.exe"". Action Taken: No Action Taken.
144: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{35465706-E211-11d3-8B87-C295F909460A}" refers to invalid object "F:\MAGIX\Media_Manager\WMServerReader.dll". Action Taken: No Action Taken.
145: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{3836A5BF-51B3-4B37-8E96-9D429C22183C}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
146: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{53B8B406-42E4-4dd3-96E7-9DEC8CEB3DD8}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ICQVideoControl.dll". Action Taken: No Action Taken.
147: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOKUME~1\Bernhard\LOKALE~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.
148: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{63E6BE14-A742-4EEA-8AF3-0EC39F10F850}" refers to invalid object "C:\PROGRA~1\Google\GOOGLE~1\GOOGLE~1.EXE". Action Taken: No Action Taken.
149: Sat Oct 15 14:40:06 2005 => Entry "HKCR\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}" refers to invalid object "C:\PROGRA~1\mozilla.org\Mozilla\MapiProxy.dll". Action Taken: No Action Taken.
150: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{795698C9-E328-4AB3-ACC6-F685635FBF9F}" refers to invalid object "F:\MAGIX\Media_Manager\Hhprend.ax". Action Taken: No Action Taken.
151: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{838186E3-56E1-11D2-9758-0060979C3633}" refers to invalid object "C:\PROGRA~1\Adobe\ACROBA~1.0\PDFMaker\ADOBEP~1.DLL". Action Taken: No Action Taken.
152: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{8722111A-DE20-48ac-832D-0CEDA23212AB}" refers to invalid object "F:\MAGIX\Media_Manager\CDDBUI.dll". Action Taken: No Action Taken.
153: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{A2D4475B-C9AA-48E2-A029-1DB829DACF7B}" refers to invalid object "C:\PROGRA~1\Google\GOOGLE~1\GOOGLE~1.EXE". Action Taken: No Action Taken.
154: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{A4178E50-A793-4B93-8616-1AAC87DF373B}" refers to invalid object "F:\MAGIX\Media_Manager\JWVidRend.ax". Action Taken: No Action Taken.
155: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{AA9B2BD7-B7AA-4d4a-AF5C-D7B2C8FB6582}" refers to invalid object "F:\MAGIX\Media_Manager\CDDBUI.dll". Action Taken: No Action Taken.
156: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{AB7AB3FF-EB55-4B40-AE1D-80ECEFA32E17}" refers to invalid object "F:\MAGIX\Media_Manager\CDDBUI.dll". Action Taken: No Action Taken.
157: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{AF1A9404-6CA9-11D3-B053-00C04F4C0826}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
158: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{AFD07A5E-3E20-4D77-825C-2F6D1A50BE5B}" refers to invalid object "C:\PROGRA~1\Google\GOOGLE~1\GOOGLE~1.EXE". Action Taken: No Action Taken.
159: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{B0528CE4-F67E-11D2-8F8E-00C04F4C3B9F}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
160: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{B20B4521-CCF8-11D6-B8A5-000064657374}" refers to invalid object "C:\DOKUME~1\BERNHARD\DESKTOP\MOZILL~1.2-D\MOZILLA\MOZILLA.EXE -PalmSyncStartup". Action Taken: No Action Taken.
161: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{BBF37B9E-2F4F-11D3-B02F-00C04F4C0826}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
162: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{BBF37BA0-2F4F-11D3-B02F-00C04F4C0826}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
163: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{BBF37BA2-2F4F-11D3-B02F-00C04F4C0826}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
164: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{BBF37BA4-2F4F-11D3-B02F-00C04F4C0826}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
165: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{C073A662-A344-4611-8632-06452280EBB0}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
166: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{C192C703-22AE-4C7E-B9B2-76EC6DBBF5B9}" refers to invalid object "C:\PROGRA~1\INTERM~1\HELIUM~1\Helium2.exe". Action Taken: No Action Taken.
167: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{C8CE6FC1-CCF1-11D6-B8A5-000064657374}" refers to invalid object "C:\DOKUME~1\BERNHARD\DESKTOP\MOZILL~1.2-D\MOZILLA\PalmSyncProxy.dll". Action Taken: No Action Taken.
168: Sat Oct 15 14:40:07 2005 => Entry "HKCR\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}" refers to invalid object "f:\sierra\counter-strike\SvenCoop\Msvbvm60.dll". Action Taken: No Action Taken.
169: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{D734EAE8-0810-4513-99B6-DDAC4BC30E29}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
170: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{D7A4D8FB-83F0-40e5-954F-88F48D15AE96}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ICQVideoControl.dll". Action Taken: No Action Taken.
171: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{DFEF3E96-F1D4-47CE-A429-2CC8C10DFDB6}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
172: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{E8201A18-B291-4046-A531-744CC6FA131E}" refers to invalid object ""f:\Söldner\portal\jwdcom.exe"". Action Taken: No Action Taken.
173: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{F0B52259-19ED-4FE1-A034-0543A57B9B4B}" refers to invalid object ""f:\Söldner\portal\jwdcom.exe"". Action Taken: No Action Taken.
174: Sat Oct 15 14:40:08 2005 => Entry "HKCR\CLSID\{F4BAFF02-F907-11D2-8F8F-00C04F4C3B9F}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
175: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{1B23D700-05DD-4893-901C-98B32FCB26F2}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ICQVideoControl.dll". Action Taken: No Action Taken.
176: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{26BF9366-95A2-463B-8237-238114494AF7}" refers to invalid object "F:\MAGIX\Media_Manager\CDDBUI.dll". Action Taken: No Action Taken.
177: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{3476FAB2-687F-4EA6-9AC2-88D72DC7D7FC}" refers to invalid object "C:\Programme\Google\Google Earth\GoogleEarth.exe". Action Taken: No Action Taken.
178: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{4E1F9F75-1CAF-4E25-91D5-AF22D937C3D1}" refers to invalid object "C:\DOKUME~1\Bernhard\LOKALE~1\Temp\VBE\MSForms.EXD". Action Taken: No Action Taken.
179: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{63E18C8C-C1B9-4534-9F93-42DE1F6A8965}" refers to invalid object "f:\Söldner\portal\jwdcom.exe". Action Taken: No Action Taken.
180: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{78165D71-DF28-11D3-9A89-005004A56D53}" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\Acrobat\Acrobat.tlb". Action Taken: No Action Taken.
181: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{7AF322C5-AB43-11D4-A00B-0050DA18DE71}" refers to invalid object "C:\DOKUME~1\Bernhard\LOKALE~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.
182: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{9E93C96F-CF0D-43F6-8BA8-B807A3370712}" refers to invalid object "C:\Programme\iTunes\iTunes.exe". Action Taken: No Action Taken.
183: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}" refers to invalid object "F:\MAGIX\Media_Manager\CddbControl.dll". Action Taken: No Action Taken.
184: Sat Oct 15 14:40:08 2005 => Entry "HKCR\TypeLib\{F539E4BA-AEC1-4919-B329-30F660F6B214}" refers to invalid object "C:\Programme\Intermedia Design\Helium 2\Helium2.exe". Action Taken: No Action Taken.
185: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.acl" refers to invalid object "ACLFile". Action Taken: No Action Taken.
186: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.aw" refers to invalid object "AWFile". Action Taken: No Action Taken.
187: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.col" refers to invalid object "COLFile". Action Taken: No Action Taken.
188: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.elm" refers to invalid object "ELMFile". Action Taken: No Action Taken.
189: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.ffa" refers to invalid object "FFAFile". Action Taken: No Action Taken.
190: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.ffl" refers to invalid object "FFLFile". Action Taken: No Action Taken.
191: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.fft" refers to invalid object "FFTFile". Action Taken: No Action Taken.
192: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.ffx" refers to invalid object "FFXFile". Action Taken: No Action Taken.
193: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.opc" refers to invalid object "OPCFile". Action Taken: No Action Taken.
194: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.pcb" refers to invalid object "PCBFile". Action Taken: No Action Taken.
195: Sat Oct 15 14:40:08 2005 => Entry "HKCR\.pip" refers to invalid object "PIPFile". Action Taken: No Action Taken.
196: Sat Oct 15 14:40:09 2005 => Entry "HKCR\.stf" refers to invalid object "STFFile". Action Taken: No Action Taken.
197: Sat Oct 15 14:40:09 2005 => Entry "HKCR\.tuw" refers to invalid object "TUWFile". Action Taken: No Action Taken.
198: Sat Oct 15 14:40:09 2005 => Entry "HKCR\ADM25.ADM25.1" refers to invalid object "{1D3BCE37-7834-4579-8169-E67681420A98}". Action Taken: No Action Taken.
199: Sat Oct 15 14:40:09 2005 => Entry "HKCR\ADM4.ADM4.1" refers to invalid object "{DEF37997-D9C9-4A4B-BF3C-88F99EACEEC2}". Action Taken: No Action Taken.
200: Sat Oct 15 14:40:09 2005 => Entry "HKCR\Backstage.Document\shell\open\command" refers to invalid object "C:\PROGRA~1\MACROM~1\DREAMW~1\DREAMW~1.EXE "%1"". Action Taken: No Action Taken.
201: Sat Oct 15 14:40:09 2005 => Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
202: Sat Oct 15 14:40:09 2005 => Entry "HKCR\DBC.MPEG.1\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
203: Sat Oct 15 14:40:09 2005 => Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken.
204: Sat Oct 15 14:40:09 2005 => Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken.
205: Sat Oct 15 14:40:09 2005 => Entry "HKCR\Excel.Chart.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\excel.exe" /e". Action Taken: No Action Taken.
206: Sat Oct 15 14:40:09 2005 => Entry "HKCR\Excel.Sheet.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\excel.exe" /e". Action Taken: No Action Taken.
207: Sat Oct 15 14:40:09 2005 => Entry "HKCR\GSASkin.Document\shell\open\command" refers to invalid object "C:\Programme\GameSpy Arcade\GSAPak.exe "%1"". Action Taken: No Action Taken.
208: Sat Oct 15 14:40:09 2005 => Entry "HKCR\GTA3.ImageArchive\shell\open\command" refers to invalid object "C:\Dokumente und Einstellungen\Bernhard\Desktop\IMG Tool1\IMGTool.exe "%1"". Action Taken: No Action Taken.
209: Sat Oct 15 14:40:09 2005 => Entry "HKCR\Hammer.Map\shell\open\command" refers to invalid object "F:\VALVEH~1\hammer.exe "%1"". Action Taken: No Action Taken.
210: Sat Oct 15 14:40:10 2005 => Entry "HKCR\Launcher.Bulk\shell\open\command" refers to invalid object "C:\PROGRA~1\YAMAHA\Launcher\Launcher.exe "%1"". Action Taken: No Action Taken.
211: Sat Oct 15 14:40:10 2005 => Entry "HKCR\Launcher.Pattern\shell\open\command" refers to invalid object "C:\PROGRA~1\YAMAHA\Launcher\Launcher.exe "%1"". Action Taken: No Action Taken.
212: Sat Oct 15 14:40:10 2005 => Entry "HKCR\LiveUpdate.MIDI.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
213: Sat Oct 15 14:40:10 2005 => Entry "HKCR\m3x_auto_file\shell\open\command" refers to invalid object "F:\MAGIX\MEDIA_~1\MEDIAM~1.EXE "%1"". Action Taken: No Action Taken.
214: Sat Oct 15 14:40:10 2005 => Entry "HKCR\mks_auto_file\shell\open\command" refers to invalid object "F:\MAGIX\MEDIA_~1\MEDIAM~1.EXE "%1"". Action Taken: No Action Taken.
215: Sat Oct 15 14:40:10 2005 => Entry "HKCR\plr_auto_file\shell\open\command" refers to invalid object "F:\MAGIX\MEDIA_~1\MEDIAM~1.EXE "%1"". Action Taken: No Action Taken.
216: Sat Oct 15 14:40:10 2005 => Entry "HKCR\plv_auto_file\shell\open\command" refers to invalid object "F:\MAGIX\MEDIA_~1\MEDIAM~1.EXE "%1"". Action Taken: No Action Taken.
217: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.AIFF.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
218: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.AU.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
219: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.AVI.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
220: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.MP1.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
221: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.MP2.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
222: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.MP4.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
223: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.MPEG.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
224: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.PLSPL.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
225: Sat Oct 15 14:40:10 2005 => Entry "HKCR\RealPlayer.WAV.6\shell\open\command" refers to invalid object ""C:\Programme\Real\RealOne Player\RealPlay.exe" "%1"". Action Taken: No Action Taken.
226: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Wally.Document\shell\open\command" refers to invalid object "F:\wally\Wally.exe /dde". Action Taken: No Action Taken.
227: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Word.Backup.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe" /n". Action Taken: No Action Taken.
228: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Word.Basic.8" refers to invalid object "{000209FE-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
229: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Word.Document.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe" /n". Action Taken: No Action Taken.
230: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Word.RTF.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe" /n". Action Taken: No Action Taken.
231: Sat Oct 15 14:40:11 2005 => Entry "HKCR\Word.Template.8\shell\open\command" refers to invalid object ""C:\Programme\Microsoft Office\Office\Winword.exe" /n". Action Taken: No Action Taken.

--------------------------------------------------
-------- DATEIEN ZUM LÖSCHEN HINZUGEFÜGT ---------
--------------------------------------------------

1: F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0272773.exe => tagged:Server-Proxy.Win32.Hltv.
2: F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP171\A0272988.exe => tagged:Server-Proxy.Win32.Hltv.
3: F:\System Volume Information\_restore{1399C6C7-23E1-40DE-9271-EE2DF623D4B9}\RP172\A0290383.exe => tagged:Server-Proxy.Win32.Hltv.
4: F:\Sierra\Half-Life\hltv.exe => tagged:Server-Proxy.Win32.Hltv.
5: F:\Sierra\Counter-Strike\hltv.exe => tagged:Server-Proxy.Win32.Hltv.

--------------------------------------------------
-------------------- Statistik -------------------
--------------------------------------------------

Sat Oct 15 15:11:28 2005 => Total Objects Scanned: 144071
Sat Oct 15 15:11:28 2005 => Total Virus(es) Found: 109
Sat Oct 15 15:11:28 2005 => Total Errors: 231
Sat Oct 15 15:11:28 2005 => Virus Database Date: 2005/10/15
Sat Oct 15 15:11:28 2005 => Virus Database Count: 154224
Sat Oct 15 15:55:14 2005 => Total Objects Scanned: 144071
Sat Oct 15 15:55:14 2005 => Total Virus(es) Found: 109
Sat Oct 15 15:55:14 2005 => Total Errors: 231

ach, und danke für eure hilfe

Du siehst doch, was noch alles gefunden wurde... Nikita machts.