| |
| |||||||
Log-Analyse und Auswertung: Ihr system wird aus sicherheitsgründen blockiertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
02.03.2012, 01:18
| #1 |
| |  Ihr system wird aus sicherheitsgründen blockiert Hallo zusammen, habe mir gerade beim surfen mit Firefox anscheinend einen "lustigen" Virus eingefangen. Beim normalen starten blockiert direkt der Bildschirm mit einer Sicherheitswarnung und ich soll "Lösegeld" in Hohöe von 100 € bezahlen damit alles wieder gut wird.  Der Taskmanager wird auch deaktiviert, kann zwar im abgesicherten Modus in der Registry wieder aktiviert werden, beim normalen Neustart ist er jedoch wieder futsch. Habe mal die OTL-Logs angehangen und bin für jede Hilfe äußerst dankbar.OTL.txt Code:
ATTFilter OTL logfile created on: 02.03.2012 00:39:24 - Run 1 OTL by OldTimer - Version 3.2.34.0 Folder = C:\Downloads 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,94 Gb Total Physical Memory | 6,88 Gb Available Physical Memory | 86,72% Memory free 15,87 Gb Paging File | 14,86 Gb Available in Paging File | 93,64% Paging File free Paging file location(s): d:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 64,52 Gb Total Space | 3,87 Gb Free Space | 5,99% Space Free | Partition Type: NTFS Drive D: | 400,47 Gb Total Space | 12,71 Gb Free Space | 3,17% Space Free | Partition Type: NTFS Drive G: | 3,66 Gb Total Space | 3,59 Gb Free Space | 98,03% Space Free | Partition Type: FAT32 Computer Name: E6510-AGRUETT | User Name: agruett | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.03.01 23:55:06 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Downloads\OTL.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.02.02 21:46:08 | 000,055,296 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\iprntsrv.exe -- (iprntsrv) SRV:64bit: - [2012.01.17 04:28:58 | 000,019,544 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe -- (XTSvcMgr) SRV:64bit: - [2011.01.12 16:44:02 | 000,042,360 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV:64bit: - [2011.01.12 16:41:42 | 000,810,144 | ---- | M] (ESET) [Auto | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn) SRV:64bit: - [2010.08.16 22:59:52 | 000,263,168 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV) SRV:64bit: - [2010.08.16 22:58:34 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters) SRV:64bit: - [2010.03.24 00:07:58 | 001,039,776 | ---- | M] (Broadcom Corporation) [Auto | Stopped] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service) SRV:64bit: - [2010.03.24 00:07:58 | 000,031,136 | ---- | M] (Broadcom Corporation) [Auto | Stopped] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage) SRV:64bit: - [2009.09.21 14:24:40 | 001,420,560 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2009.09.21 14:00:44 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.01.05 17:16:50 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.01.06 12:36:58 | 000,147,904 | ---- | M] (Red Gate Software Ltd.) [On_Demand | Stopped] -- D:\Programme\ANTZ\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe -- (ANTS Performance Profiler 6 Service) SRV - [2011.01.06 12:36:57 | 000,168,896 | ---- | M] (Red Gate Software Ltd.) [On_Demand | Stopped] -- D:\Programme\ANTZ\ANTS Memory Profiler 6\RedGate.Memory.IISService.exe -- (ANTS Memory Profiler 6 Service) SRV - [2010.11.22 23:50:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Stopped] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc) SRV - [2010.11.05 22:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010.09.06 08:06:44 | 000,196,608 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\novell\zenworks\bin\ZENPreAgent.exe -- (ZENPreAgent) SRV - [2010.08.01 11:38:46 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2010.08.01 11:38:32 | 000,334,384 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2010.08.01 11:38:28 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2010.08.01 10:39:16 | 000,539,184 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService) SRV - [2010.07.31 07:27:36 | 000,235,624 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010.07.20 16:20:46 | 000,097,792 | ---- | M] () [Disabled | Stopped] -- d:\oracle\ora10g_db64\Bin\extjob.exe -- (OracleJobSchedulerLOCAL10) SRV - [2010.07.20 16:20:26 | 076,156,416 | ---- | M] (Oracle Corporation) [On_Demand | Stopped] -- d:\oracle\ora10g_db64\bin\ORACLE.EXE -- (OracleServiceLOCAL10) SRV - [2010.06.30 08:22:10 | 001,839,104 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe -- (nzwinvnc) SRV - [2010.06.30 06:24:44 | 000,028,672 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Novell\ZENworks\bin\ZenworksWindowsService.exe -- (Novell ZENworks Agent Service) SRV - [2010.06.29 00:12:10 | 000,258,048 | ---- | M] () [On_Demand | Stopped] -- D:\oracle\ora10g_db64\BIN\TNSLSNR.exe -- (OracleOraDb10g_home1TNSListener) SRV - [2010.06.25 11:33:28 | 000,032,768 | ---- | M] (Oracle Corporation) [Disabled | Stopped] -- D:\oracle\ora10g_db64\BIN\nmesrvc.exe -- (OracleDBConsolelocal10) SRV - [2010.06.24 14:28:12 | 000,069,120 | ---- | M] (Oracle) [On_Demand | Stopped] -- D:\oracle\ora10g_db64\BIN\isqlplussvc.exe -- (OracleOraDb10g_home1iSQL*Plus) SRV - [2010.04.27 15:42:04 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60) SRV - [2010.04.15 09:42:06 | 002,533,400 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R) SRV - [2010.04.15 09:42:04 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R) SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.10 11:01:38 | 000,060,928 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\InstallFilterService.exe -- (InstallFilterService) SRV - [2009.10.14 17:37:42 | 000,245,760 | ---- | M] (Novell, Inc) [Auto | Stopped] -- C:\Program Files (x86)\Novell\CASA\bin\micasad.exe -- (Novell Identity Store) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2004.06.15 14:29:42 | 000,380,928 | ---- | M] (RealVNC Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.01.17 04:28:58 | 000,088,152 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys -- (NCIOCTL) DRV:64bit: - [2012.01.17 04:28:58 | 000,031,320 | ---- | M] (Novell, Inc.) [Kernel | System | Running] -- C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys -- (NICM) DRV:64bit: - [2012.01.17 04:28:56 | 000,119,896 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncrecognizer.sys -- (NCRecognizer) DRV:64bit: - [2012.01.17 04:28:56 | 000,112,216 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncfilter.sys -- (NCFilter) DRV:64bit: - [2012.01.17 04:28:56 | 000,108,632 | ---- | M] () [File_System | Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys -- (NCFSD) DRV:64bit: - [2012.01.17 04:28:56 | 000,026,200 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncuncfilter.sys -- (NCUncFilter) DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.05 18:58:25 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2010.12.21 15:04:06 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm) DRV:64bit: - [2010.12.21 15:04:06 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:64bit: - [2010.12.21 13:47:38 | 000,125,296 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.09.22 20:19:02 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss) DRV:64bit: - [2010.08.16 22:59:58 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA) DRV:64bit: - [2010.08.01 11:39:16 | 000,018,480 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport) DRV:64bit: - [2010.08.01 11:39:12 | 000,080,944 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:64bit: - [2010.08.01 11:39:10 | 000,068,656 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:64bit: - [2010.08.01 11:37:24 | 000,031,792 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd) DRV:64bit: - [2010.08.01 11:37:14 | 000,030,256 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:64bit: - [2010.08.01 10:39:10 | 000,038,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:64bit: - [2010.08.01 08:18:24 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:64bit: - [2010.08.01 08:18:24 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:64bit: - [2010.06.21 14:07:38 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.06.21 13:07:24 | 000,304,760 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:64bit: - [2010.04.06 00:37:42 | 000,301,232 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R) DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA) DRV:64bit: - [2010.01.18 06:56:26 | 000,026,160 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler) DRV:64bit: - [2010.01.18 06:56:26 | 000,021,040 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdfltn.sys -- (stdflt) DRV:64bit: - [2010.01.11 08:49:06 | 000,321,576 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl) DRV:64bit: - [2009.11.03 15:40:44 | 000,038,440 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cvusbdrv.sys -- (cvusbdrv) DRV:64bit: - [2009.09.17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009.09.15 10:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.08 15:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb) DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE) DRV:64bit: - [2008.09.26 18:02:36 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2008.06.04 12:14:00 | 000,032,240 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PBADRV.SYS -- (PBADRV) DRV:64bit: - [2007.01.17 14:32:00 | 000,015,360 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Spyder2.sys -- (Spyder2) DRV - [2010.04.27 15:41:34 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2010.03.17 23:34:36 | 000,068,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- D:\Programme\VS2010\Team Tools\Performance Tools\x64\VSPerfDrv100.sys -- (VSPerfDrv100) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2604146 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.orbitdownloader.com IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7D 12 02 3E 54 9E CC 01 [binary data] IE - HKU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "HotSpot International Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2604146&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/" FF - prefs.js..extensions.enabledItems: VMwareVMRC@vmware.com:2.5.0.122581 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {15756614-ffb8-498b-b961-bce537ea94fe}:0.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.4.0024 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:1.0.0 FF - prefs.js..extensions.enabledItems: {0002ee26-8c11-49eb-9cdf-56eeffef664f}:2.6.0.15 FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties" FF - prefs.js..network.proxy.autoconfig_url: "hxxp://tecnet/proxy.pac" FF - prefs.js..network.proxy.backup.ftp: "proxyib.ib" FF - prefs.js..network.proxy.backup.ftp_port: 80 FF - prefs.js..network.proxy.backup.gopher: "proxyib.ib" FF - prefs.js..network.proxy.backup.gopher_port: 80 FF - prefs.js..network.proxy.backup.socks: "proxyib.ib" FF - prefs.js..network.proxy.backup.socks_port: 80 FF - prefs.js..network.proxy.backup.ssl: "proxyib.ib" FF - prefs.js..network.proxy.backup.ssl_port: 80 FF - prefs.js..network.proxy.ftp: "proxyib.ib" FF - prefs.js..network.proxy.ftp_port: 80 FF - prefs.js..network.proxy.gopher: "proxyib.ib" FF - prefs.js..network.proxy.gopher_port: 80 FF - prefs.js..network.proxy.http: "proxyib.ib" FF - prefs.js..network.proxy.http_port: 80 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, 172.*" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "proxyib.ib" FF - prefs.js..network.proxy.socks_port: 80 FF - prefs.js..network.proxy.ssl: "proxyib.ib" FF - prefs.js..network.proxy.ssl_port: 80 FF - prefs.js..network.proxy.type: 4 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.3: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.3: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@novell.com/iPrint: C:\Windows\SysWOW64 [2012.03.01 16:25:34 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: N:\FIREFOX.36\COMPONENTS 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: N:\FIREFOX.36\PLUGINS 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD [2011.03.22 15:42:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 12:38:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.22 16:33:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011.03.22 15:42:13 | 000,000,000 | ---D | M] [2011.09.05 13:40:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Extensions [2012.02.21 16:23:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions [2012.01.08 13:30:31 | 000,000,000 | ---D | M] (HotSpot International Community Toolbar) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{0002ee26-8c11-49eb-9cdf-56eeffef664f} [2011.09.05 13:45:48 | 000,000,000 | ---D | M] (LocalLink) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{15756614-ffb8-498b-b961-bce537ea94fe} [2011.09.05 13:45:48 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.12.26 11:38:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.09.05 13:45:50 | 000,000,000 | ---D | M] (Anywhere Application Sharing for Firefox 4) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{EDEDFCDD-FBAC-4956-AC31-FD5604B6ECAE} [2011.12.09 01:47:51 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\2020Player_IKEA@2020Technologies.com [2011.09.05 13:45:43 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\DTToolbar@toolbarnet.com [2011.09.05 13:45:46 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\engine@conduit.com [2012.02.04 22:38:07 | 000,000,000 | ---D | M] ("VWC Cocoon") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\firefox-support@vworldc.com [2011.09.05 13:45:46 | 000,000,000 | ---D | M] (VMware Remote Console Plug-in) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com [2010.04.21 20:07:06 | 000,000,945 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\searchplugins\conduit.xml [2011.12.23 12:00:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.02.17 12:38:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.01.28 15:53:01 | 000,171,320 | ---- | M] (Cisco WebEx LLC) -- C:\Program Files (x86)\mozilla firefox\plugins\npatgpc.dll [2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.08.31 14:36:16 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll [2012.02.17 12:38:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.17 12:38:17 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.17 12:38:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.02.17 12:38:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.17 12:38:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.17 12:38:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found O2 - BHO: (HotSpot International Toolbar) - {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKLM\..\Toolbar: (HotSpot International Toolbar) - {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\..\Toolbar\WebBrowser: (HotSpot International Toolbar) - {0002EE26-8C11-49EB-9CDF-56EEFFEF664F} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4:64bit: - HKLM..\Run: [iPrint Event Monitor] C:\Windows\SysNative\iprntlgn.exe (Novell, Inc.) O4:64bit: - HKLM..\Run: [iPrint Tray] C:\Windows\SysNative\iprntctl.exe (Novell, Inc.) O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe () O4:64bit: - HKLM..\Run: [NWTRAY] C:\Windows\SysNative\nwtray.exe () O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation) O4 - HKLM..\Run: [NalView] C:\Program Files (x86)\Novell\ZENworks\bin\NalView.exe (Novell, Inc.) O4 - HKLM..\Run: [VMware hqtray] C:\Program Files (x86)\VMware\VMware Player\hqtray.exe (VMware, Inc.) O4 - HKLM..\Run: [ZenNotifyIcon] C:\Program Files (x86)\Novell\ZENworks\bin\ZenNotifyIcon.exe (Novell, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Psi.lnk = D:\Programme\PSI\Psi.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioradmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioruser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enableinstallerdetection = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enablelua = 0 O7 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - CC:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {A64DBFEB-F36F-4E47-8A2A-39308CFABEB9} https://www.anywhereconference.com/plugins/IE/ANWShare.cab?2,7,0,16 (msScreener Class) O16 - DPF: {B94C2238-346E-4C5E-9B36-8CC627F35574} Reg Error: Key error. (VMware Remote Console Plug-in 2.5.0.00000) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inform-ac.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A8F59A4-D4DB-44F3-AD57-E2CE55950B38}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LCredMgr: DllName - (C:\Program Files\Novell\CASA\bin\lcredmgr.dll) - C:\Program Files\Novell\CASA\Bin\lcredmgr.dll () O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock) O28:64bit: - HKLM ShellExecuteHooks: {763370C4-268E-4308-A60C-D8DA0342BE32} - C:\Program Files (x86)\Novell\ZENworks\bin\NalShell.dll (Novell, Inc.) O30:64bit: - LSA: Authentication Packages - (ZenV1_0) - C:\Windows\SysNative\ZenV1_0.dll (Novell, Inc.) O30:64bit: - LSA: Authentication Packages - (ncv1_0) - C:\Windows\SysNative\ncv1_0.dll () O30 - LSA: Authentication Packages - (ZenV1_0) - File not found O30 - LSA: Authentication Packages - (ncv1_0) - File not found O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{fc6e511f-4ab4-11e1-8b0a-1c659d014698}\Shell - "" = AutoRun O33 - MountPoints2\{fc6e511f-4ab4-11e1-8b0a-1c659d014698}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{fc6e512d-4ab4-11e1-8b0a-1c659d014698}\Shell - "" = AutoRun O33 - MountPoints2\{fc6e512d-4ab4-11e1-8b0a-1c659d014698}\Shell\AutoRun\command - "" = G:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) MsConfig:64bit - State: "bootini" - Reg Error: Key error. SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.VMnc - C:\Windows\SysWow64\vmnc.dll (VMware, Inc.) CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2012.03.02 00:37:06 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\agruett.E6510-AGRUETT\Desktop\OTL.exe [2012.03.01 16:43:28 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell [2012.02.17 12:36:35 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\Sql [2012.02.14 12:41:10 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\GF-Präsentationen [2012.02.14 11:30:31 | 000,055,296 | ---- | C] (Novell, Inc.) -- C:\Windows\SysNative\iprntsrv.exe [2012.02.14 11:30:31 | 000,029,184 | ---- | C] (Novell, Inc.) -- C:\Windows\SysNative\iprntWinCredMan.dll [2012.02.14 11:30:31 | 000,026,112 | ---- | C] (Novell, Inc.) -- C:\Windows\SysWow64\iprntWinCredMan.dll [2012.02.08 20:50:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2012.02.07 10:43:47 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\INFORM proposal [2012.02.06 12:48:09 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\STD [2012.02.02 17:52:32 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\DUS [2011.03.23 13:30:57 | 000,536,576 | ---- | C] (Microsoft) -- C:\Program Files (x86)\MSEfor64BitAnyCPUGedöns.exe [4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp files -> C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.02 00:35:50 | 000,725,468 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.03.02 00:35:50 | 000,151,824 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.03.02 00:31:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.02 00:31:15 | 2095,443,967 | -HS- | M] () -- C:\hiberfil.sys [2012.03.02 00:27:54 | 000,877,050 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.03.02 00:24:33 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.02 00:24:25 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2012.03.01 23:55:06 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\agruett.E6510-AGRUETT\Desktop\OTL.exe [2012.03.01 22:58:06 | 000,001,051 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jag79366.exe.lnk [2012.03.01 22:48:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.01 16:53:14 | 000,000,106 | ---- | M] () -- C:\Windows\WPCMAPI.INI [2012.03.01 16:39:32 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.01 16:39:32 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.01 11:23:26 | 015,288,401 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\FSG.design [2012.02.28 15:20:15 | 000,002,086 | -H-- | M] () -- C:\Users\agruett.E6510-AGRUETT\Documents\Default.rdp [2012.02.21 15:38:20 | 000,137,215 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB2.design [2012.02.21 15:38:14 | 000,093,665 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB1.design [2012.02.21 15:38:00 | 000,256,207 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB.design [2012.02.21 09:06:38 | 000,492,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.02.14 12:37:31 | 000,208,630 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\KWI AIRPORT W COLOR.JPG [2012.02.08 20:50:58 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2012.02.08 10:24:48 | 000,343,091 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\tumblr_ly0civznuG1rn5gmlo1_r1_500.jpg [2012.02.02 21:46:08 | 000,055,296 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntsrv.exe [2012.02.02 21:45:28 | 000,029,184 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntWinCredMan.dll [2012.02.02 21:45:22 | 000,026,112 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntWinCredMan.dll [2012.02.02 12:34:34 | 000,041,344 | ---- | M] () -- C:\Windows\SysNative\drivers\nipplpt.sys [2012.02.02 12:34:32 | 001,865,816 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nipplib.dll [2012.02.02 12:34:32 | 001,591,896 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nipplib.dll [2012.02.02 12:34:32 | 000,790,864 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\ienipp.ocx [2012.02.02 12:34:32 | 000,533,840 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\ienipp.ocx [2012.02.02 12:34:32 | 000,254,352 | ---- | M] () -- C:\Windows\SysWow64\npnipp.dll [2012.02.02 12:34:32 | 000,177,240 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nippnt.dll [2012.02.02 12:34:32 | 000,109,144 | ---- | M] (Novell Inc.) -- C:\Windows\SysWow64\npnisp.dll [2012.02.02 12:34:32 | 000,100,952 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntcmd.exe [2012.02.02 12:34:32 | 000,080,472 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntzip.dll [2012.02.02 12:34:32 | 000,080,472 | ---- | M] () -- C:\Windows\SysNative\nipplpte.exe [2012.02.02 12:34:32 | 000,072,280 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntlgn.exe [2012.02.02 12:34:32 | 000,072,280 | ---- | M] () -- C:\Windows\SysNative\icapture.exe [2012.02.02 12:34:32 | 000,070,744 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntzip.dll [2012.02.02 12:34:32 | 000,069,720 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntlgn.exe [2012.02.02 12:34:32 | 000,068,184 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntctl.exe [2012.02.02 12:34:32 | 000,066,136 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntctl.exe [2012.02.02 12:34:32 | 000,065,112 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntcfg.exe [2012.02.02 12:34:32 | 000,064,088 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntcfg.exe [2012.02.02 12:34:32 | 000,052,312 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nippcl32.dll [2012.02.02 12:34:32 | 000,048,216 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nippcl32.dll [2012.02.02 12:34:32 | 000,040,536 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntcmd.exe [2012.02.02 12:34:32 | 000,030,296 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntzppd.dll [2012.02.02 12:34:32 | 000,029,272 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nipplgex.dll [2012.02.02 12:34:32 | 000,028,248 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntzppd.dll [2012.02.02 12:34:32 | 000,027,224 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nipplgex.dll [4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp files -> C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.01 22:58:06 | 000,001,051 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jag79366.exe.lnk [2012.03.01 11:23:25 | 015,288,401 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\FSG.design [2012.02.21 15:38:20 | 000,137,215 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB2.design [2012.02.21 15:38:14 | 000,093,665 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB1.design [2012.02.21 15:38:00 | 000,256,207 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB.design [2012.02.14 12:37:31 | 000,208,630 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\KWI AIRPORT W COLOR.JPG [2012.02.08 20:50:58 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2012.02.08 17:43:39 | 022,415,876 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\Bestand_farbe_o_xref.dwg [2012.02.08 10:24:48 | 000,343,091 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\tumblr_ly0civznuG1rn5gmlo1_r1_500.jpg [2012.01.17 04:28:58 | 001,832,536 | ---- | C] () -- C:\Windows\SysWow64\noveap.dll [2012.01.17 04:28:58 | 000,908,376 | ---- | C] () -- C:\Windows\SysWow64\ncnetprovider.dll [2012.01.17 04:28:58 | 000,665,176 | ---- | C] () -- C:\Windows\SysWow64\ncloginui.dll [2012.01.17 04:28:58 | 000,230,488 | ---- | C] () -- C:\Windows\SysWow64\nwshlxnt.dll [2012.01.17 04:28:58 | 000,185,944 | ---- | C] () -- C:\Windows\SysWow64\lgnwnt32.dll [2012.01.17 04:28:58 | 000,156,760 | ---- | C] () -- C:\Windows\SysWow64\mapbase.dll [2012.01.17 04:28:58 | 000,092,760 | ---- | C] () -- C:\Windows\SysWow64\nclangid.dll [2012.01.17 04:28:58 | 000,026,200 | ---- | C] () -- C:\Windows\SysWow64\loginw32.exe [2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Woodwinds [2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Woodwind [2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Widgets [2011.09.05 13:34:54 | 000,007,657 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\Resmon.ResmonCfg [2011.09.05 13:34:54 | 000,000,000 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\debuggee.mdmp [2011.09.05 13:34:54 | 000,000,000 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\{8ADD5CC7-9401-4EEA-9E88-C395B5AEAADB} [2011.08.25 21:23:12 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe [2011.08.25 21:23:12 | 000,001,332 | ---- | C] () -- C:\Windows\unins000.dat [2011.06.30 21:01:36 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll [2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Workflows [2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\designjet [2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\business-inkjet [2011.06.14 07:45:01 | 000,000,012 | RH-- | C] () -- C:\ProgramData\vhosts [2011.06.14 07:42:45 | 000,000,000 | ---- | C] () -- C:\ProgramData\WebServer [2011.06.14 07:42:45 | 000,000,000 | ---- | C] () -- C:\ProgramData\Trance Pad [2011.03.05 19:06:07 | 000,000,086 | ---- | C] () -- C:\Windows\EmperorEdit.INI [2011.03.05 19:03:28 | 000,000,150 | ---- | C] () -- C:\Windows\Sierra.ini [2011.03.01 15:17:01 | 000,000,141 | ---- | C] () -- C:\Windows\ODBC.INI [2011.03.01 15:14:14 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.02.25 17:48:06 | 000,000,000 | ---- | C] () -- C:\Windows\gsrthubgui.INI [2011.01.07 19:13:06 | 000,155,700 | ---- | C] () -- C:\Windows\SysWow64\ODMA32.DLL [2010.11.30 10:58:34 | 000,254,352 | ---- | C] () -- C:\Windows\SysWow64\npnipp.dll [2010.11.29 16:06:42 | 000,000,000 | ---- | C] () -- C:\Windows\gsrtstaffgui.INI [2010.11.19 11:13:26 | 000,186,400 | ---- | C] () -- C:\Windows\SysWow64\ANWShare25.dll [2010.11.17 12:31:23 | 000,000,000 | ---- | C] () -- C:\Windows\gsrtstandsgui.INI [2010.11.14 22:23:41 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI [2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT [2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT [2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT [2010.11.08 17:19:27 | 000,000,106 | ---- | C] () -- C:\Windows\WPCMAPI.INI [2010.10.06 10:43:40 | 000,222,240 | ---- | C] () -- C:\Windows\SysWow64\VersionChecker.dll [2010.09.06 16:34:30 | 000,862,962 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.09.01 13:12:03 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2010.08.31 13:51:19 | 000,080,368 | ---- | C] () -- C:\Windows\SysWow64\pbadrvdll.dll ========== LOP Check ========== [2012.03.01 18:34:47 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\.oit [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Atari [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Autodesk [2012.01.21 19:32:05 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2 [2012.01.19 00:07:40 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1 [2012.01.18 13:06:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1 [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DAEMON Tools Lite [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DVDVideoSoftIEHelpers [2011.11.17 20:12:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\elsterformular [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\eTeks [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FILEminimizer [2011.12.26 11:38:03 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FileZilla [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GHISLER [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gnupg [2011.12.09 12:24:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GrabPro [2012.01.18 21:38:38 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gtk-2.0 [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\JAM Software [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Nikon [2012.03.01 16:43:28 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell [2012.02.21 16:23:17 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Orbit [2011.09.15 11:58:46 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Passolo Demo [2011.12.09 12:15:14 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\ProgSense [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Scilab [2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\SQL Developer [2011.09.05 12:39:21 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Stardock [2011.09.05 13:00:12 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Subversion [2011.06.07 13:08:06 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\webex [2010.08.31 08:56:07 | 000,000,000 | ---D | M] -- C:\Users\IMG\AppData\Roaming\WirelessManager [2011.08.25 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\mcarell\AppData\Roaming\Stardock [2011.09.05 12:16:25 | 000,000,000 | ---D | M] -- C:\Users\notbremse\AppData\Roaming\Stardock [2010.08.31 14:36:37 | 000,000,000 | ---D | M] -- C:\Users\poldy\AppData\Roaming\Foxit [2010.09.02 10:49:56 | 000,000,000 | ---D | M] -- C:\Users\poldy\AppData\Roaming\GHISLER [2012.01.05 17:05:55 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2012.03.01 18:34:47 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\.oit [2011.09.05 13:40:29 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Adobe [2011.11.10 14:41:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Apple Computer [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Atari [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Autodesk [2012.01.21 19:32:05 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2 [2012.01.19 00:07:40 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1 [2012.01.18 13:06:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1 [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DAEMON Tools Lite [2011.10.22 21:50:27 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\dvdcss [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DVDVideoSoftIEHelpers [2011.11.17 20:12:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\elsterformular [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\eTeks [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FILEminimizer [2011.12.26 11:38:03 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FileZilla [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GHISLER [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gnupg [2011.12.09 12:24:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GrabPro [2012.01.18 21:38:38 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gtk-2.0 [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Identities [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\InstallShield [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Intel [2011.09.05 12:39:15 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Intel Corporation [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\JAM Software [2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft [2010.11.17 14:51:55 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Macromedia [2009.07.14 08:45:37 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Media Center Programs [2012.01.31 08:58:05 | 000,000,000 | --SD | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft Corporation [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft FxCop [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Nikon [2012.03.01 16:43:28 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell [2012.02.21 16:23:17 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Orbit [2011.09.15 11:58:46 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Passolo Demo [2011.12.09 12:15:14 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\ProgSense [2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Scilab [2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\SQL Developer [2011.09.05 12:39:21 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Stardock [2011.09.05 13:00:12 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Subversion [2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\TortoiseSVN [2011.11.07 11:24:34 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\vlc [2012.02.29 13:20:09 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\VMware [2011.06.07 13:08:06 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\webex [2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2007.05.04 10:10:38 | 001,634,304 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\mysqldump.exe [2002.11.12 18:07:00 | 000,126,976 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\pageant.exe [2006.02.13 15:55:18 | 000,290,816 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\plink.exe [2006.03.28 17:51:00 | 000,348,160 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\pscp.exe [2006.03.28 17:50:00 | 000,339,968 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\psftp.exe [2006.03.28 17:50:00 | 000,499,712 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\putty.exe [2002.11.12 18:07:00 | 000,159,744 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\puttygen.exe [2011.06.07 15:49:30 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2010.11.10 11:32:20 | 000,405,504 | R--- | M] (Acresso Software Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}\ARPPRODUCTICON.exe [2012.01.20 14:37:28 | 000,010,134 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{559D2B32-5066-4762-A2F2-52831AC6F67B}\ARPPRODUCTICON.exe [2011.08.18 12:35:49 | 000,004,710 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}\_294823.exe [2011.06.14 07:45:41 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe [2010.11.10 11:32:11 | 000,365,322 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{AF7E4468-E364-4991-BC2A-6E8293E1055B}\ARPPRODUCTICON.exe [2011.08.17 14:17:51 | 000,010,134 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe [2008.10.10 10:38:52 | 000,069,632 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmplayer-service.exe [2008.10.10 10:38:14 | 001,773,568 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmware-remotemks.exe [2008.10.10 10:43:58 | 003,190,784 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmware-vmrc.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTOR.SYS > [2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys [2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_05602dde0a28e7f4\iaStor.sys < MD5 for: IASTORV.SYS > [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FD268286 < End of report > |
|
02.03.2012, 01:21
| #2 |
| | Ihr system wird aus sicherheitsgründen blockiert ... und hier die
__________________Extra.txt Code:
ATTFilter OTL Extras logfile created on: 02.03.2012 00:39:24 - Run 1
OTL by OldTimer - Version 3.2.34.0 Folder = C:\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,94 Gb Total Physical Memory | 6,88 Gb Available Physical Memory | 86,72% Memory free
15,87 Gb Paging File | 14,86 Gb Available in Paging File | 93,64% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 64,52 Gb Total Space | 3,87 Gb Free Space | 5,99% Space Free | Partition Type: NTFS
Drive D: | 400,47 Gb Total Space | 12,71 Gb Free Space | 3,17% Space Free | Partition Type: NTFS
Drive G: | 3,66 Gb Total Space | 3,59 Gb Free Space | 98,03% Space Free | Partition Type: FAT32
Computer Name: E6510-AGRUETT | User Name: agruett | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}" = UPEK TouchChip Fingerprint Reader
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{06C7075F-7474-460F-AE0E-1F5E20FEBC66}" = Exception Hunter 2
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{08044C1C-760B-45D1-81B7-10C690313012}" = CASA
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0C3831AA-1EA4-48D5-AAF1-24B27CBBBBF4}" = usermanagement-langs-x86_64
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{11107A2A-AD44-4BC8-ABB5-E88E63BCA785}" = Intel(R) Network Connections 14.8.43.0
"{183C740A-0406-380F-A235-2EC2F8A28D13}" = Microsoft Windows SDK MSHelp (30514)
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{22859902-78CE-40B0-9429-6FE7A00BBF85}" = NMAS Client
"{26A24AE4-039D-4CA4-87B4-2F86416023FF}" = Java(TM) 6 Update 23 (64-bit)
"{2D290715-B0FC-3898-9247-62F803A585DF}" = Microsoft Windows SDK for Windows 7 Redistributable Components for Common Tools (30514)
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{3938F3E6-53A0-4B93-A8B0-1C70D3768EED}" = .NET Reflector 6
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{45EF12B0-F531-4A2C-A1C0-6B1495698E30}" = TortoiseSVN 1.6.15.21042 (64 bit)
"{467D5E81-8349-4892-9E81-C3674ED8E451}" = Cisco Systems VPN Client 5.0.07.0290
"{4A8CE6D7-4D52-43B9-970B-03FC75FAD667}" = Microsoft SQL Server System CLR Types (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{50E9E32F-063A-412A-9627-553D5DA57C17}" = ESET NOD32 Antivirus
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{54031C8D-F80D-47BB-B3CA-5E9BD7750C27}" = NMAS Challenge Response Method
"{559D2B32-5066-4762-A2F2-52831AC6F67B}" = NICI (64 bit)
"{5783F2D7-9028-0409-0100-0060B0CE6BBA}" = DWG TrueView 2011
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0160230}" = Java(TM) SE Development Kit 6 Update 23 (64-bit)
"{662014D2-0450-37ED-ABAE-157C88127BEB}" = Visual Studio 2010 Prerequisites - English
"{68570626-1BF6-310B-AF69-6CD686C04AEA}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{70945452-9283-4C6D-BEE8-369A64F1DEC4}" = ANTS Memory Profiler 6
"{71119565-2A84-4B05-8CC2-A4749E5EA20F}" = Slik Subversion 1.6.11 (x64)
"{71F00D08-438B-474A-BBC7-AA25605AAE2F}" = Microsoft Redistributable Files (x64)
"{75EFBF78-ACF7-479F-98F8-3A6550D09546}" = ZENworks User Management
"{7F1B5849-D93C-4DB8-9568-E0E6D3C7A743}" = ANTS Performance Profiler 6
"{8125F749-B244-4F7B-811E-532165C5F2D5}" = Microsoft SQL Server 2008 RsFx Driver
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{84E30D73-E30F-3A02-BAA0-5353C04DD18A}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{88BAE373-00F4-3E33-828F-96E89E5E0CB9}" = Microsoft Visual Studio 2010 IntelliTrace Collection (x64)
"{89026002-A893-42D9-9E20-6829B844735E}" = Application Verifier (x64)
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8E80AF23-17B4-4611-B28E-68A114B23488}" = Dell ControlVault Host Components Installer 64Bit
"{8FF0ACBD-17A5-3637-95F4-D7C69723E2BF}" = Microsoft Visual Studio 2010 Performance Collection Tools - ENU
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0B0F02C-410B-3DE3-9740-EC4C3D902532}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{A2C55034-8DAF-3755-BA85-CC321707FE99}" = Microsoft Windows SDK for Visual Studio .NET 4.0 Framework Tools
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B0A5A6EE-F8BA-48B1-BB32-BAC17E96C2B4}" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64)
"{B35E92BA-9C6E-4C06-9435-7105DC915BCE}" = Novell ZENworks Remote Management
"{B7D0C3BC-CB39-3CA1-9295-A23A93994893}" = Microsoft Windows SDK for Windows 7 Redistributable Components for Windows Debugging Tools (30514)
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C0C690C8-F335-4BA4-A2AD-675EAD1DFA90}" = Microsoft SQL Server 2008 Setup Support Files
"{C3AF5BD8-30D5-41F5-AF61-705D98146B0F}" = Microsoft SQL Server 2008 Native Client
"{C44218B2-EC4D-4EB9-A3E3-F8F4A46927EC}" = MySQL Connector/ODBC 5.1
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{CCAFF072-4DDB-4846-963D-15F02A8E9472}" = Intel(R) PROSet/Wireless WiFi-Software
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA67488A-2689-4F10-B90F-D2F6977509D6}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{DBFC6AAE-DCCB-4C23-B01C-3EDDDC03298B}" = Debugging Tools for Windows (x64)
"{DE0248C8-0701-4132-95A5-9130D22B3A24}" = ANTS Profiler Visual Studio Add-in 1
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{F1C4B89A-8BF0-3D7C-8095-BAE412FBEA3F}" = Microsoft Windows SDK .NET Framework Tools (30514)
"{F3D7BBAA-7412-4388-B510-11E145D2C48B}" = Microsoft Web Platform Installer 3.0
"{F5079164-1DB9-3BDA-853B-F78AF67CE071}" = Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"{FE0D2049-AD64-418D-A2BD-5C60B940F27D}" = Novell CASA Authentication Token Client (x64)
"9512AA21B791B05A54E27065C45BBC417AB282DF" = Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"DWG TrueView 2011" = DWG TrueView 2011
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual J# 2.0 Redistributable Package - SE (x64)" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64)
"Novell Client for Windows" = Novell Client for Windows
"Novell iPrint Client" = Novell iPrint Client v05.78.00
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"ProInst" = Intel PROSet Wireless
"PROSetDX" = Intel(R) Network Connections 14.8.43.0
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"scilab-5.3.0 (64-bit)_is1" = scilab-5.3.0 (64-bit)
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04AB5C6A-CC57-40DC-8DD3-92F2CFAAC85A}" = ZENworks Agent System Update Module
"{05855322-BE43-41FE-B583-D3AE0C326D58}" = Microsoft Silverlight 4 SDK
"{07EF3970-F8E5-4A27-A5A3-230484D35026}" = Microsoft Expression Encoder 4
"{083C7BC0-C862-4963-9B13-E2AB80256B54}" = bundle-langs
"{08907D91-D8BB-4CF0-A563-571D3E95819A}" = ZENworks Version Information
"{08D605B4-DCD1-451F-ABD7-52E6BB868E4E}" = Microsoft Expression Design 4
"{0947D851-CD66-4F62-AF28-2A07AFE81119}" = ZENworks Agent Bundle Management
"{09A7FDFF-5C51-4008-9DCA-1D9F4F1C9432}" = ZENworks Image Management
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0E6925C6-F57A-44EB-8AC7-86827DACA79E}" = ZENworks Windows UI
"{0EC99F43-B66D-41ED-AF6F-B0E790F8BC04}" = inventory-langs
"{0FD23E02-2BFB-4BEC-8823-FE984F83F161}" = VMware Server Console
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{1250E27F-7AF5-46F3-962A-36CE75C65F32}" = Infragistics NetAdvantage WPF 2009.2
"{139E4D07-F58B-44B5-8429-D00C49679576}" = Novell ZENworks Adaptive Agent Help
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{1AB2E5D6-73D0-404F-9559-D9D0E00628D6}" = ZENworks Policy Libraries
"{1C997E1C-5CE9-4AF3-AAA9-DC65E6090827}" = Microsoft Expression Blend SDK for Silverlight 4
"{1D7FF152-070A-43B7-B079-739DBF1B8DB4}" = GroupWise
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{234F5FD0-7C56-D5AF-E46A-E00231D6D99F}" = Creeper World 2
"{256E7DAC-9BE8-494E-8DE7-7857BF96B774}" = Microsoft Expression Blend 3 SDK
"{25955A6C-B0C9-4EF7-A699-97D9E1320C21}" = ZENworks Agent Core Modules
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silverlight 4
"{292490BF-5CAF-47D2-8AB4-7E98EE80BD0A}" = zencore-agent-langs
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2B2B45B1-3CA0-4F8D-BBB3-AC77ED46A0FE}" = Dell Client System Update
"{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{398CE561-7E00-43F8-8AE3-DA3F0F579FB5}" = zennotifyicon-langs
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3ED67637-DB89-428B-94E3-4AE09D5AC739}" = ZENworks Agent Patch Management
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{40EDCEF4-2295-476F-939A-248DB43352AE}" = Bing Map App SDK Beta
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{48D8CFE8-8274-4388-B34F-C111E77B2E7F}" = ZENworks Remote Management
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C6D5779-A766-45DF-9938-D6F595A66F2B}" = Microsoft Expression Blend 4
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{5421E8BF-2208-46AD-BAC4-FC3946EEB351}" = ILMerge
"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010
"{55B177C3-B95C-4A73-BA95-1D99D6E14885}" = Microsoft Redistributable Files (x86)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57B5F8F3-3414-4635-A8DE-48F75982D32C}" = content-distribution-point-langs
"{59BB7F21-1987-4A1C-9DF3-82FEC6591C60}" = SlimDX SDK (June 2010)
"{5B38770A-2A5E-4EC6-82F4-5C52B1419ACA}" = primary-agent-langs
"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{5F8D931D-B230-47F3-A9C0-0C8CA459A332}" = Microsoft Expression Web 4
"{61132DB4-5BFA-4639-8C1D-21B7583FE23E}" = ZENworks Action Utilities
"{641E3749-55CD-DD82-8480-6C95C3A175BA}" = Creeper World 2 Demo
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6742BE3D-1A59-3BFD-BA20-2FDA866099B8}" = Microsoft Visual Studio 2010 Premium - ENU
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319
"{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}" = Oracle Data Provider for .NET Help
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6E48D296-3078-4070-9FE1-CE51AB1662D2}" = ZENworks Status Collection Point
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{781FC5D0-3E2D-4F93-8D5D-659C2CCFCE7A}" = ZENworks Policy Handlers
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7A25D130-4EC8-11E1-BEA4-B8AC6F97B88E}" = Google Earth
"{80262C7D-B649-4A5D-B539-F5221A4CF47F}" = patch-langs
"{80F7CA44-F3A5-4853-8BA6-DDF57CD4F078}" = Rosetta Stone Version 3
"{81CF9B71-3AD9-428B-8183-83A67930D9BA}" = ZENworks Primary Agent
"{81EF6BA3-91A9-4E91-87DF-8FE8C0C3D335}" = actions-langs
"{821DABD6-26F2-49E5-AE55-40A589ADBE6D}" = DER ERSTE KAISER: Aufstieg des Reichs der Mitte
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83D4BEDC-CBCD-4DFE-BA38-99A54E88123E}" = auth-satellite-server-langs
"{846D9AAD-EA7D-4126-9177-F874FD389BE4}" = Microsoft FxCop 1.35
"{85076DFF-7A17-3566-9CC0-488E6E6D4494}" = Microsoft Visual Web Developer 2010 Express - ENU
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{88A4F1FF-DA66-49F4-973C-A52828A47FE1}" = ZENworks Agent WinProxy Module
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B432EF1-84E2-4EC9-A1E7-657A927A681B}" = ZENworks Agent Asset Management Module
"{8FFC6175-D2C5-4FA7-91E8-E2A9431A5CDA}" = WCF RIA Services V1.0 for Visual Studio 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3
"{91A3F247-1325-4C98-B38B-305452125052}" = WinProxy-langs
"{9461535E-3818-4F01-89AD-7BDEEE88D1C0}" = Novell ZENworks Image-Safe Data Service
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9547FEAD-5D99-4E3B-9652-378F2AA29B34}" = ZENworks Agent Inventory Management
"{99038B98-A3C1-4E70-9993-F6077C05B5BD}" = ZENworks Content Distribution Point
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AC6DA44-ECD6-432D-B4F5-484B0ABF7BFC}" = ZENworks Imaging Server
"{9B3A1C97-A361-463E-8817-444F9F88CDFE}" = Microsoft Expression Blend SDK for .NET 4
"{9B6E7DAF-6DA8-4396-9FCD-4118CF2D1BE8}" = ZENworks Agent Policy Management
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A06FE62B-CEBC-4E94-AED8-92DCC33BC8EA}" = Microsoft Expression Studio 4
"{A4458FAA-FD92-4F27-8E85-9F289D8D18EB}" = ZENworks Agent Authentication Satellite Module
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAFE0B97-B9C7-4499-A2DC-55136FB928F2}" = Policy Action Handler Resources
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B434B5BB-C941-4520-86F2-87C14910AE09}" = Action Handler Resources
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BA8618CA-6093-479E-9F79-ABEA020957DE}" = ZENworks Action Handlers
"{BF127B80-CFD5-4379-9752-E8AF1A5D0141}" = Microsoft Expression Encoder 4 Screen Capture Codec
"{BF6BFEB7-6601-42B9-A773-896D221EA475}" = ZENworks Uninstaller
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{CA206913-EE9F-495F-AD43-032E5833EE13}" = AnkhSVN 2.1.8420.8
"{CA4CF3FF-A0B4-4C07-9B64-85FFEEABC77D}" = windows-desktop-langs-x86_64
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D2384E2B-F120-4AD1-A376-E94614B305DE}" = ZENworks Actions
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D2F28E39-9813-41D3-8EC9-BAADA38C426D}" = VMware Remote Console Plug-in
"{D92F029C-A937-4170-8075-FA39314C8F0C}" = remotemanagement-langs
"{DAA01565-832C-4E5B-99C2-E6F01D6DF404}" = novell-zenworks-patch-management-agent
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{E00D18BE-3FB4-415A-9CDA-8DB4550D1B29}" = assetmanagementmodule-langs
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3A9D466-BEA2-4A4A-A508-C78C6E41A6E8}" = status-collection-point-langs
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{F02DBC5D-33E3-45E9-B0F8-B7745229ED1C}" = NICI (Shared) U.S./Worldwide (128 bit) (2.7.6-1)
"{F049FD6B-22EE-4410-8556-AB2476CA3781}" = ZENworks Extensions Libraries
"{F0B0F46D-0483-4B95-A766-83167EE133E7}" = Policy Handler Resources
"{F0BC0F9E-C4A8-485C-93ED-424DB9EA3F75}" = Oracle Database 10g Express Edition
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F15AEACD-0973-4A4C-8F30-8B234D52F2E6}" = ZENworks Information Icon
"{F3260CBB-611A-4C46-B6AE-5A8A48011B8F}" = ZENworks Image-Safe Data Agent
"{F5993FCC-DF5D-4879-B70D-AA1F379C5C6B}" = Microsoft Expression Web 4 Service Pack 2
"{F6645011-F936-42E9-B787-CD8EC485FA20}" = policy-langs
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"7-Zip" = 7-Zip 9.20
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"AxCrypt" = AxCrypt (Nur Entfernen)
"Blend_4.0.20525.0" = Microsoft Expression Blend 4
"CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1" = Creeper World 2
"CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1" = Creeper World 2 Demo
"DAEMON Tools Lite" = DAEMON Tools Lite
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Design_7.0.20516.0" = Microsoft Expression Design 4
"ElsterFormular 12.4.0.7094p" = ElsterFormular
"eMule" = eMule
"Encoder_4.0.1639.0" = Microsoft Expression Encoder 4
"EngInSite Client for MySQL_is1" = EngInSite Client for MySQL 2.0.4.231
"ExpressionStudio_4.0.20525.0" = Microsoft Expression Studio 4
"Fences" = Fences
"FileZilla Client" = FileZilla Client 3.3.4.1
"FinePrint 2000" = FinePrint 2000
"Foxit Reader" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.37.426
"FreePDF_XP" = FreePDF (Remove only)
"Google Satellite Maps Retriever_is1" = Google Satellite Maps Retriever 6.80
"GPL Ghostscript 9.00" = GPL Ghostscript 9.00
"GSview 4.9" = GSview 4.9
"HijackThis" = HijackThis 2.0.2
"HotSpot_International Toolbar" = HotSpot International Toolbar
"InstallShield_{F0BC0F9E-C4A8-485C-93ED-424DB9EA3F75}" = Oracle Database 10g Express Edition
"JDownloader" = JDownloader
"Microsoft Visual Studio 2010 Premium - ENU" = Microsoft Visual Studio 2010 Premium - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Web Developer 2010 Express - ENU" = Microsoft Visual Web Developer 2010 Express - ENU
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Pandora's Box Trial" = MS Pandora's Box Trial Version
"Panzer Corps_is1" = Panzer Corps version 1.0
"Panzer Corps1.00" = Panzer Corps
"Passolo Demo" = Passolo Demo
"Postal 2_is1" = Portal 2
"Psi" = Psi (remove only)
"Qtel Mobile Broadband E180" = Qtel Mobile Broadband E180
"RealVNC_is1" = VNC 4.0
"Spyder2express" = Spyder2express
"StarCraft" = StarCraft
"StarCraft II" = StarCraft II
"Steamless Portal Pack" = Steamless Portal Pack
"SuperGet GS_is1" = SuperGet GS 4.05
"The Rosetta Stone" = The Rosetta Stone
"Titan Poker" = Titan Poker
"Totalcmd" = Total Commander (Remove or Repair)
"TRANSDAT_is1" = TRANSDAT
"TreeSize Free_is1" = TreeSize Free V2.4
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.9
"VMware_Player" = VMware Player
"Web_4.0.1303.0" = Microsoft Expression Web 4
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinMerge_is1" = WinMerge 2.12.4
"WinRAR archiver" = WinRAR
"WMS" = Windows NT Messaging
"Z" = Windows Z V1.0
"ZENworks" = Novell ZENworks
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 01.03.2012 05:22:57 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4072
Error - 01.03.2012 06:15:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Application Error | ID = 1000
Description = Faulting application name: splwow64.exe, version: 6.1.7601.17514,
time stamp: 0x4ce7b4c8 Faulting module name: dlxbuzim.dll, version: 0.3.0.0, time
stamp: 0x4a5d2d12 Exception code: 0xc0000005 Fault offset: 0x000000000005a7a9 Faulting
process id: 0x468 Faulting application start time: 0x01ccf79414c6ee8a Faulting application
path: C:\Windows\splwow64.exe Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\dlxbuzim.dll
Report
Id: 7edc2587-6387-11e1-a62f-1c659d014698
Error - 01.03.2012 11:13:12 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Novell Client System Tray Menu' could not
be shut down.
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15070
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15070
Error - 01.03.2012 19:35:47 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is not formatted
correctly. The malformed string is 19678. The first DWORD in the Data section contains
the index value to the malformed string while the second and third DWORDs in the
Data section contain the last valid index values.
Error - 01.03.2012 19:35:47 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.
Error - 01.03.2012 19:35:50 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is not formatted
correctly. The malformed string is 19678. The first DWORD in the Data section contains
the index value to the malformed string while the second and third DWORDs in the
Data section contain the last valid index values.
Error - 01.03.2012 19:41:47 | Computer Name = e6510-agruett.inform-ac.com | Source = System Restore | ID = 8193
Description =
[ System Events ]
Error - 01.03.2012 19:45:48 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068
< End of report >
und schonmal DANKE an alle die sich dafür Zeit nehmen. axel |
|
02.03.2012, 11:41
| #3 |
| /// Malware-holic   | Ihr system wird aus sicherheitsgründen blockiert hi,
__________________im abgesicherten modus mit netzwerk im betroffenen konto anmelden: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ |
|
| Themen zu Ihr system wird aus sicherheitsgründen blockiert |
| 4d36e972-e325-11ce-bfc1-08002be10318, alternate, antivirus, bho, bildschirm, blockiert, bonjour, conduit, desktop, error, eset nod32, firefox, flash player, format, google earth, home, hotspot, hotspot shield, langs, logfile, mozilla thunderbird, nvstor.sys, object, plug-in, registry, rundll, scan, searchscopes, server, software, starten, system, taskmanager, usb, version=1.0, virus, windows, wrapper |
Linear-Darstellung
