Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Ihr system wird aus sicherheitsgründen blockiert

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 02.03.2012, 01:18   #1
uxilator
 
Ihr system wird aus sicherheitsgründen blockiert - Standard

Ihr system wird aus sicherheitsgründen blockiert



Hallo zusammen,

habe mir gerade beim surfen mit Firefox anscheinend einen "lustigen" Virus eingefangen. Beim normalen starten blockiert direkt der Bildschirm mit einer Sicherheitswarnung und ich soll "Lösegeld" in Hohöe von 100 € bezahlen damit alles wieder gut wird. Der Taskmanager wird auch deaktiviert, kann zwar im abgesicherten Modus in der Registry wieder aktiviert werden, beim normalen Neustart ist er jedoch wieder futsch. Habe mal die OTL-Logs angehangen und bin für jede Hilfe äußerst dankbar.


OTL.txt
Code:
ATTFilter
OTL logfile created on: 02.03.2012 00:39:24 - Run 1
OTL by OldTimer - Version 3.2.34.0     Folder = C:\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 6,88 Gb Available Physical Memory | 86,72% Memory free
15,87 Gb Paging File | 14,86 Gb Available in Paging File | 93,64% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 64,52 Gb Total Space | 3,87 Gb Free Space | 5,99% Space Free | Partition Type: NTFS
Drive D: | 400,47 Gb Total Space | 12,71 Gb Free Space | 3,17% Space Free | Partition Type: NTFS
Drive G: | 3,66 Gb Total Space | 3,59 Gb Free Space | 98,03% Space Free | Partition Type: FAT32
 
Computer Name: E6510-AGRUETT | User Name: agruett | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.01 23:55:06 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Downloads\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.02.02 21:46:08 | 000,055,296 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\iprntsrv.exe -- (iprntsrv)
SRV:64bit: - [2012.01.17 04:28:58 | 000,019,544 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe -- (XTSvcMgr)
SRV:64bit: - [2011.01.12 16:44:02 | 000,042,360 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV:64bit: - [2011.01.12 16:41:42 | 000,810,144 | ---- | M] (ESET) [Auto | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn)
SRV:64bit: - [2010.08.16 22:59:52 | 000,263,168 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:64bit: - [2010.08.16 22:58:34 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2010.03.24 00:07:58 | 001,039,776 | ---- | M] (Broadcom Corporation) [Auto | Stopped] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service)
SRV:64bit: - [2010.03.24 00:07:58 | 000,031,136 | ---- | M] (Broadcom Corporation) [Auto | Stopped] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage)
SRV:64bit: - [2009.09.21 14:24:40 | 001,420,560 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2009.09.21 14:00:44 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.01.05 17:16:50 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.01.06 12:36:58 | 000,147,904 | ---- | M] (Red Gate Software Ltd.) [On_Demand | Stopped] -- D:\Programme\ANTZ\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe -- (ANTS Performance Profiler 6 Service)
SRV - [2011.01.06 12:36:57 | 000,168,896 | ---- | M] (Red Gate Software Ltd.) [On_Demand | Stopped] -- D:\Programme\ANTZ\ANTS Memory Profiler 6\RedGate.Memory.IISService.exe -- (ANTS Memory Profiler 6 Service)
SRV - [2010.11.22 23:50:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Stopped] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2010.11.05 22:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010.09.06 08:06:44 | 000,196,608 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\novell\zenworks\bin\ZENPreAgent.exe -- (ZENPreAgent)
SRV - [2010.08.01 11:38:46 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2010.08.01 11:38:32 | 000,334,384 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2010.08.01 11:38:28 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2010.08.01 10:39:16 | 000,539,184 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010.07.31 07:27:36 | 000,235,624 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.07.20 16:20:46 | 000,097,792 | ---- | M] () [Disabled | Stopped] -- d:\oracle\ora10g_db64\Bin\extjob.exe -- (OracleJobSchedulerLOCAL10)
SRV - [2010.07.20 16:20:26 | 076,156,416 | ---- | M] (Oracle Corporation) [On_Demand | Stopped] -- d:\oracle\ora10g_db64\bin\ORACLE.EXE -- (OracleServiceLOCAL10)
SRV - [2010.06.30 08:22:10 | 001,839,104 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe -- (nzwinvnc)
SRV - [2010.06.30 06:24:44 | 000,028,672 | ---- | M] (Novell, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Novell\ZENworks\bin\ZenworksWindowsService.exe -- (Novell ZENworks Agent Service)
SRV - [2010.06.29 00:12:10 | 000,258,048 | ---- | M] () [On_Demand | Stopped] -- D:\oracle\ora10g_db64\BIN\TNSLSNR.exe -- (OracleOraDb10g_home1TNSListener)
SRV - [2010.06.25 11:33:28 | 000,032,768 | ---- | M] (Oracle Corporation) [Disabled | Stopped] -- D:\oracle\ora10g_db64\BIN\nmesrvc.exe -- (OracleDBConsolelocal10)
SRV - [2010.06.24 14:28:12 | 000,069,120 | ---- | M] (Oracle) [On_Demand | Stopped] -- D:\oracle\ora10g_db64\BIN\isqlplussvc.exe -- (OracleOraDb10g_home1iSQL*Plus)
SRV - [2010.04.27 15:42:04 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2010.04.15 09:42:06 | 002,533,400 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010.04.15 09:42:04 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.10 11:01:38 | 000,060,928 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\InstallFilterService.exe -- (InstallFilterService)
SRV - [2009.10.14 17:37:42 | 000,245,760 | ---- | M] (Novell, Inc) [Auto | Stopped] -- C:\Program Files (x86)\Novell\CASA\bin\micasad.exe -- (Novell Identity Store)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2004.06.15 14:29:42 | 000,380,928 | ---- | M] (RealVNC Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.01.17 04:28:58 | 000,088,152 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys -- (NCIOCTL)
DRV:64bit: - [2012.01.17 04:28:58 | 000,031,320 | ---- | M] (Novell, Inc.) [Kernel | System | Running] -- C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys -- (NICM)
DRV:64bit: - [2012.01.17 04:28:56 | 000,119,896 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncrecognizer.sys -- (NCRecognizer)
DRV:64bit: - [2012.01.17 04:28:56 | 000,112,216 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncfilter.sys -- (NCFilter)
DRV:64bit: - [2012.01.17 04:28:56 | 000,108,632 | ---- | M] () [File_System | Auto | Stopped] -- C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys -- (NCFSD)
DRV:64bit: - [2012.01.17 04:28:56 | 000,026,200 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\ncuncfilter.sys -- (NCUncFilter)
DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.05 18:58:25 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2010.12.21 15:04:06 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2010.12.21 15:04:06 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2010.12.21 13:47:38 | 000,125,296 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.09.22 20:19:02 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2010.08.16 22:59:58 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010.08.01 11:39:16 | 000,018,480 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport)
DRV:64bit: - [2010.08.01 11:39:12 | 000,080,944 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2010.08.01 11:39:10 | 000,068,656 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2010.08.01 11:37:24 | 000,031,792 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2010.08.01 11:37:14 | 000,030,256 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2010.08.01 10:39:10 | 000,038,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2010.08.01 08:18:24 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2010.08.01 08:18:24 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2010.06.21 14:07:38 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.06.21 13:07:24 | 000,304,760 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2010.04.06 00:37:42 | 000,301,232 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R)
DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2010.01.18 06:56:26 | 000,026,160 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2010.01.18 06:56:26 | 000,021,040 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdfltn.sys -- (stdflt)
DRV:64bit: - [2010.01.11 08:49:06 | 000,321,576 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2009.11.03 15:40:44 | 000,038,440 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV:64bit: - [2009.09.17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.09.15 10:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.08 15:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV:64bit: - [2008.09.26 18:02:36 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2008.06.04 12:14:00 | 000,032,240 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PBADRV.SYS -- (PBADRV)
DRV:64bit: - [2007.01.17 14:32:00 | 000,015,360 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Spyder2.sys -- (Spyder2)
DRV - [2010.04.27 15:41:34 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2010.03.17 23:34:36 | 000,068,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- D:\Programme\VS2010\Team Tools\Performance Tools\x64\VSPerfDrv100.sys -- (VSPerfDrv100)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2604146
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.orbitdownloader.com
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7D 12 02 3E 54 9E CC 01  [binary data]
IE - HKU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "HotSpot International Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2604146&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/"
FF - prefs.js..extensions.enabledItems: VMwareVMRC@vmware.com:2.5.0.122581
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {15756614-ffb8-498b-b961-bce537ea94fe}:0.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.4.0024
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:1.0.0
FF - prefs.js..extensions.enabledItems: {0002ee26-8c11-49eb-9cdf-56eeffef664f}:2.6.0.15
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"
FF - prefs.js..network.proxy.autoconfig_url: "hxxp://tecnet/proxy.pac"
FF - prefs.js..network.proxy.backup.ftp: "proxyib.ib"
FF - prefs.js..network.proxy.backup.ftp_port: 80
FF - prefs.js..network.proxy.backup.gopher: "proxyib.ib"
FF - prefs.js..network.proxy.backup.gopher_port: 80
FF - prefs.js..network.proxy.backup.socks: "proxyib.ib"
FF - prefs.js..network.proxy.backup.socks_port: 80
FF - prefs.js..network.proxy.backup.ssl: "proxyib.ib"
FF - prefs.js..network.proxy.backup.ssl_port: 80
FF - prefs.js..network.proxy.ftp: "proxyib.ib"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.gopher: "proxyib.ib"
FF - prefs.js..network.proxy.gopher_port: 80
FF - prefs.js..network.proxy.http: "proxyib.ib"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, 172.*"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxyib.ib"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "proxyib.ib"
FF - prefs.js..network.proxy.ssl_port: 80
FF - prefs.js..network.proxy.type: 4
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.3: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.3: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@novell.com/iPrint: C:\Windows\SysWOW64 [2012.03.01 16:25:34 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: N:\FIREFOX.36\COMPONENTS
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: N:\FIREFOX.36\PLUGINS
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD [2011.03.22 15:42:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 12:38:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.22 16:33:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011.03.22 15:42:13 | 000,000,000 | ---D | M]
 
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Extensions
[2012.02.21 16:23:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions
[2012.01.08 13:30:31 | 000,000,000 | ---D | M] (HotSpot International Community Toolbar) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{0002ee26-8c11-49eb-9cdf-56eeffef664f}
[2011.09.05 13:45:48 | 000,000,000 | ---D | M] (LocalLink) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{15756614-ffb8-498b-b961-bce537ea94fe}
[2011.09.05 13:45:48 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.12.26 11:38:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.09.05 13:45:50 | 000,000,000 | ---D | M] (Anywhere Application Sharing for Firefox 4) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\{EDEDFCDD-FBAC-4956-AC31-FD5604B6ECAE}
[2011.12.09 01:47:51 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\2020Player_IKEA@2020Technologies.com
[2011.09.05 13:45:43 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\DTToolbar@toolbarnet.com
[2011.09.05 13:45:46 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\engine@conduit.com
[2012.02.04 22:38:07 | 000,000,000 | ---D | M] ("VWC Cocoon") -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\firefox-support@vworldc.com
[2011.09.05 13:45:46 | 000,000,000 | ---D | M] (VMware Remote Console Plug-in) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com
[2010.04.21 20:07:06 | 000,000,945 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\searchplugins\conduit.xml
[2011.12.23 12:00:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.02.17 12:38:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.01.28 15:53:01 | 000,171,320 | ---- | M] (Cisco WebEx LLC) -- C:\Program Files (x86)\mozilla firefox\plugins\npatgpc.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.08.31 14:36:16 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.02.17 12:38:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.17 12:38:17 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.17 12:38:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.17 12:38:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.17 12:38:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.17 12:38:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found
O2 - BHO: (HotSpot International Toolbar) - {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (HotSpot International Toolbar) - {0002ee26-8c11-49eb-9cdf-56eeffef664f} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\..\Toolbar\WebBrowser: (HotSpot International Toolbar) - {0002EE26-8C11-49EB-9CDF-56EEFFEF664F} - C:\Program Files (x86)\HotSpot_International\tbHotS.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [iPrint Event Monitor] C:\Windows\SysNative\iprntlgn.exe (Novell, Inc.)
O4:64bit: - HKLM..\Run: [iPrint Tray] C:\Windows\SysNative\iprntctl.exe (Novell, Inc.)
O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4:64bit: - HKLM..\Run: [NWTRAY] C:\Windows\SysNative\nwtray.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKLM..\Run: [NalView] C:\Program Files (x86)\Novell\ZENworks\bin\NalView.exe (Novell, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Program Files (x86)\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKLM..\Run: [ZenNotifyIcon] C:\Program Files (x86)\Novell\ZENworks\bin\ZenNotifyIcon.exe (Novell, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Psi.lnk = D:\Programme\PSI\Psi.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioradmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioruser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enableinstallerdetection = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enablelua = 0
O7 - HKU\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - CC:\Program Files (x86)\VMware\VMware Server\x64\vsocklib.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {A64DBFEB-F36F-4E47-8A2A-39308CFABEB9} https://www.anywhereconference.com/plugins/IE/ANWShare.cab?2,7,0,16 (msScreener Class)
O16 - DPF: {B94C2238-346E-4C5E-9B36-8CC627F35574} Reg Error: Key error. (VMware Remote Console Plug-in 2.5.0.00000)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inform-ac.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A8F59A4-D4DB-44F3-AD57-E2CE55950B38}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LCredMgr: DllName - (C:\Program Files\Novell\CASA\bin\lcredmgr.dll) - C:\Program Files\Novell\CASA\Bin\lcredmgr.dll ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O28:64bit: - HKLM ShellExecuteHooks: {763370C4-268E-4308-A60C-D8DA0342BE32} - C:\Program Files (x86)\Novell\ZENworks\bin\NalShell.dll (Novell, Inc.)
O30:64bit: - LSA: Authentication Packages - (ZenV1_0) - C:\Windows\SysNative\ZenV1_0.dll (Novell, Inc.)
O30:64bit: - LSA: Authentication Packages - (ncv1_0) - C:\Windows\SysNative\ncv1_0.dll ()
O30 - LSA: Authentication Packages - (ZenV1_0) -  File not found
O30 - LSA: Authentication Packages - (ncv1_0) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{fc6e511f-4ab4-11e1-8b0a-1c659d014698}\Shell - "" = AutoRun
O33 - MountPoints2\{fc6e511f-4ab4-11e1-8b0a-1c659d014698}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{fc6e512d-4ab4-11e1-8b0a-1c659d014698}\Shell - "" = AutoRun
O33 - MountPoints2\{fc6e512d-4ab4-11e1-8b0a-1c659d014698}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.VMnc - C:\Windows\SysWow64\vmnc.dll (VMware, Inc.)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.02 00:37:06 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\agruett.E6510-AGRUETT\Desktop\OTL.exe
[2012.03.01 16:43:28 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell
[2012.02.17 12:36:35 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\Sql
[2012.02.14 12:41:10 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\GF-Präsentationen
[2012.02.14 11:30:31 | 000,055,296 | ---- | C] (Novell, Inc.) -- C:\Windows\SysNative\iprntsrv.exe
[2012.02.14 11:30:31 | 000,029,184 | ---- | C] (Novell, Inc.) -- C:\Windows\SysNative\iprntWinCredMan.dll
[2012.02.14 11:30:31 | 000,026,112 | ---- | C] (Novell, Inc.) -- C:\Windows\SysWow64\iprntWinCredMan.dll
[2012.02.08 20:50:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2012.02.07 10:43:47 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\INFORM proposal
[2012.02.06 12:48:09 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\STD
[2012.02.02 17:52:32 | 000,000,000 | ---D | C] -- C:\Users\agruett.E6510-AGRUETT\Desktop\DUS
[2011.03.23 13:30:57 | 000,536,576 | ---- | C] (Microsoft) -- C:\Program Files (x86)\MSEfor64BitAnyCPUGedöns.exe
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp files -> C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.02 00:35:50 | 000,725,468 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.03.02 00:35:50 | 000,151,824 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.03.02 00:31:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.02 00:31:15 | 2095,443,967 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.02 00:27:54 | 000,877,050 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.03.02 00:24:33 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.02 00:24:25 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012.03.01 23:55:06 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\agruett.E6510-AGRUETT\Desktop\OTL.exe
[2012.03.01 22:58:06 | 000,001,051 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jag79366.exe.lnk
[2012.03.01 22:48:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.01 16:53:14 | 000,000,106 | ---- | M] () -- C:\Windows\WPCMAPI.INI
[2012.03.01 16:39:32 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.01 16:39:32 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.01 11:23:26 | 015,288,401 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\FSG.design
[2012.02.28 15:20:15 | 000,002,086 | -H-- | M] () -- C:\Users\agruett.E6510-AGRUETT\Documents\Default.rdp
[2012.02.21 15:38:20 | 000,137,215 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB2.design
[2012.02.21 15:38:14 | 000,093,665 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB1.design
[2012.02.21 15:38:00 | 000,256,207 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB.design
[2012.02.21 09:06:38 | 000,492,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.14 12:37:31 | 000,208,630 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\KWI AIRPORT W COLOR.JPG
[2012.02.08 20:50:58 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2012.02.08 10:24:48 | 000,343,091 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\tumblr_ly0civznuG1rn5gmlo1_r1_500.jpg
[2012.02.02 21:46:08 | 000,055,296 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntsrv.exe
[2012.02.02 21:45:28 | 000,029,184 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntWinCredMan.dll
[2012.02.02 21:45:22 | 000,026,112 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntWinCredMan.dll
[2012.02.02 12:34:34 | 000,041,344 | ---- | M] () -- C:\Windows\SysNative\drivers\nipplpt.sys
[2012.02.02 12:34:32 | 001,865,816 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nipplib.dll
[2012.02.02 12:34:32 | 001,591,896 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nipplib.dll
[2012.02.02 12:34:32 | 000,790,864 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\ienipp.ocx
[2012.02.02 12:34:32 | 000,533,840 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\ienipp.ocx
[2012.02.02 12:34:32 | 000,254,352 | ---- | M] () -- C:\Windows\SysWow64\npnipp.dll
[2012.02.02 12:34:32 | 000,177,240 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nippnt.dll
[2012.02.02 12:34:32 | 000,109,144 | ---- | M] (Novell Inc.) -- C:\Windows\SysWow64\npnisp.dll
[2012.02.02 12:34:32 | 000,100,952 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntcmd.exe
[2012.02.02 12:34:32 | 000,080,472 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntzip.dll
[2012.02.02 12:34:32 | 000,080,472 | ---- | M] () -- C:\Windows\SysNative\nipplpte.exe
[2012.02.02 12:34:32 | 000,072,280 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntlgn.exe
[2012.02.02 12:34:32 | 000,072,280 | ---- | M] () -- C:\Windows\SysNative\icapture.exe
[2012.02.02 12:34:32 | 000,070,744 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntzip.dll
[2012.02.02 12:34:32 | 000,069,720 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntlgn.exe
[2012.02.02 12:34:32 | 000,068,184 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntctl.exe
[2012.02.02 12:34:32 | 000,066,136 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntctl.exe
[2012.02.02 12:34:32 | 000,065,112 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntcfg.exe
[2012.02.02 12:34:32 | 000,064,088 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntcfg.exe
[2012.02.02 12:34:32 | 000,052,312 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nippcl32.dll
[2012.02.02 12:34:32 | 000,048,216 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nippcl32.dll
[2012.02.02 12:34:32 | 000,040,536 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntcmd.exe
[2012.02.02 12:34:32 | 000,030,296 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\iprntzppd.dll
[2012.02.02 12:34:32 | 000,029,272 | ---- | M] (Novell, Inc.) -- C:\Windows\SysNative\nipplgex.dll
[2012.02.02 12:34:32 | 000,028,248 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\iprntzppd.dll
[2012.02.02 12:34:32 | 000,027,224 | ---- | M] (Novell, Inc.) -- C:\Windows\SysWow64\nipplgex.dll
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp files -> C:\Users\agruett.E6510-AGRUETT\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.01 22:58:06 | 000,001,051 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jag79366.exe.lnk
[2012.03.01 11:23:25 | 015,288,401 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\FSG.design
[2012.02.21 15:38:20 | 000,137,215 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB2.design
[2012.02.21 15:38:14 | 000,093,665 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB1.design
[2012.02.21 15:38:00 | 000,256,207 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\IB.design
[2012.02.14 12:37:31 | 000,208,630 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\KWI AIRPORT W COLOR.JPG
[2012.02.08 20:50:58 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2012.02.08 17:43:39 | 022,415,876 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\Bestand_farbe_o_xref.dwg
[2012.02.08 10:24:48 | 000,343,091 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\Desktop\tumblr_ly0civznuG1rn5gmlo1_r1_500.jpg
[2012.01.17 04:28:58 | 001,832,536 | ---- | C] () -- C:\Windows\SysWow64\noveap.dll
[2012.01.17 04:28:58 | 000,908,376 | ---- | C] () -- C:\Windows\SysWow64\ncnetprovider.dll
[2012.01.17 04:28:58 | 000,665,176 | ---- | C] () -- C:\Windows\SysWow64\ncloginui.dll
[2012.01.17 04:28:58 | 000,230,488 | ---- | C] () -- C:\Windows\SysWow64\nwshlxnt.dll
[2012.01.17 04:28:58 | 000,185,944 | ---- | C] () -- C:\Windows\SysWow64\lgnwnt32.dll
[2012.01.17 04:28:58 | 000,156,760 | ---- | C] () -- C:\Windows\SysWow64\mapbase.dll
[2012.01.17 04:28:58 | 000,092,760 | ---- | C] () -- C:\Windows\SysWow64\nclangid.dll
[2012.01.17 04:28:58 | 000,026,200 | ---- | C] () -- C:\Windows\SysWow64\loginw32.exe
[2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Woodwinds
[2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Woodwind
[2011.09.05 13:40:29 | 000,000,268 | RH-- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Widgets
[2011.09.05 13:34:54 | 000,007,657 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\Resmon.ResmonCfg
[2011.09.05 13:34:54 | 000,000,000 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\debuggee.mdmp
[2011.09.05 13:34:54 | 000,000,000 | ---- | C] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Local\{8ADD5CC7-9401-4EEA-9E88-C395B5AEAADB}
[2011.08.25 21:23:12 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe
[2011.08.25 21:23:12 | 000,001,332 | ---- | C] () -- C:\Windows\unins000.dat
[2011.06.30 21:01:36 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Workflows
[2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\designjet
[2011.06.14 07:45:01 | 000,000,268 | RH-- | C] () -- C:\ProgramData\business-inkjet
[2011.06.14 07:45:01 | 000,000,012 | RH-- | C] () -- C:\ProgramData\vhosts
[2011.06.14 07:42:45 | 000,000,000 | ---- | C] () -- C:\ProgramData\WebServer
[2011.06.14 07:42:45 | 000,000,000 | ---- | C] () -- C:\ProgramData\Trance Pad
[2011.03.05 19:06:07 | 000,000,086 | ---- | C] () -- C:\Windows\EmperorEdit.INI
[2011.03.05 19:03:28 | 000,000,150 | ---- | C] () -- C:\Windows\Sierra.ini
[2011.03.01 15:17:01 | 000,000,141 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.03.01 15:14:14 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.02.25 17:48:06 | 000,000,000 | ---- | C] () -- C:\Windows\gsrthubgui.INI
[2011.01.07 19:13:06 | 000,155,700 | ---- | C] () -- C:\Windows\SysWow64\ODMA32.DLL
[2010.11.30 10:58:34 | 000,254,352 | ---- | C] () -- C:\Windows\SysWow64\npnipp.dll
[2010.11.29 16:06:42 | 000,000,000 | ---- | C] () -- C:\Windows\gsrtstaffgui.INI
[2010.11.19 11:13:26 | 000,186,400 | ---- | C] () -- C:\Windows\SysWow64\ANWShare25.dll
[2010.11.17 12:31:23 | 000,000,000 | ---- | C] () -- C:\Windows\gsrtstandsgui.INI
[2010.11.14 22:23:41 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI
[2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2010.11.14 22:21:03 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2010.11.08 17:19:27 | 000,000,106 | ---- | C] () -- C:\Windows\WPCMAPI.INI
[2010.10.06 10:43:40 | 000,222,240 | ---- | C] () -- C:\Windows\SysWow64\VersionChecker.dll
[2010.09.06 16:34:30 | 000,862,962 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.09.01 13:12:03 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.08.31 13:51:19 | 000,080,368 | ---- | C] () -- C:\Windows\SysWow64\pbadrvdll.dll
 
========== LOP Check ==========
 
[2012.03.01 18:34:47 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\.oit
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Atari
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Autodesk
[2012.01.21 19:32:05 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2
[2012.01.19 00:07:40 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1
[2012.01.18 13:06:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DAEMON Tools Lite
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.17 20:12:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\elsterformular
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\eTeks
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FILEminimizer
[2011.12.26 11:38:03 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FileZilla
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GHISLER
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gnupg
[2011.12.09 12:24:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GrabPro
[2012.01.18 21:38:38 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gtk-2.0
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\JAM Software
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Nikon
[2012.03.01 16:43:28 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell
[2012.02.21 16:23:17 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Orbit
[2011.09.15 11:58:46 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Passolo Demo
[2011.12.09 12:15:14 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\ProgSense
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Scilab
[2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\SQL Developer
[2011.09.05 12:39:21 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Stardock
[2011.09.05 13:00:12 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Subversion
[2011.06.07 13:08:06 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\webex
[2010.08.31 08:56:07 | 000,000,000 | ---D | M] -- C:\Users\IMG\AppData\Roaming\WirelessManager
[2011.08.25 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\mcarell\AppData\Roaming\Stardock
[2011.09.05 12:16:25 | 000,000,000 | ---D | M] -- C:\Users\notbremse\AppData\Roaming\Stardock
[2010.08.31 14:36:37 | 000,000,000 | ---D | M] -- C:\Users\poldy\AppData\Roaming\Foxit
[2010.09.02 10:49:56 | 000,000,000 | ---D | M] -- C:\Users\poldy\AppData\Roaming\GHISLER
[2012.01.05 17:05:55 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.03.01 18:34:47 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\.oit
[2011.09.05 13:40:29 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Adobe
[2011.11.10 14:41:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Apple Computer
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Atari
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Autodesk
[2012.01.21 19:32:05 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2
[2012.01.19 00:07:40 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1
[2012.01.18 13:06:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DAEMON Tools Lite
[2011.10.22 21:50:27 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\dvdcss
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.17 20:12:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\elsterformular
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\eTeks
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FILEminimizer
[2011.12.26 11:38:03 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\FileZilla
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GHISLER
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gnupg
[2011.12.09 12:24:20 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\GrabPro
[2012.01.18 21:38:38 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\gtk-2.0
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Identities
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\InstallShield
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Intel
[2011.09.05 12:39:15 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Intel Corporation
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\JAM Software
[2011.09.05 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft
[2010.11.17 14:51:55 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Macromedia
[2009.07.14 08:45:37 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Media Center Programs
[2012.01.31 08:58:05 | 000,000,000 | --SD | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft Corporation
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft FxCop
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Nikon
[2012.03.01 16:43:28 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Novell
[2012.02.21 16:23:17 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Orbit
[2011.09.15 11:58:46 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Passolo Demo
[2011.12.09 12:15:14 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\ProgSense
[2011.09.05 13:40:35 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Scilab
[2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\SQL Developer
[2011.09.05 12:39:21 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Stardock
[2011.09.05 13:00:12 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Subversion
[2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\TortoiseSVN
[2011.11.07 11:24:34 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\vlc
[2012.02.29 13:20:09 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\VMware
[2011.06.07 13:08:06 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\webex
[2011.09.05 13:40:36 | 000,000,000 | ---D | M] -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2007.05.04 10:10:38 | 001,634,304 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\mysqldump.exe
[2002.11.12 18:07:00 | 000,126,976 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\pageant.exe
[2006.02.13 15:55:18 | 000,290,816 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\plink.exe
[2006.03.28 17:51:00 | 000,348,160 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\pscp.exe
[2006.03.28 17:50:00 | 000,339,968 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\psftp.exe
[2006.03.28 17:50:00 | 000,499,712 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\putty.exe
[2002.11.12 18:07:00 | 000,159,744 | ---- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\LuckaSoft\MySQL Client\bin\puttygen.exe
[2011.06.07 15:49:30 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.11.10 11:32:20 | 000,405,504 | R--- | M] (Acresso Software Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}\ARPPRODUCTICON.exe
[2012.01.20 14:37:28 | 000,010,134 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{559D2B32-5066-4762-A2F2-52831AC6F67B}\ARPPRODUCTICON.exe
[2011.08.18 12:35:49 | 000,004,710 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}\_294823.exe
[2011.06.14 07:45:41 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
[2010.11.10 11:32:11 | 000,365,322 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{AF7E4468-E364-4991-BC2A-6E8293E1055B}\ARPPRODUCTICON.exe
[2011.08.17 14:17:51 | 000,010,134 | R--- | M] () -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2008.10.10 10:38:52 | 000,069,632 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmplayer-service.exe
[2008.10.10 10:38:14 | 001,773,568 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmware-remotemks.exe
[2008.10.10 10:43:58 | 003,190,784 | ---- | M] (VMware, Inc.) -- C:\Users\agruett.E6510-AGRUETT\AppData\Roaming\Mozilla\Firefox\Profiles\dh2h3wo2.default\extensions\VMwareVMRC@vmware.com\plugins\vmware-vmrc.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys
[2010.11.05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_05602dde0a28e7f4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FD268286

< End of report >
         

Alt 02.03.2012, 01:21   #2
uxilator
 
Ihr system wird aus sicherheitsgründen blockiert - Standard

Ihr system wird aus sicherheitsgründen blockiert



... und hier die

Extra.txt

Code:
ATTFilter
OTL Extras logfile created on: 02.03.2012 00:39:24 - Run 1
OTL by OldTimer - Version 3.2.34.0     Folder = C:\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 6,88 Gb Available Physical Memory | 86,72% Memory free
15,87 Gb Paging File | 14,86 Gb Available in Paging File | 93,64% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 64,52 Gb Total Space | 3,87 Gb Free Space | 5,99% Space Free | Partition Type: NTFS
Drive D: | 400,47 Gb Total Space | 12,71 Gb Free Space | 3,17% Space Free | Partition Type: NTFS
Drive G: | 3,66 Gb Total Space | 3,59 Gb Free Space | 98,03% Space Free | Partition Type: FAT32
 
Computer Name: E6510-AGRUETT | User Name: agruett | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1202839594-1105990689-3141586818-1023\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}" = UPEK TouchChip Fingerprint Reader
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{06C7075F-7474-460F-AE0E-1F5E20FEBC66}" = Exception Hunter 2
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{08044C1C-760B-45D1-81B7-10C690313012}" = CASA
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0C3831AA-1EA4-48D5-AAF1-24B27CBBBBF4}" = usermanagement-langs-x86_64
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{11107A2A-AD44-4BC8-ABB5-E88E63BCA785}" = Intel(R) Network Connections 14.8.43.0
"{183C740A-0406-380F-A235-2EC2F8A28D13}" = Microsoft Windows SDK MSHelp (30514)
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{22859902-78CE-40B0-9429-6FE7A00BBF85}" = NMAS Client
"{26A24AE4-039D-4CA4-87B4-2F86416023FF}" = Java(TM) 6 Update 23 (64-bit)
"{2D290715-B0FC-3898-9247-62F803A585DF}" = Microsoft Windows SDK for Windows 7 Redistributable Components for Common Tools (30514)
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{3938F3E6-53A0-4B93-A8B0-1C70D3768EED}" = .NET Reflector 6
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{45EF12B0-F531-4A2C-A1C0-6B1495698E30}" = TortoiseSVN 1.6.15.21042 (64 bit)
"{467D5E81-8349-4892-9E81-C3674ED8E451}" = Cisco Systems VPN Client 5.0.07.0290
"{4A8CE6D7-4D52-43B9-970B-03FC75FAD667}" = Microsoft SQL Server System CLR Types (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{50E9E32F-063A-412A-9627-553D5DA57C17}" = ESET NOD32 Antivirus
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{54031C8D-F80D-47BB-B3CA-5E9BD7750C27}" = NMAS Challenge Response Method
"{559D2B32-5066-4762-A2F2-52831AC6F67B}" = NICI (64 bit)
"{5783F2D7-9028-0409-0100-0060B0CE6BBA}" = DWG TrueView 2011
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0160230}" = Java(TM) SE Development Kit 6 Update 23 (64-bit)
"{662014D2-0450-37ED-ABAE-157C88127BEB}" = Visual Studio 2010 Prerequisites - English
"{68570626-1BF6-310B-AF69-6CD686C04AEA}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{70945452-9283-4C6D-BEE8-369A64F1DEC4}" = ANTS Memory Profiler 6
"{71119565-2A84-4B05-8CC2-A4749E5EA20F}" = Slik Subversion 1.6.11 (x64)
"{71F00D08-438B-474A-BBC7-AA25605AAE2F}" = Microsoft Redistributable Files (x64)
"{75EFBF78-ACF7-479F-98F8-3A6550D09546}" = ZENworks User Management
"{7F1B5849-D93C-4DB8-9568-E0E6D3C7A743}" = ANTS Performance Profiler 6
"{8125F749-B244-4F7B-811E-532165C5F2D5}" = Microsoft SQL Server 2008 RsFx Driver
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{84E30D73-E30F-3A02-BAA0-5353C04DD18A}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{88BAE373-00F4-3E33-828F-96E89E5E0CB9}" = Microsoft Visual Studio 2010 IntelliTrace Collection (x64)
"{89026002-A893-42D9-9E20-6829B844735E}" = Application Verifier (x64)
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8E80AF23-17B4-4611-B28E-68A114B23488}" = Dell ControlVault Host Components Installer 64Bit
"{8FF0ACBD-17A5-3637-95F4-D7C69723E2BF}" = Microsoft Visual Studio 2010 Performance Collection Tools - ENU
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0B0F02C-410B-3DE3-9740-EC4C3D902532}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{A2C55034-8DAF-3755-BA85-CC321707FE99}" = Microsoft Windows SDK for Visual Studio .NET 4.0 Framework Tools
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B0A5A6EE-F8BA-48B1-BB32-BAC17E96C2B4}" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64)
"{B35E92BA-9C6E-4C06-9435-7105DC915BCE}" = Novell ZENworks Remote Management
"{B7D0C3BC-CB39-3CA1-9295-A23A93994893}" = Microsoft Windows SDK for Windows 7 Redistributable Components for Windows Debugging Tools (30514)
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C0C690C8-F335-4BA4-A2AD-675EAD1DFA90}" = Microsoft SQL Server 2008 Setup Support Files 
"{C3AF5BD8-30D5-41F5-AF61-705D98146B0F}" = Microsoft SQL Server 2008 Native Client
"{C44218B2-EC4D-4EB9-A3E3-F8F4A46927EC}" = MySQL Connector/ODBC 5.1
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{CCAFF072-4DDB-4846-963D-15F02A8E9472}" = Intel(R) PROSet/Wireless WiFi-Software
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA67488A-2689-4F10-B90F-D2F6977509D6}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{DBFC6AAE-DCCB-4C23-B01C-3EDDDC03298B}" = Debugging Tools for Windows (x64)
"{DE0248C8-0701-4132-95A5-9130D22B3A24}" = ANTS Profiler Visual Studio Add-in 1
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{F1C4B89A-8BF0-3D7C-8095-BAE412FBEA3F}" = Microsoft Windows SDK .NET Framework Tools (30514)
"{F3D7BBAA-7412-4388-B510-11E145D2C48B}" = Microsoft Web Platform Installer 3.0
"{F5079164-1DB9-3BDA-853B-F78AF67CE071}" = Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"{FE0D2049-AD64-418D-A2BD-5C60B940F27D}" = Novell CASA Authentication Token Client (x64)
"9512AA21B791B05A54E27065C45BBC417AB282DF" = Windows Driver Package - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"DWG TrueView 2011" = DWG TrueView 2011
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual J# 2.0 Redistributable Package - SE (x64)" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64)
"Novell Client for Windows" = Novell Client for Windows
"Novell iPrint Client" = Novell iPrint Client v05.78.00
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"ProInst" = Intel PROSet Wireless
"PROSetDX" = Intel(R) Network Connections 14.8.43.0
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"scilab-5.3.0 (64-bit)_is1" = scilab-5.3.0 (64-bit)
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04AB5C6A-CC57-40DC-8DD3-92F2CFAAC85A}" = ZENworks Agent System Update Module
"{05855322-BE43-41FE-B583-D3AE0C326D58}" = Microsoft Silverlight 4 SDK
"{07EF3970-F8E5-4A27-A5A3-230484D35026}" = Microsoft Expression Encoder 4
"{083C7BC0-C862-4963-9B13-E2AB80256B54}" = bundle-langs
"{08907D91-D8BB-4CF0-A563-571D3E95819A}" = ZENworks Version Information
"{08D605B4-DCD1-451F-ABD7-52E6BB868E4E}" = Microsoft Expression Design 4
"{0947D851-CD66-4F62-AF28-2A07AFE81119}" = ZENworks Agent Bundle Management
"{09A7FDFF-5C51-4008-9DCA-1D9F4F1C9432}" = ZENworks Image Management
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0E6925C6-F57A-44EB-8AC7-86827DACA79E}" = ZENworks Windows UI
"{0EC99F43-B66D-41ED-AF6F-B0E790F8BC04}" = inventory-langs
"{0FD23E02-2BFB-4BEC-8823-FE984F83F161}" = VMware Server Console
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{1250E27F-7AF5-46F3-962A-36CE75C65F32}" = Infragistics NetAdvantage WPF 2009.2
"{139E4D07-F58B-44B5-8429-D00C49679576}" = Novell ZENworks Adaptive Agent Help
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{1AB2E5D6-73D0-404F-9559-D9D0E00628D6}" = ZENworks Policy Libraries
"{1C997E1C-5CE9-4AF3-AAA9-DC65E6090827}" = Microsoft Expression Blend SDK for Silverlight 4
"{1D7FF152-070A-43B7-B079-739DBF1B8DB4}" = GroupWise
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{234F5FD0-7C56-D5AF-E46A-E00231D6D99F}" = Creeper World 2
"{256E7DAC-9BE8-494E-8DE7-7857BF96B774}" = Microsoft Expression Blend 3 SDK
"{25955A6C-B0C9-4EF7-A699-97D9E1320C21}" = ZENworks Agent Core Modules
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silverlight 4
"{292490BF-5CAF-47D2-8AB4-7E98EE80BD0A}" = zencore-agent-langs
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2B2B45B1-3CA0-4F8D-BBB3-AC77ED46A0FE}" = Dell Client System Update
"{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{398CE561-7E00-43F8-8AE3-DA3F0F579FB5}" = zennotifyicon-langs
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3ED67637-DB89-428B-94E3-4AE09D5AC739}" = ZENworks Agent Patch Management
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{40EDCEF4-2295-476F-939A-248DB43352AE}" = Bing Map App SDK Beta
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{48D8CFE8-8274-4388-B34F-C111E77B2E7F}" = ZENworks Remote Management
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C6D5779-A766-45DF-9938-D6F595A66F2B}" = Microsoft Expression Blend 4
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{5421E8BF-2208-46AD-BAC4-FC3946EEB351}" = ILMerge
"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010
"{55B177C3-B95C-4A73-BA95-1D99D6E14885}" = Microsoft Redistributable Files (x86)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57B5F8F3-3414-4635-A8DE-48F75982D32C}" = content-distribution-point-langs
"{59BB7F21-1987-4A1C-9DF3-82FEC6591C60}" = SlimDX SDK (June 2010)
"{5B38770A-2A5E-4EC6-82F4-5C52B1419ACA}" = primary-agent-langs
"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{5F8D931D-B230-47F3-A9C0-0C8CA459A332}" = Microsoft Expression Web 4
"{61132DB4-5BFA-4639-8C1D-21B7583FE23E}" = ZENworks Action Utilities
"{641E3749-55CD-DD82-8480-6C95C3A175BA}" = Creeper World 2 Demo
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6742BE3D-1A59-3BFD-BA20-2FDA866099B8}" = Microsoft Visual Studio 2010 Premium - ENU
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}" = Oracle Data Provider for .NET Help
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6E48D296-3078-4070-9FE1-CE51AB1662D2}" = ZENworks Status Collection Point
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{781FC5D0-3E2D-4F93-8D5D-659C2CCFCE7A}" = ZENworks Policy Handlers
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7A25D130-4EC8-11E1-BEA4-B8AC6F97B88E}" = Google Earth
"{80262C7D-B649-4A5D-B539-F5221A4CF47F}" = patch-langs
"{80F7CA44-F3A5-4853-8BA6-DDF57CD4F078}" = Rosetta Stone Version 3
"{81CF9B71-3AD9-428B-8183-83A67930D9BA}" = ZENworks Primary Agent
"{81EF6BA3-91A9-4E91-87DF-8FE8C0C3D335}" = actions-langs
"{821DABD6-26F2-49E5-AE55-40A589ADBE6D}" = DER ERSTE KAISER: Aufstieg des Reichs der Mitte
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83D4BEDC-CBCD-4DFE-BA38-99A54E88123E}" = auth-satellite-server-langs
"{846D9AAD-EA7D-4126-9177-F874FD389BE4}" = Microsoft FxCop 1.35
"{85076DFF-7A17-3566-9CC0-488E6E6D4494}" = Microsoft Visual Web Developer 2010 Express - ENU
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{88A4F1FF-DA66-49F4-973C-A52828A47FE1}" = ZENworks Agent WinProxy Module
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B432EF1-84E2-4EC9-A1E7-657A927A681B}" = ZENworks Agent Asset Management Module
"{8FFC6175-D2C5-4FA7-91E8-E2A9431A5CDA}" = WCF RIA Services V1.0 for Visual Studio 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3
"{91A3F247-1325-4C98-B38B-305452125052}" = WinProxy-langs
"{9461535E-3818-4F01-89AD-7BDEEE88D1C0}" = Novell ZENworks Image-Safe Data Service
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9547FEAD-5D99-4E3B-9652-378F2AA29B34}" = ZENworks Agent Inventory Management
"{99038B98-A3C1-4E70-9993-F6077C05B5BD}" = ZENworks Content Distribution Point
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AC6DA44-ECD6-432D-B4F5-484B0ABF7BFC}" = ZENworks Imaging Server
"{9B3A1C97-A361-463E-8817-444F9F88CDFE}" = Microsoft Expression Blend SDK for .NET 4
"{9B6E7DAF-6DA8-4396-9FCD-4118CF2D1BE8}" = ZENworks Agent Policy Management
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A06FE62B-CEBC-4E94-AED8-92DCC33BC8EA}" = Microsoft Expression Studio 4
"{A4458FAA-FD92-4F27-8E85-9F289D8D18EB}" = ZENworks Agent Authentication Satellite Module
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAFE0B97-B9C7-4499-A2DC-55136FB928F2}" = Policy Action Handler Resources
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B434B5BB-C941-4520-86F2-87C14910AE09}" = Action Handler Resources
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BA8618CA-6093-479E-9F79-ABEA020957DE}" = ZENworks Action Handlers
"{BF127B80-CFD5-4379-9752-E8AF1A5D0141}" = Microsoft Expression Encoder 4 Screen Capture Codec
"{BF6BFEB7-6601-42B9-A773-896D221EA475}" = ZENworks Uninstaller
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{CA206913-EE9F-495F-AD43-032E5833EE13}" = AnkhSVN 2.1.8420.8
"{CA4CF3FF-A0B4-4C07-9B64-85FFEEABC77D}" = windows-desktop-langs-x86_64
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D2384E2B-F120-4AD1-A376-E94614B305DE}" = ZENworks Actions
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D2F28E39-9813-41D3-8EC9-BAADA38C426D}" = VMware Remote Console Plug-in
"{D92F029C-A937-4170-8075-FA39314C8F0C}" = remotemanagement-langs
"{DAA01565-832C-4E5B-99C2-E6F01D6DF404}" = novell-zenworks-patch-management-agent
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{E00D18BE-3FB4-415A-9CDA-8DB4550D1B29}" = assetmanagementmodule-langs
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3A9D466-BEA2-4A4A-A508-C78C6E41A6E8}" = status-collection-point-langs
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{F02DBC5D-33E3-45E9-B0F8-B7745229ED1C}" = NICI (Shared) U.S./Worldwide (128 bit) (2.7.6-1)
"{F049FD6B-22EE-4410-8556-AB2476CA3781}" = ZENworks Extensions Libraries
"{F0B0F46D-0483-4B95-A766-83167EE133E7}" = Policy Handler Resources
"{F0BC0F9E-C4A8-485C-93ED-424DB9EA3F75}" = Oracle Database 10g Express Edition
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F15AEACD-0973-4A4C-8F30-8B234D52F2E6}" = ZENworks Information Icon
"{F3260CBB-611A-4C46-B6AE-5A8A48011B8F}" = ZENworks Image-Safe Data Agent
"{F5993FCC-DF5D-4879-B70D-AA1F379C5C6B}" = Microsoft Expression Web 4 Service Pack 2
"{F6645011-F936-42E9-B787-CD8EC485FA20}" = policy-langs
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"7-Zip" = 7-Zip 9.20
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"AxCrypt" = AxCrypt (Nur Entfernen)
"Blend_4.0.20525.0" = Microsoft Expression Blend 4
"CreeperWorld2.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1" = Creeper World 2
"CreeperWorld2Demo.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1" = Creeper World 2 Demo
"DAEMON Tools Lite" = DAEMON Tools Lite
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Design_7.0.20516.0" = Microsoft Expression Design 4
"ElsterFormular 12.4.0.7094p" = ElsterFormular
"eMule" = eMule
"Encoder_4.0.1639.0" = Microsoft Expression Encoder 4
"EngInSite Client for MySQL_is1" = EngInSite Client for MySQL 2.0.4.231
"ExpressionStudio_4.0.20525.0" = Microsoft Expression Studio 4
"Fences" = Fences
"FileZilla Client" = FileZilla Client 3.3.4.1
"FinePrint 2000" = FinePrint 2000
"Foxit Reader" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.37.426
"FreePDF_XP" = FreePDF (Remove only)
"Google Satellite Maps Retriever_is1" = Google Satellite Maps Retriever 6.80
"GPL Ghostscript 9.00" = GPL Ghostscript 9.00
"GSview 4.9" = GSview 4.9
"HijackThis" = HijackThis 2.0.2
"HotSpot_International Toolbar" = HotSpot International Toolbar
"InstallShield_{F0BC0F9E-C4A8-485C-93ED-424DB9EA3F75}" = Oracle Database 10g Express Edition
"JDownloader" = JDownloader
"Microsoft Visual Studio 2010 Premium - ENU" = Microsoft Visual Studio 2010 Premium - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Web Developer 2010 Express - ENU" = Microsoft Visual Web Developer 2010 Express - ENU
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Pandora's Box Trial" = MS Pandora's Box Trial Version
"Panzer Corps_is1" = Panzer Corps version 1.0
"Panzer Corps1.00" = Panzer Corps
"Passolo Demo" = Passolo Demo
"Postal 2_is1" = Portal 2
"Psi" = Psi (remove only)
"Qtel Mobile Broadband E180" = Qtel Mobile Broadband E180
"RealVNC_is1" = VNC 4.0
"Spyder2express" = Spyder2express
"StarCraft" = StarCraft
"StarCraft II" = StarCraft II
"Steamless Portal Pack" = Steamless Portal Pack
"SuperGet GS_is1" = SuperGet GS 4.05
"The Rosetta Stone" = The Rosetta Stone
"Titan Poker" = Titan Poker
"Totalcmd" = Total Commander (Remove or Repair)
"TRANSDAT_is1" = TRANSDAT
"TreeSize Free_is1" = TreeSize Free V2.4
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.9
"VMware_Player" = VMware Player
"Web_4.0.1303.0" = Microsoft Expression Web 4
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinMerge_is1" = WinMerge 2.12.4
"WinRAR archiver" = WinRAR
"WMS" = Windows NT Messaging
"Z" = Windows Z V1.0
"ZENworks" = Novell ZENworks
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.03.2012 05:22:57 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4072
 
Error - 01.03.2012 06:15:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Application Error | ID = 1000
Description = Faulting application name: splwow64.exe, version: 6.1.7601.17514, 
time stamp: 0x4ce7b4c8  Faulting module name: dlxbuzim.dll, version: 0.3.0.0, time
 stamp: 0x4a5d2d12  Exception code: 0xc0000005  Fault offset: 0x000000000005a7a9  Faulting
 process id: 0x468  Faulting application start time: 0x01ccf79414c6ee8a  Faulting application
 path: C:\Windows\splwow64.exe  Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\dlxbuzim.dll
Report
 Id: 7edc2587-6387-11e1-a62f-1c659d014698
 
Error - 01.03.2012 11:13:12 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Novell Client System Tray Menu' could not 
be shut down.
 
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15070
 
Error - 01.03.2012 11:34:02 | Computer Name = e6510-agruett.inform-ac.com | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15070
 
Error - 01.03.2012 19:35:47 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is not formatted
 correctly. The malformed string is 19678. The first DWORD in the Data section contains
 the index value to the malformed string while the second and third DWORDs in the
 Data section contain the last valid index values.
 
Error - 01.03.2012 19:35:47 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
 failed. The first DWORD in the Data section contains the error code.
 
Error - 01.03.2012 19:35:50 | Computer Name = e6510-agruett.inform-ac.com | Source = Microsoft-Windows-LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is not formatted
 correctly. The malformed string is 19678. The first DWORD in the Data section contains
 the index value to the malformed string while the second and third DWORDs in the
 Data section contain the last valid index values.
 
Error - 01.03.2012 19:41:47 | Computer Name = e6510-agruett.inform-ac.com | Source = System Restore | ID = 8193
Description = 
 
[ System Events ]
Error - 01.03.2012 19:45:48 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:48:32 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:52:56 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 01.03.2012 19:55:40 | Computer Name = e6510-agruett.inform-ac.com | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
 
< End of report >
         

und schonmal DANKE an alle die sich dafür Zeit nehmen.

axel
Angehängte Dateien
Dateityp: zip OTL.zip (37,5 KB, 67x aufgerufen)
Dateityp: zip Extras.zip (15,3 KB, 67x aufgerufen)
__________________


Alt 02.03.2012, 11:41   #3
markusg
/// Malware-holic
 
Ihr system wird aus sicherheitsgründen blockiert - Standard

Ihr system wird aus sicherheitsgründen blockiert



hi,
im abgesicherten modus mit netzwerk im betroffenen konto anmelden:
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.
__________________
__________________

Antwort

Themen zu Ihr system wird aus sicherheitsgründen blockiert
4d36e972-e325-11ce-bfc1-08002be10318, alternate, antivirus, bho, bildschirm, blockiert, bonjour, conduit, desktop, error, eset nod32, firefox, flash player, format, google earth, home, hotspot, hotspot shield, langs, logfile, mozilla thunderbird, nvstor.sys, object, registry, rundll, scan, searchscopes, server, software, starten, system, taskmanager, usb, version=1.0, virus, windows



Ähnliche Themen: Ihr system wird aus sicherheitsgründen blockiert


  1. Windows wird aus Sicherheitsgründen Blockiert :///
    Log-Analyse und Auswertung - 16.05.2012 (21)
  2. Aus Sicherheitsgründen wird ihr Windowssystem blockiert.
    Plagegeister aller Art und deren Bekämpfung - 06.02.2012 (37)
  3. Windows wird aus Sicherheitsgründen blockiert!
    Log-Analyse und Auswertung - 02.02.2012 (7)
  4. Windows wird aus Sicherheitsgründen blockiert - die Xte
    Plagegeister aller Art und deren Bekämpfung - 07.01.2012 (17)
  5. Aus Sicherheitsgründen wird ihr Windows System blockiert
    Log-Analyse und Auswertung - 05.01.2012 (16)
  6. Aus Sicherheitsgründen wird Ihr System blockiert!!!
    Plagegeister aller Art und deren Bekämpfung - 02.01.2012 (12)
  7. Verspätetes "Xmas-geschenk": 50€-Virus mit Text "System wird aus sicherheitsgründen blockiert"
    Log-Analyse und Auswertung - 02.01.2012 (5)
  8. Aus Sicherheitsgründen wird Ihr System blockiert
    Log-Analyse und Auswertung - 02.01.2012 (1)
  9. Windows wird aus Sicherheitsgründen blockiert.
    Plagegeister aller Art und deren Bekämpfung - 30.12.2011 (21)
  10. Pc wird blockiert: Aus Sicherheitsgründen wurde ihr Windows System blockiert.....
    Log-Analyse und Auswertung - 29.12.2011 (19)
  11. "Aus Sicherheitsgründen wird Ihr System blockiert"
    Plagegeister aller Art und deren Bekämpfung - 27.12.2011 (8)
  12. "Windows wird aus Sicherheitsgründen blockiert"Virus blockiert System
    Log-Analyse und Auswertung - 22.12.2011 (4)
  13. Aus Sicherheitsgründen wird Windows Blockiert
    Log-Analyse und Auswertung - 21.12.2011 (1)
  14. Aus Sicherheitsgründen Windows wird blockiert :-(
    Plagegeister aller Art und deren Bekämpfung - 20.12.2011 (15)
  15. Aus Sicherheitsgründen wird Windows Blockiert
    Log-Analyse und Auswertung - 17.12.2011 (1)
  16. Windows wird aus Sicherheitsgründen blockiert.
    Log-Analyse und Auswertung - 17.12.2011 (3)
  17. Pc wird blockiert: Aus Sicherheitsgründen wurde ihr Windows System blockiert.....
    Plagegeister aller Art und deren Bekämpfung - 12.12.2011 (7)

Zum Thema Ihr system wird aus sicherheitsgründen blockiert - Hallo zusammen, habe mir gerade beim surfen mit Firefox anscheinend einen "lustigen" Virus eingefangen. Beim normalen starten blockiert direkt der Bildschirm mit einer Sicherheitswarnung und ich soll "Lösegeld" in Hohöe - Ihr system wird aus sicherheitsgründen blockiert...
Archiv
Du betrachtest: Ihr system wird aus sicherheitsgründen blockiert auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.