Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 20.07.2012, 21:35   #1
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Hallo,

Hab auf einem Windows 2008R2 64bit Server das Problem, dass sich die Firewall nicht starten lässt. Beim Starten kommt die Fehlermeldung:
Beim Öffnen des Snap-Ins "Windows-Firewall mit erweiterter Sicherheit" ist ein Fehler aufgetreten. Das Snap-In "Windows-Firewall mit erweiterter Sicherheit" konnte nicht geladen werden. Starten Sie den Windows-Firewalldienst auf dem von Ihnen verwalteten Computer neu. Fehlercode: 0x6D9

In "Dienste" ist die Firewall nicht gestartet. Beim Versuch zu starten kommt die Meldung: "Windows-Firewall auf Lokaler Computer konnte nicht gestartet werden. Weitere Informationen ....."
Im Ereignisprotokoll steht nur "Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: Zugriff verweigert."

Hab viel gegoogelt und ausprobiert, aber nichts konnte bislang helfen, auch nicht folgende Batch-Datei:
sc config MpsSvc start= auto
sc config KeyIso start= auto
sc config BFE start= auto
sc config FwcAgent start= auto
net stop MpsSvc
net start MpsSvc
net stop KeyIso
net start KeyIso
net start Wlansvc
net start dot3svc
net start EapHostnet
net stop BFE
net start BFE
net start PolicyAgent
net start MpsSvc
net start IKEEXT
net start DcaSvcnet
net stop FwcAgent
net start FwcAgent

Hatte bislang Kaspersky als Antivirusprogramm auf dem Rechner, nun auf Eset Nod 32 gewechselt, und beim Scan damit wurden folgende Infektionen erkannt und beseitigt:
Win32/InstallCore.D
Win32/Adware.ADON
Quarantine:
Hash Occurred first Occurred last Object name Size Reason Hits File
0f2357d38eb6af3b5e8519f8cc247985df5f28ed 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXZOPMXT\cnet2_pscan13_exe.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data
692f9ad1fe17415dabefea71c02805548f37c603 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T9TOMZZC\cnet2_aports_zip.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data
6e45431b698cdb7be8f1a41266be7b327f33ad38 8 hours ago 8 hours ago E:\rib\Sonstiges\Unlocker1.9.1.exe 783 KByte Win32/Adware.ADON evtl. unerwünschte Anwendung 1 No Data


Die Firewall lässt sich weiterhin nicht starten, und ich hab die Sorge, dass irgendetwas Böses noch auf dem Rechner ist, und das Starten der Firewall verhindert.

Nachfolgend das Scan-Ergebniss von Malwarebytes:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.20.04

Windows Server 2008 R2 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: SERVER [Administrator]

20.07.2012 15:45:33
mbam-log-2012-07-20 (15-45-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 2029664
Laufzeit: 5 Stunde(n), 24 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


Der Quick-Scan von OTL:
OTL.txt
OTL logfile created on: 20.07.2012 17:14:55 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools
64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free
11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS
Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS
Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS

Computer Name: SERVER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.20 15:38:57 | 000,596,480 | ---- | M] (OldTimer Tools) -- E:\daten\Eset Nod32\Removal Tools\OTL.exe
PRC - [2012.07.16 16:37:24 | 006,849,448 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
PRC - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.07.16 16:22:42 | 000,106,408 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe
PRC - [2012.05.18 16:53:24 | 006,219,744 | ---- | M] (ESET) -- D:\Program Files (x86)\ESET\ESET Remote Administrator\Console\console.exe
PRC - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe
PRC - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe
PRC - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) -- D:\David\Code\sl.exe
PRC - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) -- D:\David\Apps\Maserver\CODE\maserver.exe
PRC - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) -- D:\David\Apps\Postman\Code\postman.exe
PRC - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\snmp.exe
PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- c:\Windows\SysWOW64\cmd.exe
PRC - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) -- D:\David\Apps\Webbox\Code\webbox.exe
PRC - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) -- D:\David\Apps\Dvgrab\Code\dvgrab.exe
PRC - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe
PRC - [2010.06.25 20:04:58 | 007,276,416 | ---- | M] (Super Flexible Software) -- D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe
PRC - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe
PRC - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe
PRC - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe
PRC - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe
PRC - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
PRC - [2010.01.13 04:10:00 | 006,352,896 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
PRC - [2009.12.22 16:29:10 | 000,193,536 | ---- | M] (Tobit.Software) -- C:\Windows\SysWOW64\DV4TS.EXE
PRC - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe
PRC - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe
PRC - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe
PRC - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\ADVANTAGE\Server\ads.exe
PRC - [2006.11.22 06:20:00 | 003,768,320 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
PRC - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe


========== Modules (No Company Name) ==========

MOD - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe
MOD - [2010.07.04 23:32:36 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerHook.dll
MOD - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011.12.26 08:45:13 | 000,696,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dns.exe -- (DNS)
SRV:64bit: - [2010.11.20 15:26:05 | 000,729,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpssvc.dll -- (DHCPServer)
SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP)
SRV:64bit: - [2010.11.20 15:25:02 | 001,020,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ntfrs.exe -- (NtFrs)
SRV:64bit: - [2010.11.20 15:24:50 | 000,059,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ismserv.exe -- (IsmServ)
SRV:64bit: - [2010.11.20 15:24:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\inetsrv\inetinfo.exe -- (IISADMIN)
SRV:64bit: - [2010.11.20 15:24:38 | 004,518,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfsrs.exe -- (DFSR)
SRV:64bit: - [2010.11.20 15:24:38 | 000,377,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfssvc.exe -- (Dfs)
SRV:64bit: - [2010.01.25 14:50:28 | 000,017,960 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\sysdown.exe -- (sysdown)
SRV:64bit: - [2009.07.14 03:41:53 | 000,014,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sacsvr.dll -- (sacsvr)
SRV:64bit: - [2009.07.14 03:40:52 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FCRegSvc.dll -- (FCRegSvc)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.07.14 03:39:31 | 000,091,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rsopprov.exe -- (RSoPProv)
SRV:64bit: - [2008.11.14 12:21:50 | 000,022,568 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\cpqrcmc.exe -- (CpqRcmc)
SRV - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe -- (ERA_SERVER)
SRV - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) [On_Demand | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe -- (ERA_HTTP_SERVER)
SRV - [2012.05.14 07:19:22 | 000,042,408 | ---- | M] (ESET) [On_Demand | Unknown] -- D:\Program Files\ESET\ESET File Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) [Auto | Running] -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe -- (ekrn)
SRV - [2011.06.17 22:28:12 | 000,431,456 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$DAVID) SQL Server Agent (DAVID)
SRV - [2011.06.17 22:22:56 | 062,111,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe -- (MSSQL$DAVID) SQL Server (DAVID)
SRV - [2010.12.10 18:34:52 | 039,627,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -- (MSSQL$MICROSOFT##SSEE) Windows Internal Database (MICROSOFT##SSEE)
SRV - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Code\sl.exe -- (DavidServiceLayer)
SRV - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Maserver\CODE\maserver.exe -- (DavidMailAccessServer)
SRV - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Postman\Code\postman.exe -- (DavidPostMan)
SRV - [2010.11.20 15:44:11 | 000,487,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe -- (ADWS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP)
SRV - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Webbox\Code\webbox.exe -- (DavidWebBox)
SRV - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Dvgrab\Code\dvgrab.exe -- (DavidGrabbingServer)
SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe -- (ectisrv)
SRV - [2010.06.24 11:58:48 | 004,370,513 | ---- | M] (ESTOS GmbH) [On_Demand | Stopped] -- D:\Program Files (x86)\ESTOS\TapiServer\ETapiSrv.exe -- (etapisrv)
SRV - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe -- (emeta2)
SRV - [2010.06.06 17:26:40 | 001,665,536 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Replica\Code\replica.exe -- (DavidReplica)
SRV - [2010.06.06 17:06:04 | 001,578,496 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\showis\showis.exe -- (DavidShowInterfaceServices)
SRV - [2010.04.03 12:02:52 | 000,032,096 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe -- (MSSQLFDLauncher$DAVID) SQL Full-text Filter Daemon Launcher (DAVID)
SRV - [2010.04.03 12:00:10 | 000,146,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.04.03 12:00:08 | 000,059,744 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2010.03.19 12:25:30 | 000,167,424 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.25 21:43:40 | 001,291,776 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent)
SRV - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe -- (RIB NetCounterLM)
SRV - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe -- (Sentinel RMS License Manager)
SRV - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe -- (RIB.License.Server)
SRV - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.12.09 14:18:02 | 000,148,480 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\pbxpense\code\pbxpense.exe -- (DavidPBXpense)
SRV - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe -- (FreeSSHDService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.02 15:56:16 | 001,278,976 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\videocpt\code\VideoCapture.exe -- (DavidVideoCapture)
SRV - [2009.04.21 09:26:50 | 000,113,664 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\tvindex\tvindex.exe -- (DavidTVIndex)
SRV - [2009.04.10 12:33:54 | 000,245,760 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dvhost\CODE\dvhost.exe -- (DavidHost)
SRV - [2009.04.10 12:29:40 | 000,329,728 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dserver\Code\dserver.exe -- (DavidDiscussionServer)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Spooldienst)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Archivierungsdienst)
SRV - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) [Auto | Running] -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe -- (APCPBEAgent)
SRV - [2008.11.15 06:53:14 | 006,447,744 | ---- | M] () [Disabled | Stopped] -- D:\Program Files (x86)\Bitfarm-Archiv\mysql-5.1.30-win32\bin\mysqld.exe -- (Mysql-bf)
SRV - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\ADVANTAGE\Server\ads.exe -- (Advantage)
SRV - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe -- (WkSvw32.exe)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.21 15:52:36 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2011.11.24 10:58:44 | 000,078,208 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV:64bit: - [2011.10.07 10:31:42 | 000,321,536 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock)
DRV:64bit: - [2011.08.09 08:11:50 | 000,021,120 | ---- | M] (SafeNet Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb)
DRV:64bit: - [2011.06.17 21:54:22 | 000,313,696 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\RsFx0151.sys -- (RsFx0151)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.05 12:23:04 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2011.01.05 12:23:04 | 000,125,296 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:33:18 | 000,066,944 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\dfsrro.sys -- (DfsrRo)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:57:24 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp)
DRV:64bit: - [2010.11.20 11:57:17 | 000,181,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid)
DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.10.20 12:05:28 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (q57nd60a)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2010.02.22 13:02:18 | 000,156,776 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpCISSs2.sys -- (HpCISSs2)
DRV:64bit: - [2010.01.25 14:50:26 | 000,160,296 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpqilo2.sys -- (hpqilo2)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeamMP)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeam)
DRV:64bit: - [2009.08.07 08:59:18 | 000,016,896 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Wibukey2_64.sys -- (Wibukey2_64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,051,776 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\dfs.sys -- (DfsDriver)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 03:45:45 | 000,096,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sacdrv.sys -- (sacdrv)
DRV:64bit: - [2009.06.24 23:33:46 | 002,210,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ati2mtag.sys -- (ati2mtag)
DRV:64bit: - [2009.06.10 22:35:30 | 000,035,328 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qd260x64.sys -- (ioatdma) Intel(R)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.05.11 16:08:08 | 000,051,752 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqcidrv.sys -- (CpqCiDrv)
DRV:64bit: - [2006.11.22 06:20:00 | 000,107,008 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\WibuKey64.sys -- (WIBUKEY)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007.04.02 14:53:04 | 000,039,552 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapitd.sys -- (elcapitd)
DRV - [2007.01.23 16:28:30 | 000,151,296 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ELCAPI20.SYS -- (elcapi20)
DRV - [2007.01.23 16:21:46 | 000,113,600 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapibs.sys -- (elcapibs)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/SoftAdmin.htm
IE - HKCU\..\SearchScopes,DefaultScope = {EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: D:\PROGRAM FILES\ESET\ESET FILE SECURITY\MOZILLA THUNDERBIRD [2012.07.19 17:35:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird


O1 HOSTS File: ([2010.08.31 17:34:45 | 000,000,847 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.7.2 roihost
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company)
O4:64bit: - HKLM..\Run: [egui] D:\Program Files\ESET\ESET File Security\egui.exe (ESET)
O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found
O4 - HKCU..\Run: [ExtremeSync Background Scheduler] D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe (Super Flexible Software)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Ranges: Range1 ([file] in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053B40FB-8357-4177-95F4-70CBEF6040C5}: NameServer = 192.168.7.250,192.168.7.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF2345F7-E2F5-46DA-B8AC-1E3289CFAA40}: NameServer = 192.168.7.5,192.168.7.250
O18:64bit: - Protocol\Handler\hpapp - No CLSID value found
O18:64bit: - Protocol\Handler\hpapp\Apps - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\hpapp {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files (x86)\Compaq\Cpqacuxe\Bin\hpapp.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\hpapp\Apps - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (pwdssp.dll) - File not found
O29 - HKLM SecurityProviders - (pwdssp.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.20 16:38:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012.07.20 16:16:34 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.07.20 15:58:59 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.07.20 15:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.07.20 15:43:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.20 15:43:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.20 09:15:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET
[2012.07.20 09:13:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\temp
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.19 11:52:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker
[2012.07.19 11:03:35 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.19 10:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET

========== Files - Modified Within 30 Days ==========

[2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 16:38:19 | 000,003,009 | ---- | M] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:52:50 | 001,027,624 | ---- | M] () -- C:\ADS_ERR.ADT
[2012.07.20 15:52:50 | 000,018,944 | ---- | M] () -- C:\ADS_ERR.ADI
[2012.07.20 15:44:52 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job
[2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 09:21:19 | 000,001,994 | -H-- | M] () -- C:\Users\Administrator\Documents\Default.rdp
[2012.07.20 09:13:05 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.20 09:11:19 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\bd4040cn.dat
[2012.07.20 09:11:19 | 000,000,026 | ---- | M] () -- C:\Windows\BRPP2KA.INI
[2012.07.19 23:20:50 | 002,346,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.19 23:20:50 | 000,965,724 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.19 23:20:50 | 000,904,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.19 23:20:50 | 000,250,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.19 23:20:50 | 000,215,958 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.19 21:35:44 | 000,031,177 | ---- | M] () -- C:\ADS_ERR.adm
[2012.07.19 21:06:13 | 000,000,404 | ---- | M] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\tasks\komsthoeft_daten.job
[2012.07.19 17:29:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.19 12:29:36 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.07.17 09:42:43 | 000,000,766 | ---- | M] () -- C:\Windows\tobit.ini
[2012.07.12 03:36:36 | 000,312,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 03:29:15 | 000,000,376 | ---- | M] () -- C:\Windows\dtools.INI
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012.07.20 16:38:19 | 000,003,009 | ---- | C] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 15:43:15 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 09:13:05 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7 Host.lnk
[2012.07.20 09:13:05 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.19 21:06:13 | 000,000,404 | ---- | C] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 12:29:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.06.16 00:19:29 | 000,000,376 | ---- | C] () -- C:\Windows\dtools.INI
[2012.06.16 00:07:21 | 000,000,145 | ---- | C] () -- C:\Windows\BRICK.INI
[2011.07.19 17:23:54 | 000,000,600 | ---- | C] () -- C:\Users\Administrator\AppData\Local\PUTTY.RND
[2011.04.12 16:45:33 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\NetCapiConfig.exe
[2011.04.12 16:45:33 | 000,077,890 | ---- | C] () -- C:\Windows\SysWow64\CAPI2032.dll
[2011.04.12 16:34:05 | 000,090,624 | ---- | C] () -- C:\Windows\SysWow64\elalui32.dll
[2011.02.01 16:02:16 | 000,000,657 | ---- | C] () -- C:\Users\Administrator\static.key
[2011.01.05 08:57:25 | 000,017,563 | ---- | C] () -- C:\Windows\Q-Dir.ini
[2010.12.07 18:45:30 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL
[2010.12.07 18:45:30 | 000,099,840 | ---- | C] () -- C:\Windows\IMGMSGMO.dll
[2010.12.07 18:45:17 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI
[2010.12.07 18:44:35 | 000,000,766 | ---- | C] () -- C:\Windows\tobit.ini
[2010.12.07 18:42:34 | 008,283,136 | ---- | C] () -- C:\Windows\TOBITCLT.DLL
[2010.12.07 18:42:32 | 002,648,064 | ---- | C] () -- C:\Windows\SysWow64\DVMSG.DLL
[2010.12.07 18:42:32 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\dvccext.dll
[2010.12.07 18:20:28 | 000,000,047 | ---- | C] () -- C:\Windows\TOBITADD.INI
[2010.08.20 16:23:16 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini
[2010.08.18 23:15:32 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2010.08.17 13:57:31 | 000,000,153 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2010.08.17 13:57:31 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.08.17 13:57:31 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2010.08.17 13:56:59 | 000,020,605 | ---- | C] () -- C:\Windows\HL-4040CN.INI
[2010.08.17 13:56:44 | 000,000,471 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.08.17 13:56:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat
[2010.08.17 13:56:44 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010.08.17 13:56:26 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2010.08.17 13:56:25 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2010.08.12 21:53:59 | 000,001,247 | ---- | C] () -- C:\Windows\SysWow64\cygrunsrv.exe.stackdump
[2010.08.06 18:45:52 | 000,011,306 | ---- | C] () -- C:\Users\Administrator\gsview32.ini
[2010.08.03 16:14:20 | 000,003,843 | ---- | C] () -- C:\Users\Administrator\cadwin.ini
[2010.08.02 15:41:31 | 000,472,576 | ---- | C] () -- C:\Windows\SysWow64\ApolloCrypt.dll
[2010.08.02 15:41:31 | 000,059,392 | ---- | C] () -- C:\Windows\Bssudf.dll
[2010.07.26 09:46:12 | 000,001,164 | ---- | C] () -- C:\Users\Administrator\copyclient.ini
[2010.07.25 12:03:29 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\APCSnmp.dll
[2010.07.24 18:53:50 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth2.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth1.dll
[2010.07.24 18:53:49 | 000,000,095 | ---- | C] () -- C:\Windows\SysWow64\prsrvk.dll
[2010.07.24 18:53:49 | 000,000,072 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2010.07.24 17:47:47 | 000,000,521 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.07.24 17:44:53 | 000,001,680 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.07.24 10:47:28 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2010.07.24 10:47:28 | 000,000,204 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2010.07.23 17:06:05 | 000,196,608 | ---- | C] () -- C:\Windows\SysWow64\twxapi32.dll
[2010.07.23 13:52:45 | 002,353,740 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.06.08 13:45:20 | 000,003,076 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== LOP Check ==========

[2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core
[2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv
[2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS
[2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF
[2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo
[2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD
[2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer
[2012.05.30 15:40:53 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL
[2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++
[2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org
[2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir
[2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB
[2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer
[2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer
[2012.07.09 16:18:17 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit
[2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke
[2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\Tasks\komsthoeft_daten.job
[2011.03.17 04:00:38 | 000,019,396 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job

========== Purity Check ==========



< End of report >


Extras.txt:
OTL Extras logfile created on: 20.07.2012 17:14:55 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools
64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free
11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS
Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS
Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS

Computer Name: SERVER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 1
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 1
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06E50997-ADD9-4D37-90D5-8A935DAE2BCF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{07120A22-1219-4F57-8722-6DB09C1018D6}" = lport=139 | protocol=6 | dir=in | app=system |
"{1388AD42-6824-426D-A352-461445D16792}" = lport=6262 | protocol=17 | dir=in | name=advantage udp |
"{14D44A0F-1C11-4C3B-85CE-2A6B642A71E3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{15561199-F6AC-47A2-A82F-482944B7B23D}" = lport=6262 | protocol=6 | dir=in | name=advantage tcp |
"{18AC0313-F185-44B1-83BC-726898339B01}" = lport=5358 | protocol=6 | dir=in | app=system |
"{1BB83F8F-CC9A-4727-BC4E-23A901776132}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2B9EE05C-F86C-4E9D-8170-FB038AB44429}" = lport=138 | protocol=17 | dir=in | app=system |
"{31CEEA99-87E0-42EC-9489-77C382EA41F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{331E61FF-FA25-48C7-ABDD-F1FC4D15433A}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{34B16F1A-8BC7-41C7-9BFE-49C0C114D99D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3F5C7288-B263-4A2F-8259-E27A91BD46A7}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{3FA40EFE-DB37-4919-A151-72D58B4E8761}" = lport=3306 | protocol=6 | dir=in | name=mysql |
"{4743813F-3F8E-429D-BAB1-BA46E4212FC9}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{5263BFB3-5FE9-4806-98F9-9716927D53E0}" = lport=137 | protocol=17 | dir=in | app=system |
"{6B9BA7B2-0F3C-49C4-88EA-D9706761B728}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{6C1E1DF1-062E-4AB0-B142-282D6CBDF046}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{7694AA81-7B2E-401C-AE9B-B8BED1BF03AD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{779CC6AA-821F-48C6-9FB9-F5F726E66BFA}" = rport=139 | protocol=6 | dir=out | app=system |
"{831A6729-9581-40CB-A0D2-07E51A848DB4}" = rport=138 | protocol=17 | dir=out | app=system |
"{83F14079-9A9D-49D7-B9CB-9F56F1F59558}" = rport=5358 | protocol=6 | dir=out | app=system |
"{851DE5A8-F5E8-428D-9343-9615BB2DC15F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8704EEE9-9D3A-4830-B70E-FC7192911276}" = lport=6004 | protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office14\outlook.exe |
"{88644FA6-8681-43CF-9D73-8CD118147965}" = rport=137 | protocol=17 | dir=out | app=system |
"{8DC5178B-09AF-4D75-916D-4CA9A4B8DBB4}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{94E9D7A2-F550-4F2C-B85D-63D950B4472C}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B7B0B15-7CF5-4447-A9D7-27E3CF0B0BFC}" = lport=445 | protocol=6 | dir=in | app=system |
"{9D418EAE-D1AA-48D9-86D2-01B2DE7BA6C8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9DA7DD22-F5A9-488D-910F-4D7D82C6E3D5}" = lport=137 | protocol=17 | dir=in | app=system |
"{A49718FE-AB4E-40A0-A7CF-9A181F627664}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B27D098F-3604-45ED-9B8F-2E74453411C8}" = rport=137 | protocol=17 | dir=out | app=system |
"{B4A36897-19FD-4DE5-A164-92A14143196D}" = rport=445 | protocol=6 | dir=out | app=system |
"{BB123C8F-C146-46F7-B05C-A7A5383A240F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D0167492-83FD-4482-B711-D2F08994476E}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{E403A58F-BFF3-421C-BD86-6B274137914C}" = lport=5357 | protocol=6 | dir=in | app=system |
"{E6B756FD-19A8-4E1B-82BE-8BF841DB51CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E996943A-B8E9-4BA9-87C0-F6A9CEFD9FB1}" = rport=5357 | protocol=6 | dir=out | app=system |
"{EB68839E-62FD-4B1B-8DDF-CE9F611D664B}" = rport=138 | protocol=17 | dir=out | app=system |
"{EC22F5F0-66FC-4EF4-B117-A56961A7DF76}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{F3FFE92F-C133-43C5-9274-0EB77D35E247}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{F4B757F6-BE22-4DA8-8FF9-4172D33B2601}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F79D295C-4BA2-4F4C-95EA-FBBA19465E33}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F8EAA3F0-0F6E-4201-92EC-7F1FBDD6285B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{087DBC19-5A42-4487-84ED-EC490AA43F6C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{13B40177-C7F4-4813-A9FB-2AB547E814BD}" = protocol=17 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe |
"{27F5776E-5787-47E3-AA7F-16A0232F1B33}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe |
"{2CBBC0DD-F0D9-414A-9BA6-4A0846C2C4B6}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) |
"{31CBB4F6-AE73-4BF4-AA41-F4B569988F56}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe |
"{38869D43-357A-41F4-BB6F-13D4DD7C9592}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{411BFE4D-301E-4EAB-8FF8-ED11865F5EEC}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{41ABE070-77B9-449C-BE4F-C47D74002CB7}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) |
"{421EA704-C1C2-40C5-B979-B94E053C6303}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{42BA6D81-33F3-4CAF-840A-F34B4503B471}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{49F5E4DD-9BFE-424A-A461-069300FC0F78}" = protocol=6 | dir=out | app=system |
"{53BF4A4A-7854-4D78-8B2B-8EE2FDE7D453}" = protocol=6 | dir=in | app=d:\david\code\sl.exe |
"{58622F99-00BE-4C15-A2B6-7D4D4EB2EDE7}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{5A8F8ED4-D3B6-4EAB-96F8-EAB1FF408A7A}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe |
"{6AF04484-4352-45A1-ADD3-40D3753D9685}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe |
"{7032D7C3-F2CA-4CD7-B0A0-9656925E993B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{754EDA6E-4AEC-4BE4-A6CC-6E9D555796CD}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{85259848-E949-4B67-853E-0E2CB47635FB}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{99E394E2-A39F-44AF-A46C-56C99AC85521}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe |
"{A13700BC-C658-44BC-9BFA-C450E00F37B9}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{A8124960-8564-4795-BD63-6B73CDF95FCB}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{C3D6F1D6-D79C-47B1-87EE-F62129C1C57F}" = protocol=6 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe |
"{DAA522E0-7443-4CD1-A91B-0A3A32417F3C}" = protocol=17 | dir=in | app=d:\david\code\sl.exe |
"{FC9754A1-E3C8-4DAF-86E2-9DE69A9C48B1}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00060000-0000-1004-8002-0000C06B5161}" = WIBU-KEY Setup (WIBU-KEY Remove)
"{01078B88-2981-4F75-96B0-8B22E2D2DE03}" = Microsoft SQL Server 2008 R2 Setup (English)
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F27A9B5-63FD-43DB-8230-FFE1E9CFE2C4}" = HP Smart Array SAS/SATA Event Notification Service
"{234F6B0D-10AE-4BB7-B2F3-E48D4861952D}" = SQL Server 2008 R2 SP1 Common Files
"{288D79EE-A2D1-42AF-9597-B0ADCC23A8ED}" = Microsoft SQL Server VSS Writer
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{2E97856A-345A-475D-913C-B8A78406BDF6}" = HP Lights-Out Online Configuration Utility
"{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1
"{36F70DEE-1EBF-4707-AFA2-E035EEAEBAA1}" = SQL Server 2008 R2 SP1 Common Files
"{471AAD2C-9078-4DAC-BD43-FA10FB7C3FCE}" = Microsoft SQL Server 2008 R2 Native Client
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{74D49383-7EF9-4FD3-B5B0-73CA22F51CE8}" = HP ProLiant Remote Monitor Service
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client
"{9DFA5914-C275-42E0-810E-C88E46A7F9EA}" = SQL Server 2008 R2 SP1 Full text search
"{A2122A9C-A699-4365-ADF8-68FEAC125D61}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B40EE88B-400A-4266-A17B-E3DE64E94431}" = Microsoft SQL Server 2008 Setup Support Files
"{BDD79957-5801-4A2D-B09E-852E7FA64D01}" = Windows Internal Database (MICROSOFT##SSEE)
"{BF7B0C91-5AF6-46B7-91CE-C8DD3D36E4BD}" = MySQL Server 5.1
"{C450F717-C461-4D47-93C3-6D93779AD5C9}" = ESET File Security
"{C942A025-A840-4BF2-8987-849C0DD44574}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{D32B3BF4-4019-4D62-8400-6B2E16CDEA23}" = HP ProLiant Integrated Management Log Viewer
"{D64C20F4-C49B-476C-A0D1-7813D954ED12}" = VanDyke Software Client Pack 6.5
"{D8C23BDE-4748-44D9-A9DD-8AB64EB18BE3}" = Microsoft SQL Server 2008 R2 RsFx Driver
"{DCEA910B-3269-4F5B-A915-D59293004751}" = HP Insight Diagnostics Online Edition for Windows
"{E7814BDC-DC36-4181-B765-E34FD673F957}" = RIB Lizenzmanagement
"{F31183CF-E10F-4DE1-BB59-6C0FF38E481E}" = Sql Server Customer Experience Improvement Program
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = SQL Server 2008 R2 SP1 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = SQL Server 2008 R2 SP1 Database Engine Services
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"GPL Ghostscript 9.04" = GPL Ghostscript
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 R2 (64-bit)
"Microsoft SQL Server 2008 R2" = Microsoft SQL Server 2008 R2 (64-bit)
"PDF-XChange 3_is1" = PDF-XChange 3
"Redirection Port Monitor" = RedMon - Druckeranschluß-Umleitungsmonitor

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0DE5137F-581B-448C-AF70-9498EF364E34}" = Advantage Database Server for Windows v9.10
"{14A5045C-33EE-4596-AA69-8761611AE8EB}" = HP Array Configuration Utility CLI
"{173438F5-BD4D-47AE-9C8F-73E6BAA62624}" = PFA Server Registry Update
"{19382EF6-8D47-4C3C-AA57-D2D2CDF03828}" = elmeg PABX TAPI V1.32
"{23170F69-40C1-2701-0464-000001000000}" = 7-Zip 4.64
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (KAV_CS_ADMIN_KIT)
"{34D6E797-AA32-455D-8E65-4EBD1AC9DED7}" = HP ProLiant PCI-express Power Management Update for Windows
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5563B6-DE0A-4F3B-A5D6-15789FD12D9B}" = Headless Server Registry Update
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"{5A5F45AE-0250-4C34-9D89-F10BDDEE665F}" = HP Version Control Agent
"{5DADDACD-0B7B-4E48-908E-C451D16AACA6}" = David.InfoCenter
"{640A92A1-9B8B-4C80-B412-9595460EBC53}_is1" = TopKontor Handwerk Version 5
"{65B1D8AD-D8ED-4EF0-89FC-CA211C63130A}" = HP Array Diagnostics Utility CLI
"{6AFCC61D-7273-4F30-8A3A-5733FD771F82}" = HP Array Diagnostic Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{717F49F9-BCE2-4D3F-97D8-EC3A36B3CF77}" = ESTOS CtiServer Multiline Tapi
"{74C48700-A6A7-4B3D-BD3A-C4E131CDD8E8}" = HP Array Configuration Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7CB265A0-4179-4A15-A993-7A12E8A88D28}" = ESTOS CtiServer
"{80AB11C2-0313-4A32-932C-12048D758BDF}" = Brother HL-4040CN
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{884F6891-633B-4BCA-B08E-A702EDF038E4}" = ESET Remote Administrator Server
"{8CD7E3FE-74F8-49E4-8B4F-EE038D507132}" = Microsoft Tool Web Package : DELSRV.EXE
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARD_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_STANDARD_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2010
"{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{E8AA7558-2024-4C5A-9691-62F9946E06F7}" =
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.OUTLOOK_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.OUTLOOK_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.OUTLOOK_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.OUTLOOK_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.OUTLOOK_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2D3436-AD2B-418B-A87E-862F583DDB61}" = elmeg LAN-CAPI
"{A5A50F99-4BA2-4457-A3A3-96C11050F243}" = bitfarm-Archiv
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{BCE9F441-9027-4911-82E0-5FB28057897D}" = APC PowerChute Business Edition Agent
"{BF9BF038-FE03-429D-9B26-2FA0FD756052}" = Microsoft SQL Server Browser
"{C676B806-E3E0-4CD5-8BB9-70DBE183B8E1}" = ESTOS ProCall Enterprise / TapiServer
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{D3A77E10-5987-42C3-9EF3-84F24E446693}" = ESTOS MetaDirectory
"{D9EF2DA1-0B4E-44B0-93E3-2A1B05030100}" = OpenSSH for Windows
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FCB10DE3-E190-4A7E-B06A-FAC61567ABFC}" = MySQL Tools for 5.0
"{FD9832CE-6761-4126-95F2-1FD7E1E9E74F}" = ESET Remote Administrator Console
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"70DBC326-7505-4913-A0C1-C6BD87C1859D_is1" = freeSSHd 1.2.6
"Advanced Port Scanner v1.3" = Advanced Port Scanner v1.3
"bitfarm-Archiv" = bitfarm-Archiv (remove only)
"BRICKware_is1" = BRICKware 7.5.4
"CAD Viewer 8.0" = CAD Viewer 8.0
"David" = David.fx
"ESET Online Scanner" = ESET Online Scanner v3
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.63" = GPL Ghostscript 8.63
"GSview 4.9" = GSview 4.9
"InstallShield_{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1
"InstallShield_{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MPE" = MyPhoneExplorer
"Notepad++" = Notepad++
"Office14.OUTLOOK" = Microsoft Outlook 2010
"OpenVPN" = OpenVPN 2.1.4
"Q-Dir" = Q-Dir
"Romey CopyCad_is1" = Romey CopyCad 1.0
"Romey CopyClient_is1" = Romey CopyClient 1.0
"STANDARD" = Microsoft Office Standard 2007
"Super Flexible File Synchronizer_is1" = Super Flexible File Synchronizer v4.97
"TeamViewer 7 Host" = TeamViewer 7 Host
"TightVNC_is1" = TightVNC 1.3.10
"Wilbur" = Wilbur (remove only)

========== Last 20 Event Log Errors ==========

[ Active Directory Web Services Events ]
Error - 15.12.2010 22:34:19 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206
Description =

Error - 27.04.2012 00:57:28 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206
Description =

[ Application Events ]
Error - 19.07.2012 07:22:06 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 19.07.2012 08:09:11 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 19.07.2012 11:19:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193
Description =

Error - 19.07.2012 11:20:20 | Computer Name = Server.GK.local | Source = MySQL | ID = 100
Description = The update log is no longer supported by MySQL in version 5.0 and
above. It is replaced by the binary log. For more information, see Help and Support
Center at hxxp://www.mysql.com.

Error - 19.07.2012 11:30:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193
Description =

Error - 19.07.2012 11:31:24 | Computer Name = Server.GK.local | Source = MySQL | ID = 100
Description = The update log is no longer supported by MySQL in version 5.0 and
above. It is replaced by the binary log. For more information, see Help and Support
Center at hxxp://www.mysql.com.

Error - 19.07.2012 14:00:01 | Computer Name = Server.GK.local | Source = MySQL Administrator | ID = 1
Description =

Error - 19.07.2012 18:36:33 | Computer Name = Server.GK.local | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files
(x86)\blue solution\handwerk 5\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"d:\program files (x86)\blue solution\handwerk 5\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 20.07.2012 02:23:52 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 20.07.2012 03:32:10 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

[ DFS Replication Events ]
Error - 08.06.2010 07:22:53 | Computer Name = Server | Source = DFSR | ID = 1202
Description = Der DFS-Replikationsdienst konnte keine Verbindung mit dem Domänencontroller
"" zum Zugriff auf die Konfigurationsinformationen herstellen. Die Replikation wurde
beendet. Der Dienst wiederholt den Vorgang beim nächsten Konfigurationsabfragezyklus,
der in 60 Minuten eintritt. Dieses Ereignis kann durch TCP/IP-Verbindungs-, Firewall-,
Active Directory-Domänendienste- oder DNS-Probleme verursacht werden. Weitere Informationen:
Fehler: 1355 (Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung
hergestellt werden.)

[ DNS Server Events ]
Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.250
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.250 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407
Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2
nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server
bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407
Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2
nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server
bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

[ System Events ]
Error - 26.08.2011 12:06:08 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 13:06:13 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 15:06:14 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 17:06:12 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 18:06:16 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 20:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 22:07:44 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 00:07:43 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 02:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 04:07:47 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =


< End of report >


Besten Dank im Vorraus !

Joe

Alt 23.07.2012, 11:34   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Was machst du zu Hause mit einem Windows-Server?
Oder bist du Netzwerk- und Systemadmin in einer Firma?

Code:
ATTFilter
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local
         
Domäne deiner Firma?
__________________

__________________

Alt 23.07.2012, 19:29   #3
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



.. ist ein Server auf der Arbeit, Firma meiner Brüder, darf mich unteranderem um die IT kümmern....

"GK" ist die Domäne.
__________________

Alt 24.07.2012, 14:42   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Firmenrechner werden hier eigentlich nicht bereinigt

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html

Zitat:
3. Grundsätzlich bereinigen wir keine gewerblich genutzten Rechner. Dafür ist die IT Abteilung eurer Firma zuständig.

Bei Kleinunternehmen, welche keinen IT Support haben, machen wir da eine Ausnahme und helfen gerne ( kleine Spende hilft auch uns ).
Voraussetzung: Ihr teilt uns dies in eurer ersten Antwort mit.
Bedenkt jedoch, dass Logfiles viele heikle Informationen enthalten können ( Kundendaten, Bankdaten, etc ) sowie das Malware die Möglichkeit besitzt, diese auszuspähen und zu missbrauchen. Hier legen wir euch ein Formatieren und Neuaufsetzen nahe.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 25.07.2012, 07:32   #5
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



..sorry, das hab ich nicht gelesen.
Ein Kleinunternehmen sind wir aber auf jedenfall, einen eigenen IT-Support haben wir nicht, wie schon geschrieben, kümmere mach selbst drum, bin aber nicht auf allen Bereichen so erfahren....

Also wenn jmd. helfen könnte, wär das schon super!


Alt 25.07.2012, 11:34   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________
--> Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D

Alt 27.07.2012, 18:27   #7
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



ne leider nicht, bin erst "aufgewacht" nachdem Eset Nod32 mit den ersten Meldungen kam... daraufhin erst mit Malwarebytes gescannt...

Alt 27.07.2012, 22:36   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Also wenn Adware auf eurem SERVER drauf ist, dann solltest ihr mal überlegen, ob man unbedingt diese und jene Software unbedingt auf dem SERVER benötigt! Sowas sollte wohl überlegt sein - aber der Trend geht ja mittlerweile leider dahin, dass wirklich jeder den erstbesten Google-Link anklickt wenn er nach Software sucht und meistens landet man dann bei Softonic

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 28.07.2012, 11:32   #9
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



..tja, normalerweise achte ich da schon drauf, was ist installiere,wenns denn über Softonic läuft, klick ich normal auch alles andere aus, aber scheinbar hab ich wohl doch nicht gut genug aufgepasst...

Gemäß nachfolgendem Log gibst doch "nur" die Quickstore Toolbar.
Die wird doch nicht der Grund sein, warum die Firewall nicht starten darf, oder ?

Hier der Log:

# AdwCleaner v1.703 - Logfile created 07/28/2012 at 11:24:17
# Updated 20/07/2012 by Xplode
# Operating system : Windows Server 2008 R2 Standard Service Pack 1 (64 bits)
# User : Administrator - SERVER
# Running from : C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJOG1EJ9\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\advantage
Folder Found : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
File Found : C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Found : C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url

***** [Registry] *****

Key Found : HKCU\Software\Headlight
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Description
[x64] Key Found : HKCU\Software\Headlight
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Description

***** [Registre - GUID] *****

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1276 octets] - [28/07/2012 11:24:17]

########## EOF - C:\AdwCleaner[R1].txt - [1404 octets] ##########

Alt 29.07.2012, 00:11   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Dir ist klar, dass wir für die Bereinigung mehrere Neustarts des Windows-Servers benötigen?

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 30.07.2012, 08:47   #11
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



# AdwCleaner v1.703 - Logfile created 07/30/2012 at 07:44:51
# Updated 20/07/2012 by Xplode
# Operating system : Windows Server 2008 R2 Standard Service Pack 1 (64 bits)
# User : Administrator - SERVER
# Running from : C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJOG1EJ9\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\advantage
Folder Deleted : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
File Deleted : C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Deleted : C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url

***** [Registry] *****

Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Description
[x64] Key Deleted : HKLM\SOFTWARE\Description

***** [Registre - GUID] *****

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1399 octets] - [28/07/2012 11:24:17]
AdwCleaner[S1].txt - [1268 octets] - [30/07/2012 07:44:51]

########## EOF - C:\AdwCleaner[S1].txt - [1396 octets] ##########

Alt 30.07.2012, 09:01   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 30.07.2012, 12:06   #13
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



1.) Der normale Windows-Modus funktioniert wie auch zuvor, lediglich der Aufruf der Firewall klappt weiterhin nicht, dies wird durch irgendwas im System unterdrückt...
2.) nein, vermisse nichts, gibt auch keine leeren Ordner...

Server verhält sich grundsätzlich unauffällig, bin nur über die "Virenfunde" und die nicht starten wollende Firewall skeptisch geworden, ob da alles in Ordnung ist..

Alt 30.07.2012, 17:09   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 30.07.2012, 18:22   #15
joe1681978
 
Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Standard

Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D



OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 30.07.2012 18:11:12 - Run 2
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Administrator\Desktop
64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,99 Gb Total Physical Memory | 3,24 Gb Available Physical Memory | 54,12% Memory free
11,98 Gb Paging File | 8,90 Gb Available in Paging File | 74,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 125,00 Gb Total Space | 63,99 Gb Free Space | 51,19% Space Free | Partition Type: NTFS
Drive D: | 125,00 Gb Total Space | 15,11 Gb Free Space | 12,09% Space Free | Partition Type: NTFS
Drive E: | 215,73 Gb Total Space | 3,73 Gb Free Space | 1,73% Space Free | Partition Type: NTFS
 
Computer Name: SERVER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.30 18:06:56 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
PRC - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe
PRC - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe
PRC - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe
PRC - [2011.03.20 19:11:40 | 010,406,152 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VersionBackup.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) -- D:\David\Code\sl.exe
PRC - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) -- D:\David\Apps\Maserver\CODE\maserver.exe
PRC - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) -- D:\David\Apps\Postman\Code\postman.exe
PRC - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\snmp.exe
PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- c:\Windows\SysWOW64\cmd.exe
PRC - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) -- D:\David\Apps\Webbox\Code\webbox.exe
PRC - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) -- D:\David\Apps\Dvgrab\Code\dvgrab.exe
PRC - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe
PRC - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe
PRC - [2010.06.12 12:02:00 | 000,754,160 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VBackRun.exe
PRC - [2010.06.12 12:01:58 | 001,303,040 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VBackDisplay.exe
PRC - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe
PRC - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe
PRC - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe
PRC - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
PRC - [2010.01.13 04:10:00 | 006,352,896 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
PRC - [2009.12.22 16:29:10 | 000,193,536 | ---- | M] (Tobit.Software) -- C:\Windows\SysWOW64\DV4TS.EXE
PRC - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe
PRC - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe
PRC - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe
PRC - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\ADVANTAGE\Server\ads.exe
PRC - [2006.11.22 06:20:00 | 003,768,320 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
PRC - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe
MOD - [2008.11.23 20:11:17 | 000,086,520 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\VBZip2R.dll
MOD - [2007.02.09 13:13:40 | 000,050,176 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\csc32.dll
MOD - [2006.12.15 08:39:42 | 000,113,664 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\see32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.12.26 08:45:13 | 000,696,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dns.exe -- (DNS)
SRV:64bit: - [2010.11.20 15:26:05 | 000,729,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpssvc.dll -- (DHCPServer)
SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP)
SRV:64bit: - [2010.11.20 15:25:02 | 001,020,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ntfrs.exe -- (NtFrs)
SRV:64bit: - [2010.11.20 15:24:50 | 000,059,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ismserv.exe -- (IsmServ)
SRV:64bit: - [2010.11.20 15:24:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\inetsrv\inetinfo.exe -- (IISADMIN)
SRV:64bit: - [2010.11.20 15:24:38 | 004,518,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfsrs.exe -- (DFSR)
SRV:64bit: - [2010.11.20 15:24:38 | 000,377,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfssvc.exe -- (Dfs)
SRV:64bit: - [2010.01.25 14:50:28 | 000,017,960 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\sysdown.exe -- (sysdown)
SRV:64bit: - [2009.07.14 03:41:53 | 000,014,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sacsvr.dll -- (sacsvr)
SRV:64bit: - [2009.07.14 03:40:52 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FCRegSvc.dll -- (FCRegSvc)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.07.14 03:39:31 | 000,091,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rsopprov.exe -- (RSoPProv)
SRV:64bit: - [2008.11.14 12:21:50 | 000,022,568 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\cpqrcmc.exe -- (CpqRcmc)
SRV - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe -- (ERA_SERVER)
SRV - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) [On_Demand | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe -- (ERA_HTTP_SERVER)
SRV - [2012.05.14 07:19:22 | 000,042,408 | ---- | M] (ESET) [On_Demand | Stopped] -- D:\Program Files\ESET\ESET File Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) [Auto | Running] -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe -- (ekrn)
SRV - [2011.06.17 22:28:12 | 000,431,456 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$DAVID)
SRV - [2011.06.17 22:22:56 | 062,111,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe -- (MSSQL$DAVID)
SRV - [2010.12.10 18:34:52 | 039,627,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -- (MSSQL$MICROSOFT##SSEE)
SRV - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Code\sl.exe -- (DavidServiceLayer)
SRV - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Maserver\CODE\maserver.exe -- (DavidMailAccessServer)
SRV - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Postman\Code\postman.exe -- (DavidPostMan)
SRV - [2010.11.20 15:44:11 | 000,487,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe -- (ADWS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP)
SRV - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Webbox\Code\webbox.exe -- (DavidWebBox)
SRV - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Dvgrab\Code\dvgrab.exe -- (DavidGrabbingServer)
SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe -- (ectisrv)
SRV - [2010.06.24 11:58:48 | 004,370,513 | ---- | M] (ESTOS GmbH) [On_Demand | Stopped] -- D:\Program Files (x86)\ESTOS\TapiServer\ETapiSrv.exe -- (etapisrv)
SRV - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe -- (emeta2)
SRV - [2010.06.12 12:02:00 | 000,754,160 | ---- | M] (SB-AW) [Auto | Running] -- D:\Program Files (x86)\VersionBackup\VBackRun.exe -- (VersionBackup)
SRV - [2010.06.06 17:26:40 | 001,665,536 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Replica\Code\replica.exe -- (DavidReplica)
SRV - [2010.06.06 17:06:04 | 001,578,496 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\showis\showis.exe -- (DavidShowInterfaceServices)
SRV - [2010.04.03 12:02:52 | 000,032,096 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe -- (MSSQLFDLauncher$DAVID)
SRV - [2010.04.03 12:00:10 | 000,146,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.04.03 12:00:08 | 000,059,744 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2010.03.19 12:25:30 | 000,167,424 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.25 21:43:40 | 001,291,776 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent)
SRV - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe -- (RIB NetCounterLM)
SRV - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe -- (Sentinel RMS License Manager)
SRV - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe -- (RIB.License.Server)
SRV - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.12.09 14:18:02 | 000,148,480 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\pbxpense\code\pbxpense.exe -- (DavidPBXpense)
SRV - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe -- (FreeSSHDService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.02 15:56:16 | 001,278,976 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\videocpt\code\VideoCapture.exe -- (DavidVideoCapture)
SRV - [2009.04.21 09:26:50 | 000,113,664 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\tvindex\tvindex.exe -- (DavidTVIndex)
SRV - [2009.04.10 12:33:54 | 000,245,760 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dvhost\CODE\dvhost.exe -- (DavidHost)
SRV - [2009.04.10 12:29:40 | 000,329,728 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dserver\Code\dserver.exe -- (DavidDiscussionServer)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Spooldienst)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Archivierungsdienst)
SRV - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) [Auto | Running] -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe -- (APCPBEAgent)
SRV - [2008.11.15 06:53:14 | 006,447,744 | ---- | M] () [Disabled | Stopped] -- D:\Program Files (x86)\Bitfarm-Archiv\mysql-5.1.30-win32\bin\mysqld.exe -- (Mysql-bf)
SRV - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\ADVANTAGE\Server\ads.exe -- (Advantage)
SRV - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe -- (WkSvw32.exe)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.21 15:52:36 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2011.11.24 10:58:44 | 000,078,208 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV:64bit: - [2011.10.07 10:31:42 | 000,321,536 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock)
DRV:64bit: - [2011.08.09 08:11:50 | 000,021,120 | ---- | M] (SafeNet Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb)
DRV:64bit: - [2011.06.17 21:54:22 | 000,313,696 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\RsFx0151.sys -- (RsFx0151)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.05 12:23:04 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2011.01.05 12:23:04 | 000,125,296 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2010.11.30 11:03:06 | 000,321,424 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cbfs3.sys -- (cbfs3)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:33:18 | 000,066,944 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\dfsrro.sys -- (DfsrRo)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:57:24 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp)
DRV:64bit: - [2010.11.20 11:57:17 | 000,181,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid)
DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.10.20 12:05:28 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (q57nd60a)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2010.02.22 13:02:18 | 000,156,776 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpCISSs2.sys -- (HpCISSs2)
DRV:64bit: - [2010.01.25 14:50:26 | 000,160,296 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpqilo2.sys -- (hpqilo2)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeamMP)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeam)
DRV:64bit: - [2009.08.07 08:59:18 | 000,016,896 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Wibukey2_64.sys -- (Wibukey2_64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,051,776 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\dfs.sys -- (DfsDriver)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 03:45:45 | 000,096,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sacdrv.sys -- (sacdrv)
DRV:64bit: - [2009.06.24 23:33:46 | 002,210,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ati2mtag.sys -- (ati2mtag)
DRV:64bit: - [2009.06.10 22:35:30 | 000,035,328 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qd260x64.sys -- (ioatdma)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.05.11 16:08:08 | 000,051,752 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqcidrv.sys -- (CpqCiDrv)
DRV:64bit: - [2006.11.22 06:20:00 | 000,107,008 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\WibuKey64.sys -- (WIBUKEY)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007.04.02 14:53:04 | 000,039,552 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapitd.sys -- (elcapitd)
DRV - [2007.01.23 16:28:30 | 000,151,296 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ELCAPI20.SYS -- (elcapi20)
DRV - [2007.01.23 16:21:46 | 000,113,600 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapibs.sys -- (elcapibs)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = 
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = 
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/SoftAdmin.htm
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes,DefaultScope = {EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes\{EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: D:\PROGRAM FILES\ESET\ESET FILE SECURITY\MOZILLA THUNDERBIRD [2012.07.19 17:35:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
 
 
O1 HOSTS File: ([2010.08.31 17:34:45 | 000,000,847 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.7.2 roihost
O2:64bit: - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company)
O4:64bit: - HKLM..\Run: [egui] D:\Program Files\ESET\ESET File Security\egui.exe (ESET)
O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found
O4 - HKU\S-1-5-21-945631898-3404820810-274502779-500..\Run: [ExtremeSync Background Scheduler] D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe (Super Flexible Software)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Ranges: Range1 ([file] in Local intranet)
O15 - HKU\S-1-5-21-945631898-3404820810-274502779-500\..Trusted Ranges: Range1 ([http] in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053B40FB-8357-4177-95F4-70CBEF6040C5}: NameServer = 192.168.7.250,192.168.7.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF2345F7-E2F5-46DA-B8AC-1E3289CFAA40}: NameServer = 192.168.7.5,192.168.7.250
O18:64bit: - Protocol\Handler\hpapp - No CLSID value found
O18:64bit: - Protocol\Handler\hpapp\Apps - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\hpapp {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files (x86)\Compaq\Cpqacuxe\Bin\hpapp.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\hpapp\Apps - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) -  File not found
O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O29:64bit: - HKLM SecurityProviders - (pwdssp.dll) -  File not found
O29 - HKLM SecurityProviders - (pwdssp.dll) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
NetSvcs:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - D:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - D:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - D:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: UnlockerAssistant - hkey= - key= -  File not found
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation)
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: TabletInputService - Service
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WudfRd - Driver
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: TabletInputService - Service
SafeBootMin: vmms - Service
SafeBootMin: WudfRd - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NativeWifiP - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation)
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TabletInputService - Service
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: Wlansvc - Service
SafeBootNet:64bit: WudfRd - Driver
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NativeWifiP - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TabletInputService - Service
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: Wlansvc - Service
SafeBootNet: WudfRd - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {A509B1A7-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iesetup.dll",IEHardenAdmin
ActiveX:64bit: {A509B1A8-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iesetup.dll",IEHardenUser
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A509B1A7-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iesetup.dll",IEHardenAdmin
ActiveX: {A509B1A8-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iesetup.dll",IEHardenUser
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
CREATERESTOREPOINT
System Restore Service not available.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.30 18:07:24 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.07.23 14:54:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SB-AW
[2012.07.21 12:05:09 | 000,000,000 | ---D | C] -- C:\TMP
[2012.07.21 12:04:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VersionBackup
[2012.07.21 12:04:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VersionBackup
[2012.07.20 23:14:41 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup
[2012.07.20 23:04:20 | 000,216,856 | ---- | C] (EldoS Corporation) -- C:\Windows\SysWow64\CbFsNetRdr3.dll
[2012.07.20 23:04:20 | 000,188,696 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\CbFsMntNtf3.dll
[2012.07.20 23:04:20 | 000,155,416 | ---- | C] (EldoS Corporation) -- C:\Windows\SysWow64\CbFsMntNtf3.dll
[2012.07.20 23:04:20 | 000,139,032 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\CbFsNetRdr3.dll
[2012.07.20 23:04:18 | 000,321,424 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\drivers\cbfs3.sys
[2012.07.20 16:38:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012.07.20 16:16:34 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.07.20 15:58:59 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.07.20 15:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.07.20 15:43:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.20 15:43:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.20 09:15:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET
[2012.07.20 09:13:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\temp
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.19 11:52:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker
[2012.07.19 11:03:35 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.19 10:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.30 18:06:56 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.07.30 14:43:41 | 001,027,624 | ---- | M] () -- C:\ADS_ERR.ADT
[2012.07.30 14:43:41 | 000,018,944 | ---- | M] () -- C:\ADS_ERR.ADI
[2012.07.30 14:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.30 13:37:06 | 000,000,026 | ---- | M] () -- C:\Windows\BRPP2KA.INI
[2012.07.30 13:37:05 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\bd4040cn.dat
[2012.07.30 12:00:22 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job
[2012.07.30 12:00:13 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.30 11:49:41 | 000,000,766 | ---- | M] () -- C:\Windows\tobit.ini
[2012.07.30 08:56:25 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 08:56:25 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 08:54:51 | 002,346,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.30 08:54:51 | 000,965,724 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.30 08:54:51 | 000,904,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.30 08:54:51 | 000,250,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.30 08:54:51 | 000,215,958 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.30 08:45:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.29 20:00:03 | 000,000,696 | ---- | M] () -- C:\Windows\tasks\komsthoeft_daten.job
[2012.07.28 11:24:05 | 000,632,049 | ---- | M] () -- C:\Users\Administrator\Desktop\adwcleaner.exe
[2012.07.27 14:28:24 | 000,031,177 | ---- | M] () -- C:\ADS_ERR.adm
[2012.07.21 12:04:08 | 000,000,737 | ---- | M] () -- C:\Users\Administrator\Desktop\VersionBackup.lnk
[2012.07.21 12:04:07 | 000,000,870 | ---- | M] () -- C:\Users\Administrator\Desktop\VB-Shutdown.lnk
[2012.07.21 12:04:07 | 000,000,863 | ---- | M] () -- C:\Users\Administrator\Desktop\Backup-Browser.lnk
[2012.07.21 12:04:07 | 000,000,723 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VersionBackup.lnk
[2012.07.20 16:38:19 | 000,003,009 | ---- | M] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:44:52 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 09:21:19 | 000,001,994 | -H-- | M] () -- C:\Users\Administrator\Documents\Default.rdp
[2012.07.20 09:13:05 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.19 21:06:13 | 000,000,404 | ---- | M] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 12:29:36 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.07.12 03:36:36 | 000,312,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 03:29:15 | 000,000,376 | ---- | M] () -- C:\Windows\dtools.INI
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.07.30 07:43:51 | 000,632,049 | ---- | C] () -- C:\Users\Administrator\Desktop\adwcleaner.exe
[2012.07.21 12:04:08 | 000,000,737 | ---- | C] () -- C:\Users\Administrator\Desktop\VersionBackup.lnk
[2012.07.21 12:04:07 | 000,000,870 | ---- | C] () -- C:\Users\Administrator\Desktop\VB-Shutdown.lnk
[2012.07.21 12:04:07 | 000,000,863 | ---- | C] () -- C:\Users\Administrator\Desktop\Backup-Browser.lnk
[2012.07.21 12:04:07 | 000,000,723 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VersionBackup.lnk
[2012.07.20 16:38:19 | 000,003,009 | ---- | C] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 15:43:15 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 09:13:05 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7 Host.lnk
[2012.07.20 09:13:05 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.19 21:06:13 | 000,000,404 | ---- | C] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 12:29:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.06.16 00:19:29 | 000,000,376 | ---- | C] () -- C:\Windows\dtools.INI
[2012.06.16 00:07:21 | 000,000,145 | ---- | C] () -- C:\Windows\BRICK.INI
[2011.07.19 17:23:54 | 000,000,600 | ---- | C] () -- C:\Users\Administrator\AppData\Local\PUTTY.RND
[2011.04.12 16:45:33 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\NetCapiConfig.exe
[2011.04.12 16:45:33 | 000,077,890 | ---- | C] () -- C:\Windows\SysWow64\CAPI2032.dll
[2011.04.12 16:34:05 | 000,090,624 | ---- | C] () -- C:\Windows\SysWow64\elalui32.dll
[2011.02.01 16:02:16 | 000,000,657 | ---- | C] () -- C:\Users\Administrator\static.key
[2011.01.05 08:57:25 | 000,017,563 | ---- | C] () -- C:\Windows\Q-Dir.ini
[2010.12.07 18:45:30 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL
[2010.12.07 18:45:30 | 000,099,840 | ---- | C] () -- C:\Windows\IMGMSGMO.dll
[2010.12.07 18:45:17 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI
[2010.12.07 18:44:35 | 000,000,766 | ---- | C] () -- C:\Windows\tobit.ini
[2010.12.07 18:42:34 | 008,283,136 | ---- | C] () -- C:\Windows\TOBITCLT.DLL
[2010.12.07 18:42:32 | 002,648,064 | ---- | C] () -- C:\Windows\SysWow64\DVMSG.DLL
[2010.12.07 18:42:32 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\dvccext.dll
[2010.12.07 18:20:28 | 000,000,047 | ---- | C] () -- C:\Windows\TOBITADD.INI
[2010.08.20 16:23:16 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini
[2010.08.18 23:15:32 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2010.08.17 13:57:31 | 000,000,153 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2010.08.17 13:57:31 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.08.17 13:57:31 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2010.08.17 13:56:59 | 000,020,605 | ---- | C] () -- C:\Windows\HL-4040CN.INI
[2010.08.17 13:56:44 | 000,000,471 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.08.17 13:56:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat
[2010.08.17 13:56:44 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010.08.17 13:56:26 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2010.08.17 13:56:25 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2010.08.12 21:53:59 | 000,001,247 | ---- | C] () -- C:\Windows\SysWow64\cygrunsrv.exe.stackdump
[2010.08.06 18:45:52 | 000,011,306 | ---- | C] () -- C:\Users\Administrator\gsview32.ini
[2010.08.03 16:14:20 | 000,003,843 | ---- | C] () -- C:\Users\Administrator\cadwin.ini
[2010.08.02 15:41:31 | 000,472,576 | ---- | C] () -- C:\Windows\SysWow64\ApolloCrypt.dll
[2010.08.02 15:41:31 | 000,059,392 | ---- | C] () -- C:\Windows\Bssudf.dll
[2010.07.26 09:46:12 | 000,001,164 | ---- | C] () -- C:\Users\Administrator\copyclient.ini
[2010.06.08 13:45:20 | 000,003,076 | RHS- | C] () -- C:\ProgramData\ntuser.pol
 
========== LOP Check ==========
 
[2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core
[2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv
[2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS
[2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF
[2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo
[2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD
[2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer
[2012.07.20 23:16:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup
[2012.07.30 07:44:12 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL
[2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++
[2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org
[2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir
[2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB
[2012.07.23 14:54:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\SB-AW
[2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer
[2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer
[2012.07.30 18:07:42 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit
[2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke
[2010.08.14 10:33:46 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK\AppData\Roaming\bitfarm-archiv
[2010.08.14 10:38:04 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK\AppData\Roaming\Notepad++
[2010.08.15 18:00:58 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK.000\AppData\Roaming\OpenOffice.org
[2010.08.19 08:04:32 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK.002\AppData\Roaming\OpenOffice.org
[2012.07.29 20:00:03 | 000,000,696 | ---- | M] () -- C:\Windows\Tasks\komsthoeft_daten.job
[2011.03.17 04:00:38 | 000,019,900 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.30 12:00:13 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.30 14:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.30 12:00:22 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.07.23 15:06:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Adobe
[2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core
[2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv
[2010.08.17 13:59:39 | 000,000,000 | R--D | M] -- C:\Users\Administrator\AppData\Roaming\Brother
[2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS
[2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF
[2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo
[2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD
[2010.08.15 09:18:47 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Identities
[2011.04.12 16:33:57 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\InstallShield
[2012.07.20 15:43:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2011.08.26 21:47:50 | 000,000,000 | --SD | M] -- C:\Users\Administrator\AppData\Roaming\Microsoft
[2010.08.20 16:21:18 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Microsoft Web Folders
[2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer
[2012.07.20 23:16:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup
[2012.07.30 07:44:12 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL
[2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++
[2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org
[2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir
[2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB
[2012.07.23 14:54:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\SB-AW
[2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer
[2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer
[2012.07.30 18:07:42 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit
[2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke
 
< %APPDATA%\*.exe /s >
[2012.07.20 16:38:19 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Administrator\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
[2010.06.08 12:20:32 | 000,010,134 | R--- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
[2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.08.21 07:35:46 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=0D9A3F095FFBFB55DCC74F5581B4154C -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16661_none_6412f79e85ff0b30\netlogon.dll
[2010.08.21 09:24:02 | 000,693,760 | ---- | M] (Microsoft Corporation) MD5=364CD71997D3C32607F1F33E8ED7C9CE -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.20787_none_5a384bfb6ac6b8eb\netlogon.dll
[2010.08.21 08:35:10 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=740F0AF801E1AAE4D7602B82D49B07E0 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16661_none_59be4d4c519e4935\netlogon.dll
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.08.21 08:52:22 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=A751C9A96F0BB0F9164D11E59BD7AE10 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.20787_none_648cf64d9f277ae6\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 03:15:20 | 000,380,957 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\expsrv.dll
[2009.07.14 03:16:13 | 000,163,840 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\scrrun.dll
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 158 bytes -> C:\Windows\SYSVOL\staging\domain\ContentSet{5037438D-1888-4FAE-8226-338016215716}-{6F05F487-426D-4659-ABED-7466A5B1046E}:ReplicatedFolderList
@Alternate Data Stream - 158 bytes -> C:\Windows\SYSVOL\staging areas\GK.local\ContentSet{5037438D-1888-4FAE-8226-338016215716}-{6F05F487-426D-4659-ABED-7466A5B1046E}:ReplicatedFolderList

< End of report >
         
--- --- ---

[/code]

Antwort

Themen zu Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D
7-zip, adware.adon, autorun, bho, computer, diagnostics, dns-server, document, error, eset nod32, excel, firefox, firewall, heuristiks/extra, heuristiks/shuriken, hijack, install.exe, installation, internet, intranet, ip-adresse, kaspersky, locker, logfile, microsoft office word, office 2007, problem, registry, richtlinie, rundll, scan, searchscopes, security, server, sicherheit, sicherstellen, software, starten, super, svchost.exe, udp, vista, win32.adware.adon, win32.installcore.d, windows, windows server 2008 r2, windows-firewall, zugriff verweigert



Ähnliche Themen: Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D


  1. Windows 7: ADWARE/InstallCore.Gen7 mit Avira gefunden
    Log-Analyse und Auswertung - 02.02.2015 (9)
  2. Adware.Gen7 - Adware/Cherished.oia - Adware/InstallCore.Gen9 - TR/Trash.Gen bei Antivir gefunden
    Plagegeister aller Art und deren Bekämpfung - 03.12.2014 (13)
  3. ADWARE/InstallCore.Gen7 gefunden Win 8
    Plagegeister aller Art und deren Bekämpfung - 27.11.2014 (11)
  4. ADWARE/InstallCore.Gen7 gefunden
    Plagegeister aller Art und deren Bekämpfung - 23.11.2014 (11)
  5. Windows Server 2008R2: Gruppenrichtlinien
    Alles rund um Windows - 16.09.2014 (7)
  6. Windows 8.1: Avira hat Malware gefunden-Aktion: Zugriff verweigert
    Log-Analyse und Auswertung - 19.08.2014 (5)
  7. ADWARE/InstallCore.gen und ADWARE/InstallCore.E von Avira gefunden
    Plagegeister aller Art und deren Bekämpfung - 16.07.2014 (7)
  8. Avira hat Malware gefunden: ADWARE/InstallCore.tjf
    Plagegeister aller Art und deren Bekämpfung - 30.05.2014 (29)
  9. Windows 7: Malware ADWARE/InstallCore.Gen7 mit Avira gefunden
    Log-Analyse und Auswertung - 27.05.2014 (13)
  10. Avira hat ADWARE/installCore.Gen gefunden
    Plagegeister aller Art und deren Bekämpfung - 07.04.2014 (14)
  11. TR/Mediyes.Gen und Adware/InstallCore.ead gefunden bei Suchdurchlauf
    Plagegeister aller Art und deren Bekämpfung - 09.12.2013 (18)
  12. ADWARE/InstallCore.Gen, ADWARE/Yontoo.Gen und ADWARE/InstallCore.E von AVIRA gefunden
    Plagegeister aller Art und deren Bekämpfung - 16.04.2013 (10)
  13. Trojaner? ADWARE/InstallCore.1.42 - gefunden von Antivir
    Log-Analyse und Auswertung - 22.04.2012 (13)
  14. Windows Server 2008R2 Standard Edition
    Alles rund um Windows - 12.10.2010 (13)
  15. Malware/Adware/Trojaner? Verdacht Nod 32 Zugriff verweigert URL/IP
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (0)
  16. 70 ausgehende Verbindungen lt. Comodo o. Aktivität, div.Funde:Win32/Adware.ADON, Adware.F1 Organizer
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (5)
  17. Trojaner gefunden und zugriff verweigert geklickt
    Antiviren-, Firewall- und andere Schutzprogramme - 03.12.2007 (1)

Zum Thema Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D - Hallo, Hab auf einem Windows 2008R2 64bit Server das Problem, dass sich die Firewall nicht starten lässt. Beim Starten kommt die Fehlermeldung: Beim Öffnen des Snap-Ins "Windows-Firewall mit erweiterter Sicherheit" - Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D...
Archiv
Du betrachtest: Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.