Achtung! Wegen Sicherheitsgründe Windowssystem wird blockiert! (oder so aehnlich)

OTL logfile created on: 14.03.2012 20:09:54 - Run 1
OTL by OldTimer - Version 3.2.37.0     Folder = C:\Documents and Settings\bko.BUL-AWT-43793\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,25 Gb Total Physical Memory | 0,54 Gb Available Physical Memory | 43,57% Memory free
1,86 Gb Paging File | 1,36 Gb Available in Paging File | 73,23% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 11,49 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
Drive D: | 39,06 Gb Total Space | 7,08 Gb Free Space | 18,14% Space Free | Partition Type: NTFS
Drive E: | 35,47 Gb Total Space | 31,44 Gb Free Space | 88,64% Space Free | Partition Type: NTFS
Drive H: | 19,53 Gb Total Space | 14,22 Gb Free Space | 72,78% Space Free | Partition Type: NTFS
Drive I: | 92,23 Gb Total Space | 59,60 Gb Free Space | 64,62% Space Free | Partition Type: FAT32
 
Computer Name: SERVICE | User Name: bko | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\bko.BUL-AWT-43793\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\TotalCommander\TOTALCMD.EXE (C. Ghisler & Co.)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (r_server) -- C:\Program Files\RAdmin\R_server.exe /service File not found
SRV - (Autodesk Licensing Service) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (NiExServ) -- C:\Program Files\NetInst\NiExServ.exe (enteo Software GmbH)
SRV - (NIAIServ) -- C:\Program Files\NetInst\NiAiServ.exe (enteo Software GmbH)
SRV - (SavRoam) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SNDSrvc) -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (IPSECMON) -- C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe (SafeNet)
SRV - (IreIKE) -- C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe (SafeNet)
SRV - (MvWebServer) -- C:\WINDOWS\system32\LexWebService.exe ()
SRV - (MvServer) -- C:\WINDOWS\system32\LexMvService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (HTCAND32) -- System32\Drivers\ANDROIDUSB.sys File not found
DRV - (Changer) --  File not found
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (teamviewervpn) -- C:\WINDOWS\system32\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV - (pneteth) -- C:\WINDOWS\system32\drivers\pneteth.sys (June Fabrics Technology Inc.)
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110502.002\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110502.002\NAVENG.SYS (Symantec Corporation)
DRV - (MHIKEY10) -- C:\WINDOWS\system32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (cpuz134) -- C:\WINDOWS\system32\drivers\cpuz134_x32.sys (Windows (R) Win 7 DDK provider)
DRV - (cxbu0wdm) -- C:\WINDOWS\system32\drivers\cxbu0wdm.sys (HID Global Corporation)
DRV - (mcdbus) -- C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (ZSMC303) -- C:\WINDOWS\system32\drivers\usbVM303.sys (Vimicro Corporation)
DRV - (WinUSB) -- C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (vmfilter303) -- C:\WINDOWS\system32\drivers\vmfilter303.sys (Vimicro Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\symtdi.sys (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINDOWS\system32\drivers\symredrv.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SAVRT) -- C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (SAVRTPEL) -- C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (IPSECDRV) -- C:\WINDOWS\system32\drivers\IpSecDrv.sys (SafeNet)
DRV - (Crypto) -- C:\WINDOWS\System32\drivers\Crypto.sig ()
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (DniVap) SafeNet WAN Miniport (VA) -- C:\WINDOWS\system32\drivers\vapnt.sys (Deterministic Networks Inc.)
DRV - (G400) -- C:\WINDOWS\system32\drivers\G400m.sys (Matrox Graphics Inc.)
DRV - (EL90XBC) -- C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mevabg.com/
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 86 26 E5 8A 26 86 CB 01  [binary data]
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes\{E1609B4A-33D3-4224-9E8C-C6B776D616D0}: "URL" = hxxp://www.google.co.uk/search?hl=en&q={searchTerms}&meta=
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mevabg.com/
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 86 26 E5 8A 26 86 CB 01  [binary data]
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-18\..\SearchScopes\{E1609B4A-33D3-4224-9E8C-C6B776D616D0}: "URL" = hxxp://www.google.co.uk/search?hl=en&q={searchTerms}&meta=
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=proxy.meva.de:8080;https=proxy.meva.de:8080;ftp=proxy.meva.de:8080;gopher=proxy.meva.de:8080;socks=proxy.meva.de:8080
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\SearchScopes,DefaultScope = {3F2951B8-ECFC-4AD6-A582-FD75693AE9B5}
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\SearchScopes\{3F2951B8-ECFC-4AD6-A582-FD75693AE9B5}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADBR
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1220945662-823518204-682003330-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
 
[2011.09.21 11:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.09.21 11:41:36 | 000,000,000 | ---D | M] ("B-Trust Smart Card Certificate") -- C:\Program Files\Mozilla Firefox\extensions\sc_cert_delete@b-trust.org
 
O1 HOSTS File: ([2007.04.02 13:42:30 | 000,000,776 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 192.168.10.16	intranet 	intranet.meva.de
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Support.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Support.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..\Toolbar\WebBrowser: (Support.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) File not found
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe (Vimicro)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [VMSnap3] C:\WINDOWS\vmsnap3.exe (ZSMCSNAP)
O4 - HKU\S-1-5-21-1220945662-823518204-682003330-1006..\Run: [SkypeM] C:\Documents and Settings\bko.BUL-AWT-43793\Local Settings\Application Data\Skype\Skype.exe (Transaction Software, D 81737 Munich)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\cv act sc interface RegisterTool.lnk = C:\Program Files\cv cryptovision\cv act sc interface\RegisterTool.exe (cv cryptovision GmbH)
O4 - Startup: C:\Documents and Settings\bko.BUL-AWT-43793\Start Menu\Programs\Startup\PdaNet Desktop.lnk = C:\Program Files\PdaNet for Android\PdaNetPC.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-823518204-682003330-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-823518204-682003330-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_22.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
O15 - HKU\.DEFAULT\..Trusted Domains: fps-ni ([]* in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Domains: fps-ni ([]* in Local intranet)
O15 - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..Trusted Domains: fps-ni ([]* in Local intranet)
O15 - HKU\S-1-5-21-1220945662-823518204-682003330-1006\..Trusted Domains: server ([]* in Local intranet)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {167248DA-0F88-4DE1-B4B1-45176751026D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/renew/CertManX.cab (CertManX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab (Microsoft Genuine Advantage Self Support Tool)
O16 - DPF: {4DB62416-BC86-4439-B5BA-366948F47C8D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/sign/SCManagerX.cab (SCManagerX Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174495503887 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} hxxp://www2.dotphoto.com/DPImageUploader.cab (Aurigma Image Uploader 3.5 Control)
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/sign/capicom.dll (Settings Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} hxxp://service.futuremark.com/virtualmark/tc/MSC3.cab (Measurement Services Client v.3.12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{04E21032-AB7B-4A0C-A7A0-3DF32A65EA81}: DhcpNameServer = 192.168.10.16 192.168.10.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6134DBAB-3491-4210-9A95-113D5672AE66}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\Controls\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\Controls\SAPHTMLP.DLL (SAP AG, Walldorf)
O20 - AppInit_DLLs: (C:\PROGRA~1\NetInst\NiAMH.dll) - C:\Program Files\NetInst\NiAMH.dll (enteo Software GmbH)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - (C:\WINDOWS\system32\NavLogon.dll) - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.07 11:02:59 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2007.03.16 15:10:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.14 19:52:50 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\bko.BUL-AWT-43793\Desktop\OTL.exe
[2012.03.14 18:59:18 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.03.14 18:59:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Malwarebytes
[2012.03.14 18:59:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.14 18:59:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012.03.14 18:59:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.03.14 18:59:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.14 18:54:57 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.03.14 18:54:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bko.BUL-AWT-43793\Local Settings\Application Data\AskToolbar
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.14 19:55:34 | 000,003,823 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2012.03.14 19:52:53 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\bko.BUL-AWT-43793\Desktop\OTL.exe
[2012.03.14 19:33:29 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.03.14 19:24:37 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.03.14 19:16:05 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.03.14 19:13:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.03.14 19:10:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.03.14 19:05:46 | 000,000,976 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.14 19:03:32 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{5101AFB1-81EC-4FED-99D5-E055F9BA49E9}.job
[2012.03.14 18:59:11 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.14 06:34:00 | 000,000,980 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.12 19:53:13 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012.03.11 10:02:00 | 000,001,052 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2012.03.06 20:26:37 | 002,653,492 | ---- | M] () -- C:\Documents and Settings\bko.BUL-AWT-43793\My Documents\Sabine_Sack.JPG
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[2012.02.22 19:46:28 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.02.16 19:45:11 | 000,357,920 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.02.16 19:09:30 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.14 18:59:11 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.14 18:55:34 | 000,000,230 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.03.06 20:26:09 | 002,653,492 | ---- | C] () -- C:\Documents and Settings\bko.BUL-AWT-43793\My Documents\Sabine_Sack.JPG
[2012.02.16 19:04:39 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.16 19:04:39 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\dllcache\iacenc.dll
[2012.01.30 21:30:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\setupfilter.exe
[2011.08.06 11:56:56 | 000,000,080 | RHS- | C] () -- C:\WINDOWS\System32\9A2F5526AC.dll
[2011.08.06 10:52:32 | 000,000,125 | ---- | C] () -- C:\WINDOWS\FlashDecompiler.INI
[2010.11.11 09:14:07 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2010.11.11 09:14:07 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2010.06.29 11:55:36 | 000,399,512 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010.06.22 08:47:30 | 000,001,061 | ---- | C] () -- C:\WINDOWS\LMAAE2DD.ini
 
========== LOP Check ==========
 
[2007.03.30 15:28:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Autodesk
[2007.03.30 15:27:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\servonic
[2007.03.23 09:17:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.MEVA\Application Data\Autodesk
[2007.03.23 08:56:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.MEVA\Application Data\servonic
[2009.05.30 09:55:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2011.08.06 10:52:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AutoUpdate
[2010.06.09 08:48:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
[2009.11.20 16:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ICQ
[2007.04.17 09:05:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2008.08.28 16:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PixelPlanet
[2011.08.06 10:56:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007.03.23 10:11:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko\Application Data\Autodesk
[2007.03.22 11:29:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko\Application Data\servonic
[2010.06.09 09:31:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\anpo.republika.pl
[2009.05.30 09:55:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Autodesk
[2011.09.28 08:45:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\B-Trust Combo
[2011.02.28 12:04:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\BitTorrent
[2011.08.04 11:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Dekart
[2011.08.06 10:54:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Eltima Software
[2010.06.09 09:27:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\fltk.org
[2011.08.06 10:42:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\FMA
[2010.06.09 08:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\GARMIN
[2011.10.12 08:36:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\gtk-2.0
[2011.01.10 08:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\ImgBurn
[2009.07.29 12:14:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\kompozer.net
[2007.06.28 08:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Leadertech
[2011.08.06 09:19:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Mael
[2011.11.09 09:25:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\MyPhoneExplorer
[2007.03.30 15:39:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\servonic
[2007.04.05 12:57:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Simply Super Software
[2012.02.18 17:14:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\TeamViewer
[2010.10.28 15:28:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\Teleca
[2012.02.03 06:56:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\uTorrent
[2007.04.24 14:19:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bko.BUL-AWT-43793\Application Data\XnView
[2007.03.30 07:27:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\edvx\Application Data\servonic
[2012.03.14 19:33:29 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2012.03.14 19:10:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2012.03.14 19:03:32 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{5101AFB1-81EC-4FED-99D5-E055F9BA49E9}.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011.11.13 12:29:49 | 000,001,921 | ---- | M] ()(C:\Documents and Settings\All Users\Desktop\Google ????.lnk) -- C:\Documents and Settings\All Users\Desktop\Google Земя.lnk
[2011.11.13 12:29:49 | 000,001,921 | ---- | C] ()(C:\Documents and Settings\All Users\Desktop\Google ????.lnk) -- C:\Documents and Settings\All Users\Desktop\Google Земя.lnk
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DED17083
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9

< End of report >
         

OTL Extras logfile created on: 14.03.2012 20:09:54 - Run 1
OTL by OldTimer - Version 3.2.37.0     Folder = C:\Documents and Settings\bko.BUL-AWT-43793\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,25 Gb Total Physical Memory | 0,54 Gb Available Physical Memory | 43,57% Memory free
1,86 Gb Paging File | 1,36 Gb Available in Paging File | 73,23% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 11,49 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
Drive D: | 39,06 Gb Total Space | 7,08 Gb Free Space | 18,14% Space Free | Partition Type: NTFS
Drive E: | 35,47 Gb Total Space | 31,44 Gb Free Space | 88,64% Space Free | Partition Type: NTFS
Drive H: | 19,53 Gb Total Space | 14,22 Gb Free Space | 72,78% Space Free | Partition Type: NTFS
Drive I: | 92,23 Gb Total Space | 59,60 Gb Free Space | 64,62% Space Free | Partition Type: FAT32
 
Computer Name: SERVICE | User Name: bko | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]
.scr [@ = AutoCADScriptFile] -- "" "%1"
 
[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]
.scr [@ = AutoCADScriptFile] -- "" "%1"
 
[HKEY_USERS\S-1-5-21-1220945662-823518204-682003330-1006\SOFTWARE\Classes\<extension>]
.scr [@ = AutoCADScriptFile] -- "" "%1"
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"4899:TCP" = 4899:TCP:*:Enabled:RAdmin
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\WatchGuard\Mobile User VPN\Vpn.exe" = C:\Program Files\WatchGuard\Mobile User VPN\Vpn.exe:*:Enabled:VPN Connection Manager -- (SafeNet)
"C:\Program Files\RAdmin\R_server.exe" = C:\Program Files\RAdmin\R_server.exe:*:Enabled:R_server
"C:\Program Files\WatchGuard\Mobile User VPN\CmonApp.exe" = C:\Program Files\WatchGuard\Mobile User VPN\CmonApp.exe:*:Enabled:CMon Test Application -- (SafeNet)
"C:\Program Files\Symantec Client Security\Symantec AntiVirus\VPC32.exe" = C:\Program Files\Symantec Client Security\Symantec AntiVirus\VPC32.exe:*:Enabled:Symantec AntiVirus
"C:\Program Files\WatchGuard\Mobile User VPN\ViewLog.exe" = C:\Program Files\WatchGuard\Mobile User VPN\ViewLog.exe:*:Enabled:ViewLog -- (SafeNet)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"C:\Program Files\TotalCommander\TOTALCMD.EXE" = C:\Program Files\TotalCommander\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows -- (C. Ghisler & Co.)
"C:\Program Files\Common Files\XPressUpdate\XPressUpdate.exe" = C:\Program Files\Common Files\XPressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate
"C:\Program Files\ICQ6\ICQ.exe" = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Documents and Settings\bko.BUL-AWT-43793\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Documents and Settings\bko.BUL-AWT-43793\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)
"C:\Program Files\WinHTTrack\WinHTTrack.exe" = C:\Program Files\WinHTTrack\WinHTTrack.exe:*:Enabled:WinHTTrack Website Copier, Web Site mirroring for professional and private purposes -- (HTTrack)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\TeamViewer\Version7\TeamViewer.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{34E4EE2F-F9C1-48E7-80ED-4C3C4553A5AE}" = RAdmin2.0 o. Viewer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3533B9EB-BE15-4C5F-8726-0150B12CAA6A}" = cv act sc/interface 5.0.0 - user edition
"{3B4C85FA-E312-11D7-BCF5-00105A24FEA8}" = Mobile User VPN
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{43D7324B-9C5A-4D43-8EAD-0D667AB7B314}" = DOC
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4DDEADA8-25B8-41CB-9989-8F16D50A8E9C}" = OMNIKEY 3x21 PC/SC Driver
"{4F905C32-B72B-4EC9-91CD-1AC76BC88D3F}" = Migration LASER 6.5.2 bis
"{55D9E026-DCB0-46FF-B60A-68B972228CF6}" = Autodesk Design Review 2010
"{5783F2D7-5004-0407-0002-0060B0CE6BBA}" = Autodesk Architectural Desktop 2007 - Deutsch
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Земя
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{848AC794-8B81-440A-81AE-6474337DB527}" = Symantec AntiVirus
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87ABA03D-8F69-4A1C-A40E-626DC56D93E1}" = CRM-Tools
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{901E0402-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Bulgarian User Interface Pack
"{901E0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 German User Interface Pack
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.1
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC76BA86-7AD7-5760-0000-800000000003}" = Japanese Fonts Support For Adobe Reader 8
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE3B8E96-B0AF-4871-9178-1519B58E3A93}" = A4 TECH PC Camera H
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{E3B67F67-F1BA-4709-96CE-72E92A8BF5E3}" = hpg2410
"{E5B04674-1885-4B08-BAE7-ECDEC1F84677}" = HP Scanjet G2410 and 2400
"{e7394a0f-3f80-45b1-87fc-abcd51893246}" = Python 2.6.4
"7-Zip" = 7-Zip 4.45 beta
"9397EA7527D5597E900F76DDCF42A1DEDCBDC288" = Windows Driver Package - Dekart (DEKART38) SmartCardReader  (11/21/2007 1.0.5.9)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2
"Audacity_is1" = Audacity 1.2.6
"Autodesk Design Review 2010" = Autodesk Design Review 2010
"B-Trust Combo Lite_is1" = B-Trust Combo Lite 1.7
"Bulgarian(Phonetic)" = BulgarianPhonetic XP by G. Atanasov
"CCleaner" = CCleaner (remove only)
"combolite" = B-Trust Combo Lite Context Menu Plugin 1.0 (Remove Only)
"CommView for WiFi PPC" = CommView for WiFi PPC
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.56
"FreePDF_XP" = FreePDF XP (Remove only)
"Google Updater" = Google Updater
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IE7-MUI" = Windows Internet Explorer 7 Multilingual User Interface (MUI)
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InstallShield_{43D7324B-9C5A-4D43-8EAD-0D667AB7B314}" = DOC
"InstallShield_{4F905C32-B72B-4EC9-91CD-1AC76BC88D3F}" = Migration LASER 6.5.2 bis
"IrfanView" = IrfanView (remove only)
"Lexmark Printer Software Uninstall" = Lexmark Drucker-Software deinstallieren
"LiveUpdate" = LiveUpdate 2.0 (Symantec Corporation)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Measurement Services Client" = Futuremark Measurement Services Client
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MPE" = MyPhoneExplorer
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PdaNet_is1" = PdaNet for Android 3.02
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"pycairo-py2.6" = Python 2.6 pycairo-1.4.12
"pygobject-py2.6" = Python 2.6 pygobject-2.14.2
"pygtk-py2.6" = Python 2.6 pygtk-2.12.1
"SAPFrontend" = SAP Front End
"TeamViewer 7" = TeamViewer 7
"Tweak UI 2.10" = Tweak UI
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.11
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.43-9C
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1220945662-823518204-682003330-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Support.com Toolbar Updater
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 14.03.2012 14:03:52 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 512000 (0x000000000007d000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:53 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 557056 (0x0000000000088000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:54 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 5718016 (0x0000000000574000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:55 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 65536 (0x0000000000010000) für 8192 (0x00002000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:56 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 548864 (0x0000000000086000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:57 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 385024 (0x000000000005e000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:03:58 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 155648 (0x0000000000026000) für 8192 (0x00002000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:04:00 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 303104 (0x000000000004a000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:04:01 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 139264 (0x0000000000022000) für 8192 (0x00002000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
Error - 14.03.2012 14:04:03 | Computer Name = SERVICE | Source = ESENT | ID = 482
Description = HelpSvc (3696) Versuch, in Datei "C:\WINDOWS\PCHealth\HelpCtr\InstalledSKUs\Professional_32_0407\Database\HCdata.edb"
 bei Offset 32768 (0x0000000000008000) für 4096 (0x00001000) Bytes zu schreiben,
 ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler
 -1032 (0xfffffbf8) bei Schreiboperation. Wenn dieser Zustand andauert, ist die 
Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt
 werden.
 
[ System Events ]
Error - 14.03.2012 14:08:43 | Computer Name = SERVICE | Source = SCardSvr | ID = 602
Description = Die WDM-Lesertreiberinitialisierung konnte den Leser nicht öffnen:
 Das System kann den angegebenen Pfad nicht finden.
 
Error - 14.03.2012 14:09:58 | Computer Name = SERVICE | Source = SCardSvr | ID = 602
Description = Die WDM-Lesertreiberinitialisierung konnte den Leser nicht öffnen:
 Das System kann den angegebenen Pfad nicht finden.
 
Error - 14.03.2012 14:09:58 | Computer Name = SERVICE | Source = SCardSvr | ID = 602
Description = Die WDM-Lesertreiberinitialisierung konnte den Leser nicht öffnen:
 Das System kann den angegebenen Pfad nicht finden.
 
Error - 14.03.2012 14:09:58 | Computer Name = SERVICE | Source = SCardSvr | ID = 602
Description = Die WDM-Lesertreiberinitialisierung konnte den Leser nicht öffnen:
 Das System kann den angegebenen Pfad nicht finden.
 
Error - 14.03.2012 14:09:58 | Computer Name = SERVICE | Source = SCardSvr | ID = 602
Description = Die WDM-Lesertreiberinitialisierung konnte den Leser nicht öffnen:
 Das System kann den angegebenen Pfad nicht finden.
 
Error - 14.03.2012 14:10:47 | Computer Name = SERVICE | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Parallel port driver" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1058
 
Error - 14.03.2012 14:10:47 | Computer Name = SERVICE | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Remote Administrator Service" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 14.03.2012 14:15:04 | Computer Name = SERVICE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   Fips  intelppm  SAVRT  SYMTDI
 
Error - 14.03.2012 14:16:22 | Computer Name = SERVICE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 14.03.2012 14:52:42 | Computer Name = SERVICE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
 
< End of report >
         

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.14.05

Windows XP Service Pack 3 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.6001.18702
bko :: SERVICE [Administrator]

14.03.2012 19:25:03
mbam-log-2012-03-14 (20-27-10).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 452515
Laufzeit: 48 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SkypeM (Trojan.Ransom) -> Daten: C:\Documents and Settings\bko.BUL-AWT-43793\Local Settings\Application Data\Skype\Skype.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Program Files\RAdmin12\AdmDll.dll_ (PUP.RemoteAdmin) -> Keine Aktion durchgeführt.
C:\Program Files\RAdmin12\raddrv.dll (PUP.RemoteAdmin) -> Keine Aktion durchgeführt.
C:\Program Files\RAdmin12\R_server.ekse_ (Malware.Tool) -> Keine Aktion durchgeführt.
C:\Documents and Settings\bko.BUL-AWT-43793\Local Settings\Temp\ms0cfg32.exe (Exploit.Drop.CFG) -> Keine Aktion durchgeführt.
C:\Documents and Settings\bko.BUL-AWT-43793\Local Settings\Application Data\Skype\Skype.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.

(Ende)