Liebes Helfer-Team,

vor einigen Wochen wurde von meinem Email-Account (gmx) eine Mail an verschiedene Leute versandt. Eine Bekannte berichtete mir, dass in dieser Mail lediglich ein nicht zu öffnender Link gestanden hat. Außerdem ist mir aufgefallen, dass mein sehr neuer Laptop (Kauf im Mai) seit dem immer wieder "Hänger" hat. Zum Beispiel hat er beim normalen Schreiben Aussetzer und schreibt nicht alle Buchstaben die man tippt (egal ob bei Word oder sonst wo). Zweimal hat sich jetzt auch die Uhr verstellt. Und hin und wieder kann man den Laptop nicht aus dem Ruhezustand "zurückholen".
Alles in allem bereitet mir der Zustand Sorgen, vor allem da ich gerade am Schreiben meiner Diplomarbeit bin und den Laptop dringend brauche.
AntiVir meldet nur drei Warnungen und Malwarebytes Antimalware bleibt ganz ohne Fund. Logs s.u., vielen Dank schon mal!


OTL.txt

OTL logfile created on: 10.07.2012 20:24:15 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Torsten\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,94 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 52,63% Memory free
7,87 Gb Paging File | 5,68 Gb Available in Paging File | 72,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 274,96 Gb Total Space | 206,91 Gb Free Space | 75,25% Space Free | Partition Type: NTFS
Drive E: | 17,83 Gb Total Space | 2,71 Gb Free Space | 15,19% Space Free | Partition Type: NTFS
Drive F: | 4,98 Gb Total Space | 2,13 Gb Free Space | 42,69% Space Free | Partition Type: FAT32

Computer Name: TORSTEN-HP | User Name: Torsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.10 20:23:14 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Torsten\Desktop\OTL.exe
PRC - [2012.05.31 12:53:00 | 000,096,768 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
PRC - [2012.05.08 21:32:21 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 21:32:21 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 21:32:21 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.03.14 14:50:56 | 000,365,440 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe
PRC - [2012.03.14 10:28:28 | 000,197,504 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2012.02.10 11:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe
PRC - [2012.02.08 12:44:04 | 000,200,704 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
PRC - [2012.02.08 12:10:00 | 001,323,008 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
PRC - [2012.01.13 19:18:07 | 000,527,312 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
PRC - [2012.01.13 19:17:40 | 000,476,112 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2011.08.11 19:29:24 | 001,128,952 | ---- | M] (PDF Complete Inc) -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe
PRC - [2011.03.16 11:26:42 | 000,070,256 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
PRC - [2011.03.16 11:26:40 | 000,113,264 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2011.02.12 05:07:16 | 000,820,048 | R--- | M] (DigitalPersona, Inc.) -- c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
PRC - [2011.02.11 02:44:28 | 000,076,344 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
PRC - [2011.02.07 20:41:42 | 012,274,688 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
PRC - [2011.02.07 20:41:26 | 000,320,000 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
PRC - [2011.01.28 18:41:30 | 000,133,688 | ---- | M] (Hewlett-Packard Company) -- c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
PRC - [2011.01.26 19:00:32 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.01.26 19:00:00 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.01.17 21:42:04 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.01.17 21:42:02 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011.01.07 05:08:38 | 000,138,400 | ---- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
PRC - [2010.11.29 21:10:32 | 000,210,896 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
PRC - [2010.11.17 19:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.11.11 09:43:00 | 000,502,464 | ---- | M] (ArcSoft, Inc.) -- C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
PRC - [2009.07.14 03:14:47 | 000,254,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe


========== Modules (No Company Name) ==========

MOD - [2012.06.16 12:18:06 | 000,475,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\80b4cd3b84dea19ceafd07b591d13ea0\IAStorUtil.ni.dll
MOD - [2012.06.16 12:13:39 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012.06.16 12:13:31 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012.06.08 01:25:54 | 000,877,624 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\HP.SupportFramework\1.0.0.0__2a4860322af7ba08\HP.SupportFramework.dll
MOD - [2012.05.12 09:58:41 | 000,997,888 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll
MOD - [2012.05.12 09:58:40 | 000,014,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\f9a70c3039c1effc4df35709143e7b2f\IAStorCommon.ni.dll
MOD - [2012.05.12 05:45:20 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012.05.12 05:43:56 | 003,325,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll
MOD - [2012.05.12 05:43:48 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012.05.12 05:43:43 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012.05.12 05:43:42 | 007,952,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012.05.12 05:43:27 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2012.02.20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.02.08 12:44:04 | 000,200,704 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
MOD - [2011.09.05 09:57:34 | 000,366,136 | ---- | M] () -- C:\Windows\SysWOW64\flcdlmsg.dll
MOD - [2011.05.03 03:09:30 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2011.05.03 03:09:26 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012.06.14 23:44:11 | 000,305,152 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\STacSV64.exe -- (STacSV)
SRV:64bit: - [2012.06.14 23:44:09 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2012.02.28 13:15:16 | 000,031,000 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2012.02.08 12:10:00 | 001,323,008 | ---- | M] () [Auto | Running] -- C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe -- (McAfee Endpoint Encryption Agent)
SRV:64bit: - [2011.07.15 14:09:38 | 000,137,272 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe -- (HP Power Assistant Service)
SRV:64bit: - [2011.02.12 05:07:16 | 000,481,104 | R--- | M] (DigitalPersona, Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe -- (DpHost)
SRV:64bit: - [2011.01.28 18:41:30 | 000,133,688 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe -- (HPDayStarterService)
SRV:64bit: - [2011.01.22 04:36:02 | 003,154,224 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.05.31 12:53:00 | 000,096,768 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2012.05.08 21:32:21 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 21:32:21 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.03.14 14:50:56 | 000,365,440 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe -- (hpHotkeyMonitor)
SRV - [2012.03.14 10:28:28 | 000,197,504 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2012.02.10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe -- (BBUpdate)
SRV - [2012.02.10 11:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe -- (BBSvc)
SRV - [2012.01.13 19:17:40 | 000,476,112 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2011.09.09 17:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011.09.05 09:57:24 | 000,476,728 | ---- | M] (Hewlett-Packard Company) [On_Demand | Stopped] -- c:\Windows\SysWOW64\flcdlock.exe -- (FLCDLOCK)
SRV - [2011.08.11 19:29:24 | 001,128,952 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2011.03.16 11:26:40 | 000,113,264 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2011.03.07 22:48:10 | 000,062,184 | ---- | M] (Xobni Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Xobni\XobniService.exe -- (XobniService)
SRV - [2011.02.07 20:41:26 | 000,320,000 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)
SRV - [2011.01.26 19:00:00 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2011.01.22 04:24:50 | 002,708,784 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)
SRV - [2011.01.17 21:42:04 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011.01.17 21:42:02 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2011.01.12 20:12:06 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) [On_Demand | Stopped] -- c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2011.01.07 05:08:38 | 000,138,400 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2011.01.07 05:06:56 | 000,053,920 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)
SRV - [2010.11.29 21:10:32 | 000,210,896 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe -- (jhi_service) Intel(R)
SRV - [2010.11.11 09:43:00 | 000,502,464 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe -- (uArcCapture)
SRV - [2010.09.30 23:44:46 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 20:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.06.14 23:44:11 | 000,535,040 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2012.05.08 21:32:22 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 21:32:22 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.28 13:15:16 | 000,043,800 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2012.02.28 13:15:16 | 000,029,976 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2012.02.08 12:55:20 | 000,100,808 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\MfeEpeOpal.sys -- (MfeEpeOpal)
DRV:64bit: - [2012.02.08 12:54:56 | 000,158,920 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\MfeEpePc.sys -- (MfeEpePc)
DRV:64bit: - [2012.01.13 19:08:23 | 000,026,536 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2012.01.13 19:07:30 | 000,106,408 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.26 06:17:50 | 012,262,336 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.07 16:50:26 | 000,063,336 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\DAMDrv64.sys -- (DAMDrv)
DRV:64bit: - [2011.02.04 05:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.01.31 12:04:42 | 000,174,168 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.01.08 17:16:24 | 002,698,240 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.01.07 05:07:32 | 000,279,200 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2011.01.07 05:07:30 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2011.01.07 05:07:30 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2011.01.07 05:07:30 | 000,055,456 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2011.01.07 05:07:28 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2011.01.07 05:07:26 | 000,298,144 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2011.01.07 05:07:26 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010.12.21 19:21:16 | 001,826,048 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2010.12.10 23:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 23:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.12.03 02:02:58 | 000,025,912 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2010.11.30 18:32:38 | 000,406,632 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.11.11 09:46:00 | 000,032,192 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftVCapture.sys -- (ARCVCAM)
DRV:64bit: - [2010.10.29 07:10:34 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.10.20 03:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.10.15 13:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE:64bit: - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
IE - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {FC74B2E7-987F-4A89-B727-9590ED82F211}
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE - HKCU\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{FC74B2E7-987F-4A89-B727-9590ED82F211}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}&rlz=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2011.05.03 03:18:03 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe (Hewlett-Packard Company, L.P.)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MfeEpePcMonitor] C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [DTRun] c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [File Sanitizer] C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe (Hewlett-Packard Development Company L.P.)
O4 - HKLM..\Run: [HPQuickWebProxy] c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe (Hewlett-Packard Company)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} https://vpn.uni-mannheim.de/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect Secure Mobility Client Web Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{85AB36BC-C069-4637-8EE4-352A1975B1EA}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87C402F1-0D00-4221-8FF4-D1872C92DEEC}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe) - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\windows\SysWow64\DeviceNP.dll (Hewlett-Packard Company)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{fe3d7ba0-947b-11e1-87ee-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe3d7ba0-947b-11e1-87ee-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{fe3d7ba0-947b-11e1-87ee-806e6f6e6963}\Shell\configure\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{fe3d7ba0-947b-11e1-87ee-806e6f6e6963}\Shell\install\command - "" = D:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.10 20:23:14 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Torsten\Desktop\OTL.exe
[2012.06.19 23:38:21 | 000,000,000 | ---D | C] -- C:\Tanja
[2012.06.14 23:52:00 | 000,000,000 | ---D | C] -- C:\Users\Torsten\AppData\Roaming\Hewlett-Packard Company
[2012.06.14 23:48:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Telespree
[2012.06.14 23:44:29 | 001,966,080 | ---- | C] (IDT, Inc.) -- C:\windows\SysNative\stapo64.dll
[2012.06.14 23:44:29 | 000,655,872 | ---- | C] (IDT, Inc.) -- C:\windows\SysNative\stapi64.dll
[2012.06.14 23:44:29 | 000,535,040 | ---- | C] (IDT, Inc.) -- C:\windows\SysNative\drivers\stwrt64.sys
[2012.06.14 23:44:29 | 000,446,464 | ---- | C] (IDT, Inc.) -- C:\windows\SysNative\stcplx64.dll
[2012.06.14 23:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\IDT
[2012.06.14 23:42:23 | 000,000,000 | ---D | C] -- C:\Users\Torsten\AppData\Local\Downloaded Installations
[2012.06.14 23:30:27 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

========== Files - Modified Within 30 Days ==========

[2012.07.10 20:26:42 | 000,019,536 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.10 20:26:42 | 000,019,536 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.10 20:23:14 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Torsten\Desktop\OTL.exe
[2012.07.10 20:20:00 | 000,001,112 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.10 20:18:51 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2012.07.10 20:18:48 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.10 20:18:39 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.07.10 20:18:34 | 4226,146,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.10 20:17:50 | 000,000,188 | ---- | M] () -- C:\Users\Torsten\defogger_reenable
[2012.07.10 20:16:01 | 000,050,477 | ---- | M] () -- C:\Users\Torsten\Desktop\Defogger.exe
[2012.07.05 22:42:03 | 000,000,340 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForTorsten.job
[2012.07.02 18:26:17 | 000,000,346 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForTORSTEN-HP$.job
[2012.06.19 23:38:31 | 000,000,642 | ---- | M] () -- C:\Users\Torsten\Desktop\Tanja - Verknüpfung.lnk
[2012.06.19 09:10:13 | 000,002,016 | -H-- | M] () -- C:\Users\Torsten\Documents\Default.rdp
[2012.06.18 19:04:54 | 001,612,484 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.06.18 19:04:54 | 000,696,870 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.06.18 19:04:54 | 000,652,148 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.06.18 19:04:54 | 000,148,134 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.06.18 19:04:54 | 000,121,080 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.06.16 12:10:50 | 000,415,384 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.06.14 23:52:23 | 000,000,191 | ---- | M] () -- C:\windows\SysNative\HPPA.ini
[2012.06.14 23:44:11 | 004,113,408 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\stlang64.dll
[2012.06.14 23:44:11 | 001,966,080 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\stapo64.dll
[2012.06.14 23:44:11 | 001,424,896 | ---- | M] (IDT, Inc.) -- C:\windows\sttray64.exe
[2012.06.14 23:44:11 | 000,655,872 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\stapi64.dll
[2012.06.14 23:44:11 | 000,535,040 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\drivers\stwrt64.sys
[2012.06.14 23:44:11 | 000,446,464 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\stcplx64.dll
[2012.06.14 23:44:11 | 000,251,392 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\staco64.dll
[2012.06.14 23:44:10 | 006,012,416 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\IDTNGUI.exe
[2012.06.14 23:44:10 | 005,077,504 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\IDTNHP.dll
[2012.06.14 23:44:10 | 001,819,136 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\IDTNC64.cpl
[2012.06.14 23:44:10 | 001,041,920 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\IDTNX.dll
[2012.06.14 23:44:10 | 000,233,472 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\IDTNJ.exe
[2012.06.14 23:44:09 | 000,223,744 | ---- | M] (IDT, Inc.) -- C:\windows\SysNative\HPToneCtrls64.dll
[2012.06.14 22:35:25 | 000,000,000 | RHS- | M] () -- C:\windows\SysWow64\drivers\103C_HP_bNB_ProBook 4530s_Y5336AN_0U_QCNU14327G4_E636589-A42_4A_I167C_SHP_V22.1F_B68SRR F.0A_T110718_W73-0_L407_M4031_J320_7Intel_86A7_92.20_#110502_N10EC8168;168C002B_(LW862EA#ABD)_XMOBILE_CN10_Z_2A0001D02.MRK
[2012.06.14 22:35:25 | 000,000,000 | RHS- | M] () -- C:\windows\SysNative\drivers\103C_HP_bNB_ProBook 4530s_Y5336AN_0U_QCNU14327G4_E636589-A42_4A_I167C_SHP_V22.1F_B68SRR F.0A_T110718_W73-0_L407_M4031_J320_7Intel_86A7_92.20_#110502_N10EC8168;168C002B_(LW862EA#ABD)_XMOBILE_CN10_Z_2A0001D02.MRK
[2012.06.13 00:22:01 | 000,001,439 | ---- | M] () -- C:\Users\Torsten\Desktop\Internet Explorer.lnk

========== Files Created - No Company Name ==========

[2012.07.10 20:17:49 | 000,000,188 | ---- | C] () -- C:\Users\Torsten\defogger_reenable
[2012.07.10 20:16:01 | 000,050,477 | ---- | C] () -- C:\Users\Torsten\Desktop\Defogger.exe
[2012.06.19 23:38:31 | 000,000,642 | ---- | C] () -- C:\Users\Torsten\Desktop\Tanja - Verknüpfung.lnk
[2012.06.14 23:45:14 | 000,001,646 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SRS Premium Sound.lnk
[2012.06.13 00:22:01 | 000,001,439 | ---- | C] () -- C:\Users\Torsten\Desktop\Internet Explorer.lnk
[2012.05.10 14:43:40 | 000,002,728 | ---- | C] () -- C:\Users\Torsten\AppData\Local\recently-used.xbel
[2011.10.29 07:01:37 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdeccdf.sys
[2011.10.29 06:47:17 | 000,025,984 | ---- | C] () -- C:\windows\snuvcdsm.exe
[2011.10.29 06:47:16 | 000,015,497 | ---- | C] () -- C:\windows\snp2uvc.ini
[2011.09.05 09:57:34 | 000,366,136 | ---- | C] () -- C:\windows\SysWow64\flcdlmsg.dll
[2011.05.03 03:42:26 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdecibj.sys
[2011.05.03 03:18:23 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdecied.sys
[2011.05.03 02:50:35 | 004,175,910 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.03.26 06:16:12 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2011.03.26 06:16:10 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011.03.26 06:16:10 | 000,216,876 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2011.02.26 00:32:12 | 000,012,144 | ---- | C] () -- C:\windows\HPun2430Version.dll
[2011.02.12 05:07:16 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPSCEL.dll.hpsign
[2011.02.12 05:07:16 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPFPApi.dll.hpsign
[2011.02.12 05:07:16 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPClback.dll.hpsign
[2011.02.12 05:04:36 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPLic.dll.hpsign
[2011.02.04 05:56:58 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011.02.03 05:49:02 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPFPApiUI.dll.hpsign
[2011.02.03 05:47:42 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPPassFilter.dll.hpsign
[2011.02.03 05:47:42 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPCrProv.dll.hpsign
[2011.01.30 01:49:32 | 000,017,232 | ---- | C] () -- C:\windows\SysWow64\CoHpCasl.exe
[2011.01.22 21:40:54 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\vcsAPIShared.dll.hpsign
[2011.01.11 05:03:08 | 086,271,980 | ---- | C] () -- C:\windows\SysWow64\BioTrustFace.dat
[2010.12.07 07:16:34 | 000,181,072 | ---- | C] () -- C:\windows\SysWow64\PassThroughOTP.dll
[2010.12.07 07:16:34 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\PassThroughOTP.dll.hpsign

========== LOP Check ==========

[2012.07.06 09:46:07 | 000,032,542 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >



Extras.txt:

OTL Extras logfile created on: 10.07.2012 20:24:15 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Torsten\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,94 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 52,63% Memory free
7,87 Gb Paging File | 5,68 Gb Available in Paging File | 72,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 274,96 Gb Total Space | 206,91 Gb Free Space | 75,25% Space Free | Partition Type: NTFS
Drive E: | 17,83 Gb Total Space | 2,71 Gb Free Space | 15,19% Space Free | Partition Type: NTFS
Drive F: | 4,98 Gb Total Space | 2,13 Gb Free Space | 42,69% Space Free | Partition Type: FAT32

Computer Name: TORSTEN-HP | User Name: Torsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00C56C56-AFEE-4E87-96AA-67D2D61EEFEB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{04532B2F-4418-490E-9361-74548AE34DAA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{06E19B00-F139-40CA-BC48-91B9D5C6B945}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0DBAA538-CBAB-4AF2-9E44-5692B2717078}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0E594C86-DBEE-4D8C-861B-AECD7619A6A4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{2D7DF806-E588-46A8-870D-0D0194B4B240}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{379F59E4-C62E-4D74-8B77-AAD2870F996F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{39035072-0FB1-4651-9FFD-158BE05F32AD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{3E76CEC4-FBA9-4E64-AB0F-DD02663FF9BC}" = lport=445 | protocol=6 | dir=in | app=system |
"{43AA4D36-88D3-438C-84D5-854E43EA350E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{68A9EAF1-8960-4F9B-AC4A-187F66876669}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{79E73BC6-82C3-4EAF-9A93-BE812C22FF68}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7A66D155-D9C2-4CCC-995A-81CA0EFB32C1}" = lport=10243 | protocol=6 | dir=in | app=system |
"{7DBBC23B-F1B5-4667-91B7-042A1FD0864B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{81906CCD-C57D-4FDC-B1C7-5809FC9B0E68}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{83CBA2F1-45FB-4E84-9C3C-43ED4556015B}" = rport=139 | protocol=6 | dir=out | app=system |
"{94336D25-A3E6-46CB-9886-6181C43914A0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9C9EE1A9-5408-4754-9107-E93E59C6920F}" = lport=137 | protocol=17 | dir=in | app=system |
"{9DB0416A-9D40-4CCC-AC09-0BD664FE430F}" = lport=139 | protocol=6 | dir=in | app=system |
"{9EEABE7E-7127-4623-BC90-3A98AE4D9394}" = rport=138 | protocol=17 | dir=out | app=system |
"{B5FCB8D3-35D2-42F1-99CF-9F66009B50FE}" = lport=138 | protocol=17 | dir=in | app=system |
"{C732F283-8B98-485E-B17F-2C8F7B4B8B8F}" = rport=137 | protocol=17 | dir=out | app=system |
"{D88C5671-3FC2-4150-A307-3F1C4031349A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DE57BB13-5289-426A-9825-52912F92BECB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E55BF783-88C2-4952-BF5E-7348DCA410AD}" = rport=445 | protocol=6 | dir=out | app=system |
"{FF1E8BC8-226B-4771-97F9-AD3504A9793F}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{005687AA-81C2-44E8-AD1D-D3F7ABE33F03}" = protocol=6 | dir=out | app=system |
"{023F0CD8-6F0A-402F-BB21-7C475A14CA2B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{039F87BB-89F9-4EA4-BBEB-8012437C911E}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{1C3EAD8A-C553-487A-BCAA-33F352BA1529}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{270F7FD4-B2CD-4D35-B1CD-C9FFC7761B03}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{328290C6-187B-466E-90EA-DEFF3EF8FD9E}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3C05FEDB-823A-4A6E-997F-E15B68548C7F}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{4E802204-C64B-4F16-9630-00DF8F23E4E1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{50C51480-4EB5-4940-B9EB-67D4D755C4CC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5BEAF88E-22DD-4C95-B48D-0A63EBC18EA4}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{602ED46F-01A0-4D2E-A0B6-BF0C5B25F47A}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{62342F13-220A-4495-B64E-9F1189B2B71B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{64336B91-E54E-47D6-A2EA-A8CE0C7CB468}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6ED5BFF4-BC5F-45AC-AFFB-6329982FA86A}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{75CF04D9-D801-4B07-A1B4-87F58C8B525F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7D7C2378-B09E-4048-AB62-FDA0C1DBCAA2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{81BC4896-1804-491F-A30F-6540ACA340C7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{84450BC9-9600-48B8-AFC4-989D65FE8F2B}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{90BD8AEE-1340-4453-BFAF-EB48F0B91700}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{95D8F198-B805-4670-B5BF-D4E31CE16F44}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{9CCE0A87-D74A-4D89-8C39-C2B7C6E87BBE}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{B061A64C-E383-4C29-AA47-425EA5C7BB96}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BC5788F8-3E1E-4C9C-9B0A-0ACABD3BD96A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BE8BC5D7-4D3A-450B-8547-D3B40FEC1030}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CBFCB688-B1ED-4A6C-A149-59EE0E18DE38}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D61D5F29-FB5D-4EE1-BCB4-85B48676C693}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DB37AEF5-DA05-4D9E-87A4-427FE61D3226}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{E147A907-17D2-40AD-B02D-333B8BAC00E3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E1E7AB4D-247D-4450-BF84-AF19598BC0ED}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E39E9714-F8B3-4F4F-937D-243934ECFE25}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{E4E65FCF-7A9B-4B55-B3B5-28CC1D7E141A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E9F6EA0C-4DCF-4E5B-9247-1E56E5DA5B92}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F6D9E479-2B73-4E7C-8429-677520341EC7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{422BA615-2133-4DC0-8673-09C8CC7557F2}" = HP ProtectTools Security Manager
"{483D5A49-A26B-4CB8-AA2D-0D1811322061}" = HP DayStarter
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{65C1BEAD-B50B-498C-BB6B-CDE4F30584B1}" = HP 3D DriveGuard
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}" = Drive Encryption For HP ProtectTools
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ACA53F68-B003-4D0E-9C3D-0C4EE09D08A8}" = Privacy Manager for HP ProtectTools
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{D3A775F2-2674-4452-8D80-1FC1446052EE}" = Face Recognition for HP ProtectTools
"{D9355D03-2C06-401B-8A16-F6500379AE21}" = HP Power Assistant
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FFC3E41D-2C2B-45B7-9AD9-5EA19572DD26}" = Validity Fingerprint Sensor Driver
"GIMP-2_is1" = GIMP 2.8.0
"HPProtectTools" = HP ProtectTools Security Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03046EBB-CB7C-4B98-BEFB-690EB955DA22}" = HP Setup
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{09F56A49-A7B1-4AAB-95B9-D13094254AD1}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BE5C4DB-8EA2-483D-BD71-D7EB09040CDE}" = Windows Live UX Platform Language Pack
"{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}" = SDK
"{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}" = HP Wallpaper
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}" = ArcSoft Webcam Sharing Manager
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20976B1F-E910-404D-9261-C16EE7E12DC8}" = HP QuickWeb
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2C43790E-8470-1027-82D3-DF319F3C410F}" = Intel(R) Identity Protection Technology 1.0.71.0
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{344A1AA2-AC8E-4741-BDB0-65B68FDA883C}" = HP SoftPaq Download Manager
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam Driver
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4114A073-7385-4742-8A5E-A5788FAC838F}" = ArcSoft TotalMedia
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{531000B3-DBEE-4115-BBF3-DA48B67C053F}" = HP Software Setup
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}" = Bing Rewards Client Installer
"{6357258D-2BF9-49E7-A9EF-0C609D52C46D}" = HP ESU for Microsoft Windows 7
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6A9C9BE1-14A3-42ED-A388-42E30A1412E9}" = HP Documentation
"{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}" = File Sanitizer For HP ProtectTools
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A6B4340-7090-418F-8976-EE9650B35550}" = HP Connection Manager
"{85BE320B-A37D-42DA-B9BE-20A40B6A05E3}" = Cisco AnyConnect Secure Mobility Client
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC069E7-893C-41E1-9442-DE89FEC33371}" = Xobni Core
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"{AF6EB833-D48A-49AC-9394-4C57489FDFF2}" = HP Software Framework
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C97CC14E-4789-4FC5-BC75-79191F7CE009}" = HP Hotkey Support
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D2131BFA-A0D6-4FDE-8614-75B07A9B15EE}" = Windows Live UX Platform Language Pack
"{D2A2E5CD-801A-4B8D-8119-F79449A09B67}" = HP System Default Settings
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.2.2
"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = Realtek Ethernet Controller All-In-One Windows Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"ArcSoft TotalMedia" = ArcSoft TotalMedia
"Avira AntiVir Desktop" = Avira Free Antivirus
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.0.2
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"My HP Game Console" = HP Game Console
"PDF Complete" = PDF Complete Special Edition
"TeamViewer 7" = TeamViewer 7
"VIP Access SDK" = VIP Access SDK x64(1.0.0.50)
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"WT087330" = Bounce Symphony
"WT087361" = FATE
"WT087380" = John Deere Drive Green
"WT087394" = Penguins!
"WT087396" = Polar Bowler
"WT087428" = Bejeweled 2 Deluxe
"WT087453" = Chuzzle Deluxe
"WT087480" = Insaniquarium Deluxe
"WT087485" = Jewel Quest II
"WT087490" = Jewel Quest Solitaire
"WT087501" = Plants vs. Zombies
"WT087510" = Slingo Deluxe
"WT087513" = Virtual Villagers - The Secret City
"WT087519" = Wedding Dash
"WT087533" = Zuma Deluxe
"WT087536" = Diner Dash 2 Restaurant Rescue
"WT089303" = Build-a-Lot - The Elizabethan Era
"WT089308" = Blasterball 3
"WT089328" = Farm Frenzy
"WT089359" = Cake Mania
"WT089362" = Agatha Christie - Peril at End House
"XobniMain" = Xobni

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 18.06.2012 16:19:29 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1108

Error - 18.06.2012 16:19:29 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1108

Error - 18.06.2012 16:48:47 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 18.06.2012 16:48:47 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1758943

Error - 18.06.2012 16:48:47 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1758943

Error - 23.06.2012 13:34:06 | Computer Name = Torsten-HP | Source = RasClient | ID = 20227
Description =

Error - 24.06.2012 05:11:25 | Computer Name = Torsten-HP | Source = RasClient | ID = 20227
Description =

Error - 25.06.2012 04:19:29 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 25.06.2012 04:19:29 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8605640

Error - 25.06.2012 04:19:29 | Computer Name = Torsten-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8605640

[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 10.07.2012 13:33:59 | Computer Name = Torsten-HP | Source = acvpnui | ID = 67108865
Description = Function: ConnectMgr::activateConnectEvent File: .\ConnectMgr.cpp Line:
1084 NULL object. Cannot establish a connection at this time.

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CSocketTransport::callbackHandler File: .\IPC\SocketTransport.cpp
Line:
1280 Invoked Function: WSAGetOverlappedResult Return Code: 10054 (0x00002746) Description:
Eine vorhandene Verbindung wurde vom Remotehost geschlossen.

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CSocketTransport::callbackHandler File: .\IPC\SocketTransport.cpp
Line:
1281 Invoked Function: WSARecv/WSARecvFrom Return Code: 0 (0x00000000) Description:
unknown

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CIpcTransport::OnSocketReadComplete File: .\IPC\IPCTransport.cpp
Line:
873 Invoked Function: CSocketTransport::readSocket Return Code: -31522801 (0xFE1F000F)
Description:
SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CIpcDepot::OnIpcMessageReceived File: .\IPC\IPCDepot.cpp Line:
832 Invoked Function: CIpcTransport::OnSocketReadComplete Return Code: -31522801
(0xFE1F000F) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CTcpTransport::writeSocketBlocking File: .\IPC\SocketTransport.cpp
Line:
1676 Invoked Function: WSASend Return Code: 10054 (0x00002746) Description: Eine vorhandene
Verbindung wurde vom Remotehost geschlossen.

Error - 10.07.2012 14:17:58 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CIpcTransport::terminateIpcConnection File: .\IPC\IPCTransport.cpp
Line:
384 Invoked Function: CSocketTransport::writeSocketBlocking Return Code: -31522805
(0xFE1F000B) Description: SOCKETTRANSPORT_ERROR_WRITE

Error - 10.07.2012 14:18:53 | Computer Name = Torsten-HP | Source = acvpnagent | ID = 67108866
Description = Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 376 Invoked
Function: IRunnable::Run Return Code: -32047093 (0xFE17000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE


Error - 10.07.2012 14:19:06 | Computer Name = Torsten-HP | Source = acvpnui | ID = 67108866
Description = Function: CMainFrame::getDARTInstallDir File: .\mainfrm.cpp Line: 4612
Invoked
Function: MsiEnumProductsExW Return Code: 259 (0x00000103) Description: Es sind keine
Daten mehr verfügbar.

Error - 10.07.2012 14:19:07 | Computer Name = Torsten-HP | Source = acvpnui | ID = 67108865
Description = Function: ConnectMgr::activateConnectEvent File: .\ConnectMgr.cpp Line:
1084 NULL object. Cannot establish a connection at this time.

[ Hewlett-Packard Events ]
Error - 31.05.2012 12:55:38 | Computer Name = Torsten-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\051231065536.xml
File not created by asset agent

Error - 14.06.2012 13:31:47 | Computer Name = Torsten-HP | Source = HPSF.exe | ID = 4000
Description =

[ HP Connection Manager Events ]
Error - 05.07.2012 06:04:21 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.05 12:04:21.221|00000318|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 05.07.2012 17:09:22 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.05 23:09:22.222|000018C0|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 06.07.2012 04:41:35 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.06 10:41:35.649|00001A44|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 07.07.2012 15:50:22 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.07 21:50:22.951|00001908|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 08.07.2012 23:53:38 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.09 05:53:38.316|0000042C|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 10.07.2012 05:22:24 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.10 11:22:24.462|000001FC|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 10.07.2012 06:21:20 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.10 12:21:20.846|000010E8|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 10.07.2012 09:00:48 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.10 15:00:48.936|00000D6C|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 10.07.2012 12:19:04 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.10 18:19:04.854|0000171C|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

Error - 10.07.2012 13:44:22 | Computer Name = Torsten-HP | Source = HPConnectionManager | ID = 5
Description = 2012.07.10 19:44:22.606|00000E7C|Error |App::ExitIfServiceIsNotInstalled{void()}|Application
is exiting because the service is not installed

[ HP Power Assistant Events ]
Error - 26.05.2012 17:59:29 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 102UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 26.05.2012 18:00:29 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 26.05.2012 18:01:30 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 26.05.2012 18:02:30 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 02.06.2012 14:38:34 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 02.06.2012 14:39:33 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 11.06.2012 16:21:59 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 103UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 11.06.2012 16:22:59 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 11.06.2012 16:24:00 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

Error - 11.06.2012 16:25:00 | Computer Name = Torsten-HP | Source = HP PA Application | ID = 1001
Description = An error occurred in HP Power Assistant application. Please restart
HP Power Assistant application. Additional details may be available in the Details
section. DETAILS Level value needs to be an integer between 0 and 100, got 101UpdateBatteryPredictions()
has bad values. Check PMCCapabilities.XML and PMCData.XML if in emulation mode

[ HP Software Framework Events ]
Error - 14.06.2012 17:49:28 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:28.700|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:28 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:28.976|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.007|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.043|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.083|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.114|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.143|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 14.06.2012 17:49:29 | Computer Name = Torsten-HP | Source = Casl | ID = 5
Description = 2012.06.14 23:49:29.208|00002188|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 26.06.2012 04:18:05 | Computer Name = Torsten-HP | Source = CaslSmBios | ID = 5
Description = 2012.06.26 10:18:05.796|00000C80|Error |[CaslWmi]CommandPanelBrightness::GetCurrentPanelBrightnessFromOS{hpCasl.enReturnCode(CaslWmi.enPanelBrightnessDataType,ushort&)}|Exception
occurred in querying WMI for WmiMonitorBrightness: 'Nicht unterstützt '

Error - 26.06.2012 05:37:09 | Computer Name = Torsten-HP | Source = CaslSmBios | ID = 5
Description = 2012.06.26 11:37:09.515|00000C80|Error |[CaslWmi]CommandDebug::A{hpCasl.enReturnCode()}|InvalidOperationException
message: Der Dienst hpqWmiEx auf dem Computer . konnte nicht gesteuert werden.

[ System Events ]
Error - 26.06.2012 07:45:09 | Computer Name = Torsten-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Modules Installer" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053

Error - 26.06.2012 07:45:09 | Computer Name = Torsten-HP | Source = Microsoft-Windows-LanguagePackSetup | ID = 1000
Description = Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007041d

Error - 26.06.2012 17:12:16 | Computer Name = Torsten-HP | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst Netman erreicht.

Error - 29.06.2012 11:57:22 | Computer Name = Torsten-HP | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
XobniService erreicht.

Error - 29.06.2012 11:57:22 | Computer Name = Torsten-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "XobniService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error - 30.06.2012 06:45:16 | Computer Name = Torsten-HP | Source = DCOM | ID = 10016
Description =

Error - 03.07.2012 13:08:33 | Computer Name = Torsten-HP | Source = DCOM | ID = 10016
Description =

Error - 04.07.2012 08:50:27 | Computer Name = Torsten-HP | Source = DCOM | ID = 10016
Description =

Error - 04.07.2012 08:51:35 | Computer Name = Torsten-HP | Source = DCOM | ID = 10016
Description =

Error - 04.07.2012 08:51:47 | Computer Name = Torsten-HP | Source = DCOM | ID = 10016
Description =


< End of report >


Log AntiVir:



Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 10. Juli 2012 22:59

Es wird nach 3855608 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (plain) [6.1.7600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : TORSTEN-HP

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 08.05.2012 19:32:21
AVSCAN.DLL : 12.3.0.15 66256 Bytes 08.05.2012 19:32:21
LUKE.DLL : 12.3.0.15 68304 Bytes 08.05.2012 19:32:21
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 08.05.2012 19:32:22
AVREG.DLL : 12.3.0.17 232200 Bytes 11.05.2012 00:55:33
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 09:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 06:56:15
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 06:56:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 19:44:46
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 19:44:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 16:01:56
VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 16:01:56
VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 16:01:56
VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 16:01:56
VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 16:01:56
VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 16:01:56
VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 16:01:56
VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 16:01:56
VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 16:01:56
VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 16:26:19
VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 18:03:39
VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 20:47:36
VBASE017.VDF : 7.11.35.143 126464 Bytes 09.07.2012 21:38:25
VBASE018.VDF : 7.11.35.144 2048 Bytes 09.07.2012 21:38:25
VBASE019.VDF : 7.11.35.145 2048 Bytes 09.07.2012 21:38:25
VBASE020.VDF : 7.11.35.146 2048 Bytes 09.07.2012 21:38:25
VBASE021.VDF : 7.11.35.147 2048 Bytes 09.07.2012 21:38:25
VBASE022.VDF : 7.11.35.148 2048 Bytes 09.07.2012 21:38:25
VBASE023.VDF : 7.11.35.149 2048 Bytes 09.07.2012 21:38:25
VBASE024.VDF : 7.11.35.150 2048 Bytes 09.07.2012 21:38:25
VBASE025.VDF : 7.11.35.151 2048 Bytes 09.07.2012 21:38:25
VBASE026.VDF : 7.11.35.152 2048 Bytes 09.07.2012 21:38:25
VBASE027.VDF : 7.11.35.153 2048 Bytes 09.07.2012 21:38:26
VBASE028.VDF : 7.11.35.154 2048 Bytes 09.07.2012 21:38:26
VBASE029.VDF : 7.11.35.155 2048 Bytes 09.07.2012 21:38:26
VBASE030.VDF : 7.11.35.156 2048 Bytes 09.07.2012 21:38:26
VBASE031.VDF : 7.11.35.174 36864 Bytes 09.07.2012 21:38:26
Engineversion : 8.2.10.106
AEVDF.DLL : 8.1.2.8 106867 Bytes 02.06.2012 14:06:18
AESCRIPT.DLL : 8.1.4.32 455034 Bytes 05.07.2012 20:47:37
AESCN.DLL : 8.1.8.2 131444 Bytes 02.05.2012 19:45:07
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 17:30:22
AERDL.DLL : 8.1.9.15 639348 Bytes 31.01.2012 06:55:37
AEPACK.DLL : 8.2.16.22 807288 Bytes 24.06.2012 13:08:09
AEOFFICE.DLL : 8.1.2.40 201082 Bytes 29.06.2012 16:02:04
AEHEUR.DLL : 8.1.4.64 5009782 Bytes 05.07.2012 20:47:37
AEHELP.DLL : 8.1.23.2 258422 Bytes 29.06.2012 16:01:59
AEGEN.DLL : 8.1.5.32 434548 Bytes 06.07.2012 20:47:37
AEEXP.DLL : 8.1.0.60 86388 Bytes 05.07.2012 20:47:37
AEEMU.DLL : 8.1.3.0 393589 Bytes 31.01.2012 06:55:34
AECORE.DLL : 8.1.25.10 201080 Bytes 02.06.2012 14:06:13
AEBB.DLL : 8.1.1.0 53618 Bytes 31.01.2012 06:55:33
AVWINLL.DLL : 12.3.0.15 27344 Bytes 08.05.2012 19:32:21
AVPREF.DLL : 12.3.0.15 51920 Bytes 08.05.2012 19:32:21
AVREP.DLL : 12.3.0.15 179208 Bytes 08.05.2012 19:32:22
AVARKT.DLL : 12.3.0.15 211408 Bytes 08.05.2012 19:32:21
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 08.05.2012 19:32:21
SQLITE3.DLL : 3.7.0.1 398288 Bytes 08.05.2012 19:32:22
AVSMTP.DLL : 12.3.0.15 63440 Bytes 08.05.2012 19:32:21
NETNT.DLL : 12.3.0.15 17104 Bytes 08.05.2012 19:32:21
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 08.05.2012 19:32:21
RCTEXT.DLL : 12.3.0.15 98512 Bytes 08.05.2012 19:32:21

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, E:, F:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Dienstag, 10. Juli 2012 22:59

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'E:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'F:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'iexplore.exe' - '147' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashUtil10m_ActiveX.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDKCOMServer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqWmiEx.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'uArcCapture.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdisrvc.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdfsvc.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'MfeEpeHost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'HpHotkeyMonitor.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPDrvMntSvc.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPDayStarterService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnui.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqwutils.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'coreshredder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'EpePcMonitor.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'FreemakeUtilsService.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ath_CoexAgent.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'DPAgent.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnagent.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPFSService.exe' - '21' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1441' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\$Recycle.Bin\S-1-5-21-766886762-1983554971-618772988-1002\$RUE5KO2.exe
[WARNUNG] Die Datei ist kennwortgeschützt
C:\swsetup\HPQWB\qwfiles\root.1
[WARNUNG] Unerwartetes Dateiende erreicht
C:\swsetup\HPQWB\qwfiles\root.3
[WARNUNG] Der Archivheader ist defekt
Beginne mit der Suche in 'E:\' <HP_RECOVERY>
Beginne mit der Suche in 'F:\' <HP_TOOLS>


Ende des Suchlaufs: Dienstag, 10. Juli 2012 23:58
Benötigte Zeit: 58:44 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

38724 Verzeichnisse wurden überprüft
628358 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
628358 Dateien ohne Befall
2904 Archive wurden durchsucht
3 Warnungen
0 Hinweise
649883 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden



Log Antimalware

Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.10.11

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Torsten :: TORSTEN-HP [Administrator]

Schutz: Aktiviert

10.07.2012 21:26:20
mbam-log-2012-07-10 (21-26-20).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 402162
Laufzeit: 40 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

hi
wieso hat der keine windows updates, wie servicepack 1 zb?

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Vielen Dank für die schnelle Antwort!!

Ich habe die Schritte befolgt und folgende Ergebnisse:
nach dem Neustart hat er mich nach einem JIT-Debugger gefragt. Da ich nur die Wahl zwischen Wiederholen und Abbrechen hatte, habe ich Abbrechen geklickt.

Hier die Log-Datei von Combofix:

Combofix Logfile:

ComboFix 12-07-10.01 - Torsten 11.07.2012   1:30.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.4030.1944 [GMT 2:00]
ausgeführt von:: c:\users\Torsten\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\security\Database\tmp.edb
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-10 bis 2012-07-10  ))))))))))))))))))))))))))))))
.
.
2012-07-10 23:36 . 2012-07-10 23:36	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-10 19:24 . 2012-07-10 19:24	--------	d-----w-	c:\users\Torsten\AppData\Roaming\Malwarebytes
2012-07-10 19:24 . 2012-07-10 19:24	--------	d-----w-	c:\programdata\Malwarebytes
2012-07-10 09:21 . 2012-05-31 04:04	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F105FC68-D4BC-4454-9D66-77CD414FD25C}\mpengine.dll
2012-06-25 11:23 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-25 11:23 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-25 11:23 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-25 11:23 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-25 11:23 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-25 11:23 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-25 11:23 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-25 11:23 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-25 11:23 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-06-19 21:38 . 2012-06-23 13:40	--------	d-----w-	C:\Tanja
2012-06-14 21:52 . 2012-06-14 21:52	--------	d-----w-	c:\users\Torsten\AppData\Roaming\Hewlett-Packard Company
2012-06-14 21:48 . 2012-06-14 21:48	--------	d-----w-	c:\program files (x86)\Common Files\Telespree
2012-06-14 21:44 . 2012-06-14 21:44	655872	------w-	c:\windows\system32\stapi64.dll
2012-06-14 21:44 . 2012-06-14 21:44	535040	----a-w-	c:\windows\system32\drivers\stwrt64.sys
2012-06-14 21:44 . 2012-06-14 21:44	446464	----a-w-	c:\windows\system32\stcplx64.dll
2012-06-14 21:44 . 2012-06-14 21:44	1966080	----a-w-	c:\windows\system32\stapo64.dll
2012-06-14 21:44 . 2012-06-14 21:45	--------	d-----w-	c:\program files\IDT
2012-06-14 21:42 . 2012-06-14 21:42	--------	d-----w-	c:\users\Torsten\AppData\Local\Downloaded Installations
2012-06-14 21:30 . 2011-01-14 06:14	163840	----a-w-	c:\windows\system32\umpo.dll
2012-06-14 21:30 . 2012-06-14 21:30	--------	d-----w-	c:\programdata\McAfee
2012-06-13 22:22 . 2012-05-02 05:32	208896	----a-w-	c:\windows\system32\profsvc.dll
2012-06-13 22:22 . 2012-04-26 05:34	76288	----a-w-	c:\windows\system32\rdpwsx.dll
2012-06-13 22:22 . 2012-04-26 05:34	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-06-13 22:22 . 2012-04-26 05:28	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-06-13 22:22 . 2012-05-04 10:52	5505392	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-06-13 22:22 . 2012-05-04 10:08	3958128	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 22:22 . 2012-05-04 10:08	3902320	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 22:21 . 2012-05-15 01:32	3144192	----a-w-	c:\windows\system32\win32k.sys
2012-06-13 22:21 . 2012-04-28 03:50	204800	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-06-13 22:21 . 2012-04-07 12:18	3213824	----a-w-	c:\windows\system32\msi.dll
2012-06-13 22:21 . 2012-04-07 11:34	2342400	----a-w-	c:\windows\SysWow64\msi.dll
2012-06-13 22:21 . 2012-04-24 05:59	1460224	----a-w-	c:\windows\system32\crypt32.dll
2012-06-13 22:21 . 2012-04-24 04:47	1156608	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-06-13 22:21 . 2012-04-24 05:59	182272	----a-w-	c:\windows\system32\cryptsvc.dll
2012-06-13 22:21 . 2012-04-24 05:59	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-06-13 22:21 . 2012-04-24 04:47	139264	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-06-13 22:21 . 2012-04-24 04:47	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-14 21:44 . 2011-10-29 04:59	4113408	----a-w-	c:\windows\system32\stlang64.dll
2012-06-14 21:44 . 2011-10-29 04:59	1424896	----a-w-	c:\windows\sttray64.exe
2012-06-14 21:44 . 2011-10-29 04:58	251392	----a-w-	c:\windows\system32\staco64.dll
2012-06-14 21:44 . 2011-10-29 04:59	6012416	----a-w-	c:\windows\system32\IDTNGUI.exe
2012-06-14 21:44 . 2011-10-29 04:59	5077504	----a-w-	c:\windows\system32\IDTNHP.dll
2012-06-14 21:44 . 2011-10-29 04:59	233472	----a-w-	c:\windows\system32\IDTNJ.exe
2012-06-14 21:44 . 2011-10-29 04:59	1819136	----a-w-	c:\windows\system32\IDTNC64.cpl
2012-06-14 21:44 . 2011-10-29 04:59	1041920	----a-w-	c:\windows\system32\IDTNX.dll
2012-06-14 21:44 . 2011-10-29 04:59	68608	----a-w-	c:\windows\system32\AESTAR64.dll
2012-06-14 21:44 . 2011-10-29 04:59	442368	----a-w-	c:\windows\system32\AESTEC64.dll
2012-06-14 21:44 . 2011-10-29 04:59	223744	----a-w-	c:\windows\system32\HPToneCtrls64.dll
2012-06-14 21:44 . 2011-10-29 04:59	162304	----a-w-	c:\windows\system32\AESTAC64.dll
2012-06-14 21:44 . 2011-10-29 04:59	90624	----a-w-	c:\windows\system32\AESTCo64.dll
2012-05-04 02:55 . 2012-05-04 02:55	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-05-04 02:55 . 2012-05-04 02:55	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-05-04 02:55 . 2012-05-04 02:55	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-05-04 02:55 . 2012-05-04 02:55	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-05-04 02:55 . 2012-05-04 02:55	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-05-04 02:55 . 2012-05-04 02:55	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-05-04 02:55 . 2012-05-04 02:55	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-05-04 02:55 . 2012-05-04 02:55	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-05-04 02:55 . 2012-05-04 02:55	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-05-04 02:55 . 2012-05-04 02:55	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-05-04 02:55 . 2012-05-04 02:55	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-05-04 02:55 . 2012-05-04 02:55	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-05-04 02:55 . 2012-05-04 02:55	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-05-04 02:55 . 2012-05-04 02:55	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-05-04 02:55 . 2012-05-04 02:55	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-05-04 02:55 . 2012-05-04 02:55	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-05-04 02:55 . 2012-05-04 02:55	222208	----a-w-	c:\windows\system32\msls31.dll
2012-05-04 02:55 . 2012-05-04 02:55	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-05-04 02:55 . 2012-05-04 02:55	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-05-04 02:55 . 2012-05-04 02:55	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-05-04 02:55 . 2012-05-04 02:55	12288	----a-w-	c:\windows\system32\mshta.exe
2012-05-04 02:55 . 2012-05-04 02:55	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-05-04 02:55 . 2012-05-04 02:55	114176	----a-w-	c:\windows\system32\admparse.dll
2012-05-04 02:55 . 2012-05-04 02:55	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-05-04 02:55 . 2012-05-04 02:55	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-05-04 02:55 . 2012-05-04 02:55	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-05-04 02:55 . 2012-05-04 02:55	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-05-04 02:55 . 2012-05-04 02:55	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-05-04 02:55 . 2012-05-04 02:55	448512	----a-w-	c:\windows\system32\html.iec
2012-05-04 02:55 . 2012-05-04 02:55	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-05-04 02:55 . 2012-05-04 02:55	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-05-04 02:55 . 2012-05-04 02:55	160256	----a-w-	c:\windows\system32\wextract.exe
2012-05-02 17:25 . 2012-05-02 17:25	560184	----a-w-	c:\windows\system32\drivers\sptd.sys
2012-05-02 16:14 . 2010-06-24 18:33	19352	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-02-11 76344]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-01-13 527312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe" [2012-03-14 319360]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-08-11 658424]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-02-03 22:09	75360	----a-w-	c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	DPPassFilter scecli
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-24 136176]
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [2011-07-15 137272]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe [2011-03-07 62184]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2012-01-13 106408]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys [2011-02-07 63336]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe [2011-09-05 476728]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-24 136176]
R3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2011-01-12 36864]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 MfeEpeOpal;MfeEpeOpal; [x]
S0 MfeEpePc;MfeEpePc; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2012-06-14 89600]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-01-07 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-01-07 53920]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]
S2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2012-05-31 96768]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [2011-01-28 133688]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [2011-02-07 320000]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [2012-03-14 365440]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2012-02-28 31000]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-26 13336]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2010-11-29 210896]
S2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [2012-02-08 1323008]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-08-11 1128952]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-03-16 113264]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
S2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [2010-11-11 502464]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-01-17 2656280]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2011-01-22 3154224]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-01-13 476112]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2010-11-11 32192]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-01-07 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-01-07 298144]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-01-07 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-01-07 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-01-07 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-01-07 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-01-07 279200]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2011-01-31 174168]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-11-30 406632]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-24 17:10]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-24 17:10]
.
2012-07-02 c:\windows\Tasks\HPCeeScheduleForTORSTEN-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2012-07-05 c:\windows\Tasks\HPCeeScheduleForTorsten.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-01-07 615584]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-01-07 379040]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-31 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-31 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-31 418840]
"MfeEpePcMonitor"="c:\program files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe" [2012-02-08 200704]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-06-14 1424896]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2011-07-15 14904]
"combofix"="c:\combofix\CF24913.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://google.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - hxxps://vpn.uni-mannheim.de/CACHE/stc/1/binaries/vpnweb.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-11  01:42:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-10 23:42
.
Vor Suchlauf: 10 Verzeichnis(se), 222.863.319.040 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 222.804.660.224 Bytes frei
.
- - End Of File - - 8F23A892E37EFB19635E841603EABFA7
         

--- --- ---

trat das problem mit dem debugger erneut auf?

Nein, nur nach dem Neustart nach dem Durchlauf. Heute war beim Hochfahren alles normal...

ok

lade den CCleaner standard:
CCleaner Download - CCleaner 3.20.1750
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Ich hab bei der Bewertung der Programme nun wirklich nur die als notwendig bezeichnet die ich auch regelmäßig nutze.
Da ich mich da nicht so gut auskenne habe ich die meisten nun als unbekannt bezeichnet auch wenn sie vielleicht wichtige Programme für meinen Laptop darstellen. Das könnt ihr sicher besser bewerten!
Danke für die Hilfe!!

Es zerschießt zwar die Formatierung, aber der Einfachheit halber trotzdem noch der Post:

Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 29.10.2011 6,00MB 10.2.152.26 unbekannt
Adobe Reader X (10.1.3) - Deutsch Adobe Systems Incorporated 24.05.2012 121MB 10.1.3 notwendig
Apple Application Support Apple Inc. 09.06.2012 61,0MB 2.1.7 unbekannt
Apple Mobile Device Support Apple Inc. 09.06.2012 24,9MB 5.1.1.4 unbekannt
Apple Software Update Apple Inc. 09.06.2012 2,38MB 2.1.3.127 unbekannt
ArcSoft TotalMedia ArcSoft 29.10.2011 1,01GB 2.0.39.12 unbekannt
ArcSoft Webcam Sharing Manager ArcSoft 28.10.2011 7,78MB 2.0.0.30 unbekannt
Atheros Driver Installation Program Atheros 28.10.2011 9.2 unbekannt
Avira Free Antivirus Avira 11.07.2012 125MB 12.0.0.1125 notwendig
Bing Bar Microsoft Corporation 12.05.2012 464KB 7.1.361.0 unbekannt
Bluetooth Win7 Suite (64) Atheros Communications 28.10.2011 59,4MB 7.02.000.55 unbekannt
Bonjour Apple Inc. 09.06.2012 2,00MB 3.0.0.10 unbekannt
CCleaner Piriform 22.06.2012 3.20 notwendig
Cisco AnyConnect Secure Mobility Client Cisco Systems, Inc. 19.05.2012 3.0.5080 notwendig
Cisco EAP-FAST Module Cisco Systems, Inc. 28.10.2011 1,55MB 2.2.14 notwendig
Cisco LEAP Module Cisco Systems, Inc. 28.10.2011 644KB 1.0.19 notwendig
Cisco PEAP Module Cisco Systems, Inc. 28.10.2011 1,23MB 1.1.6 notwendig
Citavi Swiss Academic Software 21.05.2012 69,2MB 3.2.0.0 unnötig
DAEMON Tools Lite DT Soft Ltd 02.05.2012 4.45.4.0315 unbekannt
Device Access Manager for HP ProtectTools Hewlett-Packard Company 14.06.2012 15,7MB 6.1.0.1 unbekannt
Drive Encryption For HP ProtectTools Hewlett-Packard Company 14.06.2012 57,3MB 6.0.98.29476 unbekannt
Energy Star Digital Logo Hewlett-Packard 28.10.2011 300KB 1.0.1 unbekannt
Evernote v. 4.2.2 Evernote Corp. 02.05.2011 139MB 4.2.2.3979 unbekannt
Face Recognition for HP ProtectTools Hewlett-Packard Company 28.10.2011 229MB 6.00.4303 unbekannt
File Sanitizer For HP ProtectTools Hewlett-Packard Company 02.05.2011 29,6MB 6.0.0.8 unbekannt
Freemake Video Converter Version 3.0.2 Ellora Assets Corporation 07.06.2012 50,1MB 3.0.2 unbekannt
GIMP 2.8.0 The GIMP Team 10.05.2012 241MB 2.8.0 notwendig
Google Chrome Google Inc. 14.07.2012 20.0.1132.57 notwendig
Google Toolbar for Internet Explorer Google Inc. 24.05.2012 7.3.2710.138 unnötig
HP 3D DriveGuard Hewlett-Packard Company 14.06.2012 7,00MB 4.1.14.1 unbekannt
HP Connection Manager Hewlett-Packard Company 14.06.2012 37,3MB 4.1.22.1 unbekannt
HP DayStarter Hewlett-Packard Company 28.10.2011 18,6MB 2.0.0.12 unbekannt
HP Documentation Hewlett-Packard 28.10.2011 740MB 1.2.0.0 unbekannt
HP ESU for Microsoft Windows 7 Hewlett-Packard Company 14.06.2012 23,6MB 2.0.6.1 unbekannt
HP Games WildTangent 29.10.2011 1.0.1.5 unbekannt
HP Hotkey Support Hewlett-Packard Company 14.06.2012 14,4MB 4.5.9.1 unbekannt
HP Power Assistant Hewlett-Packard Company 14.06.2012 28,2MB 2.1.0.6 unbekannt
HP ProtectTools Security Manager Hewlett-Packard Company 03.05.2011 88,6MB 6.00.888 unbekannt
HP QuickWeb Hewlett-Packard Company 28.10.2011 4,35MB 3.0.0.9057 unbekannt
HP Setup Hewlett-Packard Company 02.05.2011 8.5.4526.3645 unbekannt
HP SoftPaq Download Manager Hewlett-Packard Company 02.05.2011 13,9MB 3.2.0.0 unbekannt
HP Software Framework Hewlett-Packard Company 14.06.2012 4,74MB 4.1.13.1 unbekannt
HP Software Setup Hewlett-Packard Company 02.05.2011 14,1MB 8.2.1.1 unbekannt
HP Support Assistant Hewlett-Packard Company 08.06.2012 78,5MB 6.1.12.1 unbekannt
HP System Default Settings Hewlett-Packard Company 14.06.2012 1,59MB 2.3.1.2 unbekannt
HP Wallpaper Hewlett-Packard Company 02.05.2011 44,3MB 2.00 unbekannt
HP Webcam Driver Sonix 28.10.2011 5.8.50058.0 unbekannt
IDT Audio IDT 14.06.2012 1.0.6365.0 unbekannt
Intel(R) Identity Protection Technology 1.0.71.0 Intel Corporation 28.10.2011 1,13MB 1.0.71.0 unbekannt
Intel(R) Management Engine Components Intel Corporation 03.05.2011 7.0.0.1144 unbekannt
Intel(R) Processor Graphics Intel Corporation 03.05.2011 8.15.10.2342 unbekannt
Intel(R) Rapid Storage Technology Intel Corporation 29.10.2011 10.1.2.1004 unbekannt
iTunes Apple Inc. 09.06.2012 156MB 10.6.1.7 notwendig
JMicron Flash Media Controller Driver JMicron Technology Corp. 29.10.2011 1.0.57.2 unnötig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 03.05.2011 38,8MB 4.0.30319 unbekannt
Microsoft .NET Framework 4 Extended Microsoft Corporation 03.05.2011 51,9MB 4.0.30319 unbekannt
Microsoft Office Enterprise 2007 Microsoft Corporation 05.05.2012 12.0.6612.1000 unbekannt
Microsoft Silverlight Microsoft Corporation 12.05.2012 60,3MB 4.1.10329.0 unbekannt
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 02.05.2011 1,69MB 3.1.0000 unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 04.05.2012 300KB 8.0.61001 unbekannt
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 28.10.2011 610KB 8.0.61000 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 02.05.2011 788KB 9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 28.10.2011 788KB 9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 04.05.2012 788KB 9.0.30729.6161 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 02.05.2011 596KB 9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 28.10.2011 592KB 9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 04.05.2012 600KB 9.0.30729.6161 unbekannt
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 26.06.2012 13,7MB 10.0.30319 unbekannt
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 04.05.2012 12,2MB 10.0.40219 unbekannt
Microsoft_VC90_CRT_x86 Microsoft Corporation 02.05.2011 1,39MB 1.0.0 unbekannt
Mozilla Firefox 13.0.1 (x86 de) Mozilla 11.07.2012 35,7MB 13.0.1 notwendig
Mozilla Maintenance Service Mozilla 11.07.2012 199KB 13.0.1 unbekannt
PDF Complete Special Edition PDF Complete, Inc 14.06.2012 4.0.64 unbekannt
Privacy Manager for HP ProtectTools Hewlett-Packard Company 02.05.2011 21,2MB 6.00.831 unbekannt
Realtek Ethernet Controller All-In-One Windows Driver Realtek 02.05.2011 1.12.0016 unbekannt
Renesas Electronics USB 3.0 Host Controller Driver Renesas Electronics Corporation 28.10.2011 601KB 2.0.32.0 unbekannt
Skype™ 5.1 Skype Technologies S.A. 28.10.2011 22,5MB 5.1.104 unnötig
Synaptics Pointing Device Driver Synaptics Incorporated 03.05.2011 46,4MB 15.2.11.1 unbekannt
TeamViewer 7 TeamViewer 02.05.2012 7.0.12979 unbekannt
Theft Recovery for HP ProtectTools Hewlett-Packard Company 14.06.2012 748KB 6.0.0.33 unbekannt
Validity Fingerprint Sensor Driver Validity Sensors, Inc. 28.10.2011 24,8MB 4.3.117.0 unbekannt
VIP Access SDK x64(1.0.0.50) Symantec Inc. 29.10.2011 1.0.0.50 unbekannt
Windows Live Essentials Microsoft Corporation 02.05.2011 15.4.3502.0922 unbekannt
WinZip 14.5 WinZip Computing, S.L. 02.05.2012 19,9MB 14.5.9095 unbekannt
Xobni Xobni Corp. 29.10.2011 1.9.5.1328 unbekannt

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
ArcSoft : beide, falls du keine webcam nutzt.
Bing
Citavi
DAEMON Tools
Evernote
Face Recognition : falls du dich nicht mit nem gesichtsscan anmeldest, kann das weg.
Freemake
Google Toolbar
PDF Complete
TeamViewer
Validity Fingerprint : falls du keinen fingerabdruck scanner nutzt, weg
Windows Live : alle für dich unnötigen

öffne ccleaner, analysieren, starten
öffne otl, cleanup, pc startet neu, testen wie er läuft.
danach kommen wir dann zur pc absicherung und sicheren passwörtern :-)

Also nachdem ich die letzten Schritte befolgt habe und nun mal etwas gewartet habe, glaube ich geringfügige Verbesserungen festzustellen. Zumindest hat er nicht mehr so häufig diese Hänger beim Schreiben, die so extrem auffällig waren. Ganz weg sind sie allerdings nicht, nur viel seltener... Vielen Dank schon mal soweit!!
Gibt es weitere Tipps und Hilfen die ich befolgen sollte? Du hast das Thema PC-Absicherung angesprochen?

öffne ccleaner, extras, autostart, poste alle einträge

Ja HKCU:Run Sidebar Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
Ja HKLM:Run Adobe ARM Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Ja HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Ja HKLM:Run AthBtTray Atheros Commnucations "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
Ja HKLM:Run AtherosBtStack Atheros Communications "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
Ja HKLM:Run avgnt Avira Operations GmbH & Co. KG "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
Ja HKLM:Run Cisco AnyConnect Secure Mobility Agent for Windows Cisco Systems, Inc. "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
Ja HKLM:Run DTRun c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe
Ja HKLM:Run File Sanitizer Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
Ja HKLM:Run HotKeysCmds Intel Corporation C:\windows\system32\hkcmd.exe
Ja HKLM:Run HPConnectionManager Hewlett-Packard Development Company L.P. C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
Ja HKLM:Run HPPowerAssistant Hewlett-Packard Company, L.P. C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden
Ja HKLM:Run HPQuickWebProxy Hewlett-Packard Company "c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
Ja HKLM:Run IAStorIcon Intel Corporation C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
Ja HKLM:Run IgfxTray Intel Corporation C:\windows\system32\igfxtray.exe
Ja HKLM:Run iTunesHelper Apple Inc. "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
Ja HKLM:Run MfeEpePcMonitor "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe"
Ja HKLM:Run NUSB3MON Renesas Electronics Corporation "c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
Ja HKLM:Run Persistence Intel Corporation C:\windows\system32\igfxpers.exe
Ja HKLM:Run QLBController Hewlett-Packard Company C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
Ja HKLM:Run SynTPEnh %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
Ja HKLM:Run SysTrayApp IDT, Inc. C:\Program Files\IDT\WDM\sttray64.exe

Ja Extension An OneNote senden Microsoft Corporation C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
Ja Extension Research Microsoft Corporation C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
Ja Extension Send by Bluetooth to Atheros Commnucations C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
Nein Helper Adobe PDF Link Helper Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
Ja Helper CIESpeechBHO Class Atheros Commnucations C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
Ja Helper File Sanitizer for HP ProtectTools Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll

Ja Task Adobe Flash Player Updater Adobe Systems Incorporated C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Ja Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Ja Task CreateChoiceProcessTask Microsoft Corporation C:\Windows\System32\browserchoice.exe /launch
Ja Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Ja Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Ja Task HPCeeScheduleForTorsten Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForTorsten (null)
Ja Task HPCeeScheduleForTORSTEN-HP$ Hewlett-Packard C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForTORSTEN-HP$ (null)
Ja Task Registration "C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe" Registration ShowMessageTask2D
Ja Task {991C278F-1420-4A85-9813-759FBBF4F547} InstallShield Software Corporation C:\Users\Torsten\Desktop\ojT_DEU_xp1704.exe
Ja Task {F5D4FB8F-2CE7-4AD3-BEDB-874B79BE3460} InstallShield Software Corporation C:\Users\Torsten\Desktop\ojT_DEU_xp1704.exe

Ja Directory Shell Extension for Malware scanning Avira Operations GmbH & Co. KG C:\Program Files (x86)\Avira\AntiVir Desktop\shlext64.dll
Ja Directory WinZip WinZip Computing, S.L. C:\Program Files (x86)\WinZip\wzshls64.dll
Ja File Atheros Atheros Commnucations C:\Program Files (x86)\Bluetooth Suite\BtvAppExt.dll
Ja File FTShellContext Atheros Commnucations C:\Program Files (x86)\Bluetooth Suite\ShellContextExt.dll
Ja File Shell Extension for Malware scanning Avira Operations GmbH & Co. KG C:\Program Files (x86)\Avira\AntiVir Desktop\shlext64.dll
Ja File WinZip WinZip Computing, S.L. C:\Program Files (x86)\WinZip\wzshls64.dll

start ausführen, tippe:
msconfig
enter
systemstart
alle haken raus außer:
Avira

ok klicken, neustart wird ausgeführt, dann noch mal neustarten und testen wie der pc läuft.