Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D

joe1681978

Hallo,

Hab auf einem Windows 2008R2 64bit Server das Problem, dass sich die Firewall nicht starten lässt. Beim Starten kommt die Fehlermeldung:
Beim Öffnen des Snap-Ins "Windows-Firewall mit erweiterter Sicherheit" ist ein Fehler aufgetreten. Das Snap-In "Windows-Firewall mit erweiterter Sicherheit" konnte nicht geladen werden. Starten Sie den Windows-Firewalldienst auf dem von Ihnen verwalteten Computer neu. Fehlercode: 0x6D9

In "Dienste" ist die Firewall nicht gestartet. Beim Versuch zu starten kommt die Meldung: "Windows-Firewall auf Lokaler Computer konnte nicht gestartet werden. Weitere Informationen ....."
Im Ereignisprotokoll steht nur "Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: Zugriff verweigert."

Hab viel gegoogelt und ausprobiert, aber nichts konnte bislang helfen, auch nicht folgende Batch-Datei:
sc config MpsSvc start= auto
sc config KeyIso start= auto
sc config BFE start= auto
sc config FwcAgent start= auto
net stop MpsSvc
net start MpsSvc
net stop KeyIso
net start KeyIso
net start Wlansvc
net start dot3svc
net start EapHostnet
net stop BFE
net start BFE
net start PolicyAgent
net start MpsSvc
net start IKEEXT
net start DcaSvcnet
net stop FwcAgent
net start FwcAgent

Hatte bislang Kaspersky als Antivirusprogramm auf dem Rechner, nun auf Eset Nod 32 gewechselt, und beim Scan damit wurden folgende Infektionen erkannt und beseitigt:
Win32/InstallCore.D
Win32/Adware.ADON
Quarantine:
Hash Occurred first Occurred last Object name Size Reason Hits File
0f2357d38eb6af3b5e8519f8cc247985df5f28ed 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXZOPMXT\cnet2_pscan13_exe.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data
692f9ad1fe17415dabefea71c02805548f37c603 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T9TOMZZC\cnet2_aports_zip.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data
6e45431b698cdb7be8f1a41266be7b327f33ad38 8 hours ago 8 hours ago E:\rib\Sonstiges\Unlocker1.9.1.exe 783 KByte Win32/Adware.ADON evtl. unerwünschte Anwendung 1 No Data


Die Firewall lässt sich weiterhin nicht starten, und ich hab die Sorge, dass irgendetwas Böses noch auf dem Rechner ist, und das Starten der Firewall verhindert.

Nachfolgend das Scan-Ergebniss von Malwarebytes:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.20.04

Windows Server 2008 R2 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: SERVER [Administrator]

20.07.2012 15:45:33
mbam-log-2012-07-20 (15-45-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 2029664
Laufzeit: 5 Stunde(n), 24 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


Der Quick-Scan von OTL:
OTL.txt
OTL logfile created on: 20.07.2012 17:14:55 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools
64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free
11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS
Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS
Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS

Computer Name: SERVER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.20 15:38:57 | 000,596,480 | ---- | M] (OldTimer Tools) -- E:\daten\Eset Nod32\Removal Tools\OTL.exe
PRC - [2012.07.16 16:37:24 | 006,849,448 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
PRC - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.07.16 16:22:42 | 000,106,408 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe
PRC - [2012.05.18 16:53:24 | 006,219,744 | ---- | M] (ESET) -- D:\Program Files (x86)\ESET\ESET Remote Administrator\Console\console.exe
PRC - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe
PRC - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe
PRC - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) -- D:\David\Code\sl.exe
PRC - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) -- D:\David\Apps\Maserver\CODE\maserver.exe
PRC - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) -- D:\David\Apps\Postman\Code\postman.exe
PRC - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\snmp.exe
PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- c:\Windows\SysWOW64\cmd.exe
PRC - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) -- D:\David\Apps\Webbox\Code\webbox.exe
PRC - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) -- D:\David\Apps\Dvgrab\Code\dvgrab.exe
PRC - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe
PRC - [2010.06.25 20:04:58 | 007,276,416 | ---- | M] (Super Flexible Software) -- D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe
PRC - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe
PRC - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe
PRC - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe
PRC - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe
PRC - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
PRC - [2010.01.13 04:10:00 | 006,352,896 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
PRC - [2009.12.22 16:29:10 | 000,193,536 | ---- | M] (Tobit.Software) -- C:\Windows\SysWOW64\DV4TS.EXE
PRC - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe
PRC - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe
PRC - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe
PRC - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\ADVANTAGE\Server\ads.exe
PRC - [2006.11.22 06:20:00 | 003,768,320 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
PRC - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe


========== Modules (No Company Name) ==========

MOD - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe
MOD - [2010.07.04 23:32:36 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerHook.dll
MOD - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011.12.26 08:45:13 | 000,696,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dns.exe -- (DNS)
SRV:64bit: - [2010.11.20 15:26:05 | 000,729,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpssvc.dll -- (DHCPServer)
SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP)
SRV:64bit: - [2010.11.20 15:25:02 | 001,020,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ntfrs.exe -- (NtFrs)
SRV:64bit: - [2010.11.20 15:24:50 | 000,059,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ismserv.exe -- (IsmServ)
SRV:64bit: - [2010.11.20 15:24:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\inetsrv\inetinfo.exe -- (IISADMIN)
SRV:64bit: - [2010.11.20 15:24:38 | 004,518,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfsrs.exe -- (DFSR)
SRV:64bit: - [2010.11.20 15:24:38 | 000,377,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfssvc.exe -- (Dfs)
SRV:64bit: - [2010.01.25 14:50:28 | 000,017,960 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\sysdown.exe -- (sysdown)
SRV:64bit: - [2009.07.14 03:41:53 | 000,014,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sacsvr.dll -- (sacsvr)
SRV:64bit: - [2009.07.14 03:40:52 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FCRegSvc.dll -- (FCRegSvc)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.07.14 03:39:31 | 000,091,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rsopprov.exe -- (RSoPProv)
SRV:64bit: - [2008.11.14 12:21:50 | 000,022,568 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\cpqrcmc.exe -- (CpqRcmc)
SRV - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe -- (ERA_SERVER)
SRV - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) [On_Demand | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe -- (ERA_HTTP_SERVER)
SRV - [2012.05.14 07:19:22 | 000,042,408 | ---- | M] (ESET) [On_Demand | Unknown] -- D:\Program Files\ESET\ESET File Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) [Auto | Running] -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe -- (ekrn)
SRV - [2011.06.17 22:28:12 | 000,431,456 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$DAVID) SQL Server Agent (DAVID)
SRV - [2011.06.17 22:22:56 | 062,111,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe -- (MSSQL$DAVID) SQL Server (DAVID)
SRV - [2010.12.10 18:34:52 | 039,627,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -- (MSSQL$MICROSOFT##SSEE) Windows Internal Database (MICROSOFT##SSEE)
SRV - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Code\sl.exe -- (DavidServiceLayer)
SRV - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Maserver\CODE\maserver.exe -- (DavidMailAccessServer)
SRV - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Postman\Code\postman.exe -- (DavidPostMan)
SRV - [2010.11.20 15:44:11 | 000,487,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe -- (ADWS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP)
SRV - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Webbox\Code\webbox.exe -- (DavidWebBox)
SRV - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Dvgrab\Code\dvgrab.exe -- (DavidGrabbingServer)
SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe -- (ectisrv)
SRV - [2010.06.24 11:58:48 | 004,370,513 | ---- | M] (ESTOS GmbH) [On_Demand | Stopped] -- D:\Program Files (x86)\ESTOS\TapiServer\ETapiSrv.exe -- (etapisrv)
SRV - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe -- (emeta2)
SRV - [2010.06.06 17:26:40 | 001,665,536 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Replica\Code\replica.exe -- (DavidReplica)
SRV - [2010.06.06 17:06:04 | 001,578,496 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\showis\showis.exe -- (DavidShowInterfaceServices)
SRV - [2010.04.03 12:02:52 | 000,032,096 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe -- (MSSQLFDLauncher$DAVID) SQL Full-text Filter Daemon Launcher (DAVID)
SRV - [2010.04.03 12:00:10 | 000,146,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.04.03 12:00:08 | 000,059,744 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2010.03.19 12:25:30 | 000,167,424 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.25 21:43:40 | 001,291,776 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent)
SRV - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe -- (RIB NetCounterLM)
SRV - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe -- (Sentinel RMS License Manager)
SRV - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe -- (RIB.License.Server)
SRV - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.12.09 14:18:02 | 000,148,480 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\pbxpense\code\pbxpense.exe -- (DavidPBXpense)
SRV - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe -- (FreeSSHDService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.02 15:56:16 | 001,278,976 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\videocpt\code\VideoCapture.exe -- (DavidVideoCapture)
SRV - [2009.04.21 09:26:50 | 000,113,664 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\tvindex\tvindex.exe -- (DavidTVIndex)
SRV - [2009.04.10 12:33:54 | 000,245,760 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dvhost\CODE\dvhost.exe -- (DavidHost)
SRV - [2009.04.10 12:29:40 | 000,329,728 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dserver\Code\dserver.exe -- (DavidDiscussionServer)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Spooldienst)
SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Archivierungsdienst)
SRV - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) [Auto | Running] -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe -- (APCPBEAgent)
SRV - [2008.11.15 06:53:14 | 006,447,744 | ---- | M] () [Disabled | Stopped] -- D:\Program Files (x86)\Bitfarm-Archiv\mysql-5.1.30-win32\bin\mysqld.exe -- (Mysql-bf)
SRV - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\ADVANTAGE\Server\ads.exe -- (Advantage)
SRV - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe -- (WkSvw32.exe)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.21 15:52:36 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2011.11.24 10:58:44 | 000,078,208 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV:64bit: - [2011.10.07 10:31:42 | 000,321,536 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock)
DRV:64bit: - [2011.08.09 08:11:50 | 000,021,120 | ---- | M] (SafeNet Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb)
DRV:64bit: - [2011.06.17 21:54:22 | 000,313,696 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\RsFx0151.sys -- (RsFx0151)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.05 12:23:04 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2011.01.05 12:23:04 | 000,125,296 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:33:18 | 000,066,944 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\dfsrro.sys -- (DfsrRo)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:57:24 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp)
DRV:64bit: - [2010.11.20 11:57:17 | 000,181,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid)
DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.10.20 12:05:28 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (q57nd60a)
DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2010.02.22 13:02:18 | 000,156,776 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpCISSs2.sys -- (HpCISSs2)
DRV:64bit: - [2010.01.25 14:50:26 | 000,160,296 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpqilo2.sys -- (hpqilo2)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeamMP)
DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeam)
DRV:64bit: - [2009.08.07 08:59:18 | 000,016,896 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Wibukey2_64.sys -- (Wibukey2_64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,051,776 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\dfs.sys -- (DfsDriver)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 03:45:45 | 000,096,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sacdrv.sys -- (sacdrv)
DRV:64bit: - [2009.06.24 23:33:46 | 002,210,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ati2mtag.sys -- (ati2mtag)
DRV:64bit: - [2009.06.10 22:35:30 | 000,035,328 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qd260x64.sys -- (ioatdma) Intel(R)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.05.11 16:08:08 | 000,051,752 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqcidrv.sys -- (CpqCiDrv)
DRV:64bit: - [2006.11.22 06:20:00 | 000,107,008 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\WibuKey64.sys -- (WIBUKEY)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007.04.02 14:53:04 | 000,039,552 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapitd.sys -- (elcapitd)
DRV - [2007.01.23 16:28:30 | 000,151,296 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ELCAPI20.SYS -- (elcapi20)
DRV - [2007.01.23 16:21:46 | 000,113,600 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapibs.sys -- (elcapibs)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/SoftAdmin.htm
IE - HKCU\..\SearchScopes,DefaultScope = {EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: D:\PROGRAM FILES\ESET\ESET FILE SECURITY\MOZILLA THUNDERBIRD [2012.07.19 17:35:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird


O1 HOSTS File: ([2010.08.31 17:34:45 | 000,000,847 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.7.2 roihost
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company)
O4:64bit: - HKLM..\Run: [egui] D:\Program Files\ESET\ESET File Security\egui.exe (ESET)
O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found
O4 - HKCU..\Run: [ExtremeSync Background Scheduler] D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe (Super Flexible Software)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Ranges: Range1 ([file] in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053B40FB-8357-4177-95F4-70CBEF6040C5}: NameServer = 192.168.7.250,192.168.7.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF2345F7-E2F5-46DA-B8AC-1E3289CFAA40}: NameServer = 192.168.7.5,192.168.7.250
O18:64bit: - Protocol\Handler\hpapp - No CLSID value found
O18:64bit: - Protocol\Handler\hpapp\Apps - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\hpapp {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files (x86)\Compaq\Cpqacuxe\Bin\hpapp.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\hpapp\Apps - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (pwdssp.dll) - File not found
O29 - HKLM SecurityProviders - (pwdssp.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.20 16:38:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012.07.20 16:16:34 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.07.20 15:58:59 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.07.20 15:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.07.20 15:43:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.20 15:43:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.20 09:15:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET
[2012.07.20 09:13:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\temp
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.19 11:52:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker
[2012.07.19 11:03:35 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.19 10:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET

========== Files - Modified Within 30 Days ==========

[2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.20 16:38:19 | 000,003,009 | ---- | M] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:52:50 | 001,027,624 | ---- | M] () -- C:\ADS_ERR.ADT
[2012.07.20 15:52:50 | 000,018,944 | ---- | M] () -- C:\ADS_ERR.ADI
[2012.07.20 15:44:52 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job
[2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 09:21:19 | 000,001,994 | -H-- | M] () -- C:\Users\Administrator\Documents\Default.rdp
[2012.07.20 09:13:05 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.20 09:11:19 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\bd4040cn.dat
[2012.07.20 09:11:19 | 000,000,026 | ---- | M] () -- C:\Windows\BRPP2KA.INI
[2012.07.19 23:20:50 | 002,346,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.19 23:20:50 | 000,965,724 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.19 23:20:50 | 000,904,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.19 23:20:50 | 000,250,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.19 23:20:50 | 000,215,958 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.19 21:35:44 | 000,031,177 | ---- | M] () -- C:\ADS_ERR.adm
[2012.07.19 21:06:13 | 000,000,404 | ---- | M] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\tasks\komsthoeft_daten.job
[2012.07.19 17:29:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.19 12:29:36 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.07.17 09:42:43 | 000,000,766 | ---- | M] () -- C:\Windows\tobit.ini
[2012.07.12 03:36:36 | 000,312,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 03:29:15 | 000,000,376 | ---- | M] () -- C:\Windows\dtools.INI
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012.07.20 16:38:19 | 000,003,009 | ---- | C] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk
[2012.07.20 15:44:00 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.20 15:43:15 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 09:13:05 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7 Host.lnk
[2012.07.20 09:13:05 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk
[2012.07.19 21:06:13 | 000,000,404 | ---- | C] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat
[2012.07.19 12:29:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk
[2012.06.16 00:19:29 | 000,000,376 | ---- | C] () -- C:\Windows\dtools.INI
[2012.06.16 00:07:21 | 000,000,145 | ---- | C] () -- C:\Windows\BRICK.INI
[2011.07.19 17:23:54 | 000,000,600 | ---- | C] () -- C:\Users\Administrator\AppData\Local\PUTTY.RND
[2011.04.12 16:45:33 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\NetCapiConfig.exe
[2011.04.12 16:45:33 | 000,077,890 | ---- | C] () -- C:\Windows\SysWow64\CAPI2032.dll
[2011.04.12 16:34:05 | 000,090,624 | ---- | C] () -- C:\Windows\SysWow64\elalui32.dll
[2011.02.01 16:02:16 | 000,000,657 | ---- | C] () -- C:\Users\Administrator\static.key
[2011.01.05 08:57:25 | 000,017,563 | ---- | C] () -- C:\Windows\Q-Dir.ini
[2010.12.07 18:45:30 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL
[2010.12.07 18:45:30 | 000,099,840 | ---- | C] () -- C:\Windows\IMGMSGMO.dll
[2010.12.07 18:45:17 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI
[2010.12.07 18:44:35 | 000,000,766 | ---- | C] () -- C:\Windows\tobit.ini
[2010.12.07 18:42:34 | 008,283,136 | ---- | C] () -- C:\Windows\TOBITCLT.DLL
[2010.12.07 18:42:32 | 002,648,064 | ---- | C] () -- C:\Windows\SysWow64\DVMSG.DLL
[2010.12.07 18:42:32 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\dvccext.dll
[2010.12.07 18:20:28 | 000,000,047 | ---- | C] () -- C:\Windows\TOBITADD.INI
[2010.08.20 16:23:16 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini
[2010.08.18 23:15:32 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2010.08.17 13:57:31 | 000,000,153 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2010.08.17 13:57:31 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.08.17 13:57:31 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2010.08.17 13:56:59 | 000,020,605 | ---- | C] () -- C:\Windows\HL-4040CN.INI
[2010.08.17 13:56:44 | 000,000,471 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.08.17 13:56:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat
[2010.08.17 13:56:44 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010.08.17 13:56:26 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2010.08.17 13:56:25 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2010.08.12 21:53:59 | 000,001,247 | ---- | C] () -- C:\Windows\SysWow64\cygrunsrv.exe.stackdump
[2010.08.06 18:45:52 | 000,011,306 | ---- | C] () -- C:\Users\Administrator\gsview32.ini
[2010.08.03 16:14:20 | 000,003,843 | ---- | C] () -- C:\Users\Administrator\cadwin.ini
[2010.08.02 15:41:31 | 000,472,576 | ---- | C] () -- C:\Windows\SysWow64\ApolloCrypt.dll
[2010.08.02 15:41:31 | 000,059,392 | ---- | C] () -- C:\Windows\Bssudf.dll
[2010.07.26 09:46:12 | 000,001,164 | ---- | C] () -- C:\Users\Administrator\copyclient.ini
[2010.07.25 12:03:29 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\APCSnmp.dll
[2010.07.24 18:53:50 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth2.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth1.dll
[2010.07.24 18:53:49 | 000,000,095 | ---- | C] () -- C:\Windows\SysWow64\prsrvk.dll
[2010.07.24 18:53:49 | 000,000,072 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2010.07.24 17:47:47 | 000,000,521 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.07.24 17:44:53 | 000,001,680 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.07.24 10:47:28 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2010.07.24 10:47:28 | 000,000,204 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2010.07.23 17:06:05 | 000,196,608 | ---- | C] () -- C:\Windows\SysWow64\twxapi32.dll
[2010.07.23 13:52:45 | 002,353,740 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.06.08 13:45:20 | 000,003,076 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== LOP Check ==========

[2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core
[2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv
[2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab
[2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS
[2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF
[2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo
[2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD
[2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer
[2012.05.30 15:40:53 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL
[2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++
[2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org
[2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir
[2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB
[2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer
[2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer
[2012.07.09 16:18:17 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit
[2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke
[2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\Tasks\komsthoeft_daten.job
[2011.03.17 04:00:38 | 000,019,396 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job
[2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job

========== Purity Check ==========



< End of report >


Extras.txt:
OTL Extras logfile created on: 20.07.2012 17:14:55 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools
64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free
11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS
Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS
Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS

Computer Name: SERVER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 1
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 1
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH)
"bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06E50997-ADD9-4D37-90D5-8A935DAE2BCF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{07120A22-1219-4F57-8722-6DB09C1018D6}" = lport=139 | protocol=6 | dir=in | app=system |
"{1388AD42-6824-426D-A352-461445D16792}" = lport=6262 | protocol=17 | dir=in | name=advantage udp |
"{14D44A0F-1C11-4C3B-85CE-2A6B642A71E3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{15561199-F6AC-47A2-A82F-482944B7B23D}" = lport=6262 | protocol=6 | dir=in | name=advantage tcp |
"{18AC0313-F185-44B1-83BC-726898339B01}" = lport=5358 | protocol=6 | dir=in | app=system |
"{1BB83F8F-CC9A-4727-BC4E-23A901776132}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2B9EE05C-F86C-4E9D-8170-FB038AB44429}" = lport=138 | protocol=17 | dir=in | app=system |
"{31CEEA99-87E0-42EC-9489-77C382EA41F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{331E61FF-FA25-48C7-ABDD-F1FC4D15433A}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{34B16F1A-8BC7-41C7-9BFE-49C0C114D99D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3F5C7288-B263-4A2F-8259-E27A91BD46A7}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{3FA40EFE-DB37-4919-A151-72D58B4E8761}" = lport=3306 | protocol=6 | dir=in | name=mysql |
"{4743813F-3F8E-429D-BAB1-BA46E4212FC9}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{5263BFB3-5FE9-4806-98F9-9716927D53E0}" = lport=137 | protocol=17 | dir=in | app=system |
"{6B9BA7B2-0F3C-49C4-88EA-D9706761B728}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{6C1E1DF1-062E-4AB0-B142-282D6CBDF046}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit |
"{7694AA81-7B2E-401C-AE9B-B8BED1BF03AD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{779CC6AA-821F-48C6-9FB9-F5F726E66BFA}" = rport=139 | protocol=6 | dir=out | app=system |
"{831A6729-9581-40CB-A0D2-07E51A848DB4}" = rport=138 | protocol=17 | dir=out | app=system |
"{83F14079-9A9D-49D7-B9CB-9F56F1F59558}" = rport=5358 | protocol=6 | dir=out | app=system |
"{851DE5A8-F5E8-428D-9343-9615BB2DC15F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8704EEE9-9D3A-4830-B70E-FC7192911276}" = lport=6004 | protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office14\outlook.exe |
"{88644FA6-8681-43CF-9D73-8CD118147965}" = rport=137 | protocol=17 | dir=out | app=system |
"{8DC5178B-09AF-4D75-916D-4CA9A4B8DBB4}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{94E9D7A2-F550-4F2C-B85D-63D950B4472C}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B7B0B15-7CF5-4447-A9D7-27E3CF0B0BFC}" = lport=445 | protocol=6 | dir=in | app=system |
"{9D418EAE-D1AA-48D9-86D2-01B2DE7BA6C8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9DA7DD22-F5A9-488D-910F-4D7D82C6E3D5}" = lport=137 | protocol=17 | dir=in | app=system |
"{A49718FE-AB4E-40A0-A7CF-9A181F627664}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B27D098F-3604-45ED-9B8F-2E74453411C8}" = rport=137 | protocol=17 | dir=out | app=system |
"{B4A36897-19FD-4DE5-A164-92A14143196D}" = rport=445 | protocol=6 | dir=out | app=system |
"{BB123C8F-C146-46F7-B05C-A7A5383A240F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D0167492-83FD-4482-B711-D2F08994476E}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{E403A58F-BFF3-421C-BD86-6B274137914C}" = lport=5357 | protocol=6 | dir=in | app=system |
"{E6B756FD-19A8-4E1B-82BE-8BF841DB51CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E996943A-B8E9-4BA9-87C0-F6A9CEFD9FB1}" = rport=5357 | protocol=6 | dir=out | app=system |
"{EB68839E-62FD-4B1B-8DDF-CE9F611D664B}" = rport=138 | protocol=17 | dir=out | app=system |
"{EC22F5F0-66FC-4EF4-B117-A56961A7DF76}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{F3FFE92F-C133-43C5-9274-0EB77D35E247}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit |
"{F4B757F6-BE22-4DA8-8FF9-4172D33B2601}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F79D295C-4BA2-4F4C-95EA-FBBA19465E33}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F8EAA3F0-0F6E-4201-92EC-7F1FBDD6285B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{087DBC19-5A42-4487-84ED-EC490AA43F6C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{13B40177-C7F4-4813-A9FB-2AB547E814BD}" = protocol=17 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe |
"{27F5776E-5787-47E3-AA7F-16A0232F1B33}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe |
"{2CBBC0DD-F0D9-414A-9BA6-4A0846C2C4B6}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) |
"{31CBB4F6-AE73-4BF4-AA41-F4B569988F56}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe |
"{38869D43-357A-41F4-BB6F-13D4DD7C9592}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{411BFE4D-301E-4EAB-8FF8-ED11865F5EEC}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{41ABE070-77B9-449C-BE4F-C47D74002CB7}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) |
"{421EA704-C1C2-40C5-B979-B94E053C6303}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{42BA6D81-33F3-4CAF-840A-F34B4503B471}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{49F5E4DD-9BFE-424A-A461-069300FC0F78}" = protocol=6 | dir=out | app=system |
"{53BF4A4A-7854-4D78-8B2B-8EE2FDE7D453}" = protocol=6 | dir=in | app=d:\david\code\sl.exe |
"{58622F99-00BE-4C15-A2B6-7D4D4EB2EDE7}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{5A8F8ED4-D3B6-4EAB-96F8-EAB1FF408A7A}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe |
"{6AF04484-4352-45A1-ADD3-40D3753D9685}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe |
"{7032D7C3-F2CA-4CD7-B0A0-9656925E993B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{754EDA6E-4AEC-4BE4-A6CC-6E9D555796CD}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{85259848-E949-4B67-853E-0E2CB47635FB}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{99E394E2-A39F-44AF-A46C-56C99AC85521}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe |
"{A13700BC-C658-44BC-9BFA-C450E00F37B9}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe |
"{A8124960-8564-4795-BD63-6B73CDF95FCB}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe |
"{C3D6F1D6-D79C-47B1-87EE-F62129C1C57F}" = protocol=6 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe |
"{DAA522E0-7443-4CD1-A91B-0A3A32417F3C}" = protocol=17 | dir=in | app=d:\david\code\sl.exe |
"{FC9754A1-E3C8-4DAF-86E2-9DE69A9C48B1}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00060000-0000-1004-8002-0000C06B5161}" = WIBU-KEY Setup (WIBU-KEY Remove)
"{01078B88-2981-4F75-96B0-8B22E2D2DE03}" = Microsoft SQL Server 2008 R2 Setup (English)
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F27A9B5-63FD-43DB-8230-FFE1E9CFE2C4}" = HP Smart Array SAS/SATA Event Notification Service
"{234F6B0D-10AE-4BB7-B2F3-E48D4861952D}" = SQL Server 2008 R2 SP1 Common Files
"{288D79EE-A2D1-42AF-9597-B0ADCC23A8ED}" = Microsoft SQL Server VSS Writer
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{2E97856A-345A-475D-913C-B8A78406BDF6}" = HP Lights-Out Online Configuration Utility
"{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1
"{36F70DEE-1EBF-4707-AFA2-E035EEAEBAA1}" = SQL Server 2008 R2 SP1 Common Files
"{471AAD2C-9078-4DAC-BD43-FA10FB7C3FCE}" = Microsoft SQL Server 2008 R2 Native Client
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{74D49383-7EF9-4FD3-B5B0-73CA22F51CE8}" = HP ProLiant Remote Monitor Service
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client
"{9DFA5914-C275-42E0-810E-C88E46A7F9EA}" = SQL Server 2008 R2 SP1 Full text search
"{A2122A9C-A699-4365-ADF8-68FEAC125D61}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B40EE88B-400A-4266-A17B-E3DE64E94431}" = Microsoft SQL Server 2008 Setup Support Files
"{BDD79957-5801-4A2D-B09E-852E7FA64D01}" = Windows Internal Database (MICROSOFT##SSEE)
"{BF7B0C91-5AF6-46B7-91CE-C8DD3D36E4BD}" = MySQL Server 5.1
"{C450F717-C461-4D47-93C3-6D93779AD5C9}" = ESET File Security
"{C942A025-A840-4BF2-8987-849C0DD44574}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{D32B3BF4-4019-4D62-8400-6B2E16CDEA23}" = HP ProLiant Integrated Management Log Viewer
"{D64C20F4-C49B-476C-A0D1-7813D954ED12}" = VanDyke Software Client Pack 6.5
"{D8C23BDE-4748-44D9-A9DD-8AB64EB18BE3}" = Microsoft SQL Server 2008 R2 RsFx Driver
"{DCEA910B-3269-4F5B-A915-D59293004751}" = HP Insight Diagnostics Online Edition for Windows
"{E7814BDC-DC36-4181-B765-E34FD673F957}" = RIB Lizenzmanagement
"{F31183CF-E10F-4DE1-BB59-6C0FF38E481E}" = Sql Server Customer Experience Improvement Program
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = SQL Server 2008 R2 SP1 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = SQL Server 2008 R2 SP1 Database Engine Services
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"GPL Ghostscript 9.04" = GPL Ghostscript
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 R2 (64-bit)
"Microsoft SQL Server 2008 R2" = Microsoft SQL Server 2008 R2 (64-bit)
"PDF-XChange 3_is1" = PDF-XChange 3
"Redirection Port Monitor" = RedMon - Druckeranschluß-Umleitungsmonitor

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0DE5137F-581B-448C-AF70-9498EF364E34}" = Advantage Database Server for Windows v9.10
"{14A5045C-33EE-4596-AA69-8761611AE8EB}" = HP Array Configuration Utility CLI
"{173438F5-BD4D-47AE-9C8F-73E6BAA62624}" = PFA Server Registry Update
"{19382EF6-8D47-4C3C-AA57-D2D2CDF03828}" = elmeg PABX TAPI V1.32
"{23170F69-40C1-2701-0464-000001000000}" = 7-Zip 4.64
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (KAV_CS_ADMIN_KIT)
"{34D6E797-AA32-455D-8E65-4EBD1AC9DED7}" = HP ProLiant PCI-express Power Management Update for Windows
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5563B6-DE0A-4F3B-A5D6-15789FD12D9B}" = Headless Server Registry Update
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"{5A5F45AE-0250-4C34-9D89-F10BDDEE665F}" = HP Version Control Agent
"{5DADDACD-0B7B-4E48-908E-C451D16AACA6}" = David.InfoCenter
"{640A92A1-9B8B-4C80-B412-9595460EBC53}_is1" = TopKontor Handwerk Version 5
"{65B1D8AD-D8ED-4EF0-89FC-CA211C63130A}" = HP Array Diagnostics Utility CLI
"{6AFCC61D-7273-4F30-8A3A-5733FD771F82}" = HP Array Diagnostic Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{717F49F9-BCE2-4D3F-97D8-EC3A36B3CF77}" = ESTOS CtiServer Multiline Tapi
"{74C48700-A6A7-4B3D-BD3A-C4E131CDD8E8}" = HP Array Configuration Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7CB265A0-4179-4A15-A993-7A12E8A88D28}" = ESTOS CtiServer
"{80AB11C2-0313-4A32-932C-12048D758BDF}" = Brother HL-4040CN
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{884F6891-633B-4BCA-B08E-A702EDF038E4}" = ESET Remote Administrator Server
"{8CD7E3FE-74F8-49E4-8B4F-EE038D507132}" = Microsoft Tool Web Package : DELSRV.EXE
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARD_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_STANDARD_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2010
"{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{E8AA7558-2024-4C5A-9691-62F9946E06F7}" =
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.OUTLOOK_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.OUTLOOK_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.OUTLOOK_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.OUTLOOK_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.OUTLOOK_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2D3436-AD2B-418B-A87E-862F583DDB61}" = elmeg LAN-CAPI
"{A5A50F99-4BA2-4457-A3A3-96C11050F243}" = bitfarm-Archiv
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{BCE9F441-9027-4911-82E0-5FB28057897D}" = APC PowerChute Business Edition Agent
"{BF9BF038-FE03-429D-9B26-2FA0FD756052}" = Microsoft SQL Server Browser
"{C676B806-E3E0-4CD5-8BB9-70DBE183B8E1}" = ESTOS ProCall Enterprise / TapiServer
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{D3A77E10-5987-42C3-9EF3-84F24E446693}" = ESTOS MetaDirectory
"{D9EF2DA1-0B4E-44B0-93E3-2A1B05030100}" = OpenSSH for Windows
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FCB10DE3-E190-4A7E-B06A-FAC61567ABFC}" = MySQL Tools for 5.0
"{FD9832CE-6761-4126-95F2-1FD7E1E9E74F}" = ESET Remote Administrator Console
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"70DBC326-7505-4913-A0C1-C6BD87C1859D_is1" = freeSSHd 1.2.6
"Advanced Port Scanner v1.3" = Advanced Port Scanner v1.3
"bitfarm-Archiv" = bitfarm-Archiv (remove only)
"BRICKware_is1" = BRICKware 7.5.4
"CAD Viewer 8.0" = CAD Viewer 8.0
"David" = David.fx
"ESET Online Scanner" = ESET Online Scanner v3
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.63" = GPL Ghostscript 8.63
"GSview 4.9" = GSview 4.9
"InstallShield_{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1
"InstallShield_{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MPE" = MyPhoneExplorer
"Notepad++" = Notepad++
"Office14.OUTLOOK" = Microsoft Outlook 2010
"OpenVPN" = OpenVPN 2.1.4
"Q-Dir" = Q-Dir
"Romey CopyCad_is1" = Romey CopyCad 1.0
"Romey CopyClient_is1" = Romey CopyClient 1.0
"STANDARD" = Microsoft Office Standard 2007
"Super Flexible File Synchronizer_is1" = Super Flexible File Synchronizer v4.97
"TeamViewer 7 Host" = TeamViewer 7 Host
"TightVNC_is1" = TightVNC 1.3.10
"Wilbur" = Wilbur (remove only)

========== Last 20 Event Log Errors ==========

[ Active Directory Web Services Events ]
Error - 15.12.2010 22:34:19 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206
Description =

Error - 27.04.2012 00:57:28 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206
Description =

[ Application Events ]
Error - 19.07.2012 07:22:06 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 19.07.2012 08:09:11 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 19.07.2012 11:19:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193
Description =

Error - 19.07.2012 11:20:20 | Computer Name = Server.GK.local | Source = MySQL | ID = 100
Description = The update log is no longer supported by MySQL in version 5.0 and
above. It is replaced by the binary log. For more information, see Help and Support
Center at hxxp://www.mysql.com.

Error - 19.07.2012 11:30:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193
Description =

Error - 19.07.2012 11:31:24 | Computer Name = Server.GK.local | Source = MySQL | ID = 100
Description = The update log is no longer supported by MySQL in version 5.0 and
above. It is replaced by the binary log. For more information, see Help and Support
Center at hxxp://www.mysql.com.

Error - 19.07.2012 14:00:01 | Computer Name = Server.GK.local | Source = MySQL Administrator | ID = 1
Description =

Error - 19.07.2012 18:36:33 | Computer Name = Server.GK.local | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files
(x86)\blue solution\handwerk 5\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"d:\program files (x86)\blue solution\handwerk 5\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 20.07.2012 02:23:52 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 20.07.2012 03:32:10 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008
Description =

[ DFS Replication Events ]
Error - 08.06.2010 07:22:53 | Computer Name = Server | Source = DFSR | ID = 1202
Description = Der DFS-Replikationsdienst konnte keine Verbindung mit dem Domänencontroller
"" zum Zugriff auf die Konfigurationsinformationen herstellen. Die Replikation wurde
beendet. Der Dienst wiederholt den Vorgang beim nächsten Konfigurationsabfragezyklus,
der in 60 Minuten eintritt. Dieses Ereignis kann durch TCP/IP-Verbindungs-, Firewall-,
Active Directory-Domänendienste- oder DNS-Probleme verursacht werden. Weitere Informationen:
Fehler: 1355 (Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung
hergestellt werden.)

[ DNS Server Events ]
Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.250
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.250 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407
Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2
nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server
bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407
Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2
nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server
bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404
Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2
binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0
bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet
(eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu.

Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408
Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht
öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist.
Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte
"Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen.
Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle
auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers
nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der
Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.)
Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen,
dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht,
auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe
im Abschnitt "DNS-Serverprotokollierungsreferenz".

[ System Events ]
Error - 26.08.2011 12:06:08 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 13:06:13 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 15:06:14 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 17:06:12 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 18:06:16 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 20:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 26.08.2011 22:07:44 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 00:07:43 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 02:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =

Error - 27.08.2011 04:07:47 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4
Description =


< End of report >


Besten Dank im Vorraus !

Joe