| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.DWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.07.2012, 20:35
| #1 |
| |  Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Hallo, Hab auf einem Windows 2008R2 64bit Server das Problem, dass sich die Firewall nicht starten lässt. Beim Starten kommt die Fehlermeldung: Beim Öffnen des Snap-Ins "Windows-Firewall mit erweiterter Sicherheit" ist ein Fehler aufgetreten. Das Snap-In "Windows-Firewall mit erweiterter Sicherheit" konnte nicht geladen werden. Starten Sie den Windows-Firewalldienst auf dem von Ihnen verwalteten Computer neu. Fehlercode: 0x6D9 In "Dienste" ist die Firewall nicht gestartet. Beim Versuch zu starten kommt die Meldung: "Windows-Firewall auf Lokaler Computer konnte nicht gestartet werden. Weitere Informationen ....." Im Ereignisprotokoll steht nur "Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: Zugriff verweigert." Hab viel gegoogelt und ausprobiert, aber nichts konnte bislang helfen, auch nicht folgende Batch-Datei: sc config MpsSvc start= auto sc config KeyIso start= auto sc config BFE start= auto sc config FwcAgent start= auto net stop MpsSvc net start MpsSvc net stop KeyIso net start KeyIso net start Wlansvc net start dot3svc net start EapHostnet net stop BFE net start BFE net start PolicyAgent net start MpsSvc net start IKEEXT net start DcaSvcnet net stop FwcAgent net start FwcAgent Hatte bislang Kaspersky als Antivirusprogramm auf dem Rechner, nun auf Eset Nod 32 gewechselt, und beim Scan damit wurden folgende Infektionen erkannt und beseitigt: Win32/InstallCore.D Win32/Adware.ADON Quarantine: Hash Occurred first Occurred last Object name Size Reason Hits File 0f2357d38eb6af3b5e8519f8cc247985df5f28ed 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXZOPMXT\cnet2_pscan13_exe.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data 692f9ad1fe17415dabefea71c02805548f37c603 8 hours ago 8 hours ago C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T9TOMZZC\cnet2_aports_zip.exe 452 KByte Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung 1 No Data 6e45431b698cdb7be8f1a41266be7b327f33ad38 8 hours ago 8 hours ago E:\rib\Sonstiges\Unlocker1.9.1.exe 783 KByte Win32/Adware.ADON evtl. unerwünschte Anwendung 1 No Data Die Firewall lässt sich weiterhin nicht starten, und ich hab die Sorge, dass irgendetwas Böses noch auf dem Rechner ist, und das Starten der Firewall verhindert. Nachfolgend das Scan-Ergebniss von Malwarebytes: Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.20.04 Windows Server 2008 R2 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Administrator :: SERVER [Administrator] 20.07.2012 15:45:33 mbam-log-2012-07-20 (15-45-33).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 2029664 Laufzeit: 5 Stunde(n), 24 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Der Quick-Scan von OTL: OTL.txt OTL logfile created on: 20.07.2012 17:14:55 - Run 1 OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools 64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free 11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS Computer Name: SERVER | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.20 15:38:57 | 000,596,480 | ---- | M] (OldTimer Tools) -- E:\daten\Eset Nod32\Removal Tools\OTL.exe PRC - [2012.07.16 16:37:24 | 006,849,448 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe PRC - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe PRC - [2012.07.16 16:22:42 | 000,106,408 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe PRC - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe PRC - [2012.05.18 16:53:24 | 006,219,744 | ---- | M] (ESET) -- D:\Program Files (x86)\ESET\ESET Remote Administrator\Console\console.exe PRC - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe PRC - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe PRC - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe PRC - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) -- D:\David\Code\sl.exe PRC - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) -- D:\David\Apps\Maserver\CODE\maserver.exe PRC - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) -- D:\David\Apps\Postman\Code\postman.exe PRC - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\snmp.exe PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- c:\Windows\SysWOW64\cmd.exe PRC - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) -- D:\David\Apps\Webbox\Code\webbox.exe PRC - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) -- D:\David\Apps\Dvgrab\Code\dvgrab.exe PRC - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe PRC - [2010.06.25 20:04:58 | 007,276,416 | ---- | M] (Super Flexible Software) -- D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe PRC - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe PRC - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe PRC - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe PRC - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe PRC - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe PRC - [2010.01.13 04:10:00 | 006,352,896 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe PRC - [2009.12.22 16:29:10 | 000,193,536 | ---- | M] (Tobit.Software) -- C:\Windows\SysWOW64\DV4TS.EXE PRC - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe PRC - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe PRC - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe PRC - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\ADVANTAGE\Server\ads.exe PRC - [2006.11.22 06:20:00 | 003,768,320 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe PRC - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe ========== Modules (No Company Name) ========== MOD - [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe MOD - [2010.07.04 23:32:36 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerHook.dll MOD - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.12.26 08:45:13 | 000,696,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dns.exe -- (DNS) SRV:64bit: - [2010.11.20 15:26:05 | 000,729,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpssvc.dll -- (DHCPServer) SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP) SRV:64bit: - [2010.11.20 15:25:02 | 001,020,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ntfrs.exe -- (NtFrs) SRV:64bit: - [2010.11.20 15:24:50 | 000,059,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ismserv.exe -- (IsmServ) SRV:64bit: - [2010.11.20 15:24:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\inetsrv\inetinfo.exe -- (IISADMIN) SRV:64bit: - [2010.11.20 15:24:38 | 004,518,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfsrs.exe -- (DFSR) SRV:64bit: - [2010.11.20 15:24:38 | 000,377,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfssvc.exe -- (Dfs) SRV:64bit: - [2010.01.25 14:50:28 | 000,017,960 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\sysdown.exe -- (sysdown) SRV:64bit: - [2009.07.14 03:41:53 | 000,014,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sacsvr.dll -- (sacsvr) SRV:64bit: - [2009.07.14 03:40:52 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FCRegSvc.dll -- (FCRegSvc) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.07.14 03:39:31 | 000,091,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rsopprov.exe -- (RSoPProv) SRV:64bit: - [2008.11.14 12:21:50 | 000,022,568 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\cpqrcmc.exe -- (CpqRcmc) SRV - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7) SRV - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe -- (ERA_SERVER) SRV - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) [On_Demand | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe -- (ERA_HTTP_SERVER) SRV - [2012.05.14 07:19:22 | 000,042,408 | ---- | M] (ESET) [On_Demand | Unknown] -- D:\Program Files\ESET\ESET File Security\EHttpSrv.exe -- (EhttpSrv) SRV - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) [Auto | Running] -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe -- (ekrn) SRV - [2011.06.17 22:28:12 | 000,431,456 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$DAVID) SQL Server Agent (DAVID) SRV - [2011.06.17 22:22:56 | 062,111,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe -- (MSSQL$DAVID) SQL Server (DAVID) SRV - [2010.12.10 18:34:52 | 039,627,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -- (MSSQL$MICROSOFT##SSEE) Windows Internal Database (MICROSOFT##SSEE) SRV - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Code\sl.exe -- (DavidServiceLayer) SRV - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Maserver\CODE\maserver.exe -- (DavidMailAccessServer) SRV - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Postman\Code\postman.exe -- (DavidPostMan) SRV - [2010.11.20 15:44:11 | 000,487,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe -- (ADWS) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP) SRV - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Webbox\Code\webbox.exe -- (DavidWebBox) SRV - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Dvgrab\Code\dvgrab.exe -- (DavidGrabbingServer) SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe -- (ectisrv) SRV - [2010.06.24 11:58:48 | 004,370,513 | ---- | M] (ESTOS GmbH) [On_Demand | Stopped] -- D:\Program Files (x86)\ESTOS\TapiServer\ETapiSrv.exe -- (etapisrv) SRV - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe -- (emeta2) SRV - [2010.06.06 17:26:40 | 001,665,536 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Replica\Code\replica.exe -- (DavidReplica) SRV - [2010.06.06 17:06:04 | 001,578,496 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\showis\showis.exe -- (DavidShowInterfaceServices) SRV - [2010.04.03 12:02:52 | 000,032,096 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe -- (MSSQLFDLauncher$DAVID) SQL Full-text Filter Daemon Launcher (DAVID) SRV - [2010.04.03 12:00:10 | 000,146,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.04.03 12:00:08 | 000,059,744 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100) SRV - [2010.03.19 12:25:30 | 000,167,424 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.25 21:43:40 | 001,291,776 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent) SRV - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe -- (RIB NetCounterLM) SRV - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe -- (Sentinel RMS License Manager) SRV - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe -- (RIB.License.Server) SRV - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.12.09 14:18:02 | 000,148,480 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\pbxpense\code\pbxpense.exe -- (DavidPBXpense) SRV - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe -- (FreeSSHDService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.02 15:56:16 | 001,278,976 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\videocpt\code\VideoCapture.exe -- (DavidVideoCapture) SRV - [2009.04.21 09:26:50 | 000,113,664 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\tvindex\tvindex.exe -- (DavidTVIndex) SRV - [2009.04.10 12:33:54 | 000,245,760 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dvhost\CODE\dvhost.exe -- (DavidHost) SRV - [2009.04.10 12:29:40 | 000,329,728 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dserver\Code\dserver.exe -- (DavidDiscussionServer) SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Spooldienst) SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Archivierungsdienst) SRV - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) [Auto | Running] -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe -- (APCPBEAgent) SRV - [2008.11.15 06:53:14 | 006,447,744 | ---- | M] () [Disabled | Stopped] -- D:\Program Files (x86)\Bitfarm-Archiv\mysql-5.1.30-win32\bin\mysqld.exe -- (Mysql-bf) SRV - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\ADVANTAGE\Server\ads.exe -- (Advantage) SRV - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe -- (WkSvw32.exe) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.21 15:52:36 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm) DRV:64bit: - [2011.11.24 10:58:44 | 000,078,208 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf) DRV:64bit: - [2011.10.07 10:31:42 | 000,321,536 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock) DRV:64bit: - [2011.08.09 08:11:50 | 000,021,120 | ---- | M] (SafeNet Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb) DRV:64bit: - [2011.06.17 21:54:22 | 000,313,696 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\RsFx0151.sys -- (RsFx0151) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.01.05 12:23:04 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:64bit: - [2011.01.05 12:23:04 | 000,125,296 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 15:33:18 | 000,066,944 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\dfsrro.sys -- (DfsrRo) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 11:57:24 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp) DRV:64bit: - [2010.11.20 11:57:17 | 000,181,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid) DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.10.20 12:05:28 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp) DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (q57nd60a) DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2010.02.22 13:02:18 | 000,156,776 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpCISSs2.sys -- (HpCISSs2) DRV:64bit: - [2010.01.25 14:50:26 | 000,160,296 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpqilo2.sys -- (hpqilo2) DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeamMP) DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeam) DRV:64bit: - [2009.08.07 08:59:18 | 000,016,896 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Wibukey2_64.sys -- (Wibukey2_64) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,051,776 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\dfs.sys -- (DfsDriver) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 03:45:45 | 000,096,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sacdrv.sys -- (sacdrv) DRV:64bit: - [2009.06.24 23:33:46 | 002,210,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ati2mtag.sys -- (ati2mtag) DRV:64bit: - [2009.06.10 22:35:30 | 000,035,328 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qd260x64.sys -- (ioatdma) Intel(R) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.05.11 16:08:08 | 000,051,752 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqcidrv.sys -- (CpqCiDrv) DRV:64bit: - [2006.11.22 06:20:00 | 000,107,008 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\WibuKey64.sys -- (WIBUKEY) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.04.02 14:53:04 | 000,039,552 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapitd.sys -- (elcapitd) DRV - [2007.01.23 16:28:30 | 000,151,296 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ELCAPI20.SYS -- (elcapi20) DRV - [2007.01.23 16:21:46 | 000,113,600 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapibs.sys -- (elcapibs) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/SoftAdmin.htm IE - HKCU\..\SearchScopes,DefaultScope = {EBA19DE3-7548-4EF2-8D2B-9FF818A507F0} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: D:\PROGRAM FILES\ESET\ESET FILE SECURITY\MOZILLA THUNDERBIRD [2012.07.19 17:35:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird O1 HOSTS File: ([2010.08.31 17:34:45 | 000,000,847 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 192.168.7.2 roihost O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found. O4:64bit: - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company) O4:64bit: - HKLM..\Run: [egui] D:\Program Files\ESET\ESET File Security\egui.exe (ESET) O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found O4 - HKCU..\Run: [ExtremeSync Background Scheduler] D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe (Super Flexible Software) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0 O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKLM\..Trusted Ranges: Range1 ([file] in Local intranet) O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites) O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053B40FB-8357-4177-95F4-70CBEF6040C5}: NameServer = 192.168.7.250,192.168.7.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF2345F7-E2F5-46DA-B8AC-1E3289CFAA40}: NameServer = 192.168.7.5,192.168.7.250 O18:64bit: - Protocol\Handler\hpapp - No CLSID value found O18:64bit: - Protocol\Handler\hpapp\Apps - No CLSID value found O18:64bit: - Protocol\Handler\ipp - No CLSID value found O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18 - Protocol\Handler\hpapp {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files (x86)\Compaq\Cpqacuxe\Bin\hpapp.dll (Hewlett-Packard Company) O18 - Protocol\Handler\hpapp\Apps - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29:64bit: - HKLM SecurityProviders - (pwdssp.dll) - File not found O29 - HKLM SecurityProviders - (pwdssp.dll) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.20 16:38:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2012.07.20 16:16:34 | 000,000,000 | ---D | C] -- C:\Windows\pss [2012.07.20 15:58:59 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Curiolab [2012.07.20 15:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.07.20 15:43:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes [2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.20 15:43:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.20 09:15:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET [2012.07.20 09:13:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\temp [2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET [2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.07.19 11:52:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker [2012.07.19 11:03:35 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.07.19 10:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET ========== Files - Modified Within 30 Days ========== [2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.20 16:41:59 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.20 16:38:19 | 000,003,009 | ---- | M] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk [2012.07.20 15:52:50 | 001,027,624 | ---- | M] () -- C:\ADS_ERR.ADT [2012.07.20 15:52:50 | 000,018,944 | ---- | M] () -- C:\ADS_ERR.ADI [2012.07.20 15:44:52 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.20 15:44:00 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job [2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job [2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job [2012.07.20 09:21:19 | 000,001,994 | -H-- | M] () -- C:\Users\Administrator\Documents\Default.rdp [2012.07.20 09:13:05 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk [2012.07.20 09:11:19 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\bd4040cn.dat [2012.07.20 09:11:19 | 000,000,026 | ---- | M] () -- C:\Windows\BRPP2KA.INI [2012.07.19 23:20:50 | 002,346,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.19 23:20:50 | 000,965,724 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.19 23:20:50 | 000,904,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.19 23:20:50 | 000,250,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.19 23:20:50 | 000,215,958 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.19 21:35:44 | 000,031,177 | ---- | M] () -- C:\ADS_ERR.adm [2012.07.19 21:06:13 | 000,000,404 | ---- | M] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat [2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\tasks\komsthoeft_daten.job [2012.07.19 17:29:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.19 12:29:36 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk [2012.07.17 09:42:43 | 000,000,766 | ---- | M] () -- C:\Windows\tobit.ini [2012.07.12 03:36:36 | 000,312,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.12 03:29:15 | 000,000,376 | ---- | M] () -- C:\Windows\dtools.INI [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.07.20 16:38:19 | 000,003,009 | ---- | C] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk [2012.07.20 15:44:00 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.07.20 15:43:15 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.20 09:13:05 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7 Host.lnk [2012.07.20 09:13:05 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk [2012.07.19 21:06:13 | 000,000,404 | ---- | C] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat [2012.07.19 12:29:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk [2012.06.16 00:19:29 | 000,000,376 | ---- | C] () -- C:\Windows\dtools.INI [2012.06.16 00:07:21 | 000,000,145 | ---- | C] () -- C:\Windows\BRICK.INI [2011.07.19 17:23:54 | 000,000,600 | ---- | C] () -- C:\Users\Administrator\AppData\Local\PUTTY.RND [2011.04.12 16:45:33 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\NetCapiConfig.exe [2011.04.12 16:45:33 | 000,077,890 | ---- | C] () -- C:\Windows\SysWow64\CAPI2032.dll [2011.04.12 16:34:05 | 000,090,624 | ---- | C] () -- C:\Windows\SysWow64\elalui32.dll [2011.02.01 16:02:16 | 000,000,657 | ---- | C] () -- C:\Users\Administrator\static.key [2011.01.05 08:57:25 | 000,017,563 | ---- | C] () -- C:\Windows\Q-Dir.ini [2010.12.07 18:45:30 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL [2010.12.07 18:45:30 | 000,099,840 | ---- | C] () -- C:\Windows\IMGMSGMO.dll [2010.12.07 18:45:17 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI [2010.12.07 18:44:35 | 000,000,766 | ---- | C] () -- C:\Windows\tobit.ini [2010.12.07 18:42:34 | 008,283,136 | ---- | C] () -- C:\Windows\TOBITCLT.DLL [2010.12.07 18:42:32 | 002,648,064 | ---- | C] () -- C:\Windows\SysWow64\DVMSG.DLL [2010.12.07 18:42:32 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\dvccext.dll [2010.12.07 18:20:28 | 000,000,047 | ---- | C] () -- C:\Windows\TOBITADD.INI [2010.08.20 16:23:16 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini [2010.08.18 23:15:32 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini [2010.08.17 13:57:31 | 000,000,153 | ---- | C] () -- C:\Windows\BRVIDEO.INI [2010.08.17 13:57:31 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini [2010.08.17 13:57:31 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini [2010.08.17 13:56:59 | 000,020,605 | ---- | C] () -- C:\Windows\HL-4040CN.INI [2010.08.17 13:56:44 | 000,000,471 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.08.17 13:56:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat [2010.08.17 13:56:44 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2010.08.17 13:56:26 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL [2010.08.17 13:56:25 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI [2010.08.12 21:53:59 | 000,001,247 | ---- | C] () -- C:\Windows\SysWow64\cygrunsrv.exe.stackdump [2010.08.06 18:45:52 | 000,011,306 | ---- | C] () -- C:\Users\Administrator\gsview32.ini [2010.08.03 16:14:20 | 000,003,843 | ---- | C] () -- C:\Users\Administrator\cadwin.ini [2010.08.02 15:41:31 | 000,472,576 | ---- | C] () -- C:\Windows\SysWow64\ApolloCrypt.dll [2010.08.02 15:41:31 | 000,059,392 | ---- | C] () -- C:\Windows\Bssudf.dll [2010.07.26 09:46:12 | 000,001,164 | ---- | C] () -- C:\Users\Administrator\copyclient.ini [2010.07.25 12:03:29 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\APCSnmp.dll [2010.07.24 18:53:50 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth2.dll [2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll [2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll [2010.07.24 18:53:49 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\rvkauth1.dll [2010.07.24 18:53:49 | 000,000,095 | ---- | C] () -- C:\Windows\SysWow64\prsrvk.dll [2010.07.24 18:53:49 | 000,000,072 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll [2010.07.24 17:47:47 | 000,000,521 | ---- | C] () -- C:\Windows\ODBC.INI [2010.07.24 17:44:53 | 000,001,680 | ---- | C] () -- C:\Windows\ODBCINST.INI [2010.07.24 10:47:28 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll [2010.07.24 10:47:28 | 000,000,204 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll [2010.07.23 17:06:05 | 000,196,608 | ---- | C] () -- C:\Windows\SysWow64\twxapi32.dll [2010.07.23 13:52:45 | 002,353,740 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.06.08 13:45:20 | 000,003,076 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== LOP Check ========== [2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core [2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv [2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab [2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS [2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF [2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo [2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD [2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer [2012.05.30 15:40:53 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL [2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++ [2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org [2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir [2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB [2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer [2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer [2012.07.09 16:18:17 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit [2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke [2012.07.19 20:00:01 | 000,000,696 | ---- | M] () -- C:\Windows\Tasks\komsthoeft_daten.job [2011.03.17 04:00:38 | 000,019,396 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.07.20 12:00:08 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job [2012.07.20 14:00:17 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job [2012.07.20 12:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job ========== Purity Check ========== < End of report > Extras.txt: OTL Extras logfile created on: 20.07.2012 17:14:55 - Run 1 OTL by OldTimer - Version 3.2.54.0 Folder = E:\daten\Eset Nod32\Removal Tools 64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 24,19% Memory free 11,98 Gb Paging File | 7,98 Gb Available in Paging File | 66,59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 125,00 Gb Total Space | 65,16 Gb Free Space | 52,13% Space Free | Partition Type: NTFS Drive D: | 125,00 Gb Total Space | 18,06 Gb Free Space | 14,45% Space Free | Partition Type: NTFS Drive E: | 215,73 Gb Total Space | 4,47 Gb Free Space | 2,07% Space Free | Partition Type: NTFS Computer Name: SERVER | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 1 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 1 "EnableFirewall" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH) "bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG) "D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH) "bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH) "bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG) "D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe" = D:\Program Files (x86)\ESTOS\TapiServer\etapisrv.exe:*:Enabled:ESTOS TapiServer -- (ESTOS GmbH) "bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG) ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{06E50997-ADD9-4D37-90D5-8A935DAE2BCF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{07120A22-1219-4F57-8722-6DB09C1018D6}" = lport=139 | protocol=6 | dir=in | app=system | "{1388AD42-6824-426D-A352-461445D16792}" = lport=6262 | protocol=17 | dir=in | name=advantage udp | "{14D44A0F-1C11-4C3B-85CE-2A6B642A71E3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{15561199-F6AC-47A2-A82F-482944B7B23D}" = lport=6262 | protocol=6 | dir=in | name=advantage tcp | "{18AC0313-F185-44B1-83BC-726898339B01}" = lport=5358 | protocol=6 | dir=in | app=system | "{1BB83F8F-CC9A-4727-BC4E-23A901776132}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{2B9EE05C-F86C-4E9D-8170-FB038AB44429}" = lport=138 | protocol=17 | dir=in | app=system | "{31CEEA99-87E0-42EC-9489-77C382EA41F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{331E61FF-FA25-48C7-ABDD-F1FC4D15433A}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit | "{34B16F1A-8BC7-41C7-9BFE-49C0C114D99D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{3F5C7288-B263-4A2F-8259-E27A91BD46A7}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit | "{3FA40EFE-DB37-4919-A151-72D58B4E8761}" = lport=3306 | protocol=6 | dir=in | name=mysql | "{4743813F-3F8E-429D-BAB1-BA46E4212FC9}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit | "{5263BFB3-5FE9-4806-98F9-9716927D53E0}" = lport=137 | protocol=17 | dir=in | app=system | "{6B9BA7B2-0F3C-49C4-88EA-D9706761B728}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit | "{6C1E1DF1-062E-4AB0-B142-282D6CBDF046}" = lport=13000 | protocol=17 | dir=in | name=kaspersky administration kit | "{7694AA81-7B2E-401C-AE9B-B8BED1BF03AD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | "{779CC6AA-821F-48C6-9FB9-F5F726E66BFA}" = rport=139 | protocol=6 | dir=out | app=system | "{831A6729-9581-40CB-A0D2-07E51A848DB4}" = rport=138 | protocol=17 | dir=out | app=system | "{83F14079-9A9D-49D7-B9CB-9F56F1F59558}" = rport=5358 | protocol=6 | dir=out | app=system | "{851DE5A8-F5E8-428D-9343-9615BB2DC15F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{8704EEE9-9D3A-4830-B70E-FC7192911276}" = lport=6004 | protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office14\outlook.exe | "{88644FA6-8681-43CF-9D73-8CD118147965}" = rport=137 | protocol=17 | dir=out | app=system | "{8DC5178B-09AF-4D75-916D-4CA9A4B8DBB4}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit | "{94E9D7A2-F550-4F2C-B85D-63D950B4472C}" = lport=138 | protocol=17 | dir=in | app=system | "{9B7B0B15-7CF5-4447-A9D7-27E3CF0B0BFC}" = lport=445 | protocol=6 | dir=in | app=system | "{9D418EAE-D1AA-48D9-86D2-01B2DE7BA6C8}" = lport=2869 | protocol=6 | dir=in | app=system | "{9DA7DD22-F5A9-488D-910F-4D7D82C6E3D5}" = lport=137 | protocol=17 | dir=in | app=system | "{A49718FE-AB4E-40A0-A7CF-9A181F627664}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{B27D098F-3604-45ED-9B8F-2E74453411C8}" = rport=137 | protocol=17 | dir=out | app=system | "{B4A36897-19FD-4DE5-A164-92A14143196D}" = rport=445 | protocol=6 | dir=out | app=system | "{BB123C8F-C146-46F7-B05C-A7A5383A240F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{D0167492-83FD-4482-B711-D2F08994476E}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit | "{E403A58F-BFF3-421C-BD86-6B274137914C}" = lport=5357 | protocol=6 | dir=in | app=system | "{E6B756FD-19A8-4E1B-82BE-8BF841DB51CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{E996943A-B8E9-4BA9-87C0-F6A9CEFD9FB1}" = rport=5357 | protocol=6 | dir=out | app=system | "{EB68839E-62FD-4B1B-8DDF-CE9F611D664B}" = rport=138 | protocol=17 | dir=out | app=system | "{EC22F5F0-66FC-4EF4-B117-A56961A7DF76}" = lport=13000 | protocol=6 | dir=in | name=kaspersky administration kit | "{F3FFE92F-C133-43C5-9274-0EB77D35E247}" = lport=14000 | protocol=6 | dir=in | name=kaspersky administration kit | "{F4B757F6-BE22-4DA8-8FF9-4172D33B2601}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{F79D295C-4BA2-4F4C-95EA-FBBA19465E33}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{F8EAA3F0-0F6E-4201-92EC-7F1FBDD6285B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{087DBC19-5A42-4487-84ED-EC490AA43F6C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{13B40177-C7F4-4813-A9FB-2AB547E814BD}" = protocol=17 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe | "{27F5776E-5787-47E3-AA7F-16A0232F1B33}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe | "{2CBBC0DD-F0D9-414A-9BA6-4A0846C2C4B6}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) | "{31CBB4F6-AE73-4BF4-AA41-F4B569988F56}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe | "{38869D43-357A-41F4-BB6F-13D4DD7C9592}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | "{411BFE4D-301E-4EAB-8FF8-ED11865F5EEC}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | "{41ABE070-77B9-449C-BE4F-C47D74002CB7}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) | "{421EA704-C1C2-40C5-B979-B94E053C6303}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe | "{42BA6D81-33F3-4CAF-840A-F34B4503B471}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{49F5E4DD-9BFE-424A-A461-069300FC0F78}" = protocol=6 | dir=out | app=system | "{53BF4A4A-7854-4D78-8B2B-8EE2FDE7D453}" = protocol=6 | dir=in | app=d:\david\code\sl.exe | "{58622F99-00BE-4C15-A2B6-7D4D4EB2EDE7}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe | "{5A8F8ED4-D3B6-4EAB-96F8-EAB1FF408A7A}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\srvadm.exe | "{6AF04484-4352-45A1-ADD3-40D3753D9685}" = protocol=6 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe | "{7032D7C3-F2CA-4CD7-B0A0-9656925E993B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{754EDA6E-4AEC-4BE4-A6CC-6E9D555796CD}" = protocol=6 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe | "{85259848-E949-4B67-853E-0E2CB47635FB}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | "{99E394E2-A39F-44AF-A46C-56C99AC85521}" = protocol=17 | dir=in | app=d:\program files (x86)\estos\ctiserver\ectisrv.exe | "{A13700BC-C658-44BC-9BFA-C450E00F37B9}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | "{A8124960-8564-4795-BD63-6B73CDF95FCB}" = protocol=17 | dir=in | app=d:\program files (x86)\wibukey\server\wksvw32.exe | "{C3D6F1D6-D79C-47B1-87EE-F62129C1C57F}" = protocol=6 | dir=in | app=c:\program files (x86)\estos\metadirectory 2\metaserver.exe | "{DAA522E0-7443-4CD1-A91B-0A3A32417F3C}" = protocol=17 | dir=in | app=d:\david\code\sl.exe | "{FC9754A1-E3C8-4DAF-86E2-9DE69A9C48B1}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00060000-0000-1004-8002-0000C06B5161}" = WIBU-KEY Setup (WIBU-KEY Remove) "{01078B88-2981-4F75-96B0-8B22E2D2DE03}" = Microsoft SQL Server 2008 R2 Setup (English) "{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{0F27A9B5-63FD-43DB-8230-FFE1E9CFE2C4}" = HP Smart Array SAS/SATA Event Notification Service "{234F6B0D-10AE-4BB7-B2F3-E48D4861952D}" = SQL Server 2008 R2 SP1 Common Files "{288D79EE-A2D1-42AF-9597-B0ADCC23A8ED}" = Microsoft SQL Server VSS Writer "{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1 "{2E97856A-345A-475D-913C-B8A78406BDF6}" = HP Lights-Out Online Configuration Utility "{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1 "{36F70DEE-1EBF-4707-AFA2-E035EEAEBAA1}" = SQL Server 2008 R2 SP1 Common Files "{471AAD2C-9078-4DAC-BD43-FA10FB7C3FCE}" = Microsoft SQL Server 2008 R2 Native Client "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64) "{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64) "{74D49383-7EF9-4FD3-B5B0-73CA22F51CE8}" = HP ProLiant Remote Monitor Service "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007 "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 "{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client "{9DFA5914-C275-42E0-810E-C88E46A7F9EA}" = SQL Server 2008 R2 SP1 Full text search "{A2122A9C-A699-4365-ADF8-68FEAC125D61}" = SQL Server 2008 R2 SP1 Database Engine Shared "{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{B40EE88B-400A-4266-A17B-E3DE64E94431}" = Microsoft SQL Server 2008 Setup Support Files "{BDD79957-5801-4A2D-B09E-852E7FA64D01}" = Windows Internal Database (MICROSOFT##SSEE) "{BF7B0C91-5AF6-46B7-91CE-C8DD3D36E4BD}" = MySQL Server 5.1 "{C450F717-C461-4D47-93C3-6D93779AD5C9}" = ESET File Security "{C942A025-A840-4BF2-8987-849C0DD44574}" = SQL Server 2008 R2 SP1 Database Engine Shared "{D32B3BF4-4019-4D62-8400-6B2E16CDEA23}" = HP ProLiant Integrated Management Log Viewer "{D64C20F4-C49B-476C-A0D1-7813D954ED12}" = VanDyke Software Client Pack 6.5 "{D8C23BDE-4748-44D9-A9DD-8AB64EB18BE3}" = Microsoft SQL Server 2008 R2 RsFx Driver "{DCEA910B-3269-4F5B-A915-D59293004751}" = HP Insight Diagnostics Online Edition for Windows "{E7814BDC-DC36-4181-B765-E34FD673F957}" = RIB Lizenzmanagement "{F31183CF-E10F-4DE1-BB59-6C0FF38E481E}" = Sql Server Customer Experience Improvement Program "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = SQL Server 2008 R2 SP1 Database Engine Services "{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = SQL Server 2008 R2 SP1 Database Engine Services "ATI Display Driver" = ATI Display Driver "CCleaner" = CCleaner "GPL Ghostscript 9.04" = GPL Ghostscript "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack "Microsoft SQL Server 10" = Microsoft SQL Server 2008 R2 (64-bit) "Microsoft SQL Server 2008 R2" = Microsoft SQL Server 2008 R2 (64-bit) "PDF-XChange 3_is1" = PDF-XChange 3 "Redirection Port Monitor" = RedMon - Druckeranschluß-Umleitungsmonitor [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis "{0DE5137F-581B-448C-AF70-9498EF364E34}" = Advantage Database Server for Windows v9.10 "{14A5045C-33EE-4596-AA69-8761611AE8EB}" = HP Array Configuration Utility CLI "{173438F5-BD4D-47AE-9C8F-73E6BAA62624}" = PFA Server Registry Update "{19382EF6-8D47-4C3C-AA57-D2D2CDF03828}" = elmeg PABX TAPI V1.32 "{23170F69-40C1-2701-0464-000001000000}" = 7-Zip 4.64 "{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13 "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (KAV_CS_ADMIN_KIT) "{34D6E797-AA32-455D-8E65-4EBD1AC9DED7}" = HP ProLiant PCI-express Power Management Update for Windows "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4E5563B6-DE0A-4F3B-A5D6-15789FD12D9B}" = Headless Server Registry Update "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62 "{5A5F45AE-0250-4C34-9D89-F10BDDEE665F}" = HP Version Control Agent "{5DADDACD-0B7B-4E48-908E-C451D16AACA6}" = David.InfoCenter "{640A92A1-9B8B-4C80-B412-9595460EBC53}_is1" = TopKontor Handwerk Version 5 "{65B1D8AD-D8ED-4EF0-89FC-CA211C63130A}" = HP Array Diagnostics Utility CLI "{6AFCC61D-7273-4F30-8A3A-5733FD771F82}" = HP Array Diagnostic Utility "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{717F49F9-BCE2-4D3F-97D8-EC3A36B3CF77}" = ESTOS CtiServer Multiline Tapi "{74C48700-A6A7-4B3D-BD3A-C4E131CDD8E8}" = HP Array Configuration Utility "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7CB265A0-4179-4A15-A993-7A12E8A88D28}" = ESTOS CtiServer "{80AB11C2-0313-4A32-932C-12048D758BDF}" = Brother HL-4040CN "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{884F6891-633B-4BCA-B08E-A702EDF038E4}" = ESET Remote Administrator Server "{8CD7E3FE-74F8-49E4-8B4F-EE038D507132}" = Microsoft Tool Web Package : DELSRV.EXE "{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007 "{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_STANDARD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARD_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002A-0000-1000-0000000FF1CE}_STANDARD_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002A-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0116-0409-1000-0000000FF1CE}_STANDARD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2010 "{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001A-0000-0000-0000000FF1CE}_Office14.OUTLOOK_{E8AA7558-2024-4C5A-9691-62F9946E06F7}" = "{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 "{90140000-001A-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 "{90140000-001F-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 "{90140000-001F-0409-0000-0000000FF1CE}_Office14.OUTLOOK_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 "{90140000-001F-040C-0000-0000000FF1CE}_Office14.OUTLOOK_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 "{90140000-001F-0410-0000-0000000FF1CE}_Office14.OUTLOOK_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0000-1000-0000000FF1CE}_Office14.OUTLOOK_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0407-1000-0000000FF1CE}_Office14.OUTLOOK_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 "{90140000-002C-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 "{90140000-006E-0407-0000-0000000FF1CE}_Office14.OUTLOOK_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9C2D3436-AD2B-418B-A87E-862F583DDB61}" = elmeg LAN-CAPI "{A5A50F99-4BA2-4457-A3A3-96C11050F243}" = bitfarm-Archiv "{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch "{BCE9F441-9027-4911-82E0-5FB28057897D}" = APC PowerChute Business Edition Agent "{BF9BF038-FE03-429D-9B26-2FA0FD756052}" = Microsoft SQL Server Browser "{C676B806-E3E0-4CD5-8BB9-70DBE183B8E1}" = ESTOS ProCall Enterprise / TapiServer "{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection "{D3A77E10-5987-42C3-9EF3-84F24E446693}" = ESTOS MetaDirectory "{D9EF2DA1-0B4E-44B0-93E3-2A1B05030100}" = OpenSSH for Windows "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{FCB10DE3-E190-4A7E-B06A-FAC61567ABFC}" = MySQL Tools for 5.0 "{FD9832CE-6761-4126-95F2-1FD7E1E9E74F}" = ESET Remote Administrator Console "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "70DBC326-7505-4913-A0C1-C6BD87C1859D_is1" = freeSSHd 1.2.6 "Advanced Port Scanner v1.3" = Advanced Port Scanner v1.3 "bitfarm-Archiv" = bitfarm-Archiv (remove only) "BRICKware_is1" = BRICKware 7.5.4 "CAD Viewer 8.0" = CAD Viewer 8.0 "David" = David.fx "ESET Online Scanner" = ESET Online Scanner v3 "FreePDF_XP" = FreePDF (Remove only) "GPL Ghostscript 8.63" = GPL Ghostscript 8.63 "GSview 4.9" = GSview 4.9 "InstallShield_{3496E5C2-CDE6-407B-BFDB-B22A3E96A1F9}" = funkwerk LANTAPI64 V3.01 Beta1 "InstallShield_{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62 "IrfanView" = IrfanView (remove only) "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "MPE" = MyPhoneExplorer "Notepad++" = Notepad++ "Office14.OUTLOOK" = Microsoft Outlook 2010 "OpenVPN" = OpenVPN 2.1.4 "Q-Dir" = Q-Dir "Romey CopyCad_is1" = Romey CopyCad 1.0 "Romey CopyClient_is1" = Romey CopyClient 1.0 "STANDARD" = Microsoft Office Standard 2007 "Super Flexible File Synchronizer_is1" = Super Flexible File Synchronizer v4.97 "TeamViewer 7 Host" = TeamViewer 7 Host "TightVNC_is1" = TightVNC 1.3.10 "Wilbur" = Wilbur (remove only) ========== Last 20 Event Log Errors ========== [ Active Directory Web Services Events ] Error - 15.12.2010 22:34:19 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206 Description = Error - 27.04.2012 00:57:28 | Computer Name = Server.GK.local | Source = ADWS | ID = 1206 Description = [ Application Events ] Error - 19.07.2012 07:22:06 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008 Description = Error - 19.07.2012 08:09:11 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008 Description = Error - 19.07.2012 11:19:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193 Description = Error - 19.07.2012 11:20:20 | Computer Name = Server.GK.local | Source = MySQL | ID = 100 Description = The update log is no longer supported by MySQL in version 5.0 and above. It is replaced by the binary log. For more information, see Help and Support Center at hxxp://www.mysql.com. Error - 19.07.2012 11:30:38 | Computer Name = Server.GK.local | Source = VSS | ID = 8193 Description = Error - 19.07.2012 11:31:24 | Computer Name = Server.GK.local | Source = MySQL | ID = 100 Description = The update log is no longer supported by MySQL in version 5.0 and above. It is replaced by the binary log. For more information, see Help and Support Center at hxxp://www.mysql.com. Error - 19.07.2012 14:00:01 | Computer Name = Server.GK.local | Source = MySQL Administrator | ID = 1 Description = Error - 19.07.2012 18:36:33 | Computer Name = Server.GK.local | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files (x86)\blue solution\handwerk 5\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "d:\program files (x86)\blue solution\handwerk 5\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 20.07.2012 02:23:52 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008 Description = Error - 20.07.2012 03:32:10 | Computer Name = Server.GK.local | Source = Customer Experience Improvement Program | ID = 1008 Description = [ DFS Replication Events ] Error - 08.06.2010 07:22:53 | Computer Name = Server | Source = DFSR | ID = 1202 Description = Der DFS-Replikationsdienst konnte keine Verbindung mit dem Domänencontroller "" zum Zugriff auf die Konfigurationsinformationen herstellen. Die Replikation wurde beendet. Der Dienst wiederholt den Vorgang beim nächsten Konfigurationsabfragezyklus, der in 60 Minuten eintritt. Dieses Ereignis kann durch TCP/IP-Verbindungs-, Firewall-, Active Directory-Domänendienste- oder DNS-Probleme verursacht werden. Weitere Informationen: Fehler: 1355 (Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung hergestellt werden.) [ DNS Server Events ] Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 404 Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.250 binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0 bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet (eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu. Error - 19.11.2011 08:34:39 | Computer Name = Server.GK.local | Source = DNS | ID = 408 Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.250 nicht öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist. Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte "Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen. Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.) Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen, dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht, auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe im Abschnitt "DNS-Serverprotokollierungsreferenz". Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407 Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2 nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server bzw. den Computer neu. Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408 Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist. Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte "Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen. Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.) Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen, dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht, auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe im Abschnitt "DNS-Serverprotokollierungsreferenz". Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404 Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2 binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0 bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet (eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu. Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408 Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist. Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte "Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen. Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.) Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen, dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht, auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe im Abschnitt "DNS-Serverprotokollierungsreferenz". Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 407 Description = Der DNS-Server konnte ein Benutzer-Datagrammsocket (UDP) zu 192.168.7.2 nicht binden. Die Ereignisdaten enthalten den Fehlercode. Starten Sie den DNS-Server bzw. den Computer neu. Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408 Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist. Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte "Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen. Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.) Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen, dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht, auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe im Abschnitt "DNS-Serverprotokollierungsreferenz". Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 404 Description = Der DNS-Server konnte ein TCP-Socket nicht an die Adresse 192.168.7.2 binden. Die Ereignisdaten enthalten den Fehlercode. Eine IP-Adresse von 0.0.0.0 bedeutet, dass ein Socket alle verfügbaren IP-Adressen des Computers verwendet (eine gültige Konfiguration). Starten Sie den DNS-Server bzw. den Computer neu. Error - 19.11.2011 08:42:41 | Computer Name = Server.GK.local | Source = DNS | ID = 408 Description = Der DNS-Server konnte den Socket für die Adresse 192.168.7.2 nicht öffnen. Überprüfen Sie, ob diese IP-Adresse auf dem Servercomputer gültig ist. Verwenden Sie im DNS-Manager das Eigenschaftenfenster des Servers und dort die Registerkarte "Schnittstellen", um diese Adresse gegebenenfalls von der Adressliste zu entfernen. Starten Sie den DNS-Server danach erneut. (Falls diese Adresse die einzige IP-Schnittstelle auf diesem Computer war, konnte der DNS-Server wahrscheinlich aufgrund dieses Fehlers nicht starten. In diesem Fall entfernen Sie den Eintrag "ListenAddress" in der Registrierung unter "\Services\DNS\Parameters", und führen Sie einen Neustart durch.) Wenn diese IP-Adresse auf dem Computer gültig ist, sollten Sie sicherstellen, dass keine andere Anwendung (z.B. ein anderer DNS-Server) aktiv ist, die versucht, auf den DNS-Port zuzugreifen. Weitere Informationen hierzu finden Sie in der Onlinehilfe im Abschnitt "DNS-Serverprotokollierungsreferenz". [ System Events ] Error - 26.08.2011 12:06:08 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 13:06:13 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 15:06:14 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 17:06:12 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 18:06:16 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 20:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 26.08.2011 22:07:44 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 27.08.2011 00:07:43 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 27.08.2011 02:07:46 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = Error - 27.08.2011 04:07:47 | Computer Name = Server.GK.local | Source = Kerberos | ID = 4 Description = < End of report > Besten Dank im Vorraus ! Joe |
|
23.07.2012, 10:34
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Was machst du zu Hause mit einem Windows-Server?
__________________Oder bist du Netzwerk- und Systemadmin in einer Firma? Code:
ATTFilter O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local
__________________ |
|
23.07.2012, 18:29
| #3 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D .. ist ein Server auf der Arbeit, Firma meiner Brüder, darf mich unteranderem um die IT kümmern....
__________________"GK" ist die Domäne. |
|
24.07.2012, 13:42
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Firmenrechner werden hier eigentlich nicht bereinigt Siehe => http://www.trojaner-board.de/108422-...-anfragen.html Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
25.07.2012, 06:32
| #5 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D ..sorry, das hab ich nicht gelesen. Ein Kleinunternehmen sind wir aber auf jedenfall, einen eigenen IT-Support haben wir nicht, wie schon geschrieben, kümmere mach selbst drum, bin aber nicht auf allen Bereichen so erfahren.... Also wenn jmd. helfen könnte, wär das schon super! |
|
25.07.2012, 10:34
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt? Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ --> Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D |
|
27.07.2012, 17:27
| #7 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D ne leider nicht, bin erst "aufgewacht" nachdem Eset Nod32 mit den ersten Meldungen kam... daraufhin erst mit Malwarebytes gescannt... |
|
27.07.2012, 21:36
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Also wenn Adware auf eurem SERVER drauf ist, dann solltest ihr mal überlegen, ob man unbedingt diese und jene Software unbedingt auf dem SERVER benötigt! Sowas sollte wohl überlegt sein - aber der Trend geht ja mittlerweile leider dahin, dass wirklich jeder den erstbesten Google-Link anklickt wenn er nach Software sucht und meistens landet man dann bei Softonic   adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.07.2012, 10:32
| #9 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D ..tja, normalerweise achte ich da schon drauf, was ist installiere,wenns denn über Softonic läuft, klick ich normal auch alles andere aus, aber scheinbar hab ich wohl doch nicht gut genug aufgepasst... Gemäß nachfolgendem Log gibst doch "nur" die Quickstore Toolbar. Die wird doch nicht der Grund sein, warum die Firewall nicht starten darf, oder ? Hier der Log: # AdwCleaner v1.703 - Logfile created 07/28/2012 at 11:24:17 # Updated 20/07/2012 by Xplode # Operating system : Windows Server 2008 R2 Standard Service Pack 1 (64 bits) # User : Administrator - SERVER # Running from : C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJOG1EJ9\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\advantage Folder Found : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar File Found : C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url File Found : C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url ***** [Registry] ***** Key Found : HKCU\Software\Headlight Key Found : HKCU\Software\Softonic Key Found : HKLM\SOFTWARE\Description [x64] Key Found : HKCU\Software\Headlight [x64] Key Found : HKCU\Software\Softonic [x64] Key Found : HKLM\SOFTWARE\Description ***** [Registre - GUID] ***** Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1276 octets] - [28/07/2012 11:24:17] ########## EOF - C:\AdwCleaner[R1].txt - [1404 octets] ########## |
|
28.07.2012, 23:11
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Dir ist klar, dass wir für die Bereinigung mehrere Neustarts des Windows-Servers benötigen? adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.07.2012, 07:47
| #11 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D # AdwCleaner v1.703 - Logfile created 07/30/2012 at 07:44:51 # Updated 20/07/2012 by Xplode # Operating system : Windows Server 2008 R2 Standard Service Pack 1 (64 bits) # User : Administrator - SERVER # Running from : C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJOG1EJ9\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\advantage Folder Deleted : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar File Deleted : C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url File Deleted : C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url ***** [Registry] ***** Key Deleted : HKCU\Software\Headlight Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Description [x64] Key Deleted : HKLM\SOFTWARE\Description ***** [Registre - GUID] ***** Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1399 octets] - [28/07/2012 11:24:17] AdwCleaner[S1].txt - [1268 octets] - [30/07/2012 07:44:51] ########## EOF - C:\AdwCleaner[S1].txt - [1396 octets] ########## |
|
30.07.2012, 08:01
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.07.2012, 11:06
| #13 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D 1.) Der normale Windows-Modus funktioniert wie auch zuvor, lediglich der Aufruf der Firewall klappt weiterhin nicht, dies wird durch irgendwas im System unterdrückt... 2.) nein, vermisse nichts, gibt auch keine leeren Ordner... Server verhält sich grundsätzlich unauffällig, bin nur über die "Virenfunde" und die nicht starten wollende Firewall skeptisch geworden, ob da alles in Ordnung ist.. |
|
30.07.2012, 16:09
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.07.2012, 17:22
| #15 |
| | Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.07.2012 18:11:12 - Run 2 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Administrator\Desktop 64bit- Server Standard Edition (full installation) Service Pack 1 (Version = 6.1.7601) - Type = NTDomainController Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 3,24 Gb Available Physical Memory | 54,12% Memory free 11,98 Gb Paging File | 8,90 Gb Available in Paging File | 74,33% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 125,00 Gb Total Space | 63,99 Gb Free Space | 51,19% Space Free | Partition Type: NTFS Drive D: | 125,00 Gb Total Space | 15,11 Gb Free Space | 12,09% Space Free | Partition Type: NTFS Drive E: | 215,73 Gb Total Space | 3,73 Gb Free Space | 1,73% Space Free | Partition Type: NTFS Computer Name: SERVER | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.30 18:06:56 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe PRC - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe PRC - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe PRC - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe PRC - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe PRC - [2011.03.20 19:11:40 | 010,406,152 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VersionBackup.exe PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe PRC - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) -- D:\David\Code\sl.exe PRC - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) -- D:\David\Apps\Maserver\CODE\maserver.exe PRC - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) -- D:\David\Apps\Postman\Code\postman.exe PRC - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\snmp.exe PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- c:\Windows\SysWOW64\cmd.exe PRC - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) -- D:\David\Apps\Webbox\Code\webbox.exe PRC - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) -- D:\David\Apps\Dvgrab\Code\dvgrab.exe PRC - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe PRC - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe PRC - [2010.06.12 12:02:00 | 000,754,160 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VBackRun.exe PRC - [2010.06.12 12:01:58 | 001,303,040 | ---- | M] (SB-AW) -- D:\Program Files (x86)\VersionBackup\VBackDisplay.exe PRC - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe PRC - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe PRC - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe PRC - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe PRC - [2010.01.13 04:10:00 | 006,352,896 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe PRC - [2009.12.22 16:29:10 | 000,193,536 | ---- | M] (Tobit.Software) -- C:\Windows\SysWOW64\DV4TS.EXE PRC - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe PRC - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe PRC - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe PRC - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\ADVANTAGE\Server\ads.exe PRC - [2006.11.22 06:20:00 | 003,768,320 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe PRC - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe ========== Modules (No Company Name) ========== MOD - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe MOD - [2008.11.23 20:11:17 | 000,086,520 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\VBZip2R.dll MOD - [2007.02.09 13:13:40 | 000,050,176 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\csc32.dll MOD - [2006.12.15 08:39:42 | 000,113,664 | ---- | M] () -- D:\Program Files (x86)\VersionBackup\see32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.12.26 08:45:13 | 000,696,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dns.exe -- (DNS) SRV:64bit: - [2010.11.20 15:26:05 | 000,729,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpssvc.dll -- (DHCPServer) SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP) SRV:64bit: - [2010.11.20 15:25:02 | 001,020,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ntfrs.exe -- (NtFrs) SRV:64bit: - [2010.11.20 15:24:50 | 000,059,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ismserv.exe -- (IsmServ) SRV:64bit: - [2010.11.20 15:24:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\inetsrv\inetinfo.exe -- (IISADMIN) SRV:64bit: - [2010.11.20 15:24:38 | 004,518,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfsrs.exe -- (DFSR) SRV:64bit: - [2010.11.20 15:24:38 | 000,377,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dfssvc.exe -- (Dfs) SRV:64bit: - [2010.01.25 14:50:28 | 000,017,960 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\sysdown.exe -- (sysdown) SRV:64bit: - [2009.07.14 03:41:53 | 000,014,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sacsvr.dll -- (sacsvr) SRV:64bit: - [2009.07.14 03:40:52 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FCRegSvc.dll -- (FCRegSvc) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.07.14 03:39:31 | 000,091,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rsopprov.exe -- (RSoPProv) SRV:64bit: - [2008.11.14 12:21:50 | 000,022,568 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\cpqrcmc.exe -- (CpqRcmc) SRV - [2012.07.16 16:37:24 | 002,677,160 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7) SRV - [2012.05.18 16:53:26 | 004,126,784 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\era.exe -- (ERA_SERVER) SRV - [2012.05.18 16:53:22 | 000,089,184 | ---- | M] (ESET) [On_Demand | Running] -- C:\Program Files (x86)\ESET\ESET Remote Administrator\Server\EHttpSrv.exe -- (ERA_HTTP_SERVER) SRV - [2012.05.14 07:19:22 | 000,042,408 | ---- | M] (ESET) [On_Demand | Stopped] -- D:\Program Files\ESET\ESET File Security\EHttpSrv.exe -- (EhttpSrv) SRV - [2012.05.14 07:15:26 | 000,933,792 | ---- | M] (ESET) [Auto | Running] -- D:\Program Files\ESET\ESET File Security\x86\ekrn.exe -- (ekrn) SRV - [2011.06.17 22:28:12 | 000,431,456 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$DAVID) SRV - [2011.06.17 22:22:56 | 062,111,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe -- (MSSQL$DAVID) SRV - [2010.12.10 18:34:52 | 039,627,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -- (MSSQL$MICROSOFT##SSEE) SRV - [2010.11.30 15:58:38 | 002,496,000 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Code\sl.exe -- (DavidServiceLayer) SRV - [2010.11.30 12:31:15 | 000,384,512 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Maserver\CODE\maserver.exe -- (DavidMailAccessServer) SRV - [2010.11.29 12:46:22 | 000,587,264 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Postman\Code\postman.exe -- (DavidPostMan) SRV - [2010.11.20 15:44:11 | 000,487,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe -- (ADWS) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP) SRV - [2010.11.16 18:30:03 | 001,944,576 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Webbox\Code\webbox.exe -- (DavidWebBox) SRV - [2010.11.11 09:39:25 | 000,406,016 | ---- | M] (Tobit Software) [Auto | Running] -- D:\David\Apps\Dvgrab\Code\dvgrab.exe -- (DavidGrabbingServer) SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2010.07.07 19:03:52 | 010,798,408 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\CtiServer\ECtiSrv.exe -- (ectisrv) SRV - [2010.06.24 11:58:48 | 004,370,513 | ---- | M] (ESTOS GmbH) [On_Demand | Stopped] -- D:\Program Files (x86)\ESTOS\TapiServer\ETapiSrv.exe -- (etapisrv) SRV - [2010.06.14 02:05:30 | 004,116,480 | ---- | M] (ESTOS GmbH) [Auto | Running] -- D:\Program Files (x86)\ESTOS\MetaDirectory 2\MetaServer.exe -- (emeta2) SRV - [2010.06.12 12:02:00 | 000,754,160 | ---- | M] (SB-AW) [Auto | Running] -- D:\Program Files (x86)\VersionBackup\VBackRun.exe -- (VersionBackup) SRV - [2010.06.06 17:26:40 | 001,665,536 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Replica\Code\replica.exe -- (DavidReplica) SRV - [2010.06.06 17:06:04 | 001,578,496 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\showis\showis.exe -- (DavidShowInterfaceServices) SRV - [2010.04.03 12:02:52 | 000,032,096 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe -- (MSSQLFDLauncher$DAVID) SRV - [2010.04.03 12:00:10 | 000,146,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.04.03 12:00:08 | 000,059,744 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100) SRV - [2010.03.19 12:25:30 | 000,167,424 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.25 21:43:40 | 001,291,776 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent) SRV - [2010.02.22 19:14:32 | 001,534,792 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\NetCounterLM\NetCounterLM.exe -- (RIB NetCounterLM) SRV - [2010.02.22 19:14:32 | 001,303,368 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- D:\Program Files (x86)\RIB\License\SentinelLM\SentinelRMS.exe -- (Sentinel RMS License Manager) SRV - [2010.02.22 19:14:32 | 000,626,504 | ---- | M] (RIB Software AG) [Auto | Running] -- D:\Program Files (x86)\RIB\License\RIB.License.Server.exe -- (RIB.License.Server) SRV - [2010.01.14 04:10:00 | 001,738,048 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.12.09 14:18:02 | 000,148,480 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\pbxpense\code\pbxpense.exe -- (DavidPBXpense) SRV - [2009.09.10 01:31:44 | 001,360,072 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\freeSSHd\FreeSSHDService.exe -- (FreeSSHDService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.02 15:56:16 | 001,278,976 | ---- | M] (Tobit.Software) [On_Demand | Stopped] -- D:\David\Apps\videocpt\code\VideoCapture.exe -- (DavidVideoCapture) SRV - [2009.04.21 09:26:50 | 000,113,664 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\tvindex\tvindex.exe -- (DavidTVIndex) SRV - [2009.04.10 12:33:54 | 000,245,760 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dvhost\CODE\dvhost.exe -- (DavidHost) SRV - [2009.04.10 12:29:40 | 000,329,728 | ---- | M] (Tobit Software) [On_Demand | Stopped] -- D:\David\Apps\Dserver\Code\dserver.exe -- (DavidDiscussionServer) SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Spooldienst) SRV - [2009.01.14 12:24:40 | 000,068,096 | ---- | M] () [Auto | Running] -- D:\Program Files (x86)\Bitfarm-Archiv\cygrunsrv.exe -- (bitfarm-archiv Archivierungsdienst) SRV - [2008.12.01 10:58:22 | 000,034,104 | ---- | M] (APC) [Auto | Running] -- d:\Program Files (x86)\APC\PowerChute Business Edition\APC\PowerChute Business Edition\agent\pbeagent.exe -- (APCPBEAgent) SRV - [2008.11.15 06:53:14 | 006,447,744 | ---- | M] () [Disabled | Stopped] -- D:\Program Files (x86)\Bitfarm-Archiv\mysql-5.1.30-win32\bin\mysqld.exe -- (Mysql-bf) SRV - [2008.11.14 10:10:00 | 002,932,736 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\ADVANTAGE\Server\ads.exe -- (Advantage) SRV - [2006.11.22 06:20:00 | 000,577,536 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- D:\Program Files (x86)\WIBUKEY\Server\WkSvW32.exe -- (WkSvw32.exe) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.21 15:52:36 | 000,170,640 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm) DRV:64bit: - [2011.11.24 10:58:44 | 000,078,208 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf) DRV:64bit: - [2011.10.07 10:31:42 | 000,321,536 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock) DRV:64bit: - [2011.08.09 08:11:50 | 000,021,120 | ---- | M] (SafeNet Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb) DRV:64bit: - [2011.06.17 21:54:22 | 000,313,696 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\RsFx0151.sys -- (RsFx0151) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.01.05 12:23:04 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:64bit: - [2011.01.05 12:23:04 | 000,125,296 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:64bit: - [2010.11.30 11:03:06 | 000,321,424 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cbfs3.sys -- (cbfs3) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 15:33:18 | 000,066,944 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\dfsrro.sys -- (DfsrRo) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 11:57:24 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp) DRV:64bit: - [2010.11.20 11:57:17 | 000,181,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid) DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.10.20 12:05:28 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp) DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (q57nd60a) DRV:64bit: - [2010.04.30 08:42:40 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2010.02.22 13:02:18 | 000,156,776 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpCISSs2.sys -- (HpCISSs2) DRV:64bit: - [2010.01.25 14:50:26 | 000,160,296 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpqilo2.sys -- (hpqilo2) DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeamMP) DRV:64bit: - [2009.09.30 03:36:18 | 000,225,792 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqteam.sys -- (CPQTeam) DRV:64bit: - [2009.08.07 08:59:18 | 000,016,896 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Wibukey2_64.sys -- (Wibukey2_64) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,051,776 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\dfs.sys -- (DfsDriver) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 03:45:45 | 000,096,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sacdrv.sys -- (sacdrv) DRV:64bit: - [2009.06.24 23:33:46 | 002,210,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ati2mtag.sys -- (ati2mtag) DRV:64bit: - [2009.06.10 22:35:30 | 000,035,328 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qd260x64.sys -- (ioatdma) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.05.11 16:08:08 | 000,051,752 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cpqcidrv.sys -- (CpqCiDrv) DRV:64bit: - [2006.11.22 06:20:00 | 000,107,008 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\WibuKey64.sys -- (WIBUKEY) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.04.02 14:53:04 | 000,039,552 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapitd.sys -- (elcapitd) DRV - [2007.01.23 16:28:30 | 000,151,296 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ELCAPI20.SYS -- (elcapi20) DRV - [2007.01.23 16:21:46 | 000,113,600 | ---- | M] (Funkwerk Enterprise Communications GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\elcapibs.sys -- (elcapibs) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/SoftAdmin.htm IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes,DefaultScope = {EBA19DE3-7548-4EF2-8D2B-9FF818A507F0} IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\..\SearchScopes\{EBA19DE3-7548-4EF2-8D2B-9FF818A507F0}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKU\S-1-5-21-945631898-3404820810-274502779-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: D:\PROGRAM FILES\ESET\ESET FILE SECURITY\MOZILLA THUNDERBIRD [2012.07.19 17:35:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird O1 HOSTS File: ([2010.08.31 17:34:45 | 000,000,847 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 192.168.7.2 roihost O2:64bit: - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O4:64bit: - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company) O4:64bit: - HKLM..\Run: [egui] D:\Program Files\ESET\ESET File Security\egui.exe (ESET) O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found O4 - HKU\S-1-5-21-945631898-3404820810-274502779-500..\Run: [ExtremeSync Background Scheduler] D:\Program Files (x86)\SuperFlexible\ExtremeSyncService.exe (Super Flexible Software) O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0 O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKLM\..Trusted Ranges: Range1 ([file] in Local intranet) O15 - HKU\S-1-5-21-945631898-3404820810-274502779-500\..Trusted Ranges: Range1 ([http] in Trusted sites) O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GK.local O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053B40FB-8357-4177-95F4-70CBEF6040C5}: NameServer = 192.168.7.250,192.168.7.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF2345F7-E2F5-46DA-B8AC-1E3289CFAA40}: NameServer = 192.168.7.5,192.168.7.250 O18:64bit: - Protocol\Handler\hpapp - No CLSID value found O18:64bit: - Protocol\Handler\hpapp\Apps - No CLSID value found O18:64bit: - Protocol\Handler\ipp - No CLSID value found O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18 - Protocol\Handler\hpapp {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files (x86)\Compaq\Cpqacuxe\Bin\hpapp.dll (Hewlett-Packard Company) O18 - Protocol\Handler\hpapp\Apps - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - File not found O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation) O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation) O29:64bit: - HKLM SecurityProviders - (pwdssp.dll) - File not found O29 - HKLM SecurityProviders - (pwdssp.dll) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) NetSvcs:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation) MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - D:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation) MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - D:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - D:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) MsConfig:64bit - StartUpReg: UnlockerAssistant - hkey= - key= - File not found MsConfig:64bit - State: "startup" - Reg Error: Key error. SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation) SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: TabletInputService - Service SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: WudfRd - Driver SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: TabletInputService - Service SafeBootMin: vmms - Service SafeBootMin: WudfRd - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NativeWifiP - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation) SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TabletInputService - Service SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: Wlansvc - Service SafeBootNet:64bit: WudfRd - Driver SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NativeWifiP - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TabletInputService - Service SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: Wlansvc - Service SafeBootNet: WudfRd - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {A509B1A7-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iesetup.dll",IEHardenAdmin ActiveX:64bit: {A509B1A8-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iesetup.dll",IEHardenUser ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {A509B1A7-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iesetup.dll",IEHardenAdmin ActiveX: {A509B1A8-37EF-4b3f-8CFC-4F3A74704073} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iesetup.dll",IEHardenUser ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT System Restore Service not available. ========== Files/Folders - Created Within 30 Days ========== [2012.07.30 18:07:24 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2012.07.23 14:54:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SB-AW [2012.07.21 12:05:09 | 000,000,000 | ---D | C] -- C:\TMP [2012.07.21 12:04:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VersionBackup [2012.07.21 12:04:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VersionBackup [2012.07.20 23:14:41 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup [2012.07.20 23:04:20 | 000,216,856 | ---- | C] (EldoS Corporation) -- C:\Windows\SysWow64\CbFsNetRdr3.dll [2012.07.20 23:04:20 | 000,188,696 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\CbFsMntNtf3.dll [2012.07.20 23:04:20 | 000,155,416 | ---- | C] (EldoS Corporation) -- C:\Windows\SysWow64\CbFsMntNtf3.dll [2012.07.20 23:04:20 | 000,139,032 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\CbFsNetRdr3.dll [2012.07.20 23:04:18 | 000,321,424 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\drivers\cbfs3.sys [2012.07.20 16:38:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2012.07.20 16:16:34 | 000,000,000 | ---D | C] -- C:\Windows\pss [2012.07.20 15:58:59 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Curiolab [2012.07.20 15:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.07.20 15:43:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes [2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.20 15:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.20 15:43:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.20 09:15:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET [2012.07.20 09:13:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\temp [2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET [2012.07.19 12:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.07.19 11:52:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker [2012.07.19 11:03:35 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.07.19 10:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET ========== Files - Modified Within 30 Days ========== [2012.07.30 18:06:56 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2012.07.30 14:43:41 | 001,027,624 | ---- | M] () -- C:\ADS_ERR.ADT [2012.07.30 14:43:41 | 000,018,944 | ---- | M] () -- C:\ADS_ERR.ADI [2012.07.30 14:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job [2012.07.30 13:37:06 | 000,000,026 | ---- | M] () -- C:\Windows\BRPP2KA.INI [2012.07.30 13:37:05 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\bd4040cn.dat [2012.07.30 12:00:22 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job [2012.07.30 12:00:13 | 000,000,494 | ---- | M] () -- C:\Windows\tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job [2012.07.30 11:49:41 | 000,000,766 | ---- | M] () -- C:\Windows\tobit.ini [2012.07.30 08:56:25 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.30 08:56:25 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.30 08:54:51 | 002,346,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.30 08:54:51 | 000,965,724 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.30 08:54:51 | 000,904,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.30 08:54:51 | 000,250,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.30 08:54:51 | 000,215,958 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.30 08:45:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.29 20:00:03 | 000,000,696 | ---- | M] () -- C:\Windows\tasks\komsthoeft_daten.job [2012.07.28 11:24:05 | 000,632,049 | ---- | M] () -- C:\Users\Administrator\Desktop\adwcleaner.exe [2012.07.27 14:28:24 | 000,031,177 | ---- | M] () -- C:\ADS_ERR.adm [2012.07.21 12:04:08 | 000,000,737 | ---- | M] () -- C:\Users\Administrator\Desktop\VersionBackup.lnk [2012.07.21 12:04:07 | 000,000,870 | ---- | M] () -- C:\Users\Administrator\Desktop\VB-Shutdown.lnk [2012.07.21 12:04:07 | 000,000,863 | ---- | M] () -- C:\Users\Administrator\Desktop\Backup-Browser.lnk [2012.07.21 12:04:07 | 000,000,723 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VersionBackup.lnk [2012.07.20 16:38:19 | 000,003,009 | ---- | M] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk [2012.07.20 15:44:52 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.20 15:44:00 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.07.20 09:21:19 | 000,001,994 | -H-- | M] () -- C:\Users\Administrator\Documents\Default.rdp [2012.07.20 09:13:05 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk [2012.07.19 21:06:13 | 000,000,404 | ---- | M] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat [2012.07.19 12:29:36 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk [2012.07.12 03:36:36 | 000,312,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.12 03:29:15 | 000,000,376 | ---- | M] () -- C:\Windows\dtools.INI [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.07.30 07:43:51 | 000,632,049 | ---- | C] () -- C:\Users\Administrator\Desktop\adwcleaner.exe [2012.07.21 12:04:08 | 000,000,737 | ---- | C] () -- C:\Users\Administrator\Desktop\VersionBackup.lnk [2012.07.21 12:04:07 | 000,000,870 | ---- | C] () -- C:\Users\Administrator\Desktop\VB-Shutdown.lnk [2012.07.21 12:04:07 | 000,000,863 | ---- | C] () -- C:\Users\Administrator\Desktop\Backup-Browser.lnk [2012.07.21 12:04:07 | 000,000,723 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VersionBackup.lnk [2012.07.20 16:38:19 | 000,003,009 | ---- | C] () -- C:\Users\Administrator\Desktop\HiJackThis.lnk [2012.07.20 15:44:00 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.07.20 15:43:15 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.20 09:13:05 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7 Host.lnk [2012.07.20 09:13:05 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7 Host.lnk [2012.07.19 21:06:13 | 000,000,404 | ---- | C] () -- C:\Users\Administrator\Desktop\RepairFirewall.bat [2012.07.19 12:29:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ESET Remote Administrator Console.lnk [2012.06.16 00:19:29 | 000,000,376 | ---- | C] () -- C:\Windows\dtools.INI [2012.06.16 00:07:21 | 000,000,145 | ---- | C] () -- C:\Windows\BRICK.INI [2011.07.19 17:23:54 | 000,000,600 | ---- | C] () -- C:\Users\Administrator\AppData\Local\PUTTY.RND [2011.04.12 16:45:33 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\NetCapiConfig.exe [2011.04.12 16:45:33 | 000,077,890 | ---- | C] () -- C:\Windows\SysWow64\CAPI2032.dll [2011.04.12 16:34:05 | 000,090,624 | ---- | C] () -- C:\Windows\SysWow64\elalui32.dll [2011.02.01 16:02:16 | 000,000,657 | ---- | C] () -- C:\Users\Administrator\static.key [2011.01.05 08:57:25 | 000,017,563 | ---- | C] () -- C:\Windows\Q-Dir.ini [2010.12.07 18:45:30 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL [2010.12.07 18:45:30 | 000,099,840 | ---- | C] () -- C:\Windows\IMGMSGMO.dll [2010.12.07 18:45:17 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI [2010.12.07 18:44:35 | 000,000,766 | ---- | C] () -- C:\Windows\tobit.ini [2010.12.07 18:42:34 | 008,283,136 | ---- | C] () -- C:\Windows\TOBITCLT.DLL [2010.12.07 18:42:32 | 002,648,064 | ---- | C] () -- C:\Windows\SysWow64\DVMSG.DLL [2010.12.07 18:42:32 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\dvccext.dll [2010.12.07 18:20:28 | 000,000,047 | ---- | C] () -- C:\Windows\TOBITADD.INI [2010.08.20 16:23:16 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini [2010.08.18 23:15:32 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini [2010.08.17 13:57:31 | 000,000,153 | ---- | C] () -- C:\Windows\BRVIDEO.INI [2010.08.17 13:57:31 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini [2010.08.17 13:57:31 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini [2010.08.17 13:56:59 | 000,020,605 | ---- | C] () -- C:\Windows\HL-4040CN.INI [2010.08.17 13:56:44 | 000,000,471 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.08.17 13:56:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat [2010.08.17 13:56:44 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2010.08.17 13:56:26 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL [2010.08.17 13:56:25 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI [2010.08.12 21:53:59 | 000,001,247 | ---- | C] () -- C:\Windows\SysWow64\cygrunsrv.exe.stackdump [2010.08.06 18:45:52 | 000,011,306 | ---- | C] () -- C:\Users\Administrator\gsview32.ini [2010.08.03 16:14:20 | 000,003,843 | ---- | C] () -- C:\Users\Administrator\cadwin.ini [2010.08.02 15:41:31 | 000,472,576 | ---- | C] () -- C:\Windows\SysWow64\ApolloCrypt.dll [2010.08.02 15:41:31 | 000,059,392 | ---- | C] () -- C:\Windows\Bssudf.dll [2010.07.26 09:46:12 | 000,001,164 | ---- | C] () -- C:\Users\Administrator\copyclient.ini [2010.06.08 13:45:20 | 000,003,076 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== LOP Check ========== [2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core [2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv [2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab [2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS [2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF [2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo [2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD [2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer [2012.07.20 23:16:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup [2012.07.30 07:44:12 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL [2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++ [2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org [2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir [2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB [2012.07.23 14:54:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\SB-AW [2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer [2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer [2012.07.30 18:07:42 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit [2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke [2010.08.14 10:33:46 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK\AppData\Roaming\bitfarm-archiv [2010.08.14 10:38:04 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK\AppData\Roaming\Notepad++ [2010.08.15 18:00:58 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK.000\AppData\Roaming\OpenOffice.org [2010.08.19 08:04:32 | 000,000,000 | ---D | M] -- C:\Users\Bitfarm.GK.002\AppData\Roaming\OpenOffice.org [2012.07.29 20:00:03 | 000,000,696 | ---- | M] () -- C:\Windows\Tasks\komsthoeft_daten.job [2011.03.17 04:00:38 | 000,019,900 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.07.30 12:00:13 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{3945145c-72e2-11df-a99c-d8d385e26e57}.job [2012.07.30 14:00:18 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{39451463-72e2-11df-a99c-d8d385e26e57}.job [2012.07.30 12:00:22 | 000,000,494 | ---- | M] () -- C:\Windows\Tasks\ShadowCopyVolume{47e6b6a6-72df-11df-a650-806e6f6e6963}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.07.23 15:06:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Adobe [2010.10.05 09:30:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\agorum core [2010.08.09 18:41:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\bitfarm-archiv [2010.08.17 13:59:39 | 000,000,000 | R--D | M] -- C:\Users\Administrator\AppData\Roaming\Brother [2012.07.20 15:58:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Curiolab [2012.06.12 14:11:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ESTOS [2012.04.16 13:16:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FreePDF [2011.05.03 18:26:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GetRightToGo [2010.08.17 10:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GuthCAD [2010.08.15 09:18:47 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Identities [2011.04.12 16:33:57 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\InstallShield [2012.07.20 15:43:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes [2011.08.26 21:47:50 | 000,000,000 | --SD | M] -- C:\Users\Administrator\AppData\Roaming\Microsoft [2010.08.20 16:21:18 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Microsoft Web Folders [2011.09.18 19:28:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MyPhoneExplorer [2012.07.20 23:16:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySecureBackup [2012.07.30 07:44:12 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\MySQL [2010.07.24 14:10:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++ [2010.08.15 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice.org [2011.01.05 09:15:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Q-Dir [2010.07.24 10:46:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\RIB [2012.07.23 14:54:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\SB-AW [2011.04.19 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Super Flexible File Synchronizer [2010.07.23 14:20:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer [2012.07.30 18:07:42 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Tobit [2010.08.03 11:58:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VanDyke < %APPDATA%\*.exe /s > [2012.07.20 16:38:19 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Administrator\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe [2010.06.08 12:20:32 | 000,010,134 | R--- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe [2011.01.14 16:36:43 | 001,350,144 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDateBookServer.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTORV.SYS > [2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.08.21 07:35:46 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=0D9A3F095FFBFB55DCC74F5581B4154C -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16661_none_6412f79e85ff0b30\netlogon.dll [2010.08.21 09:24:02 | 000,693,760 | ---- | M] (Microsoft Corporation) MD5=364CD71997D3C32607F1F33E8ED7C9CE -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.20787_none_5a384bfb6ac6b8eb\netlogon.dll [2010.08.21 08:35:10 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=740F0AF801E1AAE4D7602B82D49B07E0 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16661_none_59be4d4c519e4935\netlogon.dll [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2010.08.21 08:52:22 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=A751C9A96F0BB0F9164D11E59BD7AE10 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.20787_none_648cf64d9f277ae6\netlogon.dll [2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll [2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.07.14 03:15:20 | 000,380,957 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\expsrv.dll [2009.07.14 03:16:13 | 000,163,840 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\scrrun.dll < > ========== Alternate Data Streams ========== @Alternate Data Stream - 158 bytes -> C:\Windows\SYSVOL\staging\domain\ContentSet{5037438D-1888-4FAE-8226-338016215716}-{6F05F487-426D-4659-ABED-7466A5B1046E}:ReplicatedFolderList @Alternate Data Stream - 158 bytes -> C:\Windows\SYSVOL\staging areas\GK.local\ContentSet{5037438D-1888-4FAE-8226-338016215716}-{6F05F487-426D-4659-ABED-7466A5B1046E}:ReplicatedFolderList < End of report > [/code] |
|
| Themen zu Windows Server 2008R2 - Firewall Zugriff verweigert und Gefunden Adware.Adon und InstallCore.D |
| 7-zip, adware.adon, autorun, bho, computer, diagnostics, dns-server, document, error, eset nod32, excel, firefox, firewall, heuristiks/extra, heuristiks/shuriken, hijack, install.exe, installation, internet, intranet, ip-adresse, kaspersky, locker, logfile, microsoft office word, office 2007, plug-in, problem, registry, richtlinie, rundll, scan, searchscopes, security, server, sicherheit, sicherstellen, software, starten, super, svchost.exe, udp, vista, win32.adware.adon, win32.installcore.d, windows, windows server 2008 r2, windows-firewall, zugriff verweigert |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
