EXP/pidief.dis

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 7. November 2012  22:15

Es wird nach 4462997 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira Free Antivirus
Seriennummer   : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : Musterfrau-LAPTOP

Versionsinformationen:
BUILD.DAT      : 12.0.0.1199    40869 Bytes  07.09.2012 22:14:00
AVSCAN.EXE     : 12.3.0.33     468472 Bytes  08.08.2012 20:31:29
AVSCAN.DLL     : 12.3.0.15      66256 Bytes  02.05.2012 00:02:50
LUKE.DLL       : 12.3.0.15      68304 Bytes  01.05.2012 23:31:47
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  01.05.2012 22:13:36
AVREG.DLL      : 12.3.0.17     232200 Bytes  16.05.2012 13:29:00
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 23:22:12
VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 23:31:36
VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 09:58:50
VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 10:43:53
VBASE005.VDF   : 7.11.34.116  4034048 Bytes  29.06.2012 15:13:07
VBASE006.VDF   : 7.11.41.250  4902400 Bytes  06.09.2012 12:42:06
VBASE007.VDF   : 7.11.45.207  2363904 Bytes  11.10.2012 12:10:28
VBASE008.VDF   : 7.11.45.208     2048 Bytes  11.10.2012 12:10:28
VBASE009.VDF   : 7.11.45.209     2048 Bytes  11.10.2012 12:10:28
VBASE010.VDF   : 7.11.45.210     2048 Bytes  11.10.2012 12:10:28
VBASE011.VDF   : 7.11.45.211     2048 Bytes  11.10.2012 12:10:28
VBASE012.VDF   : 7.11.45.212     2048 Bytes  11.10.2012 12:10:28
VBASE013.VDF   : 7.11.45.213     2048 Bytes  11.10.2012 12:10:28
VBASE014.VDF   : 7.11.46.65    220160 Bytes  16.10.2012 19:16:32
VBASE015.VDF   : 7.11.46.153   173568 Bytes  18.10.2012 19:31:42
VBASE016.VDF   : 7.11.46.223   162304 Bytes  19.10.2012 19:35:47
VBASE017.VDF   : 7.11.47.35    126464 Bytes  22.10.2012 10:37:24
VBASE018.VDF   : 7.11.47.95    175616 Bytes  24.10.2012 10:37:25
VBASE019.VDF   : 7.11.47.177   164352 Bytes  26.10.2012 12:11:05
VBASE020.VDF   : 7.11.47.229   143360 Bytes  28.10.2012 12:11:05
VBASE021.VDF   : 7.11.48.47    138240 Bytes  30.10.2012 11:28:22
VBASE022.VDF   : 7.11.48.135   122880 Bytes  01.11.2012 11:28:22
VBASE023.VDF   : 7.11.48.209   142848 Bytes  05.11.2012 18:40:22
VBASE024.VDF   : 7.11.48.243   119296 Bytes  05.11.2012 18:40:22
VBASE025.VDF   : 7.11.49.47    136704 Bytes  07.11.2012 18:41:01
VBASE026.VDF   : 7.11.49.48      2048 Bytes  07.11.2012 18:41:01
VBASE027.VDF   : 7.11.49.49      2048 Bytes  07.11.2012 18:41:01
VBASE028.VDF   : 7.11.49.50      2048 Bytes  07.11.2012 18:41:01
VBASE029.VDF   : 7.11.49.51      2048 Bytes  07.11.2012 18:41:01
VBASE030.VDF   : 7.11.49.52      2048 Bytes  07.11.2012 18:41:02
VBASE031.VDF   : 7.11.49.74     55808 Bytes  07.11.2012 18:41:02
Engineversion  : 8.2.10.196
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 11:33:45
AESCRIPT.DLL   : 8.1.4.64      463228 Bytes  06.11.2012 18:40:24
AESCN.DLL      : 8.1.9.2       131444 Bytes  01.10.2012 12:31:58
AESBX.DLL      : 8.2.5.12      606578 Bytes  14.06.2012 20:13:04
AERDL.DLL      : 8.2.0.74      643445 Bytes  07.11.2012 18:41:05
AEPACK.DLL     : 8.3.0.38      811382 Bytes  01.10.2012 12:31:58
AEOFFICE.DLL   : 8.1.2.50      201084 Bytes  06.11.2012 18:40:24
AEHEUR.DLL     : 8.1.4.130    5513592 Bytes  07.11.2012 18:41:05
AEHELP.DLL     : 8.1.25.2      258423 Bytes  12.10.2012 12:10:37
AEGEN.DLL      : 8.1.6.8       434548 Bytes  07.11.2012 18:41:03
AEEXP.DLL      : 8.2.0.10      119158 Bytes  06.11.2012 18:40:24
AEEMU.DLL      : 8.1.3.2       393587 Bytes  10.07.2012 11:33:45
AECORE.DLL     : 8.1.29.2      201079 Bytes  07.11.2012 18:41:02
AEBB.DLL       : 8.1.1.4        53619 Bytes  06.11.2012 18:40:23
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  01.05.2012 22:59:21
AVPREF.DLL     : 12.3.0.15      51920 Bytes  01.05.2012 22:44:31
AVREP.DLL      : 12.3.0.15     179208 Bytes  01.05.2012 22:13:35
AVARKT.DLL     : 12.3.0.15     211408 Bytes  01.05.2012 22:21:32
AVEVTLOG.DLL   : 12.3.0.15     169168 Bytes  01.05.2012 22:28:49
SQLITE3.DLL    : 3.7.0.1       398288 Bytes  16.04.2012 21:11:02
AVSMTP.DLL     : 12.3.0.32      63480 Bytes  08.08.2012 20:31:29
NETNT.DLL      : 12.3.0.15      17104 Bytes  01.05.2012 23:33:29
RCIMAGE.DLL    : 12.3.0.31    4444408 Bytes  08.08.2012 20:31:26
RCTEXT.DLL     : 12.3.0.31     100088 Bytes  08.08.2012 20:31:26

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, 
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +PFS,+SPR,

Beginn des Suchlaufs: Mittwoch, 7. November 2012  22:15

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
  [HINWEIS]   Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '179' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_11_4_402_287.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_11_4_402_287.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '166' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'SUService.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'BtStackServer.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'PWMDBSVC.EXE' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'SCHTASK.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPLpr.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'SvcGuiHlpr.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '167' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSScheduler.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTTray.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'pidgin.exe' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'ACTray.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPKNRRES.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'TpShocks.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPONSCR.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'tpnumlkd.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '198' Modul(e) wurden durchsucht
Durchsuche Prozess 'tposdsvc.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'virtscrl.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'PWMEWSVC.EXE' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcSvc.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'c2c_service.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'lvvsst.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPKNRSVC.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'MICMUTE.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'CAMMUTE.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'btwdins.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcPrfMgrSvc.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPHKSVC.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPHKLOAD.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'atibtmon.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '153' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'ibmpmsvc.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '2115' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\Musterfrau\AppData\Local\Mozilla\Firefox\Profiles\Musterfrau\Cache\1\53\5F912d01
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/Pidief.dis
C:\Users\Musterfrau\Downloads\avira_free_antivirus_de12001125.exe
  [WARNUNG]   Die Datei ist kennwortgeschützt
C:\Users\Musterfrau\Dropbox\Bilogie Semester III (1)\ALTKLAUSUREN\3.Semester\Biochemie 2012\Biochemie Klausuren 2011\Biochemie Klausuren 2011.zip
  [WARNUNG]   Die Datei ist kennwortgeschützt

Beginne mit der Desinfektion:
C:\Users\Musterfrau\AppData\Local\Mozilla\Firefox\Profiles\Musterfrau\Cache\1\53\5F912d01
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/Pidief.dis
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55c043ce.qua' verschoben!


Ende des Suchlaufs: Mittwoch, 7. November 2012  23:28
Benötigte Zeit:  1:12:52 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  22877 Verzeichnisse wurden überprüft
 435356 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 435355 Dateien ohne Befall
   3965 Archive wurden durchsucht
      2 Warnungen
      2 Hinweise
 409833 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:33 on 07/11/2012 (Musterfrau)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)

-=E.O.F=-
         

 OTL logfile created on: 07.11.2012 23:40:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Musterfrau\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 66,20% Memory free
5,49 Gb Paging File | 4,41 Gb Available in Paging File | 80,26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 270,35 Gb Total Space | 133,81 Gb Free Space | 49,50% Space Free | Partition Type: NTFS
 
Computer Name: Musterfrau-LAPTOP | User Name: Musterfrau | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.07 23:01:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Musterfrau\Downloads\OTL.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.09.06 12:12:20 | 000,162,408 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2012.08.20 18:37:58 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2012.08.08 21:31:28 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.24 19:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Musterfrau\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.24 01:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.08.20 18:05:44 | 000,048,618 | ---- | M] (The Pidgin developer community) -- C:\Programme\Pidgin\pidgin.exe
PRC - [2011.07.25 22:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\System Update\SUService.exe
PRC - [2011.07.15 14:44:18 | 000,132,392 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe
PRC - [2011.07.04 02:02:00 | 000,148,840 | ---- | M] (Lenovo Group Limited) -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe
PRC - [2011.07.04 02:02:00 | 000,083,304 | ---- | M] (Lenovo) -- C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe
PRC - [2011.07.04 02:02:00 | 000,062,824 | ---- | M] (Lenovo Group Limited) -- C:\Programme\ThinkPad\Utilities\SCHTASK.EXE
PRC - [2011.06.17 18:33:04 | 000,272,528 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.207\SSScheduler.exe
PRC - [2011.06.13 17:43:28 | 002,352,416 | ---- | M] (Broadcom Corporation.) -- C:\Programme\ThinkPad\Bluetooth Software\BTStackServer.exe
PRC - [2011.06.13 17:43:28 | 000,804,128 | ---- | M] (Broadcom Corporation.) -- C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe
PRC - [2011.06.13 17:43:28 | 000,628,000 | ---- | M] (Broadcom Corporation.) -- C:\Programme\ThinkPad\Bluetooth Software\btwdins.exe
PRC - [2011.05.26 18:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2011.04.20 09:04:40 | 000,130,920 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tphkload.exe
PRC - [2011.04.14 12:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Access Connections\SvcGuiHlpr.exe
PRC - [2011.04.14 12:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Access Connections\ACTray.exe
PRC - [2011.04.14 12:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Access Connections\AcSvc.exe
PRC - [2011.04.14 12:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Access Connections\AcPrfMgrSvc.exe
PRC - [2011.04.04 10:43:36 | 000,135,528 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tpnumlkd.exe
PRC - [2011.04.04 09:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\micmute.exe
PRC - [2011.03.29 12:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.29 15:32:44 | 000,069,560 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.07.27 12:51:56 | 000,074,088 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe
PRC - [2010.07.27 12:51:54 | 000,062,312 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe
PRC - [2010.07.27 12:51:42 | 000,050,536 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\CamMute.exe
PRC - [2010.07.06 20:51:12 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2010.07.06 20:50:44 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2010.04.07 13:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 13:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.14 21:08:50 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012.06.14 21:08:17 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.14 21:08:06 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.05.11 23:00:06 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.11 22:58:51 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.11 22:58:43 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.11 22:58:42 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.11 22:58:19 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.09.14 20:05:15 | 000,904,525 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libcairo-2.dll
MOD - [2011.09.14 20:05:15 | 000,535,264 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\freetype6.dll
MOD - [2011.09.14 20:05:15 | 000,482,872 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libgio-2.0-0.dll
MOD - [2011.09.14 20:05:15 | 000,279,059 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libfontconfig-1.dll
MOD - [2011.09.14 20:05:15 | 000,219,305 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libpng14-14.dll
MOD - [2011.09.14 20:05:15 | 000,143,096 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libexpat-1.dll
MOD - [2011.09.14 20:05:15 | 000,095,189 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\libpangocairo-1.0-0.dll
MOD - [2011.09.14 20:05:15 | 000,090,496 | ---- | M] () -- C:\Programme\Pidgin\Gtk\lib\gtk-2.0\2.10.0\engines\libwimp.dll
MOD - [2011.09.14 20:05:15 | 000,055,808 | ---- | M] () -- C:\Programme\Pidgin\Gtk\bin\zlib1.dll
MOD - [2011.08.20 18:05:44 | 000,325,180 | ---- | M] () -- C:\Programme\Pidgin\libjabber.dll
MOD - [2011.08.20 18:05:44 | 000,288,309 | ---- | M] () -- C:\Programme\Pidgin\plugins\libmsn.dll
MOD - [2011.08.20 18:05:44 | 000,251,285 | ---- | M] () -- C:\Programme\Pidgin\liboscar.dll
MOD - [2011.08.20 18:05:44 | 000,190,214 | ---- | M] () -- C:\Programme\Pidgin\libymsg.dll
MOD - [2011.08.20 18:05:44 | 000,180,516 | ---- | M] () -- C:\Programme\Pidgin\plugins\libgg.dll
MOD - [2011.08.20 18:05:44 | 000,147,158 | ---- | M] () -- C:\Programme\Pidgin\plugins\libsilc.dll
MOD - [2011.08.20 18:05:44 | 000,119,368 | ---- | M] () -- C:\Programme\Pidgin\plugins\libmxit.dll
MOD - [2011.08.20 18:05:44 | 000,093,250 | ---- | M] () -- C:\Programme\Pidgin\plugins\libsametime.dll
MOD - [2011.08.20 18:05:44 | 000,087,918 | ---- | M] () -- C:\Programme\Pidgin\plugins\libnovell.dll
MOD - [2011.08.20 18:05:44 | 000,086,376 | ---- | M] () -- C:\Programme\Pidgin\plugins\libmyspace.dll
MOD - [2011.08.20 18:05:44 | 000,075,085 | ---- | M] () -- C:\Programme\Pidgin\plugins\libirc.dll
MOD - [2011.08.20 18:05:44 | 000,070,345 | ---- | M] () -- C:\Programme\Pidgin\plugins\libbonjour.dll
MOD - [2011.08.20 18:05:44 | 000,061,569 | ---- | M] () -- C:\Programme\Pidgin\plugins\spellchk.dll
MOD - [2011.08.20 18:05:44 | 000,043,176 | ---- | M] () -- C:\Programme\Pidgin\plugins\libsimple.dll
MOD - [2011.08.20 18:05:44 | 000,038,873 | ---- | M] () -- C:\Programme\Pidgin\plugins\log_reader.dll
MOD - [2011.08.20 18:05:44 | 000,033,896 | ---- | M] () -- C:\Programme\Pidgin\plugins\xmppdisco.dll
MOD - [2011.08.20 18:05:44 | 000,029,185 | ---- | M] () -- C:\Programme\Pidgin\plugins\xmppconsole.dll
MOD - [2011.08.20 18:05:44 | 000,023,339 | ---- | M] () -- C:\Programme\Pidgin\plugins\themeedit.dll
MOD - [2011.08.20 18:05:44 | 000,022,446 | ---- | M] () -- C:\Programme\Pidgin\plugins\ticker.dll
MOD - [2011.08.20 18:05:44 | 000,022,242 | ---- | M] () -- C:\Programme\Pidgin\plugins\pidginrc.dll
MOD - [2011.08.20 18:05:44 | 000,021,753 | ---- | M] () -- C:\Programme\Pidgin\plugins\win2ktrans.dll
MOD - [2011.08.20 18:05:44 | 000,021,709 | ---- | M] () -- C:\Programme\Pidgin\plugins\winprefs.dll
MOD - [2011.08.20 18:05:44 | 000,021,699 | ---- | M] () -- C:\Programme\Pidgin\plugins\notify.dll
MOD - [2011.08.20 18:05:44 | 000,018,706 | ---- | M] () -- C:\Programme\Pidgin\plugins\ssl-nss.dll
MOD - [2011.08.20 18:05:44 | 000,017,910 | ---- | M] () -- C:\Programme\Pidgin\plugins\convcolors.dll
MOD - [2011.08.20 18:05:44 | 000,016,371 | ---- | M] () -- C:\Programme\Pidgin\plugins\libxmpp.dll
MOD - [2011.08.20 18:05:44 | 000,016,330 | ---- | M] () -- C:\Programme\Pidgin\plugins\libyahoo.dll
MOD - [2011.08.20 18:05:44 | 000,016,291 | ---- | M] () -- C:\Programme\Pidgin\plugins\timestamp_format.dll
MOD - [2011.08.20 18:05:44 | 000,014,269 | ---- | M] () -- C:\Programme\Pidgin\plugins\markerline.dll
MOD - [2011.08.20 18:05:44 | 000,013,426 | ---- | M] () -- C:\Programme\Pidgin\plugins\autoaccept.dll
MOD - [2011.08.20 18:05:44 | 000,013,291 | ---- | M] () -- C:\Programme\Pidgin\plugins\libyahoojp.dll
MOD - [2011.08.20 18:05:44 | 000,012,953 | ---- | M] () -- C:\Programme\Pidgin\plugins\timestamp.dll
MOD - [2011.08.20 18:05:44 | 000,012,380 | ---- | M] () -- C:\Programme\Pidgin\plugins\history.dll
MOD - [2011.08.20 18:05:44 | 000,011,517 | ---- | M] () -- C:\Programme\Pidgin\plugins\idle.dll
MOD - [2011.08.20 18:05:44 | 000,011,029 | ---- | M] () -- C:\Programme\Pidgin\plugins\joinpart.dll
MOD - [2011.08.20 18:05:44 | 000,010,521 | ---- | M] () -- C:\Programme\Pidgin\plugins\offlinemsg.dll
MOD - [2011.08.20 18:05:44 | 000,010,015 | ---- | M] () -- C:\Programme\Pidgin\plugins\libicq.dll
MOD - [2011.08.20 18:05:44 | 000,009,712 | ---- | M] () -- C:\Programme\Pidgin\plugins\extplacement.dll
MOD - [2011.08.20 18:05:44 | 000,009,476 | ---- | M] () -- C:\Programme\Pidgin\plugins\statenotify.dll
MOD - [2011.08.20 18:05:44 | 000,009,084 | ---- | M] () -- C:\Programme\Pidgin\plugins\libaim.dll
MOD - [2011.08.20 18:05:44 | 000,009,055 | ---- | M] () -- C:\Programme\Pidgin\plugins\sendbutton.dll
MOD - [2011.08.20 18:05:44 | 000,008,927 | ---- | M] () -- C:\Programme\Pidgin\plugins\relnot.dll
MOD - [2011.08.20 18:05:44 | 000,008,878 | ---- | M] () -- C:\Programme\Pidgin\plugins\psychic.dll
MOD - [2011.08.20 18:05:44 | 000,007,645 | ---- | M] () -- C:\Programme\Pidgin\plugins\gtkbuddynote.dll
MOD - [2011.08.20 18:05:44 | 000,006,954 | ---- | M] () -- C:\Programme\Pidgin\plugins\newline.dll
MOD - [2011.08.20 18:05:44 | 000,006,875 | ---- | M] () -- C:\Programme\Pidgin\plugins\iconaway.dll
MOD - [2011.08.20 18:05:44 | 000,006,751 | ---- | M] () -- C:\Programme\Pidgin\plugins\buddynote.dll
MOD - [2011.08.20 18:05:44 | 000,006,526 | ---- | M] () -- C:\Programme\Pidgin\plugins\ssl.dll
MOD - [2011.08.20 18:05:42 | 002,719,062 | ---- | M] () -- C:\Programme\Pidgin\libsilc-1-1-2.dll
MOD - [2011.08.20 18:05:42 | 001,206,642 | ---- | M] () -- C:\Programme\Pidgin\libsilcclient-1-1-2.dll
MOD - [2011.08.20 18:05:42 | 000,582,656 | ---- | M] () -- C:\Programme\Pidgin\exchndl.dll
MOD - [2011.08.20 18:05:42 | 000,475,580 | ---- | M] () -- C:\Programme\Pidgin\spellcheck\libgtkspell-0.dll
MOD - [2011.08.20 18:05:42 | 000,417,501 | ---- | M] () -- C:\Programme\Pidgin\sqlite3.dll
MOD - [2011.08.20 18:05:42 | 000,173,805 | ---- | M] () -- C:\Programme\Pidgin\libmeanwhile-1.dll
MOD - [2011.08.20 18:05:40 | 001,213,633 | ---- | M] () -- C:\Programme\Pidgin\libxml2-2.dll
MOD - [2011.07.15 14:43:48 | 000,066,856 | ---- | M] () -- C:\Programme\Synaptics\SynTP\SynTPEnhPS.dll
MOD - [2011.07.04 02:02:00 | 000,054,272 | ---- | M] () -- C:\Programme\ThinkPad\Utilities\GR\PWMRT32V.DLL
MOD - [2011.06.13 17:43:40 | 000,132,384 | ---- | M] () -- C:\Programme\ThinkPad\Bluetooth Software\BTKeyInd.dll
MOD - [2010.11.13 01:02:22 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2010.11.13 01:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.07.06 20:26:46 | 000,270,336 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.05.15 14:01:26 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.30 16:55:12 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.08 20:59:37 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.03 12:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.25 22:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2011.07.20 04:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.07.04 02:02:00 | 000,148,840 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)
SRV - [2011.07.04 02:02:00 | 000,083,304 | ---- | M] (Lenovo) [On_Demand | Running] -- C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2011.06.17 18:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2011.06.13 17:43:28 | 000,628,000 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2011.04.20 09:04:40 | 000,130,920 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV - [2011.04.14 12:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Access Connections\AcSvc.exe -- (AcSvc)
SRV - [2011.04.14 12:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2011.04.04 09:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV - [2011.03.29 12:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.07.27 12:51:56 | 000,074,088 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)
SRV - [2010.07.27 12:51:42 | 000,050,536 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)
SRV - [2010.07.06 20:50:44 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Programme\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010.04.07 13:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\\SystemRoot\System32\Drivers\sptd.sys -- (sptd)
DRV - [2012.04.27 09:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.04.24 23:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.16 20:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.11.24 22:23:16 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2011.11.24 22:23:12 | 000,080,184 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2011.09.14 22:42:20 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.09.14 22:42:20 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.07.04 02:02:00 | 000,013,424 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\TPPWR32V.SYS -- (TPPWRIF)
DRV - [2011.03.29 18:14:08 | 000,122,992 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsX86.sys -- (Shockprf)
DRV - [2011.03.29 18:12:16 | 000,020,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsHM86.sys -- (TPDIGIMN)
DRV - [2011.02.23 08:14:44 | 001,033,832 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192Ce.sys -- (RTL8192Ce)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.07 13:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\smiif32.sys -- (lenovo.smi)
DRV - [2010.08.18 09:53:42 | 000,045,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2010.07.06 21:29:18 | 005,882,368 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2010.07.06 21:29:18 | 005,882,368 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2010.07.06 20:15:26 | 000,210,944 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2010.06.25 18:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2010.06.22 12:27:46 | 000,521,344 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2010.06.17 16:18:24 | 000,193,640 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.06 04:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010.04.29 04:43:22 | 000,030,464 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2010.04.28 10:40:34 | 000,125,824 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\5U877.sys -- (5U877)
DRV - [2010.03.09 21:03:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2009.03.18 16:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2007.02.19 06:56:46 | 000,021,376 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\psadd.sys -- (psadd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1A 80 F9 77 70 95 CD 01  [binary data]
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{49BFE588-6A3B-4B1B-92C4-D79FABAF2BCC}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6AA7EBE3-47A0-4247-8CF7-E5891F0EBA89&apn_sauid=56AE5403-EF0B-4141-B33A-59E9D14F4457
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.03 20:58:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.30 16:55:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.30 16:55:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011.09.14 18:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Extensions
[2012.11.04 20:42:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Firefox\Profiles\Musterfrau\extensions
[2012.10.12 22:12:13 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Firefox\Profiles\Musterfrau\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.10.22 09:59:23 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Firefox\Profiles\Musterfrau\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2012.10.13 16:37:10 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Firefox\Profiles\Musterfrau\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.10.12 22:17:50 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\Firefox\Profiles\Musterfrau\extensions\firefox@ghostery.com
[2012.09.19 08:01:07 | 000,344,774 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\autopager@mozilla.org.xpi
[2011.10.14 19:37:38 | 000,008,359 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\copy-pure-text@kashiif-gmail.com.xpi
[2012.10.12 22:15:45 | 000,088,614 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\extension@ciuvo.com.xpi
[2012.10.08 09:57:13 | 000,142,418 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\firegestures@xuldev.org.xpi
[2012.10.12 22:17:50 | 000,083,513 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\secureLogin@blueimp.net.xpi
[2012.10.12 22:17:50 | 000,631,898 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\stefanvandamme@stefanvd.net.xpi
[2012.10.12 22:12:13 | 000,004,404 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\youtubeunblocker@unblocker.yt.xpi
[2012.11.04 20:42:38 | 000,530,388 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.10.12 22:12:13 | 000,015,706 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\{d62bb6fa-7192-47fd-b640-ad8855c444f3}.xpi
[2012.07.21 16:25:54 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.10.12 22:14:34 | 000,697,733 | ---- | M] () (No name found) -- C:\Users\Musterfrau\AppData\Roaming\mozilla\firefox\profiles\Musterfrau\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
[2012.09.07 13:43:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.02 17:34:44 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.09.07 13:43:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.05.03 20:58:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.05.03 20:58:36 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.03 20:58:36 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.05.03 20:58:36 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.03 20:58:36 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.03 20:58:36 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.03 20:58:36 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [ACTray] C:\Programme\Lenovo\Access Connections\ACTray.exe (Lenovo)
O4 - HKLM..\Run: [AcWin7Hlpr] C:\Programme\Lenovo\Access Connections\AcTBenabler.exe (Lenovo)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LENOVO.TPKNRRES] C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [PWMTRV] C:\Programme\ThinkPad\Utilities\PWMTR32V.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Pidgin] C:\Program Files\Pidgin\pidgin.exe (The Pidgin developer community)
O4 - Startup: C:\Users\Musterfrau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Musterfrau\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Musterfrau\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9A65FC52-78A1-44CF-B1BC-E9F84375F9D4}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FFCCDD02-CE7E-437B-BB4E-8FE22EBB2FB8}: NameServer = 204.152.184.76,85.214.73.63
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.30 16:55:09 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2012.10.22 12:59:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask
[2012.10.22 12:59:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.10.15 21:09:27 | 000,000,000 | ---D | C] -- C:\Users\Musterfrau\AppData\Local\PDF24
[2012.10.15 21:08:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012.10.15 21:08:29 | 000,000,000 | ---D | C] -- C:\Program Files\PDF24
[2012.10.13 10:58:13 | 000,000,000 | R--D | C] -- C:\Users\Musterfrau\Desktop\Bilogie Semester III (1)
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.07 23:43:04 | 000,013,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.07 23:43:04 | 000,013,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.07 23:40:22 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.07 23:40:22 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.07 23:40:22 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.07 23:40:22 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.07 23:35:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.07 23:35:34 | 2213,146,624 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.07 23:34:35 | 000,015,674 | ---- | M] () -- C:\Users\Musterfrau\Desktop\TROJANERFORUM.rtf
[2012.11.07 23:34:21 | 000,000,020 | ---- | M] () -- C:\Users\Musterfrau\defogger_reenable
[2012.11.07 23:22:19 | 000,003,031 | ---- | M] () -- C:\Users\Musterfrau\Desktop\HILFETROJANER.rtf
[2012.11.07 22:59:07 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.07 22:18:00 | 000,090,143 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Hiryoavat.jpg
[2012.11.07 19:33:48 | 000,010,561 | ---- | M] () -- C:\Users\Musterfrau\Desktop\SternisBogen.rtf
[2012.11.07 18:49:15 | 000,169,990 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Marion-portrait.jpg
[2012.10.30 14:50:11 | 000,472,405 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Musterfrau3.pdf
[2012.10.30 14:49:32 | 000,430,413 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Musterfrau.pdf
[2012.10.18 21:44:41 | 000,002,031 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Kies Air Discovery Service.lnk
[2012.10.16 15:13:38 | 000,097,447 | ---- | M] () -- C:\Users\Musterfrau\Desktop\bewerbungsformularaushilfen2112.pdf
[2012.10.15 21:40:40 | 000,087,347 | ---- | M] () -- C:\Users\Musterfrau\Desktop\chemie.jpg
[2012.10.15 21:26:27 | 000,846,160 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Musterfrau.pdf
[2012.10.15 21:16:14 | 000,902,275 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Musterfrau.pdf
[2012.10.15 21:08:35 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk
[2012.10.15 21:08:35 | 000,001,799 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2012.10.15 21:04:36 | 002,757,078 | ---- | M] () -- C:\Users\Musterfrau\Desktop\20121015_220436.jpg
[2012.10.15 21:04:24 | 002,846,093 | ---- | M] () -- C:\Users\Musterfrau\Desktop\20121015_220424.jpg
[2012.10.15 21:04:10 | 002,620,556 | ---- | M] () -- C:\Users\Musterfrau\Desktop\20121015_220410.jpg
[2012.10.15 21:04:01 | 002,550,232 | ---- | M] () -- C:\Users\Musterfrau\Desktop\20121015_220401.jpg
[2012.10.11 20:50:05 | 000,089,069 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Stundenplan3.png
[2012.10.09 18:17:51 | 001,206,309 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Laika5.jpg
[2012.10.09 18:17:21 | 001,103,194 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Laika4.jpg
[2012.10.09 18:16:57 | 000,945,724 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Laika2.jpg
[2012.10.09 18:15:52 | 000,978,038 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Laika3.jpg
[2012.10.09 17:50:44 | 001,526,266 | ---- | M] () -- C:\Users\Musterfrau\Desktop\Laika1.PNG
 
========== Files Created - No Company Name ==========
 
[2012.11.07 23:33:55 | 000,000,020 | ---- | C] () -- C:\Users\Musterfrau\defogger_reenable
[2012.11.07 23:27:56 | 000,015,674 | ---- | C] () -- C:\Users\Musterfrau\Desktop\TROJANERFORUM.rtf
[2012.11.07 23:22:19 | 000,003,031 | ---- | C] () -- C:\Users\Musterfrau\Desktop\HILFETROJANER.rtf
[2012.11.07 22:17:58 | 000,090,143 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Hiryoavat.jpg
[2012.11.07 18:48:18 | 000,169,990 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Marion-portrait.jpg
[2012.11.03 13:48:51 | 000,010,561 | ---- | C] () -- C:\Users\Musterfrau\Desktop\SternisBogen.rtf
[2012.10.30 14:50:10 | 000,472,405 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Musterfrau3.pdf
[2012.10.30 14:49:29 | 000,430,413 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Musterfrau3.pdf
[2012.10.18 21:44:41 | 000,002,031 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Kies Air Discovery Service.lnk
[2012.10.16 15:13:38 | 000,097,447 | ---- | C] () -- C:\Users\Musterfrau\Desktop\bewerbungsformularaushilfen2112.pdf
[2012.10.15 21:40:39 | 000,087,347 | ---- | C] () -- C:\Users\Musterfrau\Desktop\chemie.jpg
[2012.10.15 21:16:10 | 000,902,275 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Musterfrau.pdf
[2012.10.15 21:13:36 | 000,846,160 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Musterfrau.pdf
[2012.10.15 21:08:35 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk
[2012.10.15 21:08:35 | 000,001,799 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2012.10.15 21:04:20 | 002,846,093 | ---- | C] () -- C:\Users\Musterfrau\Desktop\20121015_220424.jpg
[2012.10.15 21:04:19 | 002,620,556 | ---- | C] () -- C:\Users\Musterfrau\Desktop\20121015_220410.jpg
[2012.10.15 21:04:19 | 002,550,232 | ---- | C] () -- C:\Users\Musterfrau\Desktop\20121015_220401.jpg
[2012.10.15 21:04:18 | 002,757,078 | ---- | C] () -- C:\Users\Musterfrau\Desktop\20121015_220436.jpg
[2012.10.09 18:17:50 | 001,206,309 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Laika5.jpg
[2012.10.09 18:17:21 | 001,103,194 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Laika4.jpg
[2012.10.09 18:16:56 | 000,945,724 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Laika2.jpg
[2012.10.09 18:15:52 | 000,978,038 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Laika3.jpg
[2012.10.09 17:50:44 | 001,526,266 | ---- | C] () -- C:\Users\Musterfrau\Desktop\Laika1.PNG
[2012.07.22 15:47:22 | 000,003,584 | ---- | C] () -- C:\Users\Musterfrau\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.08 23:43:06 | 000,000,218 | ---- | C] () -- C:\Users\Musterfrau\.recently-used.xbel
[2011.10.10 07:19:44 | 000,000,017 | ---- | C] () -- C:\Users\Musterfrau\AppData\Local\resmon.resmoncfg
[2011.09.14 22:42:20 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.09.14 22:42:20 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.09.14 18:44:35 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.09.14 16:19:55 | 000,002,857 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011.09.14 16:19:53 | 000,205,156 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.09.14 15:46:54 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.06.10 05:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.11.07 23:37:23 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\.purple
[2011.09.14 22:37:55 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\DAEMON Tools Lite
[2012.11.07 23:36:59 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\Dropbox
[2012.05.04 17:41:09 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\DVDVideoSoft
[2012.06.16 00:03:58 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\Foxit Software
[2012.03.08 21:41:18 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\gtk-2.0
[2011.09.14 02:08:21 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\PwrMgr
[2011.09.14 22:09:26 | 000,000,000 | ---D | M] -- C:\Users\Musterfrau\AppData\Roaming\Thunderbird
 
========== Purity Check ==========

< End of report >
         

 OTL Extras logfile created on: 07.11.2012 23:40:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Musterfrau\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 66,20% Memory free
5,49 Gb Paging File | 4,41 Gb Available in Paging File | 80,26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 270,35 Gb Total Space | 133,81 Gb Free Space | 49,50% Space Free | Partition Type: NTFS
 
Computer Name: Musterfrau-LAPTOP | User Name: Musterfrau | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04DA9008-5A17-433A-B87C-4C17C9DD2EE3}" = rport=445 | protocol=6 | dir=out | app=system | 
"{09A64B59-1F4B-42A2-A8F8-FCBA3C446202}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4626928B-DE85-4797-8418-9BE9CD2BB7AE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{47DBC66E-3733-43BA-B12A-FDFD50DC14F0}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{48E33685-ED0E-45D4-9E9F-79DC7CCEC9D3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4E7398B0-3F6B-4EF3-BFDF-52687C8F5522}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4F8EB866-EBE0-41D7-A8C2-A218FBD794DE}" = lport=139 | protocol=6 | dir=in | app=system | 
"{53898EA2-520B-4EF3-959A-8CCF161D6288}" = rport=137 | protocol=17 | dir=out | app=system | 
"{56961AFB-6BDC-409E-AF84-C1EFA5CD065B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5E94C27B-69AB-43D3-885A-1CA47522511E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{63F68837-0622-4843-9BED-2B91E80E69F3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6AF4C9C2-81FF-4C26-8AAB-9E1176CA352F}" = lport=138 | protocol=17 | dir=in | app=system | 
"{6BAC6B8B-58AE-40CD-BEF0-3B6ABCF1E3B9}" = rport=139 | protocol=6 | dir=out | app=system | 
"{7C4C9F97-DECB-4F9C-A57C-653A7B1674AA}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{80632543-B4A4-465C-8567-FA4DB45081AF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{85A5E150-605B-40EF-8592-F89AF72623A6}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8D12DB9B-F171-4521-9A1C-17E4BDA30F47}" = rport=138 | protocol=17 | dir=out | app=system | 
"{ABFAB69A-B280-42A4-A550-29445F80DBC7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B08D3279-6F0D-4E80-BAB0-12E6A5125D0E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D028C1C9-6F63-4685-BC59-B523612A4F2B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D2283637-49A1-41B5-BB4C-50C916D95456}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{E1F473BF-85E2-4B86-B958-B77C1CB20571}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E22A2AEF-A4F7-4640-960D-6CA7D9859D14}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{057319D1-DE15-4DD3-8C4D-018CDC2F9943}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{06E2C145-E832-4C44-AD21-C5BFEFDBE800}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{0A85650E-3270-408C-9663-8CBAE712FD99}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{102B6EC0-9E1A-4F4A-8153-628F965CB682}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{1511E4BB-6CD5-43C0-9A5E-BC433E04AF8B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{206FB3E6-626D-417C-A58E-84BA43414526}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{2E9C2653-E3EE-49C2-9308-660575D721F0}" = protocol=17 | dir=in | app=c:\program files\lenovo\system update\uncserver.exe | 
"{4557A257-2FDA-4ECA-8C4B-708381508FC0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{52A168D1-ED24-42A6-AF9D-072391524BBF}" = protocol=6 | dir=in | app=c:\program files\anno 1404\tools\addonweb.exe | 
"{52BD1CE6-8124-42F9-808F-0CFF360ACB3B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6BFFF0BF-FD73-40CA-91B3-CD23D8FABB46}" = protocol=17 | dir=in | app=c:\program files\anno 1404\addon.exe | 
"{7CC5E74A-F357-4407-9B62-BAB63E34B90D}" = protocol=6 | dir=in | app=c:\users\Musterfrau\appdata\roaming\dropbox\bin\dropbox.exe | 
"{84E08918-4D22-46EE-BFA1-1369211073E7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{91B37AEC-9B97-4B4A-8DAB-F267D46583AD}" = protocol=6 | dir=in | app=c:\program files\anno 1404\addon.exe | 
"{A428891C-A9C4-4A6B-891E-4AF77589FB54}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{A5B9B4CA-C663-409C-A098-87FE2DA105D0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B65E10BC-859C-4650-96A1-8E6D1A19BEC6}" = protocol=6 | dir=out | app=system | 
"{B7A97F77-E87E-4422-811F-B6BF6FD1645A}" = protocol=17 | dir=in | app=c:\users\Musterfrau\appdata\roaming\dropbox\bin\dropbox.exe | 
"{D35AB443-99E6-47B3-A92D-7E60CCE4896A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{D51C10E5-61CB-4F09-AA3D-2C3F6F74052B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DD16C766-726B-4DB8-9DE7-5458CBD5BD46}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DE7AC001-CEF3-4AC2-9EC3-9AADB2D525E0}" = protocol=17 | dir=in | app=c:\users\Musterfrau\appdata\roaming\dropbox\bin\dropbox.exe | 
"{DF1B2281-8F2C-4AA3-9FA9-143B187752DC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E0579E42-84A8-4D95-8241-B7CF4765BB99}" = protocol=6 | dir=in | app=c:\users\Musterfrau\appdata\roaming\dropbox\bin\dropbox.exe | 
"{E501CD7A-36E2-416F-A24D-922ABBAD9BD6}" = protocol=6 | dir=in | app=c:\program files\lenovo\system update\uncserver.exe | 
"{F78DD2D7-A3A0-4674-8B80-2F91E719BB73}" = protocol=17 | dir=in | app=c:\program files\anno 1404\tools\addonweb.exe | 
"{F82A8EFA-28E7-46BD-ADC6-7E1A7930C961}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{A73D7935-13D8-4534-BA14-94D6C9A208E7}C:\program files\pidgin\pidgin.exe" = protocol=6 | dir=in | app=c:\program files\pidgin\pidgin.exe | 
"UDP Query User{3DF12A42-A240-4CA1-B038-5CE0199B5C5E}C:\program files\pidgin\pidgin.exe" = protocol=17 | dir=in | app=c:\program files\pidgin\pidgin.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01934B90-1176-7D9F-597E-CEB81533DEEA}" = CCC Help Finnish
"{16A15E1C-892F-CBB5-7A09-8E2C3ECFCF03}" = ATI Catalyst Install Manager
"{17D68A8C-F1E7-036B-DCCC-45C05FD053F4}" = CCC Help English
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{25C64847-B900-48AD-A164-1B4F9B774650}" = System Update
"{26A24AE4-039D-4CA4-87B4-2F83216035FF}" = Java(TM) 6 Update 35
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2B4720AB-3986-512D-5EC9-35CDAD6EC23A}" = ccc-core-static
"{2D1DA081-A918-81F0-18AE-4B51CEDAAB6E}" = CCC Help Italian
"{32B38A00-2786-EC14-B615-6864DAFA9774}" = CCC Help Chinese Standard
"{3B0BE6FE-C467-86DD-BDA2-E59D46DD82A9}" = CCC Help Thai
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D848860-252A-23A0-A16F-44962731044C}" = CCC Help German
"{41F25F17-35D9-0B05-F8FD-7B3AD1C122E4}" = CCC Help Polish
"{451689AF-1C3A-ECBA-AFA0-A1103BDD536B}" = CCC Help Russian
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{52D6A34C-4DE9-8AA7-AB7F-C05833D270CD}" = CCC Help Chinese Traditional
"{57FA0525-01F9-4051-8DE9-CBF43CAC68D9}" = Catalyst Control Center - Branding
"{5D923D23-4CD2-A29B-A398-9B919C39D8A6}" = CCC Help Norwegian
"{5FDB3B24-A39C-5D8A-A7E2-92F445C09252}" = CCC Help Portuguese
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6E9AF2B5-AE25-6F7E-2AD6-452816F7BF6A}" = CCC Help Greek
"{6FC9ABDA-CA6B-231F-55C5-BD5A1D924477}" = CCC Help Japanese
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.9.0
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{88C6A6D9-324C-46E8-BA87-563D14021442}_is1" = ThinkVantage Communications Utility
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E537894-A559-4D60-B3CB-F4485E3D24E3}" = ThinkVantage Access Connections
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{941ED5D5-C954-35CB-1B9D-4F919731E104}" = Catalyst Control Center Graphics Previews Vista
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}" = Integrated Camera TWAIN
"{9D3D2C60-A55F-4fed-B2B9-17311226DF01}" = ThinkPad Wireless LAN Adapter Software
"{9D3D2C60-A55F-4fed-B2B9-17394396DF01}" = ThinkPad Wireless LAN Adapter Software
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = ThinkPad Bluetooth with Enhanced Data Rate Software
"{A4DCD482-4F23-B2A6-6DE7-FE364B4C1613}" = CCC Help Swedish
"{A4E2D0D6-681C-4B39-4FB0-26AF6CFE9262}" = CCC Help Dutch
"{A79A2CE3-3E20-7064-47A9-29857EBAC6FA}" = CCC Help Hungarian
"{A90E920C-A2A3-8861-4DE7-EDB05637DDAC}" = Catalyst Control Center InstallProxy
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACF7EEC7-03A8-19D3-B10E-CB0E691936B8}" = Catalyst Control Center Localization All
"{AD055BBF-B56E-7A38-3B2B-71C2ED15DAC9}" = CCC Help Danish
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BAEB748D-B024-795E-6224-7410E04DB7F1}" = CCC Help Turkish
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C3CD17B4-08B0-492D-8A4C-81716D33E520}" = Integrated Camera Driver Installer Package Ver.1.0.1.8
"{C43AB192-E85C-0F71-EFC6-E5DD9BD3E0AA}" = CCC Help Korean
"{CF1E28A5-E99F-8A3B-0968-614FD3F0D87B}" = CCC Help French
"{D4C8956F-83EE-572A-B96B-53B2FADA35BA}" = ccc-utility
"{D75AEB5B-FA18-4BD4-9EED-54CA46DB5AE8}" = Intel(R) PROSet/Wireless WiFi-Software
"{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}" = ThinkPad Energie-Manager
"{DEDB888F-E02C-11F0-AF71-393642E8694B}" = CCC Help Czech
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.18
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4E3A09C-8978-C9E6-B6F7-CEE75D896217}" = CCC Help Spanish
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"2004BB9EB6CEA02846881BEF1F51C11F7A90C9D6" = Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ATI Uninstaller" = ATI Uninstaller
"Avira AntiVir Desktop" = Avira Free Antivirus
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800)
"CNXT_AUDIO_HDA" = Conexant CX20582 SmartAudio HD
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Foxit Reader_is1" = Foxit Reader
"IrfanView" = IrfanView (remove only)
"LENOVO.SMIIF" = Lenovo System Interface Driver
"LenovoAutoScrollUtility" = Lenovo Auto Scroll Utility
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OnScreenDisplay" = Anzeige am Bildschirm
"Pidgin" = Pidgin
"Power Management Driver" = ThinkPad Power Management Driver
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"VLC media player" = VLC media player 1.1.11
"WinPcapInst" = WinPcap 4.1.2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Kies Air Discovery Service" = Kies Air Discovery Service
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 29.10.2012 15:17:35 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Lenovo\Access
 Connections\AcCryptHlpr.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Lenovo\Access Connections\AcCryptHlpr.dll" in Zeile 0.  Ungültige XML-Syntax.
 
Error - 29.10.2012 15:19:15 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\InstallManagerApp.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 29.10.2012 15:19:15 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\Setup.exe".  Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 05.11.2012 06:08:46 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Lenovo\Access
 Connections\AcCryptHlpr.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Lenovo\Access Connections\AcCryptHlpr.dll" in Zeile 0.  Ungültige XML-Syntax.
 
Error - 05.11.2012 06:10:30 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\InstallManagerApp.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 05.11.2012 06:10:30 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\Setup.exe".  Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.11.2012 10:05:39 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Lenovo\Access
 Connections\AcCryptHlpr.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Lenovo\Access Connections\AcCryptHlpr.dll" in Zeile 0.  Ungültige XML-Syntax.
 
Error - 07.11.2012 10:07:35 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\InstallManagerApp.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.11.2012 10:07:36 | Computer Name = Musterfrau-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Lenovo\system
 update\session\85d808ww\Bin64\Setup.exe".  Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.11.2012 14:33:47 | Computer Name = Musterfrau-Laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 12.0.0.4493,
 Zeitstempel: 0x4f920759  Name des fehlerhaften Moduls: NPSWF32_11_4_402_287.dll_unloaded,
 Version: 0.0.0.0, Zeitstempel: 0x5066df1c  Ausnahmecode: 0xc0000005  Fehleroffset: 
0x60868ce3  ID des fehlerhaften Prozesses: 0x161c  Startzeit der fehlerhaften Anwendung:
 0x01cdbcee1e0a321a  Pfad der fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: NPSWF32_11_4_402_287.dll  Berichtskennung: aa7f1c4b-2909-11e2-9d38-60eb69fb60e4
 
[ System Events ]
Error - 03.11.2012 05:47:05 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 04.11.2012 15:41:03 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 05.11.2012 03:55:22 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 06.11.2012 14:35:27 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 06.11.2012 18:11:07 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 07.11.2012 09:44:05 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 07.11.2012 14:36:09 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 07.11.2012 16:12:23 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 07.11.2012 18:34:36 | Computer Name = Musterfrau-Laptop | Source = DCOM | ID = 10010
Description = 
 
Error - 07.11.2012 18:35:59 | Computer Name = Musterfrau-Laptop | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
< End of report >
         

 GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-08 12:09:08
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 HITACHI_HTS725050A9A364 rev.PC4ZC70F
Running: dvq7xkum.exe; Driver: C:\Users\SAZPRI~1\AppData\Local\Temp\uglyrpob.sys


---- System - GMER 1.0.15 ----

SSDT            989F95F6                                                                                                            ZwCreateSection
SSDT            989F9600                                                                                                            ZwRequestWaitReplyPort
SSDT            989F95FB                                                                                                            ZwSetContextThread
SSDT            989F9605                                                                                                            ZwSetSecurityObject
SSDT            989F960A                                                                                                            ZwSystemDebugControl
SSDT            989F9597                                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                            82C42A49 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              82C7C4D2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                 82C8362C 4 Bytes  [F6, 95, 9F, 98]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                 82C83988 4 Bytes  [00, 96, 9F, 98]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                 82C839CC 4 Bytes  [FB, 95, 9F, 98] {STI ; XCHG EBP, EAX; LAHF ; CWDE }
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                 82C83A48 4 Bytes  [05, 96, 9F, 98]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                 82C83A9C 4 Bytes  [0A, 96, 9F, 98]
.text           ...                                                                                                                 
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                                            section is writeable [0x90412000, 0x31BA76, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                                              section is writeable [0x99543300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                                              section is writeable [0x99586300, 0x1BEE, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                             Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                             Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000052                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000079                                                                                     bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ec55f9de3a36                                         
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xFF 0xF7 0xF1 0x3A ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x9B 0xDE 0x1A 0x04 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x32 0x51 0xA2 0x68 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ec55f9de3a36 (not active ControlSet)                     
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xFF 0xF7 0xF1 0x3A ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x9B 0xDE 0x1A 0x04 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x32 0x51 0xA2 0x68 ...

---- EOF - GMER 1.0.15 ----