| |
| |||||||
Log-Analyse und Auswertung: GVU Trojaner und FTP StealerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.11.2012, 02:16
| #1 |
 |  GVU Trojaner und FTP Stealer Hallo liebe TB Community, ich habe mich vor ein paar Tagen mit dem GVU Trojaner infiziert und diesen aber mit einem Wiederherstellungspunkt umgangen. Ich hatte dann meinen Laptop mithilfe von Malwarebytes und Microsoft Security Essentials gescannt und einige Schädlinge entfernt. Leider kann ich nicht mehr genau sagen was genau erkannt wurde, ich kann mich nur an Javascript Exploits erinnern. Danach war eigentlich auch alles hübsch, bis mich ein User angeschrieben hat und mir sagte, das beim besuchen meiner Webseiten sich das Antivir meldet. Daraufhin habe ich meine Webseiten gescannt und Schadcode gefunden. Es hat nur Webseiten getroffen die ich mit FileZilla bearbeitet habe. Also gehe ich davon aus, das die Malware FTP Passörter ausliest und sich über Webseiten weiterverteilt. Meine Webseiten konnte ich berenigen, trotzdem traue ich mich nicht mehr FileZilla zu benutzen da ich nicht weiß, was noch auf meinem PC schlummert.. OTL Scann Code:
ATTFilter OTL logfile created on: 24.11.2012 00:49:37 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\NBLeipzig2\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,46 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 67,06% Memory free 6,91 Gb Paging File | 5,55 Gb Available in Paging File | 80,25% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 218,20 Gb Total Space | 164,64 Gb Free Space | 75,46% Space Free | Partition Type: NTFS Drive D: | 489,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: NB16NGLEI2 | User Name: NBLeipzig2 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.24 00:47:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe PRC - [2012.09.12 17:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe PRC - [2012.08.20 18:37:58 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.02.27 04:14:40 | 000,038,248 | ---- | M] (Mindjet) -- C:\Programme\Mindjet\MindManager 10\MmReminderService.exe PRC - [2012.02.10 10:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) -- C:\Programme\Microsoft\BingBar\7.1.361.0\SeaPort.EXE PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.12.10 18:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe PRC - [2010.12.10 18:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.01.23 00:07:07 | 004,562,944 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell Wireless WLAN Card\WLTRAY.EXE PRC - [2010.01.23 00:07:07 | 000,026,112 | ---- | M] () -- C:\Programme\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE PRC - [2010.01.23 00:07:06 | 003,086,848 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE PRC - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe PRC - [2009.12.22 03:31:02 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\System32\dgdersvc.exe PRC - [2009.10.06 02:40:58 | 001,826,816 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe PRC - [2009.10.06 02:40:40 | 000,076,288 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe PRC - [2009.08.28 15:33:28 | 000,116,032 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe PRC - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2009.08.18 10:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2009.08.14 19:30:56 | 000,015,872 | ---- | M] (Broadcom Corporation) -- C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe PRC - [2009.08.07 12:29:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.08.07 12:29:36 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2009.08.01 01:16:12 | 000,458,844 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe PRC - [2009.08.01 01:16:12 | 000,221,266 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\stacsv.exe PRC - [2009.07.27 19:18:02 | 000,134,656 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe PRC - [2009.07.16 19:13:34 | 001,245,472 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe PRC - [2009.07.16 19:10:22 | 000,382,752 | ---- | M] (Dell Inc.) -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe PRC - [2009.07.08 09:12:00 | 000,243,008 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Updater\dlupdr.exe PRC - [2009.07.08 09:11:32 | 000,406,840 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpsp.exe PRC - [2009.06.25 03:19:50 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe PRC - [2009.06.19 23:57:40 | 000,249,856 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\Apoint.exe PRC - [2009.06.12 04:46:46 | 000,656,384 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe PRC - [2009.06.12 01:43:08 | 001,622,016 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe PRC - [2009.05.16 00:33:40 | 001,803,512 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\AtService.exe PRC - [2009.04.27 20:40:26 | 000,293,968 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe PRC - [2009.02.23 18:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe PRC - [2009.02.01 09:15:38 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApntEx.exe PRC - [2009.02.01 07:43:30 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\hidfind.exe PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe PRC - [2008.11.24 22:56:46 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApMsgFwd.exe PRC - [2006.12.07 16:52:14 | 000,140,184 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe PRC - [1997.08.28 04:20:00 | 000,021,504 | ---- | M] () -- C:\Windows\System32\drivers\trcboot.exe ========== Modules (No Company Name) ========== MOD - [2012.11.20 04:50:22 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\66694f9192bd0dddc2eaf90fbcbcd555\System.Management.ni.dll MOD - [2012.11.20 03:21:14 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\03cfab5534482e8fc313ead6edc19100\System.Web.ni.dll MOD - [2012.11.20 03:21:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\413288993ff690e8251d2dbe32bee01f\System.Runtime.Remoting.ni.dll MOD - [2012.11.20 03:20:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll MOD - [2012.11.20 03:20:32 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll MOD - [2012.11.20 03:20:10 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll MOD - [2012.11.20 03:20:06 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll MOD - [2012.11.20 03:20:05 | 007,988,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll MOD - [2012.11.20 03:19:53 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll MOD - [2012.11.10 20:57:08 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll MOD - [2012.02.27 04:13:54 | 000,151,376 | ---- | M] () -- C:\Programme\Mindjet\MindManager 10\zlib.dll MOD - [2012.02.20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.02.20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2012.02.17 19:55:35 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2010.11.13 01:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.01.23 00:13:39 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Status Lib\1.6.320.13950__f25c74fcad379103\Status Lib.dll MOD - [2010.01.23 00:13:39 | 000,008,192 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\StatusInterfaces\1.6.320.13949__4ca2a925deedf37d\StatusInterfaces.dll MOD - [2010.01.23 00:07:06 | 000,055,808 | ---- | M] () -- C:\Programme\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll MOD - [2009.10.06 02:36:48 | 000,569,344 | ---- | M] () -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll MOD - [2009.07.27 19:17:10 | 000,249,856 | ---- | M] () -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\ContextMenuItem.dll MOD - [2009.07.27 19:15:32 | 000,249,856 | ---- | M] () -- C:\Windows\System32\wxvault.dll MOD - [2009.06.03 19:07:50 | 000,010,752 | ---- | M] () -- C:\Windows\System32\Wavx_ESC_Logging.dll MOD - [2008.11.12 20:29:06 | 000,004,608 | ---- | M] () -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService) SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2012.10.10 16:42:06 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.09.12 17:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.21 02:59:55 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.02.10 10:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Programme\Microsoft\BingBar\7.1.361.0\SeaPort.EXE -- (BBUpdate) SRV - [2012.02.10 10:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\7.1.361.0\BBSvc.EXE -- (BBSvc) SRV - [2011.07.20 04:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2010.12.10 18:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.12.10 18:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SRV - [2010.12.10 18:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2010.12.10 18:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.01.23 00:07:07 | 000,026,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc) SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2009.12.22 03:31:02 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\System32\dgdersvc.exe -- (dgdersvc) SRV - [2009.10.06 02:40:40 | 000,076,288 | ---- | M] (Smith Micro Software, Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe -- (SMManager) SRV - [2009.08.28 15:33:28 | 000,116,032 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe -- (DLPWD) SRV - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.08.07 12:29:36 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) SRV - [2009.08.01 01:16:12 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\stacsv.exe -- (STacSV) SRV - [2009.07.16 19:10:22 | 000,382,752 | ---- | M] (Dell Inc.) [Auto | Running] -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc) SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.06.12 01:43:08 | 001,622,016 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe -- (TdmService) SRV - [2009.06.03 19:15:24 | 001,019,904 | ---- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService) SRV - [2009.05.16 00:33:40 | 001,803,512 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Programme\Fingerprint Sensor\AtService.exe -- (ATService) SRV - [2009.04.27 20:40:26 | 000,293,968 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe -- (buttonsvc32) SRV - [2009.02.23 18:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) SRV - [2008.11.12 20:25:48 | 001,273,856 | ---- | M] () [Auto | Stopped] -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe -- (tcsd_win32.exe) SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008.10.24 15:17:52 | 000,145,248 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.12.07 16:52:14 | 000,140,184 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe -- (DLSDB) SRV - [1997.08.28 04:20:00 | 000,021,504 | ---- | M] () [Auto | Running] -- C:\Windows\System32\drivers\trcboot.exe -- (TrcBoot) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\swvnic.sys -- (SWVNIC) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\NvtSp50.sys -- (NvtSp50) DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr) DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.08.30 22:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.01.23 00:07:06 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY) DRV - [2009.12.22 03:31:26 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009.12.22 03:31:02 | 000,018,136 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - [2009.11.20 05:30:42 | 000,215,088 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2009.09.19 06:30:10 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009.09.19 06:30:10 | 000,100,224 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bserd.sys -- (ss_bserd) DRV - [2009.09.19 06:30:10 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) DRV - [2009.09.19 06:30:10 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) DRV - [2009.08.01 01:16:12 | 000,409,088 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA) DRV - [2009.07.27 19:17:56 | 000,200,192 | ---- | M] (Wave Systems Corp.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\WavxDMgr.sys -- (WavxDMgr) DRV - [2009.07.14 00:45:20 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\acpials.sys -- (acpials) DRV - [2009.07.05 03:37:08 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rixdpe86.sys -- (rixdpcie) DRV - [2009.07.02 17:50:16 | 000,047,104 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rimspe86.sys -- (rimspci) DRV - [2009.07.01 04:28:28 | 000,049,152 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\risdpe86.sys -- (risdpcie) DRV - [2009.06.26 01:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2009.06.26 01:25:58 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2009.06.26 01:10:48 | 000,044,544 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2009.05.26 20:12:36 | 000,122,368 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) DRV - [2009.05.11 18:55:12 | 000,084,992 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\basp.sys -- (Blfp) DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2008.08.26 08:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.06.04 21:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PBADRV.sys -- (PBADRV) DRV - [1997.08.28 04:20:00 | 000,022,600 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klognt.sys -- (KLOGNT) DRV - [1997.08.28 04:20:00 | 000,015,360 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pcscoax.sys -- (pcscoax) DRV - [1997.08.28 04:20:00 | 000,011,488 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nstrcnt.sys -- (NsTrcNT) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {B6AAF1CD-8016-481C-9D47-DEDB01BAE019} IE - HKLM\..\SearchScopes\{B6AAF1CD-8016-481C-9D47-DEDB01BAE019}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {F16811EB-8618-4404-85C0-EE21B5673048} IE - HKCU\..\SearchScopes\{F16811EB-8618-4404-85C0-EE21B5673048}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: {7822cf50-08ee-4915-9872-ee92472df6cb}:0.986 FF - prefs.js..extensions.enabledAddons: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.9.5.1 FF - prefs.js..extensions.enabledAddons: {c151d79e-e61b-4a90-a887-5a46d38fba99}:2.8 FF - prefs.js..extensions.enabledAddons: {9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}:1.0 FF - prefs.js..extensions.enabledAddons: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.6.0.0 FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.6.1 FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.05 16:20:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.20 03:33:15 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.21 02:59:56 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 21:59:26 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\NBLeipzig2\AppData\Roaming\14001.006 [2012.07.29 18:35:20 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.05 16:20:14 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.21 02:59:56 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 21:59:26 | 000,000,000 | ---D | M] [2010.02.08 14:34:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Extensions [2012.11.20 03:51:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions [2012.05.10 00:37:42 | 000,000,000 | ---D | M] (Html Validator) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} [2012.03.30 21:50:16 | 000,000,000 | ---D | M] (affilorama) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{7822cf50-08ee-4915-9872-ee92472df6cb} [2012.10.31 21:14:43 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2012.04.02 14:09:57 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.11.17 03:28:07 | 000,012,413 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\suspendbackgroundtabs@adblockplus.org.xpi [2012.11.20 03:51:56 | 000,530,679 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.07.15 18:09:54 | 000,112,944 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\{c151d79e-e61b-4a90-a887-5a46d38fba99}.xpi [2012.09.04 13:49:36 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.07.29 18:35:20 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\NBLEIPZIG2\APPDATA\ROAMING\14001.006 [2012.07.21 02:59:56 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.03.13 06:23:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.13 06:06:36 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.03.13 06:23:34 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.03.13 06:23:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.13 06:23:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.13 06:23:34 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.google.com/ CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.89\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 6.0.330.5 (Enabled) = C:\Windows\system32\npdeployJava1.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - Extension: avast! WebRep = C:\Users\NBLeipzig2\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\ CHR - Extension: DvdVideoSoft Free Youtube Download = C:\Users\NBLeipzig2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\ O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Programme\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Programme\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.) O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.) O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.) O4 - HKLM..\Run: [DellControlPoint] c:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.) O4 - HKLM..\Run: [DLPSP] C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE (Dell Inc.) O4 - HKLM..\Run: [DLQLU] C:\Program Files\Dell Printers\Additional Color Laser Software\Launcher\DLQLU.EXE (Dell Inc.) O4 - HKLM..\Run: [DLUPDR] C:\Program Files\Dell Printers\Additional Color Laser Software\Updater\DLUPDR.EXE (Dell Inc.) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [MMReminderService] C:\Programme\Mindjet\MindManager 10\MmReminderService.exe (Mindjet) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.) O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [USCService] C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation) O4 - HKLM..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.) O4 - HKCU..\Run: [Infium] C:\Program Files\QIP 2012\qip.exe (QIP) O4 - HKCU..\Run: [InversMonitor] "C:\Program Files\klickTel\Inverssuche Sommer 2009\KMON.EXE" /MONITOR" File not found O4 - HKCU..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\/\KiesTrayAgent.exe () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe (Adobe Systems Incorporated) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Bild an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O8 - Extra context menu item: Free YouTube Download - C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Link an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Seite an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O8 - Extra context menu item: Text an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Programme\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D4F6C15-4857-4180-8BEC-AABE97F72336}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O30 - LSA: Authentication Packages - (wvauth) - C:\Windows\System32\wvauth.dll (Wave Systems Corp.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.03.31 15:11:57 | 000,641,198 | R--- | M] () - D:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{6a4c101e-71fe-11e0-a8c0-a4badba0b4ca}\Shell - "" = AutoRun O33 - MountPoints2\{6a4c101e-71fe-11e0-a8c0-a4badba0b4ca}\Shell\AutoRun\command - "" = E:\SafeStick.exe O33 - MountPoints2\{d5b0638f-076e-11df-88a1-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{d5b0638f-076e-11df-88a1-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe -- [2010.03.07 22:26:05 | 001,139,048 | R--- | M] (Hewlett-Packard) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.24 00:47:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe [2012.11.22 00:24:31 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Roaming\Malwarebytes [2012.11.22 00:23:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.11.22 00:23:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.11.22 00:23:45 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.11.22 00:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.11.21 22:14:44 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Hack [2012.11.21 16:34:54 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\cakifo [2012.11.21 01:19:17 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\creative-commons-license-manager [2012.11.20 01:07:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2012.11.17 21:20:39 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Local\fontconfig [2012.11.17 21:20:38 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Local\gegl-0.2 [2012.11.17 21:20:38 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\.gimp-2.8 [2012.11.17 20:59:29 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2 [2012.11.16 01:46:20 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Going Green Theme German [2012.11.16 01:42:01 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Genesis German [2012.11.16 01:05:55 | 000,000,000 | ---D | C] -- C:\Program Files\Poedit [2012.10.31 21:14:48 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Documents\iMacros [2012.10.31 17:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\Tweet Adder 3 [2012.10.31 17:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweet Adder 3 [1 C:\Users\NBLeipzig2\AppData\Roaming\*.tmp files -> C:\Users\NBLeipzig2\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.24 00:47:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe [2012.11.24 00:46:00 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\defogger_reenable [2012.11.24 00:45:15 | 000,050,477 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Defogger.exe [2012.11.24 00:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.24 00:05:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.11.23 23:37:20 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.11.23 23:27:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.22 16:03:41 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.22 16:03:41 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.22 16:00:59 | 000,714,918 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.11.22 16:00:59 | 000,665,892 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.11.22 16:00:59 | 000,154,814 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.11.22 16:00:59 | 000,125,026 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.11.22 15:56:48 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\AppData\Local\WavXMapDrive.bat [2012.11.22 15:56:08 | 000,001,024 | ---- | M] () -- C:\.rnd [2012.11.22 15:56:01 | 2783,313,920 | -HS- | M] () -- C:\hiberfil.sys [2012.11.22 03:43:34 | 000,512,000 | ---- | M] () -- C:\Users\NBLeipzig2\Documents\sumaop.ps6 [2012.11.22 03:43:26 | 001,627,872 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\pwd-backup.psx [2012.11.22 02:23:39 | 000,001,441 | ---- | M] () -- C:\scu.dat [2012.11.22 00:23:52 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.21 00:28:01 | 000,146,786 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze in der Ernährung.jpg [2012.11.21 00:27:00 | 000,581,035 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\pilze-ernährung1.jpg [2012.11.20 03:33:16 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2012.11.20 03:18:01 | 000,414,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.11.20 01:07:29 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.11.20 01:00:24 | 000,002,041 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2012.11.20 00:50:36 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.11.18 01:26:45 | 000,584,824 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\4449735635_e26c03b4d3_b.jpg [2012.11.18 01:22:03 | 000,145,950 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze zubereiten.jpg [2012.11.17 21:53:38 | 000,011,186 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\im3242354.png [2012.11.17 21:53:38 | 000,002,000 | ---- | M] () -- C:\Users\NBLeipzig2\AppData\Local\recently-used.xbel [2012.11.17 21:27:13 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\sitemap.xml.gz [2012.11.16 00:10:35 | 000,085,052 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze.jpg [2012.11.15 23:58:54 | 000,410,032 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze2.jpg [2012.11.02 03:44:41 | 000,140,923 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\xtc1.jpg [2012.10.31 17:41:53 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\TweetAdder3.lnk [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys [2012.10.30 23:51:07 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr [2012.10.30 23:50:59 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe [1 C:\Users\NBLeipzig2\AppData\Roaming\*.tmp files -> C:\Users\NBLeipzig2\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.24 00:46:00 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\defogger_reenable [2012.11.24 00:45:14 | 000,050,477 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Defogger.exe [2012.11.22 15:51:23 | 000,001,024 | ---- | C] () -- C:\.rnd [2012.11.22 03:43:18 | 001,627,872 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\pwd-backup.psx [2012.11.22 02:19:24 | 000,001,441 | ---- | C] () -- C:\scu.dat [2012.11.22 00:23:52 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.21 00:28:01 | 000,146,786 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze in der Ernährung.jpg [2012.11.21 00:26:59 | 000,581,035 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\pilze-ernährung1.jpg [2012.11.20 01:07:29 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif [2012.11.20 01:07:18 | 000,002,119 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2012.11.20 01:06:40 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.20 01:05:40 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.20 01:00:24 | 000,002,041 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2012.11.19 03:18:26 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.11.18 01:26:43 | 000,584,824 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\4449735635_e26c03b4d3_b.jpg [2012.11.18 01:20:47 | 000,145,950 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze zubereiten.jpg [2012.11.17 21:53:38 | 000,002,000 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\recently-used.xbel [2012.11.17 21:53:37 | 000,011,186 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\im3242354.png [2012.11.17 21:27:13 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\sitemap.xml.gz [2012.11.16 01:05:57 | 000,001,139 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poedit.lnk [2012.11.15 23:58:52 | 000,410,032 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze2.jpg [2012.11.15 23:58:52 | 000,085,052 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze.jpg [2012.11.02 03:44:41 | 000,140,923 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\xtc1.jpg [2012.08.05 16:14:30 | 000,238,316 | ---- | C] () -- C:\Windows\hpoins52.dat [2012.07.29 18:35:11 | 000,000,034 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Roaming\blckdom.res [2012.04.23 23:10:29 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll [2012.04.23 23:10:29 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys [2012.04.17 04:43:10 | 000,007,680 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.03.23 15:02:12 | 000,000,181 | ---- | C] () -- C:\Windows\WININIT.INI [2012.03.23 11:29:28 | 000,007,597 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\Resmon.ResmonCfg [2011.06.23 09:02:44 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2010.02.08 12:45:25 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\WavXMapDrive.bat ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.07.29 18:35:20 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\14001.006 [2010.02.08 12:45:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Broadcom [2012.09.06 23:40:54 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoft [2012.04.12 21:35:46 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.29 19:12:02 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\EurekaLog [2012.11.21 22:23:37 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\FileZilla [2012.03.23 15:04:59 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\klickTel [2012.07.29 18:34:58 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\kock [2012.09.06 23:40:53 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\OpenCandy [2012.03.23 16:06:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\PasswordSafe [2012.04.23 23:12:20 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\PC Suite [2012.04.12 20:24:43 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\QIP [2011.05.11 12:26:45 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\SafeStick [2012.04.23 23:08:33 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Samsung [2012.05.09 13:33:53 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\ScrapeBox Link Checker Free Edition [2010.12.10 20:49:51 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\T-Online [2010.02.08 13:36:04 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\TeamViewer [2012.11.17 03:37:31 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\TweetAdder3 [2010.02.08 12:45:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Wave Systems Corp [2012.08.05 20:27:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\xmldm ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 24.11.2012 00:49:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\NBLeipzig2\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,46 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 67,06% Memory free
6,91 Gb Paging File | 5,55 Gb Available in Paging File | 80,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218,20 Gb Total Space | 164,64 Gb Free Space | 75,46% Space Free | Partition Type: NTFS
Drive D: | 489,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: NB16NGLEI2 | User Name: NBLeipzig2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10FCC9DE-19FB-4DC1-BBB7-4F4FE571A509}" = lport=2869 | protocol=6 | dir=in | app=system |
"{14E48BDC-77D4-4454-873C-146FE30C7B9D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{1B44AD70-CE98-403B-8F38-707CAEF06604}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1FB7D17F-65F3-45A8-9598-EE688F88E6E4}" = rport=137 | protocol=17 | dir=out | app=system |
"{2C9BC5B9-D14E-4FE0-BECB-FEE74E42B57F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{3DCC53A1-FFF8-485A-83C2-A4444BB79CD0}" = lport=445 | protocol=6 | dir=in | app=system |
"{3DE64BC4-941F-41D5-A046-176B986A952C}" = rport=139 | protocol=6 | dir=out | app=system |
"{3F3670F9-F2A0-4FBE-A848-44C1531786F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4D497ACB-8AB1-4AAC-B071-4F09E127AEDF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{570F9667-28DF-4AEC-B0DF-DEC11E96A23C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{64DB6B0D-3DD1-4574-A0CF-093A9758A76F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{719545AA-75DE-4517-8333-AC72F52BD7D1}" = lport=10243 | protocol=6 | dir=in | app=system |
"{7872993B-2713-40EE-8F4A-22C9552BC95B}" = rport=445 | protocol=6 | dir=out | app=system |
"{87949095-9914-4542-867A-AE83AB067715}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8B178DC6-90FC-435D-8351-C0F8C7793D48}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A714DA95-8978-47B2-BAE5-8054C8072755}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AF1CA909-B10D-45B1-8C9F-1AC75C5FCEEB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BA3491A2-80E5-46AC-8FA5-5C2D48C7D915}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C1D64729-80C3-4CFE-9AC3-713483AE9D2C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C67650EA-D89C-4479-B4E9-31069A0379FA}" = lport=139 | protocol=6 | dir=in | app=system |
"{C6CF8E92-6D35-42F6-A5F3-6445F7BD8C19}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C6FEDFD0-2176-452C-B8C1-2E04AD664243}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C7CAE8C0-51F5-4EE0-802B-BF7420AD84A0}" = lport=137 | protocol=17 | dir=in | app=system |
"{D0966346-F469-4621-A554-2C1441DCEE70}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D5F25DFA-C7E2-41A1-B784-37442938CA57}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D97528C2-5426-4B2F-B3BD-A6053C9FFFCE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{DE26578D-9946-4B2B-ABA0-15E709C4BF7F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E0846E71-85E0-4F24-972F-891CA49C9C17}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E87CF183-8006-4F17-82E0-24367C682F8D}" = lport=138 | protocol=17 | dir=in | app=system |
"{EF31F68C-AA31-40B2-88AF-3D935D18FEAA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF3AAAE4-1A48-42DD-A198-09887D5E9633}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F40336AF-F1E4-4FC1-A586-B837ED68FA16}" = rport=138 | protocol=17 | dir=out | app=system |
"{F4D9857F-D21B-44FF-9D56-72F69BDDB7E0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F8B69A1B-E8E0-45A2-96D8-060F809907C6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FA2C8F1D-6A43-4321-B379-BF21DB48338C}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B2A826-93B5-4A53-8C17-F1D46A1A4F23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{02D011E4-D129-40B3-B090-034842A046C8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{08E5C140-AC6F-41EC-9C50-FD19C2D7CEA2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{0C832737-44E4-4350-9C93-07F5FA8D5FCA}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxs08.exe |
"{14C7E6A5-AC0C-457A-BDC4-E823E3B33847}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1A386D90-7F5C-4E38-ABC3-32231D4C6189}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposfx08.exe |
"{1EFE2CE4-D3CF-4EE1-B375-13B14115380E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpzwiz01.exe |
"{1F863032-ED56-43A8-ADB8-B4A8203CAF6F}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{2542B3E6-AEEF-413E-90B3-D70020FBB47B}" = dir=in | app=d:\setup\hpznui01.exe |
"{302646C1-43FB-4E98-8F04-17112C3AF125}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{31C3F79A-D5EA-4FBB-8253-57534EC36197}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{345A41D9-3112-4F16-97C6-28DC5CCA581F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{3526BED8-F6BF-4995-92EB-DB7FC9124EB5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{3C348BD9-C37E-4A01-AEA4-827230F126DD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4534D2BD-58CE-49A3-8895-D28FCD3D8449}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{49EAB568-933D-46FA-BC0C-81DEB7CE2C24}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5415B0D5-B8DD-46A8-B80F-B6B82BE667BD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{577CA849-8EC3-4B69-B128-A58224F2CE20}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{5D3CB888-4895-49E8-85F0-A2E5DBA9DE77}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqfxt08.exe |
"{5E847563-84BA-4CED-BFF0-7B16327D69DA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6268F960-FAE7-4A8C-9C61-9AC34FA67E4F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{665A8423-CCEE-4922-B2A6-71B1615DA823}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A193C85-5147-4FF8-B647-0DA605411BA5}" = protocol=17 | dir=in | app=c:\program files\remote mouse\server\server.exe |
"{73D312F4-479E-4027-B5ED-20E5FD0E9053}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{762121CD-A209-46D4-8552-A086B0F7E321}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{81CE1DBE-6C55-427E-A2F1-1220ABB9B645}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{81DFA2CF-3F7F-4A61-96C7-CC2AC4043C31}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{84ADE377-7385-4BD7-B65A-7D266790406A}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{89EF09CD-6B7B-4A77-AB40-58C4F9F15DF0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{8A312657-A3B7-42A3-8DE9-54CCDAE9AA60}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{8DD79004-7A3F-4751-8B39-B9FBBDC389EB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8F9D1239-31C3-42BC-B5F1-A95EE8D749DA}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{9686A9AC-B83C-4158-9494-E5431AC38899}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9F12D5BC-2394-41C7-864B-632834987664}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{A4298224-C3A8-4C7B-85F4-BE56EA8C2B5C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A71AB1FF-14EF-4AC6-99CD-FA492AFF656C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{A9A50840-33CD-4895-AC2D-AD3691A70790}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B1FDEA83-D304-488B-A5D3-1BE38D86CBDF}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{BA56BE1B-0F79-4A03-A51B-76EA7791C36B}" = protocol=6 | dir=in | app=c:\program files\remote mouse\server\server.exe |
"{BD4E0AEA-FC74-47A6-A908-E78B0A2101CB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{C6230025-E91E-4244-93DE-44A4AF072ECE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{CED834B8-E18D-489E-9C70-FCEA48FCEBA3}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{DE80F8B3-5F33-4E32-8C10-C64989BCFEBB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{E0291266-49FF-46B6-A745-805C319D4497}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxm08.exe |
"{E5752CF5-7179-4A06-B102-FC1A8A4B9159}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{E737B441-789B-41E7-A28D-A25F98D07DA0}" = protocol=6 | dir=out | app=system |
"{F78DB339-50E8-412A-941B-6F6C84D22567}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{F9E4A9EE-6682-4479-9644-A08101A124C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FC211991-69C9-4004-8C75-0A83F4DF38CD}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"TCP Query User{01BFF384-391B-4F5A-A491-4811B17549EC}C:\users\nbleipzig2\appdata\local\temp\seteb78.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\seteb78.tmp |
"TCP Query User{09A77C23-4862-47B4-92FA-0464999EB647}C:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp |
"TCP Query User{0BB98D59-8B74-4EE8-B662-3E7446E5E922}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"TCP Query User{122FE04B-9284-4DA6-B7BE-484C4E3472D9}C:\users\nbleipzig2\appdata\local\temp\set11bb.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\set11bb.tmp |
"TCP Query User{4BC8A140-3A31-41B8-8772-0CF8CB1F3A2B}C:\users\nbleipzig2\appdata\local\temp\setc61d.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setc61d.tmp |
"TCP Query User{736F3C07-5F32-4041-9701-A765EF5870B2}C:\program files\remote mouse\server\server.exe" = protocol=6 | dir=in | app=c:\program files\remote mouse\server\server.exe |
"TCP Query User{8266E0BC-620E-4076-A588-F5601316E4DF}C:\program files\qip 2012\qip.exe" = protocol=6 | dir=in | app=c:\program files\qip 2012\qip.exe |
"TCP Query User{D8E44668-A45E-465A-AFC8-12AA57180806}C:\users\nbleipzig2\appdata\local\temp\setb54b.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb54b.tmp |
"UDP Query User{181F45B0-7A95-40E4-A8C6-2173457D2F95}C:\users\nbleipzig2\appdata\local\temp\setc61d.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setc61d.tmp |
"UDP Query User{2416EBA1-1FEF-48B5-99AA-0840DBF7FDCA}C:\program files\remote mouse\server\server.exe" = protocol=17 | dir=in | app=c:\program files\remote mouse\server\server.exe |
"UDP Query User{614B9EE3-4322-4261-BA83-5201E5709BF3}C:\program files\qip 2012\qip.exe" = protocol=17 | dir=in | app=c:\program files\qip 2012\qip.exe |
"UDP Query User{ABCE0243-60B0-4FCE-B0F3-A4E8D1146538}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"UDP Query User{AD08D7D5-3779-4A00-9B5B-C71645A6CB06}C:\users\nbleipzig2\appdata\local\temp\set11bb.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\set11bb.tmp |
"UDP Query User{EA85DB8D-2AF7-4D3C-8AFB-115DBEFBC2FC}C:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp |
"UDP Query User{F0E335B2-01BE-498C-B8FE-F447ABDE9A59}C:\users\nbleipzig2\appdata\local\temp\seteb78.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\seteb78.tmp |
"UDP Query User{FFB7BE11-DAF8-49C9-9800-B3A400B1842D}C:\users\nbleipzig2\appdata\local\temp\setb54b.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb54b.tmp |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{10668AA3-490D-46C1-B606-A621451998EF}" = Password Safe and Repository 6
"{11DB380B-48CF-46EA-8B03-51874E2733C9}" = Dell Control Point
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{1DDDFDF2-4A92-4E77-959F-59D196B99C0C}" = C410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2220CF3A-EBD6-4070-94D0-0C7337B537A7}" = All Day Battery Life Configuration
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2E92BEE2-9D81-426D-9B6C-B96B6673C51F}" = Tweet Adder 3
"{2E98C5B7-D64C-4D7E-BFC3-A7D078569F28}" = Broadcom NetXtreme-I Netlink Driver and Management Installer
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{3237887D-8AC4-4C27-BDF4-57D7CB0351D6}" = SO32MMWrapper
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{59333B51-EA3C-4D7B-9AFE-96AD51B3C266}" = AuthenTec Fingerprint Software
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1" = Poedit
"{71084075-ABA7-48BC-9733-F56A9ABD184D}" = DCP32MMWrapper
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79B520D5-CE72-4661-A054-804BC3412516}" = Wave Infrastructure Installer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001C-0407-0000-0000000FF1CE}" = Microsoft Office Access Runtime (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_SMALLBUSINESSR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9143F2FA-BF20-4311-8618-4CCF51B1B80C}" = Dell ControlPoint System Manager
"{9294F169-72EE-4D74-AE92-CA25F64B4FF8}" = Fax
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A093D83F-429A-4AB2-A0CD-1F7E9C7B764A}" = Trusted Drive Manager
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B1FD6060-8DF9-4C67-AF5E-7D25A54D1854}" = Mindjet MindManager 2012
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1164ED0-EF08-4B0B-8084-3BDAEAAEFD8D}" = HP Photosmart Prem C410 All-In-One Driver Software 14.0 Rel. 7
"{C3FA63E2-AFD3-41FD-B48F-1D942CC71943}" = UPEK TouchChip Fingerprint Reader
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E63A7E64-AD93-47E7-AC5C-BA042AA740CA}" = Dell ControlPoint Connection Manager
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F217D8AF-965B-4D3E-8F14-AC47B9CA535B}" = PS_AIO_07_C410_SW_Min
"{F34EE6D2-9356-4294-B3B3-AE04428C8C43}_is1" = Remote Mouse version 1.50
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"3GP Media Player_is1" = 3GP Media Player 1.0.1
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"9D57DE505B6D8C710EF3B74BE638DBB936EED8A3" = Windows-Treiberpaket - Dell Inc. PBADRV System (01/07/2008 1.0.1.5)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"D3F88C3864C8C031A7C5D5E63A76571EC1B047DF" = Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (05/13/2009 8.4.2.0)
"Dell Wireless WLAN Card Utility" = Dell Wireless WLAN Card Utility
"FileZilla Client" = FileZilla Client 3.6.0
"Free YouTube Download_is1" = Free YouTube Download version 3.1.23.403
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.30.903
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"HPOCR" = OCR Software by I.R.I.S. 14.0
"IBM Personal Communications De-install Key" = IBM Personal Communications
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PDF-XChange 3_is1" = PDF-XChange 3
"Shop for HP Supplies" = Shop for HP Supplies
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"TVWiz" = Intel(R) TV Wizard
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
"WordFlood 1.2" = WordFlood 1.2 (remove only)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2012" = QIP 2012 4.0.7221
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 05.10.2012 21:17:46 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22866658
Error - 06.10.2012 12:45:45 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
to TPM
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1108
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1108
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2153
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2153
Error - 08.10.2012 22:29:33 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
to TPM
Error - 10.10.2012 11:21:16 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
to TPM
[ OSession Events ]
Error - 22.08.2012 18:49:18 | Computer Name = NB16NGLei2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 07.07.2012 13:20:40 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 08.07.2012 15:03:22 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 08.07.2012 17:44:03 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 09.07.2012 07:47:51 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 10.07.2012 14:56:01 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 10.07.2012 21:37:39 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 11.07.2012 16:55:12 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 13.07.2012 11:05:16 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 15.07.2012 13:08:52 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
Error - 17.07.2012 07:23:19 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%0
< End of report >
Wäre über Hilfe sehr dankbar. |
| Themen zu GVU Trojaner und FTP Stealer |
| 32 bit, antivir, antivirus, autorun, bho, bingbar, bonjour, converter, device driver, error, firefox, flash player, format, ftp, genesis, install.exe, logfile, microsoft office 2003, mozilla, mp3, office 2007, plug-in, registry, rundll, safer networking, schadcode, security, senden, server, software, svchost.exe, trojaner, windows, wlan |
Baum-Darstellung