Torpig Befall im netzwerk

politiker · 16.07.2014, 14:04

Hallo Leute,

erstmal ein herzliches Hallo an euch und danke im Voraus für eure rießen Hilfsbereitschaft!

Nun zu meinem problem, wo ich dringend Ratschlag benötige:

Die User können keine Mails mehr versenden, weil unser Absender / IP Adresse auf der CBL gelistet ist. Diese gibt uns bereits die Information dass es sich wohl um eine Torpig Infektion handelt. Dass heisst einer der Clients oder auch ein Server enthält diese Schadsoftware. Allerdings habe ich nun jeden Client und jeden Server mit insgesamt 3 Tools und dem bereits vorhanden AV geprüft. Es kann keine Infektion gefunden werden. Auch das Firewall Logging habe ich aktiviert kann aber keine Ziel IP Adresse herausfinden welche mir verdächtig vorkommen würde ( also eine IP die besonders oft von einem client aufgerufen wird).

Was wäre der nächste logische Schritt? Wäre euch sehr dankbar dafür!

Danke!

schrauber · 16.07.2014, 17:02

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

politiker · 17.07.2014, 13:12

Danke für die Antwort. Ich werde das wohl zunächst stichprobenartig machen bevor ich alle Server und alle Clients auswerte und hier dann alle Logfiles poste

Hab ich mal auf dem Terminalserver durchgeführt, den habe ich im Verdacht;

FRST Logfile:

Code:

ATTFilter

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\RAWS\bedbg.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareService.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
(BMD Systemhaus GmbH) D:\BMDSoftware\BMDNTCSSOAPService.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\RAWS\beremote.exe
(Microsoft Corporation) C:\Windows\System32\logon.scr
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(pcvisit Software ag) C:\ProgramData\pcvisit Software AG\caloa\Common\caloa_app\release\12.0.36.1315\caloa_app.exe
(pcvisit Software ag) C:\ProgramData\pcvisit Software AG\caloa\Common\caloa_app\release\12.0.36.1315\caloa_app.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\RAWS\vxmon.exe
(42 Software) \\FLDBSRV01\Prog\42Software\ERP\start42.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(42 Software) \\FLDBSRV01\Prog\42Software\ERP\start42.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareTray.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(42 Software) \\FLDBSRV01\Prog\42Software\ERP\start42.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\VMwareUser.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(42 Software) \\FLDBSRV01\Prog\42Software\ERP\start42.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [VMware Tools] => C:\Program Files\VMware\VMware Tools\VMwareTray.exe [416304 2009-04-30] (VMware, Inc.)
HKLM\...\Run: [VMware User Process] => C:\Program Files\VMware\VMware Tools\VMwareUser.exe [764464 2009-04-30] (VMware, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [133456 2012-11-01] (Trend Micro Inc.)
HKLM\...\Run: [BMDNetClient_FLTSSRV01] => C:\ProgramData\BMDNTCS\BMDNTCSClients\FLTSSRV01\BMDNetClient.exe [52392632 2014-01-16] (BMD Systemhaus GmbH)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
HKLM\...\Policies\Explorer: [NoNTSecurity] 1
HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1
HKU\.DEFAULT\...\Run: [VxBeMon] => C:\Program Files\Symantec\Backup Exec\RAWS\vxmon.exe [1170760 2010-06-29] (Symantec Corporation)
HKU\S-1-5-21-4234359448-3307843908-1490782795-1214\...\Winlogon: [Shell] explorer.exe,C:\Users\nisc\AppData\Roaming\skype.dat <==== ATTENTION 
HKU\S-1-5-21-4234359448-3307843908-1490782795-1224\...\Run: [syshost32] => C:\Users\juro\AppData\Local\{9FCA39A7-DC94-25AB-61A6-94983FF6CEBE}\syshost.exe
HKU\S-1-5-21-4234359448-3307843908-1490782795-1230\...\Run: [VxBeMon] => C:\Program Files\Symantec\Backup Exec\RAWS\vxmon.exe [1170760 2010-06-29] (Symantec Corporation)
HKU\S-1-5-21-4234359448-3307843908-1490782795-1230\...\Run: [Ikgiizw] => C:\Users\cabr\AppData\Roaming\Qiill\byahi.exe
HKU\S-1-5-21-4234359448-3307843908-1490782795-1230\...\Run: [syshost32] => C:\Users\cabr\AppData\Local\{CB1B0178-5967-10A0-6BFE-370C499CA42F}\syshost.exe
AppInit_DLLs: C:\PROGRA~2\PCVISI~1\caloa\Common\CALOA_~1\release\12036~1.131\remoteProcStart_x86.dll => C:\ProgramData\pcvisit Software AG\caloa\Common\caloa_app\release\12.0.36.1315\remoteProcStart_x86.dll [254392 2014-06-03] (pcvisit software ag)
Lsa: [Notification Packages] scecli RASSFM
Startup: C:\Users\mari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netuse_dopl.bat ()
Startup: C:\Users\nadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIMphony.lnk
ShortcutTarget: PIMphony.lnk -> C:\Program Files\Alcatel_PIMphony\aocphone.exe (No File)
Startup: C:\Users\nisc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\nadmin\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.unternehmen.at
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.unternehmen.at
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.at
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://companyweb
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1242\6.6.1089\TmIEPlg.dll (Trend Micro Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
DPF: {00134F72-5284-44F7-95A8-52A619F70751} https://fldc01:4343/officescan/console/ClientInstall/WinNTChk.cab
DPF: {00134F72-5284-44F7-95A8-52A619F70752} https://fldc01.unternehmen.local:4343/officescan/console/ClientInstall/WinNTChk.cab?ver=17,0,0,2365
DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} https://fldc01:4343/officescan/console/ClientInstall/setup.cab
DPF: {9BBB3919-F518-4D06-8209-299FC243FC44} https://fldc01.unternehmen.local:4343/SMB/console/html/root/AtxEnc.cab?ver=17,0,0,2365
DPF: {9DCD8EB7-E925-45C9-9321-8CA843FBEDCC} https://fldc01.unternehmen.local:4343/SMB/console/html/root/AtxConsole.cab?ver=17,0,0,2365
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1242\6.6.1089\TmIEPlg.dll (Trend Micro Inc.)
Winsock: Catalog9 19 C:\Program Files\VMware\VMware Tools\VSock SDK\bin\win32\vsocklib.dll [413696] (VMware, Inc.)
Winsock: Catalog9 20 C:\Program Files\VMware\VMware Tools\VSock SDK\bin\win32\vsocklib.dll [413696] (VMware, Inc.)
Tcpip\..\Interfaces\{A94922FC-B761-4E66-87F5-F437CC830ED5}: [NameServer]192.168.200.210

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.5.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-05-04]
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-07-15]

========================== Services (Whitelisted) =================

R2 BackupExecAgentAccelerator; C:\Program Files\Symantec\Backup Exec\RAWS\beremote.exe [1248888 2010-12-08] (Symantec Corporation)
R2 bedbg; C:\Program Files\Symantec\Backup Exec\RAWS\bedbg.exe [223048 2010-06-29] (Symantec Corporation)
R2 BMDNTCSSOAPSvc; D:\BMDSoftware\BMDNTCSSOAPService.EXE [286852792 2014-01-16] (BMD Systemhaus GmbH)
S2 BMDNtcsSvc; D:\BMDSoftware\BMDNtcsSvc.exe [75418296 2013-12-15] (BMD Systemhaus GmbH)
R2 Caloa Agent Service 1.2; C:\Users\gera\AppData\Local\pcvisit Software AG\caloa\Common\caloa_app\release\12.0.36.1315\caloa_app.exe [11856864 2014-06-03] (pcvisit Software ag)
S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [22016 2008-01-19] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [8704 2008-01-19] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [3201024 2008-07-29] (Microsoft Corporation)
S3 PDVFSService; C:\Program Files\Symantec\Backup Exec\RAWS\PDVFSService.exe [187176 2010-12-17] ()
S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [78336 2009-04-11] (Microsoft Corporation)
S3 sacsvr; C:\Windows\system32\sacsvr.dll [13312 2008-01-19] (Microsoft Corporation)
S3 TmListen; C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe [693776 2012-11-09] (Trend Micro Inc.)
R2 VMTools; C:\Program Files\VMware\VMware Tools\VMwareService.exe [551472 2009-04-30] (VMware, Inc.)
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=qb -dt=60000 [X]
S2 mfevtp; "C:\Windows\system32\mfevtps.exe" [X]

==================== Drivers (Whitelisted) ====================

S4 ioatdma; C:\Windows\system32\drivers\qd26032.sys [31232 2008-01-19] (Intel Corporation)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [126976 2008-01-19] (Microsoft Corporation)
R1 nm3; C:\Windows\System32\DRIVERS\nm3.sys [39736 2010-06-09] (Microsoft Corporation)
R1 PDVFSDriver; C:\Windows\System32\drivers\pdfsd.sys [57392 2010-11-01] (Symantec Corporation)
S4 s3cap; C:\Windows\system32\drivers\s3cap.sys [15816 2008-01-19] (Microsoft Corporation)
S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [88632 2008-01-19] (Microsoft Corporation)
R0 storflt; C:\Windows\System32\drivers\storflt.sys [42440 2008-01-19] (Microsoft Corporation)
R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [95224 2012-09-24] (Trend Micro Inc.)
R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [257952 2012-09-24] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [76648 2012-09-24] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92112 2010-12-06] (Trend Micro Inc.)
R3 VirtFile; C:\Windows\System32\DRIVERS\VirtFile.sys [124536 2011-08-24] (Symantec Corporation)
R3 vmx_svga; C:\Windows\System32\DRIVERS\vmx_svga.sys [63920 2009-04-30] (VMware, Inc.)
S4 BTHMODEM; \SystemRoot\system32\drivers\bthmodem.sys [X]
R0 mfehidk; system32\drivers\mfehidk.sys [X]
S0 mferkdet; system32\drivers\mferkdet.sys [X]
S4 PDVFSNP; No ImagePath
U3 tmpfw; 
U3 tpautoconnsvc; 
S4 USBSTOR; \SystemRoot\system32\drivers\usbstor.sys [X]

==================== NetSvcs (Whitelisted) ===================

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)

==================== One Month Created Files and Folders ========

2014-07-17 13:53 - 2014-07-17 13:55 - 00016219 _____ () C:\Users\nadmin\Desktop\FRST.txt
2014-07-17 13:53 - 2014-07-17 13:54 - 00000000 ____D () C:\FRST
2014-07-17 13:53 - 2014-07-17 13:53 - 01077248 _____ (Farbar) C:\Users\nadmin\Desktop\FRST.exe
2014-07-17 13:51 - 2014-07-17 12:21 - 02086912 _____ (Farbar) C:\Users\nadmin\Desktop\FRST64.exe
2014-07-17 13:35 - 2014-07-17 13:40 - 00000000 ____D () C:\Users\makl\protokoll
2014-07-17 13:25 - 2014-07-17 13:25 - 89422108 _____ () C:\Users\cabr\Downloads\Bilder_Display_klein.zip.huehjg0 (1).partial
2014-07-17 11:50 - 2014-07-17 13:55 - 00000000 ____D () C:\Users\nadmin\AppData\Local\Temp\23
2014-07-17 08:42 - 2014-07-17 13:45 - 00000000 ____D () C:\Users\sazo\AppData\Local\Temp\22
2014-07-17 08:00 - 2014-07-17 13:52 - 00000000 ____D () C:\Users\makl\AppData\Local\Temp\21
2014-07-17 07:50 - 2014-07-17 13:54 - 00000000 ____D () C:\Users\cabr\AppData\Local\Temp\20
2014-07-17 07:50 - 2014-07-17 13:41 - 00000000 ____D () C:\Users\albu\AppData\Local\Temp\15
2014-07-17 07:49 - 2014-07-17 13:55 - 00000000 ____D () C:\Users\past\AppData\Local\Temp\14
2014-07-17 07:46 - 2014-07-17 13:55 - 00000000 ____D () C:\Users\gera\AppData\Local\Temp\11
2014-07-17 07:44 - 2014-07-17 13:51 - 00000000 ____D () C:\Users\juro\AppData\Local\Temp\8
2014-07-17 07:20 - 2014-07-17 13:36 - 00000000 ____D () C:\Users\geraf\AppData\Local\Temp\5
2014-07-17 07:16 - 2014-07-17 07:16 - 00000792 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 17.csv
2014-07-16 17:50 - 2014-07-17 13:54 - 00000000 ____D () C:\Users\nisc\AppData\Local\Temp\2
2014-07-16 15:15 - 2014-07-16 15:15 - 00167344 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.9dbc.deleteme
2014-07-16 14:58 - 2014-07-16 15:00 - 10965352 _____ (McAfee Inc) C:\Users\nadmin\Downloads\stinger32.exe
2014-07-16 14:57 - 2014-07-16 16:22 - 00000000 ____D () C:\Program Files\stinger
2014-07-16 14:55 - 2014-07-16 16:22 - 00000000 ____D () C:\Users\nadmin\Desktop\stinger32-989
2014-07-16 14:14 - 2014-07-16 14:16 - 00074777 _____ () C:\Users\juro\Desktop\DB Berechnung - Sonja.xlsx
2014-07-16 13:50 - 2014-07-15 15:49 - 00066498 _____ () C:\Users\juro\Desktop\DB Berechnung - Kopie.xlsx
2014-07-16 13:48 - 2014-07-16 13:48 - 00000000 ____D () C:\Users\nadmin\Desktop\virscan
2014-07-16 10:16 - 2014-07-16 10:16 - 00000000 ____D () C:\Users\makl\Documents\Ekaflor
2014-07-16 09:46 - 2014-07-16 09:55 - 00199078 _____ () C:\Users\makl\Documents\renner produkten.xlsx
2014-07-16 07:17 - 2014-07-16 07:17 - 00000968 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 16.csv
2014-07-15 16:43 - 2014-07-15 17:16 - 00000000 ____D () C:\Users\makl\Documents\Kalkulation
2014-07-15 10:19 - 2014-07-15 10:20 - 00004044 _____ () C:\Users\nadmin\AppData\Local\Temp\NMBUILD.log
2014-07-15 10:19 - 2014-07-15 10:19 - 00000000 ____D () C:\Users\nadmin\Documents\Network Monitor 3
2014-07-15 10:18 - 2014-07-15 10:18 - 00000936 _____ () C:\Users\nadmin\Desktop\Microsoft Network Monitor 3.4.lnk
2014-07-15 10:18 - 2014-07-15 10:18 - 00000000 ____D () C:\Users\nadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Network Monitor 3.4
2014-07-15 10:18 - 2014-07-15 10:18 - 00000000 ____D () C:\Program Files\Microsoft Network Monitor 3
2014-07-15 09:50 - 2014-07-15 10:14 - 00031926 _____ () C:\Users\kake\5.mbs.txt
2014-07-15 09:33 - 2014-07-15 09:33 - 00000000 ____D () C:\ProgramData\Norton
2014-07-15 08:32 - 2014-07-15 17:13 - 00000000 ____D () C:\Users\makl\Documents\Produktinformation
2014-07-15 07:17 - 2014-07-15 07:17 - 00000924 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 15.csv
2014-07-14 13:14 - 2014-07-14 13:14 - 00010236 _____ () C:\Users\past\Desktop\GV LS.xlsx
2014-07-14 11:29 - 2014-07-14 11:18 - 00000683 ___SH () C:\ProgramData\27b0faed-9adf-479f-ba91-ab041ae85ce6
2014-07-14 11:18 - 2014-07-14 11:18 - 00000000 ____D () C:\ProgramData\f205ef16-6955-4b12-b7f4-e0e38b064f6e
2014-07-14 10:38 - 2014-07-14 10:38 - 00000000 ____D () C:\Users\past\Desktop\Angebote
2014-07-11 09:42 - 2014-07-11 09:42 - 00000000 ____D () C:\Users\makl\Documents\Marketing
2014-07-11 07:16 - 2014-07-11 07:16 - 00000748 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 11.csv
2014-07-10 14:48 - 2014-07-11 13:17 - 00015232 _____ () C:\Users\nisc\Desktop\Aufstellung Komponente für 2015.xlsx
2014-07-10 09:55 - 2014-07-17 13:38 - 00021834 _____ () C:\Users\juro\Desktop\Liste der Lieferantenzahlungsziele.xlsx
2014-07-10 07:16 - 2014-07-10 07:16 - 00000792 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 10.csv
2014-07-09 16:37 - 2014-07-09 16:37 - 00022016 ____N () C:\Users\past\Documents\Kopie von 10 wichtigsten Kunden Strobel Herbst 04.xls
2014-07-09 07:46 - 2014-07-09 13:30 - 00048199 ____N () C:\Users\juro\9.mbs.txt
2014-07-08 09:49 - 2014-07-08 11:18 - 00024087 ____N () C:\Users\kake\8.mbs.txt
2014-07-08 09:13 - 2014-07-16 13:35 - 00000000 ____D () C:\Users\cabr\Desktop\Bilder_Display_klein
2014-07-07 16:20 - 2014-07-14 13:17 - 00000000 ____D () C:\Users\makl\Documents\AD
2014-07-07 14:51 - 2014-07-17 13:25 - 89422108 _____ () C:\Users\cabr\Downloads\Bilder_Display_klein.zip.huehjg0.partial
2014-07-03 16:38 - 2014-07-03 16:38 - 00000000 ____H () C:\Users\makl\Documents\Default.rdp
2014-07-03 14:10 - 2014-07-03 15:28 - 42614500 ____N () C:\Users\cabr\Downloads\wetransfer-352d45.zip
2014-07-03 13:10 - 2014-07-03 13:10 - 00000000 ____D () C:\Users\makl\AppData\Roaming\TeamViewer
2014-07-03 13:09 - 2014-07-03 13:10 - 03896872 ____N (TeamViewer) C:\Users\makl\Desktop\emaxit_team_de.exe
2014-07-03 11:10 - 2014-07-14 17:28 - 00000000 ____D () C:\Users\makl\Documents\KAM
2014-07-03 09:35 - 2014-07-03 09:37 - 00000000 ____D () C:\Users\makl\Documents\Terrasan
2014-07-03 08:53 - 2013-05-07 15:46 - 00018944 ____N () C:\Users\cabr\Desktop\Vorlage km Abrechnung (2).xls
2014-07-03 08:53 - 2011-04-19 07:34 - 00051695 ____N () C:\Users\cabr\Desktop\Zeiterfassung Vorlage für Georg und Günter.xlsx
2014-07-03 08:52 - 2013-03-05 09:07 - 00044509 ____N () C:\Users\cabr\Desktop\Kalender2013-2014 30 Std..xlsx
2014-07-03 08:52 - 2013-03-04 17:55 - 00044377 ____N () C:\Users\cabr\Desktop\Kalender2013-2014 25. Std..xlsx
2014-07-03 08:52 - 2013-03-04 17:41 - 00044479 ____N () C:\Users\cabr\Desktop\Kalender2013-2014 16 Std..xlsx
2014-07-03 08:52 - 2013-03-04 17:22 - 00044898 ____N () C:\Users\cabr\Desktop\Kalender2013-2014.xlsx
2014-07-01 08:21 - 2014-07-07 10:22 - 00000000 ____D () C:\Users\makl\Documents\42 ERP
2014-06-30 17:02 - 2014-07-14 16:03 - 00000000 ____D () C:\Users\makl\Documents\unternehmen
2014-06-30 16:25 - 2014-07-01 11:03 - 00009927 ____N () C:\Users\nisc\Desktop\Preissteigerungen 2015.xlsx
2014-06-30 15:40 - 2014-06-30 16:04 - 157376942 ____N () C:\Users\albu\Downloads\wetransfer-02bf47.zip.tzsli7s.partial
2014-06-30 14:58 - 2014-06-30 14:58 - 00048640 ____N () C:\Users\makl\Documents\unternehmen gelöschte Basis.xls
2014-06-30 08:51 - 2014-06-30 08:51 - 00000000 ____D () C:\Users\makl\Documents\3P
2014-06-30 08:50 - 2014-06-30 08:50 - 00000000 ____D () C:\Users\makl\Documents\Eurotops
2014-06-30 08:49 - 2014-06-30 08:49 - 00000000 ____D () C:\Users\makl\Documents\Norax
2014-06-30 08:24 - 2014-07-01 17:05 - 00000000 ____D () C:\Users\makl\Documents\Terracotta
2014-06-30 07:59 - 2014-07-10 11:36 - 00035712 _____ () C:\Users\juro\0.mbs.txt
2014-06-27 11:49 - 2014-06-27 11:49 - 00048128 ____N () C:\Users\past\Documents\Kopie von Kopie von Vorlage Modul.xls
2014-06-26 13:47 - 2014-06-26 13:47 - 00022076 ____N () C:\Users\sokl\Desktop\Transportkosten Mustertabelle.xlsx
2014-06-26 09:30 - 2014-06-26 09:30 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-26 09:17 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-26 09:17 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-26 09:17 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-26 09:17 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-26 09:17 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-26 09:17 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-26 09:17 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-26 09:17 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-26 09:17 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-26 09:17 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-26 09:17 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-26 09:17 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-26 09:17 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-26 09:17 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-26 09:17 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-26 09:17 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-26 09:08 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-26 09:07 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-26 09:07 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-26 09:07 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-26 09:07 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-25 16:48 - 2014-06-25 16:48 - 00048640 _____ () C:\Users\past\Desktop\Pflanzenschutzmodul.xls
2014-06-25 16:00 - 2014-06-25 16:00 - 00081912 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_92981844375155_sign.zip
2014-06-25 15:50 - 2014-06-25 15:50 - 00081912 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_15952554118872_sign.zip
2014-06-25 13:51 - 2014-06-25 16:20 - 00001206 ____H () C:\Users\elwi\AppData\Roaming\cn38-wdjwjju37.html
2014-06-25 11:25 - 2014-07-14 15:22 - 00000000 ____D () C:\Users\past\Desktop\Bauhaus
2014-06-25 09:57 - 2014-06-25 16:00 - 00004280 ____H () C:\Users\elwi\AppData\Roaming\shvfuwefbskj.html
2014-06-25 08:17 - 2014-07-15 08:12 - 00019778 _____ () C:\Users\juro\5.mbs.txt
2014-06-24 13:45 - 2014-06-24 13:45 - 00087915 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_54323285928184_sign.zip
2014-06-24 11:08 - 2014-07-17 11:11 - 00000000 ____D () C:\Users\sokl\Desktop\Sabine
2014-06-24 10:52 - 2014-07-14 15:09 - 00072256 _____ () C:\Users\juro\4.mbs.txt
2014-06-24 09:36 - 2014-06-24 09:36 - 00103560 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_32976822643353_sign.zip
2014-06-24 09:10 - 2014-06-24 13:45 - 00004307 ____H () C:\Users\elwi\AppData\Roaming\djkhyfhknjskg92.html
2014-06-23 11:59 - 2014-06-23 12:00 - 00001630 ____N () C:\Users\sokl\Desktop\Kontierung 2014.lnk
2014-06-23 10:15 - 2014-06-23 10:23 - 00011923 ____N () C:\Users\sazo\3.mbs.txt
2014-06-23 07:48 - 2014-06-20 13:14 - 00012844 ____R () C:\Users\juro\Downloads\Wochenbericht 2014- KW 25xlsx
2014-06-20 11:23 - 2014-06-20 11:25 - 00000000 ____D () C:\Users\makl\Documents\Information
2014-06-20 10:41 - 2014-06-20 10:41 - 00000000 ____D () C:\Users\makl\Documents\Presse_öffentlichkeitsarbeit2014
2014-06-20 10:39 - 2014-06-20 10:40 - 00000000 ____D () C:\Users\makl\Documents\Tagung
2014-06-18 14:34 - 2014-07-14 13:17 - 00000000 ____D () C:\Users\makl\Documents\Bauhaus
2014-06-18 13:42 - 2014-06-18 13:42 - 00000000 ____D () C:\Users\makl\AppData\Roaming\Macromedia
2014-06-18 13:35 - 2014-06-18 13:36 - 00001616 ____N () C:\Users\elwi\Desktop\Aktuell.lnk
2014-06-18 13:34 - 2014-06-18 13:34 - 00001308 ____N () C:\Users\elwi\Desktop\FAQ.lnk
2014-06-18 10:36 - 2014-07-08 08:45 - 00035922 ____N () C:\Users\juro\8.mbs.txt
2014-06-18 08:14 - 2014-06-18 16:20 - 00007455 ____H () C:\Users\elwi\AppData\Roaming\29-46-32599.html
2014-06-17 16:09 - 2014-06-17 16:16 - 00001070 ____H () C:\Users\elwi\AppData\Roaming\892347H-02093745L.html
2014-06-17 15:44 - 2014-06-17 15:44 - 00000000 ____D () C:\Users\makl\AppData\Roaming\Adobe
2014-06-17 15:44 - 2014-06-17 15:44 - 00000000 ____D () C:\Users\makl\AppData\Local\Temp\Adobe
2014-06-17 11:06 - 2014-06-17 11:06 - 00008009 ____N () C:\Users\kake\7.mbs.txt
2014-06-17 10:38 - 2014-06-17 09:31 - 00001323 ____N () C:\Users\kake\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 10:31 - 2014-07-17 13:32 - 00023943 _____ () C:\Users\juro\7.mbs.txt
2014-06-17 10:06 - 2014-06-17 09:31 - 00001323 ____N () C:\Users\juro\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 09:31 - 2014-06-17 09:31 - 00001323 _____ () C:\Users\nadmin\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 09:08 - 2014-06-17 09:08 - 00001355 ____N () C:\Users\Public\Desktop\ELBA5 - Toplom NEU.lnk
2014-06-17 08:31 - 2014-06-17 13:01 - 00000898 ____H () C:\Users\elwi\AppData\Roaming\44AT53-334W35283.html

==================== One Month Modified Files and Folders =======

2014-07-17 13:55 - 2014-07-17 13:53 - 00016219 _____ () C:\Users\nadmin\Desktop\FRST.txt
2014-07-17 13:55 - 2014-07-17 11:50 - 00000000 ____D () C:\Users\nadmin\AppData\Local\Temp\23
2014-07-17 13:55 - 2014-07-17 07:49 - 00000000 ____D () C:\Users\past\AppData\Local\Temp\14
2014-07-17 13:55 - 2014-07-17 07:46 - 00000000 ____D () C:\Users\gera\AppData\Local\Temp\11
2014-07-17 13:55 - 2013-08-19 08:25 - 00000000 ____D () C:\Users\gera\Desktop\Archivierte Mail Gerlinde Rank
2014-07-17 13:54 - 2014-07-17 13:53 - 00000000 ____D () C:\FRST
2014-07-17 13:54 - 2014-07-17 07:50 - 00000000 ____D () C:\Users\cabr\AppData\Local\Temp\20
2014-07-17 13:54 - 2014-07-16 17:50 - 00000000 ____D () C:\Users\nisc\AppData\Local\Temp\2
2014-07-17 13:53 - 2014-07-17 13:53 - 01077248 _____ (Farbar) C:\Users\nadmin\Desktop\FRST.exe
2014-07-17 13:53 - 2012-04-07 16:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-17 13:52 - 2014-07-17 08:00 - 00000000 ____D () C:\Users\makl\AppData\Local\Temp\21
2014-07-17 13:51 - 2014-07-17 07:44 - 00000000 ____D () C:\Users\juro\AppData\Local\Temp\8
2014-07-17 13:47 - 2014-03-18 16:43 - 00000000 ____D () C:\Users\juro\Documents\Archiv
2014-07-17 13:46 - 2010-05-04 09:44 - 00000128 _____ () C:\Windows\system32\config\netlogon.ftl
2014-07-17 13:45 - 2014-07-17 08:42 - 00000000 ____D () C:\Users\sazo\AppData\Local\Temp\22
2014-07-17 13:41 - 2014-07-17 07:50 - 00000000 ____D () C:\Users\albu\AppData\Local\Temp\15
2014-07-17 13:40 - 2014-07-17 13:35 - 00000000 ____D () C:\Users\makl\protokoll
2014-07-17 13:40 - 2012-04-02 09:47 - 00000000 ____D () C:\Users\gera\Documents\42 ERP
2014-07-17 13:38 - 2014-07-10 09:55 - 00021834 _____ () C:\Users\juro\Desktop\Liste der Lieferantenzahlungsziele.xlsx
2014-07-17 13:36 - 2014-07-17 07:20 - 00000000 ____D () C:\Users\geraf\AppData\Local\Temp\5
2014-07-17 13:35 - 2014-06-13 09:14 - 00000000 ____D () C:\Users\makl
2014-07-17 13:32 - 2014-06-17 10:31 - 00023943 _____ () C:\Users\juro\7.mbs.txt
2014-07-17 13:25 - 2014-07-17 13:25 - 89422108 _____ () C:\Users\cabr\Downloads\Bilder_Display_klein.zip.huehjg0 (1).partial
2014-07-17 13:25 - 2014-07-07 14:51 - 89422108 _____ () C:\Users\cabr\Downloads\Bilder_Display_klein.zip.huehjg0.partial
2014-07-17 13:16 - 2012-10-30 15:56 - 00000000 ____D () C:\Users\past\Documents\42 ERP
2014-07-17 13:06 - 2008-01-19 13:35 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-17 13:06 - 2008-01-19 13:35 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-17 13:00 - 2012-03-31 11:41 - 00000160 ___SH () C:\Users\sokl\ntuser.ini
2014-07-17 12:51 - 2012-03-31 11:47 - 00000000 ____D () C:\Users\sokl\Documents\42 ERP
2014-07-17 12:21 - 2014-07-17 13:51 - 02086912 _____ (Farbar) C:\Users\nadmin\Desktop\FRST64.exe
2014-07-17 12:00 - 2012-04-25 15:37 - 00000480 _____ () C:\Windows\Tasks\ShadowCopyVolume{1e6cd5ed-574f-11df-be42-806e6f6e6963}.job
2014-07-17 11:52 - 2010-05-04 09:46 - 00000000 ____D () C:\Users\nadmin
2014-07-17 11:50 - 2009-04-11 14:28 - 02076220 _____ () C:\Windows\WindowsUpdate.log
2014-07-17 11:11 - 2014-06-24 11:08 - 00000000 ____D () C:\Users\sokl\Desktop\Sabine
2014-07-17 10:17 - 2012-03-30 10:52 - 00002633 _____ () C:\Users\gera\Desktop\Microsoft Office Excel 2007.lnk
2014-07-17 08:42 - 2010-05-04 14:48 - 00000000 ____D () C:\Users\sazo
2014-07-17 07:50 - 2013-05-07 13:45 - 00000000 ____D () C:\Users\cabr
2014-07-17 07:50 - 2010-05-04 14:30 - 00000000 ____D () C:\Users\albu
2014-07-17 07:16 - 2014-07-17 07:16 - 00000792 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 17.csv
2014-07-16 20:14 - 2010-05-04 14:30 - 00000160 ___SH () C:\Users\albu\ntuser.ini
2014-07-16 17:56 - 2010-05-04 14:48 - 00000160 ___SH () C:\Users\sazo\ntuser.ini
2014-07-16 17:51 - 2014-01-10 10:29 - 00000000 ____D () C:\Users\nisc\AppData\Roaming\Dropbox
2014-07-16 16:57 - 2013-06-19 08:35 - 00000250 ___SH () C:\Users\juro\ntuser.ini
2014-07-16 16:49 - 2010-05-04 14:45 - 00000160 ___SH () C:\Users\elwi\ntuser.ini
2014-07-16 16:26 - 2012-04-03 14:14 - 00000160 ___SH () C:\Users\geraf\ntuser.ini
2014-07-16 16:22 - 2014-07-16 14:57 - 00000000 ____D () C:\Program Files\stinger
2014-07-16 16:22 - 2014-07-16 14:55 - 00000000 ____D () C:\Users\nadmin\Desktop\stinger32-989
2014-07-16 15:15 - 2014-07-16 15:15 - 00167344 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.9dbc.deleteme
2014-07-16 15:00 - 2014-07-16 14:58 - 10965352 _____ (McAfee Inc) C:\Users\nadmin\Downloads\stinger32.exe
2014-07-16 14:55 - 2014-06-16 08:28 - 00064082 _____ () C:\Users\juro\6.mbs.txt
2014-07-16 14:16 - 2014-07-16 14:14 - 00074777 _____ () C:\Users\juro\Desktop\DB Berechnung - Sonja.xlsx
2014-07-16 14:07 - 2010-05-04 14:41 - 00000160 ___SH () C:\Users\gera\ntuser.ini
2014-07-16 14:05 - 2012-03-31 11:34 - 00000000 ____D () C:\Users\elwi\Documents\42 ERP
2014-07-16 13:54 - 2012-12-20 10:00 - 00000000 ____D () C:\Users\past\Desktop\Garten-Versand
2014-07-16 13:50 - 2012-03-31 11:41 - 00002633 _____ () C:\Users\sokl\Desktop\Microsoft Office Excel 2007.lnk
2014-07-16 13:48 - 2014-07-16 13:48 - 00000000 ____D () C:\Users\nadmin\Desktop\virscan
2014-07-16 13:35 - 2014-07-08 09:13 - 00000000 ____D () C:\Users\cabr\Desktop\Bilder_Display_klein
2014-07-16 13:10 - 2014-06-04 13:34 - 00000000 ____D () C:\Users\cabr\Desktop\Neu
2014-07-16 10:43 - 2010-05-04 09:46 - 00001308 __RSH () C:\Users\nadmin\ntuser.pol
2014-07-16 10:31 - 2012-03-31 11:37 - 00002631 _____ () C:\Users\elwi\Desktop\Microsoft Office Word 2007.lnk
2014-07-16 10:16 - 2014-07-16 10:16 - 00000000 ____D () C:\Users\makl\Documents\Ekaflor
2014-07-16 09:55 - 2014-07-16 09:46 - 00199078 _____ () C:\Users\makl\Documents\renner produkten.xlsx
2014-07-16 09:35 - 2013-08-29 07:45 - 00000000 ____D () C:\Users\past\Desktop\diverse
2014-07-16 08:26 - 2014-01-21 09:43 - 00000000 ____D () C:\Users\cabr\Desktop\Brand Manual
2014-07-16 08:06 - 2013-06-19 08:35 - 00000000 ____D () C:\Users\juro
2014-07-16 07:17 - 2014-07-16 07:17 - 00000968 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 16.csv
2014-07-15 17:16 - 2014-07-15 16:43 - 00000000 ____D () C:\Users\makl\Documents\Kalkulation
2014-07-15 17:13 - 2014-07-15 08:32 - 00000000 ____D () C:\Users\makl\Documents\Produktinformation
2014-07-15 15:50 - 2010-05-04 14:38 - 00000160 ___SH () C:\Users\kake\ntuser.ini
2014-07-15 15:49 - 2014-07-16 13:50 - 00066498 _____ () C:\Users\juro\Desktop\DB Berechnung - Kopie.xlsx
2014-07-15 14:22 - 2012-04-02 10:31 - 00000000 ____D () C:\Users\sazo\Documents\42 ERP
2014-07-15 13:36 - 2012-03-30 10:52 - 00002631 _____ () C:\Users\gera\Desktop\Microsoft Office Word 2007.lnk
2014-07-15 12:22 - 2010-08-26 11:51 - 00001770 ____H () C:\Users\nadmin\Documents\Default.rdp
2014-07-15 10:20 - 2014-07-15 10:19 - 00004044 _____ () C:\Users\nadmin\AppData\Local\Temp\NMBUILD.log
2014-07-15 10:19 - 2014-07-15 10:19 - 00000000 ____D () C:\Users\nadmin\Documents\Network Monitor 3
2014-07-15 10:18 - 2014-07-15 10:18 - 00000936 _____ () C:\Users\nadmin\Desktop\Microsoft Network Monitor 3.4.lnk
2014-07-15 10:18 - 2014-07-15 10:18 - 00000000 ____D () C:\Users\nadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Network Monitor 3.4
2014-07-15 10:18 - 2014-07-15 10:18 - 00000000 ____D () C:\Program Files\Microsoft Network Monitor 3
2014-07-15 10:14 - 2014-07-15 09:50 - 00031926 _____ () C:\Users\kake\5.mbs.txt
2014-07-15 09:50 - 2010-05-04 14:38 - 00000000 ____D () C:\Users\kake
2014-07-15 09:35 - 2012-03-31 11:37 - 00002633 _____ () C:\Users\elwi\Desktop\Microsoft Office Excel 2007.lnk
2014-07-15 09:33 - 2014-07-15 09:33 - 00000000 ____D () C:\ProgramData\Norton
2014-07-15 09:31 - 2013-06-19 09:21 - 00000000 ____D () C:\Users\juro\Documents\42 ERP
2014-07-15 08:21 - 2012-03-31 11:41 - 00002631 _____ () C:\Users\sokl\Desktop\Microsoft Office Word 2007.lnk
2014-07-15 08:12 - 2014-06-25 08:17 - 00019778 _____ () C:\Users\juro\5.mbs.txt
2014-07-15 07:17 - 2014-07-15 07:17 - 00000924 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 15.csv
2014-07-14 17:28 - 2014-07-03 11:10 - 00000000 ____D () C:\Users\makl\Documents\KAM
2014-07-14 16:03 - 2014-06-30 17:02 - 00000000 ____D () C:\Users\makl\Documents\unternehmen
2014-07-14 15:22 - 2014-06-25 11:25 - 00000000 ____D () C:\Users\past\Desktop\Bauhaus
2014-07-14 15:09 - 2014-06-24 10:52 - 00072256 _____ () C:\Users\juro\4.mbs.txt
2014-07-14 13:17 - 2014-07-07 16:20 - 00000000 ____D () C:\Users\makl\Documents\AD
2014-07-14 13:17 - 2014-06-18 14:34 - 00000000 ____D () C:\Users\makl\Documents\Bauhaus
2014-07-14 13:14 - 2014-07-14 13:14 - 00010236 _____ () C:\Users\past\Desktop\GV LS.xlsx
2014-07-14 11:18 - 2014-07-14 11:29 - 00000683 ___SH () C:\ProgramData\27b0faed-9adf-479f-ba91-ab041ae85ce6
2014-07-14 11:18 - 2014-07-14 11:18 - 00000000 ____D () C:\ProgramData\f205ef16-6955-4b12-b7f4-e0e38b064f6e
2014-07-14 11:18 - 2013-09-13 12:30 - 00000000 ____D () C:\ProgramData\1206
2014-07-14 10:38 - 2014-07-14 10:38 - 00000000 ____D () C:\Users\past\Desktop\Angebote
2014-07-11 13:17 - 2014-07-10 14:48 - 00015232 _____ () C:\Users\nisc\Desktop\Aufstellung Komponente für 2015.xlsx
2014-07-11 10:25 - 2014-06-11 15:53 - 00012009 _____ () C:\Users\juro\1.mbs.txt
2014-07-11 09:42 - 2014-07-11 09:42 - 00000000 ____D () C:\Users\makl\Documents\Marketing
2014-07-11 07:16 - 2014-07-11 07:16 - 00000748 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 11.csv
2014-07-10 15:16 - 2012-04-04 10:47 - 00002633 _____ () C:\Users\albu\Desktop\Microsoft Office Excel 2007.lnk
2014-07-10 12:02 - 2012-09-05 15:17 - 00000000 ____D () C:\Users\nisc\Documents\42 ERP
2014-07-10 11:36 - 2014-06-30 07:59 - 00035712 _____ () C:\Users\juro\0.mbs.txt
2014-07-10 09:56 - 2014-05-07 15:24 - 00012103 _____ () C:\Users\nisc\Desktop\Einlagerung Bark.xlsx
2014-07-10 07:16 - 2014-07-10 07:16 - 00000792 _____ () C:\Users\sokl\Desktop\unternehmen_LMX_Sendungsnummern 10.csv
2014-07-09 22:31 - 2010-08-28 04:10 - 00000000 ___HD () C:\Backup Exec AOFO Store
2014-07-09 16:37 - 2014-07-09 16:37 - 00022016 ____N () C:\Users\past\Documents\Kopie von 10 wichtigsten Kunden Strobel Herbst 04.xls
2014-07-09 14:58 - 2013-09-03 10:10 - 00000000 ____D () C:\Users\nisc\Desktop\Diskont
2014-07-09 14:50 - 2012-12-04 12:44 - 00000000 ____D () C:\Users\nisc\Desktop\Aufstellungen Menge
2014-07-09 14:50 - 2012-09-12 16:46 - 00000000 ____D () C:\Users\nisc\Desktop\Diverses
2014-07-09 13:30 - 2014-07-09 07:46 - 00048199 ____N () C:\Users\juro\9.mbs.txt
2014-07-09 10:56 - 2013-10-23 09:58 - 00000000 ____D () C:\Users\mari
2014-07-09 03:54 - 2012-04-07 16:07 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 03:54 - 2011-09-07 15:09 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 11:18 - 2014-07-08 09:49 - 00024087 ____N () C:\Users\kake\8.mbs.txt
2014-07-08 09:43 - 2013-12-17 13:07 - 00000000 ____D () C:\Users\kake\Documents\42 ERP
2014-07-08 08:45 - 2014-06-18 10:36 - 00035922 ____N () C:\Users\juro\8.mbs.txt
2014-07-07 10:22 - 2014-07-01 08:21 - 00000000 ____D () C:\Users\makl\Documents\42 ERP
2014-07-03 16:38 - 2014-07-03 16:38 - 00000000 ____H () C:\Users\makl\Documents\Default.rdp
2014-07-03 16:20 - 2012-03-30 07:33 - 00000000 ____D () C:\Program Files\FreePDF_XP
2014-07-03 15:28 - 2014-07-03 14:10 - 42614500 ____N () C:\Users\cabr\Downloads\wetransfer-352d45.zip
2014-07-03 13:10 - 2014-07-03 13:10 - 00000000 ____D () C:\Users\makl\AppData\Roaming\TeamViewer
2014-07-03 13:10 - 2014-07-03 13:09 - 03896872 ____N (TeamViewer) C:\Users\makl\Desktop\emaxit_team_de.exe
2014-07-03 09:58 - 2014-06-16 09:48 - 00049664 ____N () C:\Users\cabr\Desktop\unternehmen Reisekosten Blanco - Vorlage.xls
2014-07-03 09:37 - 2014-07-03 09:35 - 00000000 ____D () C:\Users\makl\Documents\Terrasan
2014-07-03 08:32 - 2014-06-13 08:06 - 00031837 ____N () C:\Users\juro\3.mbs.txt
2014-07-02 16:56 - 2014-06-12 11:10 - 00044105 ____N () C:\Users\juro\2.mbs.txt
2014-07-02 09:33 - 2014-05-19 09:56 - 00000000 ____D () C:\Users\past\Desktop\Messe Schallaburg
2014-07-02 09:09 - 2012-08-14 13:06 - 00000000 ____D () C:\Users\cabr\Desktop\Herbstdisplay
2014-07-02 09:02 - 2012-03-29 16:59 - 00000000 ____D () C:\Users\tobisoft\Documents\42 ERP
2014-07-02 08:59 - 2012-01-19 12:08 - 00000474 __RSH () C:\Users\tobisoft\ntuser.pol
2014-07-02 08:59 - 2012-01-19 12:08 - 00000000 ____D () C:\Users\tobisoft
2014-07-01 17:05 - 2014-06-30 08:24 - 00000000 ____D () C:\Users\makl\Documents\Terracotta
2014-07-01 11:03 - 2014-06-30 16:25 - 00009927 ____N () C:\Users\nisc\Desktop\Preissteigerungen 2015.xlsx
2014-07-01 10:06 - 2012-04-04 11:59 - 00002631 ____N () C:\Users\albu\Desktop\Microsoft Office Word 2007.lnk
2014-06-30 16:04 - 2014-06-30 15:40 - 157376942 ____N () C:\Users\albu\Downloads\wetransfer-02bf47.zip.tzsli7s.partial
2014-06-30 14:58 - 2014-06-30 14:58 - 00048640 ____N () C:\Users\makl\Documents\unternehmen gelöschte Basis.xls
2014-06-30 08:51 - 2014-06-30 08:51 - 00000000 ____D () C:\Users\makl\Documents\3P
2014-06-30 08:50 - 2014-06-30 08:50 - 00000000 ____D () C:\Users\makl\Documents\Eurotops
2014-06-30 08:49 - 2014-06-30 08:49 - 00000000 ____D () C:\Users\makl\Documents\Norax
2014-06-27 11:49 - 2014-06-27 11:49 - 00048128 ____N () C:\Users\past\Documents\Kopie von Kopie von Vorlage Modul.xls
2014-06-26 17:29 - 2008-01-19 11:41 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-26 17:19 - 2008-01-19 11:41 - 00000000 ____D () C:\Windows\Registration
2014-06-26 17:18 - 2008-01-19 13:47 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 17:17 - 2009-04-11 15:11 - 30932026 _____ () C:\Windows\PFRO.log
2014-06-26 17:16 - 2012-04-20 13:20 - 00000000 ____D () C:\ProgramData\BMDNTCS
2014-06-26 17:16 - 2008-01-19 13:47 - 00032522 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-26 13:47 - 2014-06-26 13:47 - 00022076 ____N () C:\Users\sokl\Desktop\Transportkosten Mustertabelle.xlsx
2014-06-26 09:32 - 2010-05-04 11:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-26 09:30 - 2014-06-26 09:30 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-26 09:27 - 2013-08-30 17:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-26 09:23 - 2012-07-22 11:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2008
2014-06-26 08:26 - 2014-05-13 13:48 - 00000000 ____D () C:\Users\sokl\Desktop\Datenblätter
2014-06-25 16:48 - 2014-06-25 16:48 - 00048640 _____ () C:\Users\past\Desktop\Pflanzenschutzmodul.xls
2014-06-25 16:20 - 2014-06-25 13:51 - 00001206 ____H () C:\Users\elwi\AppData\Roaming\cn38-wdjwjju37.html
2014-06-25 16:00 - 2014-06-25 16:00 - 00081912 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_92981844375155_sign.zip
2014-06-25 16:00 - 2014-06-25 09:57 - 00004280 ____H () C:\Users\elwi\AppData\Roaming\shvfuwefbskj.html
2014-06-25 15:50 - 2014-06-25 15:50 - 00081912 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_15952554118872_sign.zip
2014-06-25 11:04 - 2013-11-11 15:53 - 00002735 ____N () C:\Users\mari\Desktop\Microsoft Office Outlook 2007.lnk
2014-06-24 13:45 - 2014-06-24 13:45 - 00087915 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_54323285928184_sign.zip
2014-06-24 13:45 - 2014-06-24 09:10 - 00004307 ____H () C:\Users\elwi\AppData\Roaming\djkhyfhknjskg92.html
2014-06-24 09:36 - 2014-06-24 09:36 - 00103560 _____ () C:\Users\elwi\AppData\Roaming\2014_06rechnung_32976822643353_sign.zip
2014-06-24 09:06 - 2010-05-04 14:43 - 00000160 ___SH () C:\Users\lasz\ntuser.ini
2014-06-23 12:00 - 2014-06-23 11:59 - 00001630 ____N () C:\Users\sokl\Desktop\Kontierung 2014.lnk
2014-06-23 10:23 - 2014-06-23 10:15 - 00011923 ____N () C:\Users\sazo\3.mbs.txt
2014-06-20 13:14 - 2014-06-23 07:48 - 00012844 ____R () C:\Users\juro\Downloads\Wochenbericht 2014- KW 25xlsx
2014-06-20 11:25 - 2014-06-20 11:23 - 00000000 ____D () C:\Users\makl\Documents\Information
2014-06-20 10:41 - 2014-06-20 10:41 - 00000000 ____D () C:\Users\makl\Documents\Presse_öffentlichkeitsarbeit2014
2014-06-20 10:40 - 2014-06-20 10:39 - 00000000 ____D () C:\Users\makl\Documents\Tagung
2014-06-20 07:17 - 2014-06-11 15:51 - 02210567 ____N () C:\Users\nisc\Desktop\Aldi Service-Fragebogen neu.xlsx
2014-06-18 16:20 - 2014-06-18 08:14 - 00007455 ____H () C:\Users\elwi\AppData\Roaming\29-46-32599.html
2014-06-18 13:42 - 2014-06-18 13:42 - 00000000 ____D () C:\Users\makl\AppData\Roaming\Macromedia
2014-06-18 13:36 - 2014-06-18 13:35 - 00001616 ____N () C:\Users\elwi\Desktop\Aktuell.lnk
2014-06-18 13:34 - 2014-06-18 13:34 - 00001308 ____N () C:\Users\elwi\Desktop\FAQ.lnk
2014-06-17 16:16 - 2014-06-17 16:09 - 00001070 ____H () C:\Users\elwi\AppData\Roaming\892347H-02093745L.html
2014-06-17 15:44 - 2014-06-17 15:44 - 00000000 ____D () C:\Users\makl\AppData\Roaming\Adobe
2014-06-17 15:44 - 2014-06-17 15:44 - 00000000 ____D () C:\Users\makl\AppData\Local\Temp\Adobe
2014-06-17 13:01 - 2014-06-17 08:31 - 00000898 ____H () C:\Users\elwi\AppData\Roaming\44AT53-334W35283.html
2014-06-17 11:06 - 2014-06-17 11:06 - 00008009 ____N () C:\Users\kake\7.mbs.txt
2014-06-17 09:31 - 2014-06-17 10:38 - 00001323 ____N () C:\Users\kake\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 09:31 - 2014-06-17 10:06 - 00001323 ____N () C:\Users\juro\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 09:31 - 2014-06-17 09:31 - 00001323 _____ () C:\Users\nadmin\Desktop\ELBA5 Gartenversand NEU.lnk
2014-06-17 09:08 - 2014-06-17 09:08 - 00001355 ____N () C:\Users\Public\Desktop\ELBA5 - Toplom NEU.lnk

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-17 07:33

==================== End Of Log ============================

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-07-2014 01
Ran by nadmin at 2014-07-17 13:55:45
Running from C:\Users\nadmin\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
42 Client (HKLM\...\42 Client) (Version: 13.02.0003 - 42 Software GmbH)
42 Client (Version: 13.02.0003 - 42 Software GmbH) Hidden
42 System (HKLM\...\42 System) (Version: 8.00.0000 - 42 Software GmbH)
42 System (Version: 4.00.0000 - 42 Software GmbH) Hidden
42 System (Version: 8.00.0000 - 42 Software GmbH) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
AFPL Ghostscript Fonts (HKLM\...\AFPL Ghostscript Fonts) (Version:  - )
BMDNTCS (HKLM\...\{33FD8440-2ECE-11D3-A3FF-0008C7C9B295}) (Version:  - )
Bullzip PDF Printer 9.0.0.1437 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.0.0.1437 - Bullzip)
Client (HKLM\...\{BAB4AAD2-93A4-11D4-A165-00508B67A692}) (Version: 5.50.000 - BMD Systemhaus GesmbH)
CVE-2013-3893 (HKLM\...\{55aab41f-5d5c-abdf-4568-baef76587bd7}.sdb) (Version:  - )
ELBA5 (U:\ELBA5LOM) (HKLM\...\ELBA5 (U:_ELBA5LOM)) (Version: 5.0.0.0 - RACON Software GmbH)
ELBA5 (U:\ELBAGarten) (HKLM\...\ELBA5 (U:_ELBAGarten)) (Version: 5.0.0.0 - RACON Software GmbH)
ELBA5 (U:\Raika) (HKLM\...\ELBA5 (U:_Raika)) (Version: 5.0.0.0 - RACON Software GmbH)
Exact CRW XI (HKLM\...\{F3708C6D-444A-4860-8CA9-E6F619D553B0}) (Version: 3.0.0.0 - Exact Software)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
H O B (c:\Program Files\hob\) (HKLM\...\ST6UNST #2) (Version:  - )
H O B (HKLM\...\ST6UNST #1) (Version:  - )
Java Auto Updater (Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 5 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217005FF}) (Version: 7.0.50 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Network Monitor 3.4 (HKLM\...\{A2F2C44A-869E-4C32-9CEC-E22B1CC91F06}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Network Monitor: NetworkMonitor Parsers 3.4 (HKLM\...\{5A1A9AB2-2F68-462D-A67D-7C855DFF5EEB}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Small Business 2007 (HKLM\...\SMALLBUSINESS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Small Business 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Report Viewer Redistributable 2008 (KB971119) (Version: 9.0.30731 - Microsoft Corporation) Hidden
Microsoft Report Viewer Redistributable 2008 SP1 (HKLM\...\Microsoft Report Viewer Redistributable 2008 (KB971119)) (Version:  - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Backward compatibility (HKLM\...\{0D61D68B-DF5E-4635-82C7-B0C53F0A581B}) (Version: 8.05.2312 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Setup (English) (HKLM\...\{72DE3C67-FB48-450E-8BEA-4EB1B3B5355D}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (HKLM\...\{2F7DBBE6-8EBC-495C-9041-46A772F4E311}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{CAAD4A3A-27DE-4506-93AB-A016D9064945}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (HKLM\...\{CD5AAE18-1DF8-4D7B-8B99-9071D7D36126}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual Studio 2008 Shell (integrated mode) - ENU (HKLM\...\{BA0C9AAF-1327-3F06-B49C-349B4BE8F740}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM\...\{4ECF4BDC-8387-329A-ABE9-CF5798F84BB2}) (Version: 9.0.35191 - Microsoft Corporation)
pcvisit Remote-Host (HKLM\...\pcvisit Remote-Host) (Version: 12.0.25.9914 - pcvisit Software AG)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
SQLXML4 (HKLM\...\{8C62A94B-4AB6-485F-A111-93056684D340}) (Version: 9.00.1399.06 - Microsoft Corporation)
Symantec Backup Exec Remote Agent for Windows Systems (HKLM\...\Remote Agent for Windows Servers) (Version: 13.0.4164 - Symantec Corporation)
Symantec Backup Exec Remote Agent for Windows Systems (Version: 13.0.4164 - Symantec Corporation) Hidden
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 7.0.2316 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 7.0 - Trend Micro Inc.) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESS_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM\...\{90120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESS_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VMware Tools (HKLM\...\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}) (Version: 8.0.1.11537 - VMware, Inc.)
Windows Small Business Server 2008 ClientAgent (HKLM\...\{492F8345-095D-467F-926C-278870D93ECF}) (Version: 6.0.5601.6 - Microsoft Corporation)

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

2008-01-19 10:46 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0156D311-2102-4F16-8855-ADC4C8EB03D8} - System32\Tasks\Vollsicherung => C:\Windows\System32\wbadmin.exe [2008-01-19] (Microsoft Corporation)
Task: {572F4DE2-C5FD-41A0-B948-F0A1C7688C7C} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant => C:\Windows\system32\ceipdata.exe [2009-04-11] (Microsoft Corporation)
Task: {8458F451-3CAE-4032-BDE8-F38FB1F0C4B1} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleCollector => C:\Windows\system32\ceiprole.exe [2009-04-11] (Microsoft Corporation)
Task: {91AAB117-A987-408E-BD00-A05396F94F9B} - System32\Tasks\ShadowCopyVolume{1e6cd5ed-574f-11df-be42-806e6f6e6963} => C:\Windows\system32\vssadmin.exe [2008-01-19] (Microsoft Corporation)
Task: {A9B24974-47C6-468B-AA74-A511D9F9F580} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {D286A394-0EA5-4860-BBE3-D6A36814245E} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {DEDC0DCF-1F3E-4C66-A549-53F6F785739A} - System32\Tasks\Microsoft\Windows\Server Manager\ServerManager => C:\Windows\system32\ServerManagerLauncher.exe [2008-01-19] (Microsoft Corporation)
Task: {E48634DF-0591-4F64-8D94-424DB9889E7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {E532EB50-6B3A-42C5-9E62-4D60ABC47FEB} - System32\Tasks\Microsoft\Windows\termsrv\licensing\TlsWarning => C:\Windows\system32\tlsbln.exe [2009-04-11] (Microsoft Corporation)
Task: {FC196101-720E-4AAD-9AB0-530E904BC234} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ShadowCopyVolume{1e6cd5ed-574f-11df-be42-806e6f6e6963}.job => C:\Windows\system32\vssadmin.exe

==================== Loaded Modules (whitelisted) =============

2010-12-17 02:08 - 2010-12-17 02:08 - 00076584 _____ () C:\Program Files\Symantec\Backup Exec\RAWS\PDVFSNP.dll
2012-08-27 02:57 - 2014-04-14 10:41 - 00016384 _____ () C:\Windows\System32\KOBK2J_L.DLL
2012-08-27 10:57 - 2014-04-14 10:41 - 00016384 _____ () C:\Windows\System32\KOBJZJ_L.dll
2012-03-30 07:33 - 2010-06-17 21:56 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2009-04-30 17:03 - 2009-04-30 17:03 - 00056368 _____ () C:\Program Files\VMware\VMware Tools\sigc-2.0.dll
2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 ____N () C:\Program Files\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 ____N () C:\Program Files\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2013-03-24 05:40 - 2014-04-14 10:32 - 00937984 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\KOAYTJ_O.DLL
2014-01-22 11:19 - 2014-04-07 11:35 - 00867304 _____ () \\FLDBSRV01\Prog\42Software\ERP\Daten42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00089064 _____ () \\FLDBSRV01\Prog\42Software\ERP\BASEB42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 04020200 _____ () \\FLDBSRV01\Prog\42Software\ERP\BASE42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00748520 _____ () \\FLDBSRV01\Prog\42Software\ERP\FORM42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 02129896 _____ () \\FLDBSRV01\Prog\42Software\ERP\USER42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00413160 _____ () \\FLDBSRV01\Prog\42Software\ERP\macro42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00583144 _____ () \\FLDBSRV01\Prog\42Software\ERP\DBASE42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 02583528 _____ () \\FLDBSRV01\Prog\42Software\ERP\boapp42.dll
2013-08-28 14:11 - 2013-08-28 14:11 - 00928768 _____ () \\FLDBSRV01\Prog\42Software\ERP\dbt8112d.dll
2013-08-28 14:09 - 2013-08-28 14:09 - 00916480 _____ () \\FLDBSRV01\Prog\42Software\ERP\tls10112d.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00036840 _____ () \\FLDBSRV01\Prog\42Software\ERP\FORMD42.dll
2014-01-22 11:19 - 2014-04-07 11:35 - 00097768 _____ () \\FLDBSRV01\Prog\42Software\ERP\bo42.dll
2013-01-09 11:59 - 2013-01-09 11:59 - 00341504 _____ () \\FLDBSRV01\Prog\42Software\ERP\vc11-re200l.dll
2014-01-22 11:19 - 2014-01-22 11:19 - 00067584 _____ () \\FLDBSRV01\Prog\42Software\ERP\config.oem
2013-08-28 14:12 - 2013-08-28 14:12 - 00259072 _____ () \\FLDBSRV01\Prog\42Software\ERP\msq8112d.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupreg: BMDNetClient_unternehmen.LOCAL => "C:\Program Files\BMDNTCSClients\unternehmen.LOCAL\BMDNetClient.exe" /UPDATE

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/17/2014 09:38:29 AM) (Source: Winlogon) (EventID: 4005) (User: )
Description: Der Windows-Anmeldeprozess wurde unerwartet beendet.

Error: (07/16/2014 04:22:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung stinger32-989.exe, Version 12.1.0.989, Zeitstempel 0x53be4587, fehlerhaftes Modul mshtml.dll, Version 9.0.8112.16555, Zeitstempel 0x53861331, Ausnahmecode 0xc0000005, Fehleroffset 0x0022e236,
Prozess-ID 0x1508, Anwendungsstartzeit stinger32-989.exe0.

Error: (07/16/2014 01:22:30 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm OUTLOOK.EXE, Version 12.0.6691.5000 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 4f94
Anfangszeit: 01cfa0b9ea474172
Zeitpunkt der Beendigung: 28

Error: (07/15/2014 10:21:10 PM) (Source: Winlogon) (EventID: 4005) (User: )
Description: Der Windows-Anmeldeprozess wurde unerwartet beendet.

Error: (07/14/2014 04:14:51 AM) (Source: Winlogon) (EventID: 4005) (User: )
Description: Der Windows-Anmeldeprozess wurde unerwartet beendet.

Error: (07/13/2014 09:30:03 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {47b2fc3d-67c0-4343-9ead-475fb9ad640a}

Error: (07/11/2014 04:36:11 AM) (Source: Winlogon) (EventID: 4005) (User: )
Description: Der Windows-Anmeldeprozess wurde unerwartet beendet.

Error: (07/10/2014 00:55:26 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {156a7a60-f866-4935-92ef-ccff02204e06}

Error: (07/09/2014 10:31:11 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {156a7a60-f866-4935-92ef-ccff02204e06}

Error: (07/09/2014 10:30:54 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {156a7a60-f866-4935-92ef-ccff02204e06}


System errors:
=============
Error: (07/17/2014 01:00:36 PM) (Source: TermDD) (EventID: 56) (User: )
Description: Die Terminalserver-Sicherheitsschicht hat einen Fehler im Protokollablauf erkannt und den Client getrennt.

Error: (07/16/2014 05:49:54 PM) (Source: TermDD) (EventID: 56) (User: )
Description: Die Terminalserver-Sicherheitsschicht hat einen Fehler im Protokollablauf erkannt und den Client getrennt.

Error: (07/16/2014 04:26:02 PM) (Source: TermDD) (EventID: 56) (User: )
Description: Die Terminalserver-Sicherheitsschicht hat einen Fehler im Protokollablauf erkannt und den Client getrennt.

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: BMDNtcsSvc1

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Distributed Transaction Coordinator110001Neustart des Diensts

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Pcvisit Caloa Agent Service 1.21600001Neustart des Diensts

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Message Queuing11200001Neustart des Diensts

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Adobe Acrobat Update Service1

Error: (07/16/2014 03:04:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Softwarelizenzierung11200001Neustart des Diensts

Error: (07/16/2014 02:07:06 PM) (Source: TermDD) (EventID: 56) (User: )
Description: Die Terminalserver-Sicherheitsschicht hat einen Fehler im Protokollablauf erkannt und den Client getrennt.


Microsoft Office Sessions:
=========================
Error: (07/09/2014 08:44:08 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 299 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (07/09/2014 08:38:53 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5707 seconds with 2580 seconds of active time.  This session ended with a crash.

Error: (06/26/2014 05:15:52 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 33381 seconds with 10740 seconds of active time.  This session ended with a crash.

Error: (06/11/2014 00:05:44 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 2679 seconds with 2400 seconds of active time.  This session ended with a crash.

Error: (06/11/2014 10:50:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 198 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (06/11/2014 09:43:23 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 46 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (06/10/2014 00:55:35 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 12800 seconds with 6540 seconds of active time.  This session ended with a crash.

Error: (06/06/2014 07:17:10 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 51 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (06/06/2014 07:16:06 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 315 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (06/03/2014 00:53:45 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 17717 seconds with 6660 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-04-30 18:39:19.319
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\SETDE0D.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:19.231
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\SETDE0D.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:19.140
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\SETDE0D.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:19.050
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\SETDE0D.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:18.955
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:18.865
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:18.764
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-04-30 18:39:18.640
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2010-08-24 13:58:16.408
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Trend Micro\Client Server Security Agent\Temp\HotFix\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2010-08-24 13:58:16.377
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Trend Micro\Client Server Security Agent\Temp\HotFix\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 80%
Total physical RAM: 4094.6 MB
Available physical RAM: 779.53 MB
Total Pagefile: 8440.13 MB
Available Pagefile: 4241.63 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.81 MB

==================== Drives ================================

Drive c: (FLTSSRV01) (Fixed) (Total:78.48 GB) (Free:27.77 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (ts_daten) (Fixed) (Total:61.52 GB) (Free:38.83 GB) NTFS
Drive u: (Daten) (Network) (Total:230 GB) (Free:31.72 GB) NTFS
Drive v: (Daten) (Network) (Total:115.67 GB) (Free:90.85 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 140 GB) (Disk ID: 4CA99E43)
Partition 1: (Active) - (Size=78 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=62 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Danke vielmals!

schrauber · 17.07.2014, 17:03

Zitat:

Danke für die Antwort. Ich werde das wohl zunächst stichprobenartig machen bevor ich alle Server und alle Clients auswerte und hier dann alle Logfiles poste

Uno Momento:

Firma?

politiker · 17.07.2014, 21:52

Hallo,

@Schrauber Habe bereits den Übeltäter gefunden, danke trotzdem für die Hilfe!

Danke euch!

schrauber · 18.07.2014, 18:36

ok.

18.07.2014, 18:36	#6
schrauber /// the machine /// TB-Ausbilder	Torpig Befall im netzwerk ok. __________________ --> Torpig Befall im netzwerk

Torpig Befall im netzwerk

Plagegeister aller Art und deren Bekämpfung: Torpig Befall im netzwerk