TR/Crypt.XPACK.Gen3

oelli · 08.10.2010, 12:29

Guten Tag,

mein Avira (aktuell) wirft auf beiden PC´s seit ein paar Tagen auf beiden PCs für Dateien im Verzeichnis C:\WIDNOWS\Temp\TMP....tmp die Meldung "Ist das Trojanische Pferd TR/Crypt.XPACK.Gen3" aus, wobei ... für verschiedene hexadezimale Ziffern steht. Diese Meldung kommt für bis zu ca. 35 Dateien.

Auch nach dem Löschen/Quarantänisieren taucht diese Meldung am nächsten Tag wieder auf, da diese Dateien laufend erzeugt werden.

Auf den Rechnern befindet sich neben Avira jeweils noch ein PC Tools Spyware Doctor (ebenfalls laufend aktualisiert.)

Ich habe MBAM laufan lassen. Von PC 1 ergibt das folgenden Log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4773

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

08.10.2010 12:01:21
mbam-log-2010-10-08 (12-01-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 250198
Laufzeit: 53 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Mit OTL habe ich PC1 anschließend ebenfalls gescannt:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 08.10.2010 10:57:40 - Run 2
OTL by OldTimer - Version 3.2.14.1 Folder = D:\Installer
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 76,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 116,21 Gb Total Space | 97,46 Gb Free Space | 83,87% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 95,03 Gb Free Space | 40,81% Space Free | Partition Type: NTFS
Drive E: | 1,91 Gb Total Space | 1,80 Gb Free Space | 94,25% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: JC-PC-02
Current User Name: JO
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - D:\Installer\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\TFEngine\TFService.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Programme\FileZilla Server\FileZilla server.exe (FileZilla Project)
PRC - C:\Programme\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\scalc.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Mediencenter\tonline.exe (Deutsche Telekom AG)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (SafeNet, Inc)
PRC - C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (SafeNet, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Lantronix\UBox\nhciTaskL.exe (Lantronix)
PRC - C:\Programme\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Programme\Okidata\OKI LPR Utility\okilpr.exe (Oki Data Corporation)
PRC - C:\Programme\Miramar\PC MACLAN\ATSPOOL.EXE (Miramar Systems Inc.)
PRC - C:\Programme\Miramar\PC MACLAN\ATSERVER.EXE (Miramar Systems Inc.)
PRC - C:\Programme\Miramar\PC MACLAN\ATMSG.EXE (Miramar Systems Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Nokia\Services\ServiceLayer.exe (Nokia Mobile Phones)
PRC - C:\Programme\Gemeinsame Dateien\Nokia\NCLTools\NclTray.exe (Nokia Mobile Phones)
PRC - C:\Programme\Dantz\Retrospect\launcher.exe (Dantz Development Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\Installer\OTL.exe (OldTimer Tools)
MOD - C:\Programme\Spyware Doctor\TFEngine\TFWAH.dll (PC Tools)
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvwimg.dll ()
MOD - C:\WINDOWS\system32\nvwrsde.dll (NVIDIA Corporation)
MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (sdCoreService) -- C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) -- C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (ThreatFire) -- C:\Programme\Spyware Doctor\TFEngine\TFService.exe (PC Tools)
SRV - (Browser Defender Update Service) -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (FileZilla Server) -- C:\Programme\FileZilla Server\FileZilla Server.exe (FileZilla Project)
SRV - (OpenVPNService) -- C:\Programme\OpenVPN\bin\openvpnserv.exe ()
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (SolidWorks Licensing Service) -- C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SentinelProtectionServer) -- C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (SafeNet, Inc)
SRV - (SentinelKeysServer) -- C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (SafeNet, Inc.)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (WinVNC4) -- C:\Programme\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Miramar AppleTalk Print Server) -- C:\Programme\Miramar\PC MACLAN\ATSPOOL.EXE (Miramar Systems Inc.)
SRV - (Miramar AppleTalk File Server) -- C:\Programme\Miramar\PC MACLAN\ATSERVER.EXE (Miramar Systems Inc.)
SRV - (ATMsg) -- C:\Programme\Miramar\PC MACLAN\ATMsg.exe (Miramar Systems Inc.)
SRV - (RetroLauncher) -- C:\Programme\Dantz\Retrospect\launcher.exe (Dantz Development Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (pctplsg) -- C:\WINDOWS\system32\drivers\pctplsg.sys (PC Tools)
DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (pctgntdi) -- C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (TfSysMon) -- C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfFsMon) -- C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (TfNetMon) -- C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (WIBUKEY) -- C:\WINDOWS\system32\drivers\WibuKey.sys (WIBU-SYSTEMS AG)
DRV - (eusk3usb) -- C:\WINDOWS\system32\drivers\eusk3usb.sys (Eutron)
DRV - (npdrv) -- C:\WINDOWS\system32\drivers\npdrv.sys (Moxa Inc. )
DRV - (Wibukey2) -- C:\WINDOWS\system32\drivers\Wibukey2.sys (WIBU-SYSTEMS AG)
DRV - (Haspnt) -- C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (skeyusb) -- C:\WINDOWS\system32\drivers\skeyusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (eusk2par) -- C:\WINDOWS\system32\drivers\eusk2par.sys (Aladdin Knowledge Systems Ltd.)
DRV - (thomedav) -- C:\WINDOWS\system32\drivers\thomedav.sys ()
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (VIAHdAudAddService) -- C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.)
DRV - (monfilt) -- C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (SNTNLUSB) -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (SafeNet, Inc.)
DRV - (NHCIMONO_L) -- C:\WINDOWS\system32\drivers\nhcimonoL.sys (Lantronix)
DRV - (Hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (aksusb) -- C:\WINDOWS\system32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (akshasp) -- C:\WINDOWS\system32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (atfsd) -- C:\WINDOWS\system32\drivers\ATFSD.SYS (Miramar Systems Inc.)
DRV - (atalk) -- C:\WINDOWS\system32\drivers\ATALK.SYS (Miramar Systems Inc.)
DRV - (Pei16Wdm) -- C:\WINDOWS\system32\drivers\Pei16Wdm.sys (EIBA s.c.)
DRV - (Pei10Wdm) -- C:\WINDOWS\system32\drivers\Pei10Wdm.sys (EIBA s.c.)
DRV - (ElgTaDrv) -- C:\WINDOWS\system32\drivers\ElgTaDrv.sys (elmeg Kommunikationstechnik)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..network.proxy.http: "192.168.0.101"
FF - prefs.js..network.proxy.http_port: 800
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.16 08:31:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.16 08:31:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.09.20 11:39:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2009.07.09 09:00:33 | 000,000,000 | ---D | M]
 
[2010.01.05 12:08:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2010.01.05 12:08:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.10.07 13:32:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\ilqxafgf.default\extensions
[2010.05.03 15:02:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\ilqxafgf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.07 13:32:15 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.01.16 02:28:50 | 000,155,648 | ---- | M] (Solidworks Corporation) -- C:\Programme\Mozilla Firefox\plugins\npEModelPlugin.dll
[2009.07.09 09:00:33 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Programme\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2009.11.03 10:40:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.11.03 10:40:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.11.03 10:40:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.11.03 10:40:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.11.03 10:40:04 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No CLSID value found.
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [FileZilla Server Interface] C:\Programme\FileZilla Server\FileZilla Server Interface.exe (FileZilla Project)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HDAudDeck] C:\Programme\VIA\VIAudioi\HDADeck\HDeck##.exe File not found
O4 - HKLM..\Run: [ISTray] C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper##.exe File not found
O4 - HKLM..\Run: [Miramar Systems, Inc.] C:\Programme\Miramar\PC MACLAN\ATMSG.EXE (Miramar Systems Inc.)
O4 - HKLM..\Run: [Nokia Tray Application] C:\Programme\Gemeinsame Dateien\Nokia\NCLTools\NclTray.exe (Nokia Mobile Phones)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKCU..\Run: [Mediencenter Software] C:\Programme\Mediencenter\tonline.exe (Deutsche Telekom AG)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Lantronix UBox USB Device Server Task.lnk = C:\Programme\Lantronix\UBox\nhciTaskL.exe (Lantronix)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\OKI LPR Utility.lnk = C:\Programme\Okidata\OKI LPR Utility\okilpr.exe (Oki Data Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} hxxp://eic.lgservice.com/DjvuViewer/DjVuControl-6.1.4.cab (DjVuCtl Class)
O16 - DPF: {15A7CF10-CB3E-4265-8779-9FD22619E8ED} hxxp://192.168.0.101/XPanel.cab (XPanel Class)
O16 - DPF: {673204A0-F8B3-4090-8506-80658C5D02C6} hxxp://192.168.0.101/nwcv3setup.exe (WebVideoCtrl Class)
O16 - DPF: {6F83F815-49D0-46BB-A81C-A9D18C33A0E7} hxxp://192.168.0.201/cab/Dibos80.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {F74959B0-1779-472E-BE6E-3023E1DBEC73} hxxp://192.168.0.101/XInit.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (硅汰牯牥攮數DOWS\S) - File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.09.21 10:26:27 | 000,000,000 | ---D | C] -- C:\Programme\Crestron
[2010.09.16 08:21:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
[2010.09.16 08:21:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.09.16 08:21:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.09.16 08:21:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.09.16 08:21:45 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.14 11:07:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TeamViewer
[2010.09.14 11:06:50 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer
[2010.09.09 11:57:06 | 000,000,000 | ---D | C] -- C:\Programme\ADVANTECH
[2010.09.09 10:05:46 | 000,000,000 | ---D | C] -- C:\Programme\RealVNC
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.08 09:12:39 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010.10.08 09:12:20 | 000,186,500 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.10.08 09:10:50 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.10.08 09:10:27 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.10.08 09:10:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.10.08 08:16:59 | 000,003,459 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.10.07 15:09:30 | 000,001,092 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2010.10.07 14:58:48 | 006,553,600 | ---- | M] () -- C:\Dokumente und Einstellungen\***\NTUSER.DAT
[2010.10.05 21:38:52 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini
[2010.10.04 12:00:11 | 000,141,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.09.30 10:40:51 | 000,000,745 | ---- | M] () -- C:\WINDOWS\unins000.dat
[2010.09.30 10:40:45 | 000,707,418 | ---- | M] () -- C:\WINDOWS\unins000.exe
[2010.09.30 08:48:01 | 000,014,336 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\JC Adressen öffnen.FP3
[2010.09.16 12:06:20 | 000,007,793 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Unbenannt 1.odt
[2010.09.16 08:37:01 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2010.09.16 08:21:50 | 000,000,684 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.15 03:04:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.09.14 11:06:56 | 000,000,877 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk
[2010.09.09 12:06:31 | 000,000,997 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ADAM-5000TCP-6000 Utility.lnk
[2010.09.09 10:02:45 | 000,013,493 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.09.30 10:40:46 | 000,707,418 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2010.09.30 10:40:46 | 000,000,745 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2010.09.16 12:06:20 | 000,007,793 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\Unbenannt 1.odt
[2010.09.16 08:37:01 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2010.09.16 08:37:00 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010.09.16 08:21:50 | 000,000,684 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.14 11:06:56 | 000,000,877 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk
[2010.09.09 11:57:19 | 000,000,997 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ADAM-5000TCP-6000 Utility.lnk
[2010.09.09 11:57:18 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\ADAMTCP.dll
[2010.09.09 11:57:17 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\adv5ktcp.dll
[2010.08.13 20:03:48 | 000,277,792 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.06.24 09:26:10 | 000,011,275 | ---- | C] () -- C:\WINDOWS\System32\vgttsd.dll
[2010.04.19 14:16:52 | 000,077,759 | ---- | C] () -- C:\WINDOWS\System32\rxtxSerial.dll
[2010.04.19 14:16:52 | 000,047,421 | ---- | C] () -- C:\WINDOWS\System32\rxtxParallel.dll
[2010.03.11 12:17:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Comms.INI
[2010.03.11 12:13:33 | 000,000,060 | ---- | C] () -- C:\WINDOWS\BACKUP~1.INI
[2010.03.08 11:09:30 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\SKEYVDD.DLL
[2010.03.08 11:09:29 | 000,131,580 | ---- | C] () -- C:\WINDOWS\System32\DMXCRD32.DLL
[2010.03.08 10:50:44 | 000,000,184 | ---- | C] () -- C:\WINDOWS\WinScript.INI
[2010.03.05 12:14:13 | 000,000,135 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2010.03.05 12:13:52 | 000,034,639 | ---- | C] () -- C:\WINDOWS\System32\drivers\axblan.sys
[2010.03.03 10:33:43 | 000,000,719 | ---- | C] () -- C:\WINDOWS\Soundweb.ini
[2010.01.20 10:34:46 | 000,066,560 | ---- | C] () -- C:\WINDOWS\System32\usbdrv.sys
[2010.01.04 11:56:25 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll0545.old
[2010.01.04 11:56:25 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010.01.04 11:56:25 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2009.12.02 15:19:26 | 000,014,336 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.20 13:06:40 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\VPN.dll
[2009.11.12 15:42:01 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CsvImExport.INI
[2009.10.28 13:11:49 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\nhciClassInstallL.dll
[2009.08.18 10:10:54 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2009.08.12 07:51:22 | 000,013,493 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.08.12 07:39:08 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2009.08.06 11:49:43 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2009.07.09 09:50:40 | 000,001,563 | ---- | C] () -- C:\WINDOWS\cmvpt32.ini
[2009.07.07 09:55:01 | 000,001,092 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009.07.01 15:22:47 | 000,479,301 | ---- | C] () -- C:\WINDOWS\System32\DOWCommon.dll
[2009.07.01 15:22:47 | 000,083,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\thomedav.sys
[2009.07.01 15:22:47 | 000,061,514 | ---- | C] () -- C:\WINDOWS\System32\thomevnp.dll
[2009.06.18 15:22:26 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\Cmpnl32.dll
[2009.06.18 15:22:26 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\SSLeay32.dll
[2009.06.18 15:22:26 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\GCL52FWZ.DLL
[2009.06.18 15:22:26 | 000,109,568 | ---- | C] () -- C:\WINDOWS\System32\GCL52FW.DLL
[2009.06.18 15:22:26 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\CMUpdate.dll
[2009.06.16 11:46:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2009.06.16 11:38:18 | 000,106,047 | ---- | C] () -- C:\WINDOWS\System32\NWNETAPI.DLL
[2009.06.16 11:38:18 | 000,035,308 | ---- | C] () -- C:\WINDOWS\System32\NWIPXSPX.DLL
[2009.06.16 08:21:25 | 000,003,459 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009.06.15 11:42:56 | 000,096,071 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\FASTWiz.log
[2009.06.15 11:36:22 | 000,018,412 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009.06.15 11:35:35 | 000,018,169 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009.06.15 11:35:35 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009.06.15 11:35:22 | 000,012,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008.05.16 20:31:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.05.16 20:31:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.05.16 20:31:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.05.16 20:31:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.05.16 20:31:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005.12.21 17:57:36 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll
[2005.12.21 17:57:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll
[2005.12.21 17:54:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll
[2004.04.14 17:53:52 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\retlongpfadnameB.dll
[2003.10.02 17:21:24 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\dsci.dll
[2003.03.16 14:20:22 | 000,044,480 | ---- | C] () -- C:\WINDOWS\System32\MATRIX16.DLL
[2002.05.31 09:04:00 | 000,495,616 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll
[2001.03.06 14:08:30 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\gidReg.dll
[1999.01.14 04:10:00 | 000,036,352 | ---- | C] () -- C:\WINDOWS\System32\SX32W.DLL
[1998.07.11 23:13:00 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
 
========== LOP Check ==========
 
[2010.06.04 11:13:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\3rd Eye Solutions
[2009.08.12 07:38:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Elka Shared
[2010.02.09 10:59:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2010.06.24 09:26:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GAEB-Viewer
[2009.11.24 13:58:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GKsrv
[2010.03.08 13:42:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Medialon
[2009.11.30 10:32:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MediaMatrix
[2010.10.08 09:27:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2009.11.20 12:34:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EIBA sc
[2010.02.09 11:02:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\elsterformular
[2009.06.16 10:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Foxit
[2009.11.24 13:58:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\GAEB-Viewer
[2009.11.24 13:58:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\GKsrv
[2010.06.08 16:45:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\IPP2
[2009.06.18 08:46:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org
[2010.10.04 15:29:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TeamViewer
[2010.01.05 12:08:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Thunderbird
[2010.01.21 15:01:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TPDesign4
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 171 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
< End of report >

--- --- ---

Kann mir jemand weiterhelfen? Die Rechner verhalten sich ansonsten unauffällig; ich habe ja die Hoffnung, daß es sich um einen Antivir Fehlalarm handelt.

Gruß

ich

cosinus · 08.10.2010, 20:10

Gibt es noch weitere Logs von Malwarebytes? Wäre sehr sinnfrei, wenn Du nur das ohne Funde gepostet hättest!

oelli · 11.10.2010, 07:57

Hallo,

ich habe beide PCs mit Malwarebytes Vollsuche geprüft, und es gibt keinen Fund. Das wundert mich ja so. Natürlich habe ich die MBAM vorher aktualisiert.

cosinus · 11.10.2010, 09:51

Zitat:

FF - prefs.js..network.proxy.http: "192.168.0.101"
FF - prefs.js..network.proxy.http_port: 800

Surfst Du wirklich über einen Proxy, ist das gewollt?

Das ist nicht rein zufällig ein Büro-PC?

oelli · 11.10.2010, 13:31

Nee, eigentlich nicht über Proxy. Die Adresse 192.168.0.101 ist bei mir im LAN kein PC, sondern eine Mediensteuerung für Licht, Video, etc.

Gruß

ich

cosinus · 11.10.2010, 19:09

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
FF - prefs.js..network.proxy.http: "192.168.0.101"
FF - prefs.js..network.proxy.http_port: 800
O3 - HKLM\..\Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No CLSID value found.
O20 - HKCU Winlogon: Shell - (硅汰牯牥攮數DOWS\S) - File not found
@Alternate Data Stream - 171 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
:Commands
[purity]
[resethosts]
[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

oelli · 12.10.2010, 16:14

Moin,

so hab ich gemacht. Hier der Log:

All processes killed
========== OTL ==========
Prefs.js: "192.168.0.101" removed from network.proxy.http
Prefs.js: 800 removed from network.proxy.http_port
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:硅汰牯牥攮數DOWS\S deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

FC5A2B2 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8 deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: JO
->Temp folder emptied: 794730559 bytes
->Temporary Internet Files folder emptied: 37027857 bytes
->Java cache emptied: 81968371 bytes
->FireFox cache emptied: 40865398 bytes
->Flash cache emptied: 25101 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33172 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352202 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 193409736 bytes
RecycleBin emptied: 4345962403 bytes

Total Files Cleaned = 5.242,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10122010_165205

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_270.dat moved successfully.

Registry entries deleted on Reboot...

cosinus · 13.10.2010, 09:21

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

oelli · 19.10.2010, 07:36

Hallo,

hier der ComboFix Log:

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-10-18.03 - JO 19.10.2010   8:30.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3583.2936 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\JO\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ReadMe.txt

.
(((((((((((((((((((((((   Dateien erstellt von 2010-09-19 bis 2010-10-19  ))))))))))))))))))))))))))))))
.

2010-10-19 06:24 . 2010-10-19 06:24	--------	d-----w-	c:\programme\CCleaner
2010-09-30 08:40 . 2010-09-30 08:40	707418	----a-w-	c:\windows\unins000.exe
2010-09-21 08:26 . 2010-09-21 08:26	--------	d-----w-	c:\programme\Crestron

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mediencenter Software"="c:\programme\Mediencenter\tonline.exe" [2008-10-31 880712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2005-05-27 310272]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Nokia Tray Application"="c:\programme\Gemeinsame Dateien\Nokia\NCLTools\NclTray.exe" [2002-04-29 401408]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-03-10 77824]
"FileZilla Server Interface"="c:\programme\FileZilla Server\FileZilla Server Interface.exe" [2009-12-30 1208832]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Lantronix UBox USB Device Server Task.lnk - c:\programme\Lantronix\UBox\nhciTaskL.exe [2009-10-28 102400]
OKI LPR Utility.lnk - c:\programme\Okidata\OKI LPR Utility\okilpr.exe [2009-6-15 151552]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\NPortAdminSuite\\bin\\npadmer.exe"=
"c:\\Programme\\Claris Corp\\FileMaker Pro 4.0\\FileMaker Pro.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Gemeinsame Dateien\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Programme\\Gemeinsame Dateien\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe"=
"c:\\Programme\\Aston\\WinSwitch3\\WSEDITOR.exe"=
"c:\\Programme\\Aston\\WinSwitch3\\WSKERNEL.exe"=
"c:\\Programme\\EIB-Programme\\Power-Tool\\ToolBApp.exe"=
"c:\\Programme\\IPP\\ipp.bin"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\Programme\\Ets\\EtsNg.exe"=
"c:\\Programme\\Gemeinsame Dateien\\EIBA sc\\Falcon\\Falcon.exe"=
"c:\\Programme\\MediaMatrix\\NWare 1.5.0\\pandad.exe"=
"c:\\Programme\\MediaMatrix\\NWare 1.5.0\\NWare.exe"=
"c:\\Programme\\MediaMatrix\\NWare 1.5.0\\pion_emulator.exe"=
"c:\\Programme\\GIRA\\HS+FS\\exp232\\DE\\hilfe.exe"=
"c:\\Programme\\Nexia\\Nexia.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Programme\\GIRA\\HS+FS\\exp232\\DE\\experte.exe"=
"c:\\Programme\\Medialon Manager 3\\MedialonManager.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\Programme\\OpenVPN\\bin\\openvpn.exe"=
"c:\\Programme\\GIRA\\HS+FS\\exp240\\DE\\hilfe.exe"=
"c:\\Programme\\Dataton\\WATCHOUT 4\\WATCHMAKER.exe"=
"c:\\Programme\\Medialon\\Medialon Manager 5\\MXM\\AppRemote.exe"=
"c:\\Programme\\Dataton\\WATCHOUT 4\\WATCHPOINT.EXE"=
"c:\\Programme\\Medialon\\Medialon Manager 5\\MedialonManager.exe"=
"c:\\Programme\\TeamViewer\\Version5\\TeamViewer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"548:TCP"= 548:TCP:Apple Share IP
"548:UDP"= 548:UDP:Apple Share IP
"5800:TCP"= 5800:TCP:VNC
"5900:TCP"= 5900:TCP:VNC
"10010:TCP"= 10010:TCP:UBOX
"10010:UDP"= 10010:UDP:UBOX

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [19.06.2009 10:05 218592]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [18.05.2010 09:14 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [18.05.2010 09:14 59664]
R1 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [20.01.2010 10:39 25680]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [19.06.2009 10:05 233136]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [05.11.2009 12:03 108289]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\programme\Spyware Doctor\BDT\BDTUpdateService.exe [04.01.2010 11:56 112592]
R2 npdrv;npdrv;c:\windows\system32\drivers\npdrv.sys [29.10.2003 16:41 60944]
R2 SentinelKeysServer;Sentinel Keys Server;c:\programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [21.03.2008 01:20 327800]
R2 thomedav;TOFS File System;c:\windows\system32\drivers\thomedav.sys [01.07.2009 15:22 83072]
R3 NHCIMONO_L;NHCIMONO_L;c:\windows\system32\drivers\nhcimonoL.sys [28.10.2009 13:11 54016]
R3 Pei10Wdm;PEI10 Protokoll Treiber;c:\windows\system32\drivers\Pei10Wdm.sys [15.08.2002 09:20 35547]
R3 Pei16Wdm;PEI16 Protokoll Treiber;c:\windows\system32\drivers\Pei16Wdm.sys [19.09.2002 21:07 34683]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [18.05.2010 09:14 33552]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [15.06.2009 11:40 845184]
S3 ElgTaDrv;elmeg USB Device Driver;c:\windows\system32\drivers\ElgTaDrv.sys [28.10.2009 13:09 73660]
S3 eusk3usb;SmartKey 3 USB;c:\windows\system32\drivers\eusk3usb.sys [08.03.2010 11:09 43968]
S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [19.06.2009 10:05 63360]
S3 sdAuxService;PC Tools Auxiliary Service;c:\programme\Spyware Doctor\pctsAuxs.exe [19.06.2009 10:03 366840]
S3 skeyusb;SmartKey USB;c:\windows\system32\drivers\skeyusb.sys [20.01.2010 10:39 52800]
S3 ThreatFire;ThreatFire;c:\programme\Spyware Doctor\TFEngine\TFService.exe service --> c:\programme\Spyware Doctor\TFEngine\TFService.exe service [?]
S3 Wibukey2;Wibukey2;c:\windows\system32\drivers\Wibukey2.sys [08.03.2010 19:30 16384]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
LSP: c:\programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll
TCP: {50A9C4EB-F707-4899-8AE5-E053B5600E5D} = 194.25.2.129
DPF: {15A7CF10-CB3E-4265-8779-9FD22619E8ED} - hxxp://192.168.0.101/XPanel.cab
DPF: {673204A0-F8B3-4090-8506-80658C5D02C6} - hxxp://192.168.0.101/nwcv3setup.exe
DPF: {6F83F815-49D0-46BB-A81C-A9D18C33A0E7} - hxxp://192.168.0.201/cab/Dibos80.CAB
DPF: {F74959B0-1779-472E-BE6E-3023E1DBEC73} - hxxp://192.168.0.101/XInit.cab
FF - ProfilePath - c:\dokumente und einstellungen\JO\Anwendungsdaten\Mozilla\Firefox\Profiles\ilqxafgf.default\
FF - plugin: c:\programme\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
AddRemove-{5C8AE145-C9F7-4883-9750-7ECD2B41CCCA} - c:\programme\InstallShield Installation Information\{5C8AE145-C9F7-4883-9750-7ECD2B41CCCA}\setup.exe


.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(908)
c:\windows\system32\thomevnp.dll
c:\programme\Spyware Doctor\TFEngine\TFMon.dll
c:\programme\Spyware Doctor\TFEngine\TFRK.dll

- - - - - - - > 'lsass.exe'(972)
c:\programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll
.
Zeit der Fertigstellung: 2010-10-19  08:33:16
ComboFix-quarantined-files.txt  2010-10-19 06:33

Vor Suchlauf: 13 Verzeichnis(se), 105.389.481.984 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 105.487.355.904 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 47AE1ADB521DD48BAA8DC789C4461B28

--- --- ---

cosinus · 19.10.2010, 09:38

Zitat:

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

2 residente Virenscanner sind nicht gerade optimal, die könenn sich gegenseitig stören.
Ich weiß nicht wie das beim Spyware Doctor ist, aber zB Malwarebytes wurde entwickelt, um mit gängigen Virenscannern parallel zu arbeiten.

Zudem erzeugt AntiVir gerade Fehlalarme bei den Tempdateien, die von SpywareDoctor angelegt werden, daher kommen wohl auch die XPACK-Funde bei Dir...

oelli · 28.10.2010, 07:53

Hallo,

habe seit ein paar Tagen keine Meldungen mehr, seitdem ich Spyware Doctor stillgelegt habe.

Leistet Malwarebytes Anti Malware das gleiche wie Spyware Doctor?

Außerdem möchte ich mich ganz herzlich für deinen Einsatz bedanken. Ich finde es großartig, daß ihr euch die Zeit nehmt, uns Normalos bei solchen Problemen zu helfen!

Gruß

Jens

oelli · 01.11.2010, 15:42

Hallo,

ich habe jetzt auch meinen 2. Rechner (Lappi) gescannt, auf dem ich das gleiche Problem habe. Hier die Ergbenisse von MBAM(aktuell) und OTL.:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 5012

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

01.11.2010 14:24:34
mbam-log-2010-11-01 (14-24-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 370936
Laufzeit: 2 Stunde(n), 55 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
D:\00-000 archivierte Projekte\08-097 EXPO 2008\Float Development JOCONTROL\GIS Development\01 Install\ExpoControl.exe (Spyware.Passwords) -> No action taken.
D:\00-000 archivierte Projekte\08-097 EXPO 2008\Float Development JOCONTROL\GIS Development\alt\ExpoControl.exe (Spyware.Passwords) -> No action taken.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macromedia\SwUpdate\Local.dtd (Malware.Trace) -> No action taken.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macromedia\SwUpdate\Ui.dtd (Malware.Trace) -> No action taken.
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 01.11.2010 15:32:34 - Run 1
OTL by OldTimer - Version 3.2.12.1     Folder = D:\Installer
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 56,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 30,00 Gb Total Space | 1,74 Gb Free Space | 5,79% Space Free | Partition Type: NTFS
Drive D: | 112,51 Gb Total Space | 40,05 Gb Free Space | 35,59% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: THINKPAD
Current User Name: JO
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - D:\Installer\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\FRITZ!Fernzugang\nwtsrv.exe (AVM Berlin)
PRC - C:\Programme\FRITZ!Fernzugang\certsrv.exe (AVM Berlin)
PRC - C:\Programme\FRITZ!Fernzugang\avmike.exe (AVM Berlin)
PRC - C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Spyware Doctor\TFEngine\TFService.exe (PC Tools)
PRC - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (SafeNet, Inc)
PRC - C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (SafeNet, Inc.)
PRC - C:\Programme\Lenovo\NPDIRECT\tpfnf7sp.exe (Lenovo Group Limited)
PRC - C:\WINDOWS\system32\TpShocks.exe (Lenovo.)
PRC - C:\WINDOWS\system32\TPHDEXLG.exe (Lenovo.)
PRC - C:\Programme\Okidata\OKI LPR Utility\Okilpr.exe ()
PRC - C:\Programme\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\Client Security Solution\tvttcsd.exe (IBM)
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
PRC - C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo )
PRC - C:\Programme\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo )
PRC - C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo )
PRC - C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
PRC - c:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
PRC - C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo)
PRC - C:\Programme\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Programme\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
PRC - C:\Programme\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
PRC - C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited)
PRC - C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
PRC - c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe ()
PRC - C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited)
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Logger\logmon.exe ()
PRC - C:\Programme\Lenovo\Rescue and Recovery\ADM\IUService.exe ()
PRC - C:\WINDOWS\system32\IPSSVC.EXE (Lenovo Group Limited)
PRC - C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
PRC - C:\Programme\Lenovo\AwayTask\AwaySch.EXE (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited)
PRC - C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation)
PRC - C:\Programme\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation)
PRC - C:\Programme\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - c:\Programme\Gemeinsame Dateien\Installshield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Installshield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Installshield\UpdateService\agent.exe (InstallShield Software Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\Installer\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\Spyware Doctor\TFEngine\TFWAH.dll (PC Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvwrsde.dll (NVIDIA Corporation)
MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (nwtsrv) -- C:\Programme\FRITZ!Fernzugang\nwtsrv.exe (AVM Berlin)
SRV - (certsrv) -- C:\Programme\FRITZ!Fernzugang\certsrv.exe (AVM Berlin)
SRV - (avmike) -- C:\Programme\FRITZ!Fernzugang\avmike.exe (AVM Berlin)
SRV - (sdCoreService) -- C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) -- C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ThreatFire) -- C:\Programme\Spyware Doctor\TFEngine\TFService.exe (PC Tools)
SRV - (Browser Defender Update Service) -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (OpenVPNService) -- C:\Programme\OpenVPN\bin\openvpnserv.exe ()
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (SolidWorks Licensing Service) -- C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (SentinelProtectionServer) -- C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (SafeNet, Inc)
SRV - (SentinelKeysServer) -- C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (SafeNet, Inc.)
SRV - (LVSrvLauncher) -- C:\Programme\Gemeinsame Dateien\logishrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (TPHDEXLGSVC) -- C:\WINDOWS\system32\TPHDEXLG.exe (Lenovo.)
SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (TSSCoreService) -- C:\Programme\Lenovo\Client Security Solution\tvttcsd.exe (IBM)
SRV - (ThinkVantage Registry Monitor Service) -- C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
SRV - (AcPrfMgrSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo )
SRV - (AcSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo )
SRV - (SUService) -- c:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
SRV - (IBMPMSVC) -- C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (btwdins) -- C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (TVT Scheduler) -- c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
SRV - (TVT Backup Protection Service) -- C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe ()
SRV - (TVT Backup Service) -- C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited)
SRV - (tvtnetwk) -- C:\Programme\Lenovo\Rescue and Recovery\ADM\IUService.exe ()
SRV - (IPSSVC) -- C:\WINDOWS\system32\IPSSVC.EXE (Lenovo Group Limited)
SRV - (IviRegMgr) -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Diskeeper) -- C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation)
SRV - (WinVNC4) -- C:\Programme\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (WMConnectCDS) -- C:\Programme\Windows Media Connect 2\wmccds.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (UIUSys) -- C:\WINDOWS\System32\DRIVERS\UIUSYS.SYS File not found
DRV - (pctplsg) -- C:\WINDOWS\system32\drivers\pctplsg.sys (PC Tools)
DRV - (NWIM) -- C:\WINDOWS\system32\drivers\avmnwim.sys (AVM Berlin)
DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (pctgntdi) -- C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (TfSysMon) -- C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfFsMon) -- C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (TfNetMon) -- C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (WIBUKEY) -- C:\WINDOWS\system32\drivers\WibuKey.sys (WIBU-SYSTEMS AG)
DRV - (29239862) -- C:\WINDOWS\system32\DRIVERS\29239862.sys (Kaspersky Lab)
DRV - (setup_9.0.0.722_04.10.2010_22-33drv) -- C:\WINDOWS\system32\drivers\2923986.sys (Kaspersky Lab)
DRV - (eusk3usb) -- C:\WINDOWS\system32\drivers\eusk3usb.sys (Eutron)
DRV - (29239861) -- C:\WINDOWS\system32\drivers\29239861.sys (Kaspersky Lab)
DRV - (Wibukey2) -- C:\WINDOWS\system32\drivers\Wibukey2.sys (WIBU-SYSTEMS AG)
DRV - (avmaura) -- C:\WINDOWS\system32\drivers\avmaura.sys (AVM Berlin)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (WTComSrv) -- C:\WINDOWS\system32\drivers\WTComSrv.sys (Wiesemann & Theis GmbH)
DRV - (WTLanMod) -- C:\WINDOWS\system32\drivers\WTLanMod.sys (Wiesemann & Theis GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (FTDIBUS) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) -- C:\WINDOWS\system32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (eusk2par) -- C:\WINDOWS\system32\drivers\eusk2par.sys (Aladdin Knowledge Systems Ltd.)
DRV - (Haspnt) -- C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (tvtfilter) -- C:\WINDOWS\system32\drivers\tvtfilter.sys (Lenovo)
DRV - (pmem) -- C:\WINDOWS\system32\drivers\pmemnt.sys (Microsoft Corporation)
DRV - (thomedav) -- C:\WINDOWS\system32\drivers\thomedav.sys ()
DRV - (magpsc) -- C:\WINDOWS\system32\drivers\magpsc.sys (Mobile Action Technology Inc.)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (TPPWRIF) -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS ()
DRV - (TSMAPIP) -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS ()
DRV - (slabser) -- C:\WINDOWS\system32\drivers\slabser.sys (MCCI)
DRV - (slabbus) CP210x USB Composite Device MT ct driver (WDM) -- C:\WINDOWS\system32\drivers\slabbus.sys (MCCI)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Shockprf) -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys (Lenovo.)
DRV - (TPDIGIMN) -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys (Lenovo.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) -- C:\WINDOWS\system32\drivers\lv302af.sys (Logitech Inc.)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (CprDrvr) -- C:\WINDOWS\system32\drivers\CprDrvr.sys ()
DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (IBMPMDRV) -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys (Lenovo.)
DRV - (TVTI2C) -- C:\WINDOWS\system32\drivers\tvti2c.sys (Lenovo (United States) Inc.)
DRV - (psadd) -- C:\WINDOWS\system32\drivers\psadd.sys (Lenovo (United States) Inc.)
DRV - (e1express) Intel(R) -- C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (NETw4x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (SNTNLUSB) -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (SafeNet, Inc.)
DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (IBMTPCHK) -- C:\WINDOWS\system32\drivers\IBMBLDID.sys ()
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (smihlp) SMI Helper Driver (smihlp) -- C:\Programme\Gemeinsame Dateien\ThinkVantage Fingerprint Software\Drivers\smihlp.sys (UPEK Inc.)
DRV - (TcUsb) -- C:\WINDOWS\system32\drivers\tcusb.sys (UPEK Inc.)
DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (iaStor) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (TVTPktFilter) -- C:\WINDOWS\system32\drivers\tvtpktfilter.sys (Lenovo Group Limited)
DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (NHCIMONO_L) -- C:\WINDOWS\system32\drivers\nhcimonoL.sys (Lantronix)
DRV - (btwhid) -- C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (Hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (aksusb) -- C:\WINDOWS\system32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (akshasp) -- C:\WINDOWS\system32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (PROCDD) -- C:\WINDOWS\system32\drivers\PROCDD.SYS (Lenovo Group Limited)
DRV - (TPHKDRV) -- C:\WINDOWS\system32\drivers\TPHKDRV.sys (IBM Corporation)
DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btwmodem) -- C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.)
DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLAUDFAM) -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) -- C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLACDBHM) -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (ANC) -- C:\WINDOWS\system32\drivers\ANC.sys (IBM Corp.)
DRV - (atmeltpm) -- C:\WINDOWS\system32\drivers\atmeltpm.sys (Atmel, Inc.)
DRV - (npdrv) -- C:\WINDOWS\system32\drivers\npdrv.sys (Moxa Technologies Co., Ltd. )
DRV - (EW_HID) -- C:\WINDOWS\system32\drivers\ew_hid.sys (F. Schlaps und Partner GmbH)
DRV - (EW_USB) -- C:\WINDOWS\system32\drivers\EW_USB.sys (F.Schlaps & Partner GmbH)
DRV - (Iviaspi) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (Ser2pl) -- C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (Pei16Wdm) -- C:\WINDOWS\system32\drivers\Pei16Wdm.sys (EIBA s.c.)
DRV - (Pei10Wdm) -- C:\WINDOWS\system32\drivers\Pei10Wdm.sys (EIBA s.c.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (G400) -- C:\WINDOWS\system32\drivers\G400m.sys (Matrox Graphics Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (ac97intc) Intel(r) 82801 Audiotreiber-Installationsdienst (WDM) -- C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Lenovo | MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.10.11 16:02:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.27 22:39:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.10.29 16:46:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2009.12.29 15:04:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Mozilla\Extensions
[2009.12.29 15:04:59 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.10.30 15:05:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Mozilla\Firefox\Profiles\fjel9eik.default\extensions
[2010.07.01 16:23:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Mozilla\Firefox\Profiles\fjel9eik.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.30 15:05:27 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.09.27 22:38:59 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.27 22:38:59 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.27 22:38:59 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.27 22:38:59 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.27 22:38:59 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O2 - BHO: (CPwmIEBrowserHelper Object) - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [ACTray] C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
O4 - HKLM..\Run: [AMSG] C:\Programme\ThinkVantage\AMSG\Amsg.exe (LENOVO)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AwaySch] C:\Programme\Lenovo\AwayTask\AwaySch.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [BLOG] C:\Programme\ThinkPad\Utilities\BATLOGEX.DLL ()
O4 - HKLM..\Run: [cssauth] C:\Programme\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [DiskeeperSystray] C:\Programme\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [EZEJMNAP] C:\Programme\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [ISTray] C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\Installshield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LPManager] C:\Programme\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PWRMGRTR] C:\Programme\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [SoundMAX] C:\Programme\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TPFNF7] C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\OKI LPR-Dienstprogramm.lnk = C:\Programme\Okidata\OKI LPR Utility\Okilpr.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: microsoft.com ([www.update] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Ranges: Range2 ([*] in Lokales Intranet)
O16 - DPF: {15A7CF10-CB3E-4265-8779-9FD22619E8ED} hxxp://192.168.0.101/XPanel.cab (XPanel Class)
O16 - DPF: {6F83F815-49D0-46BB-A81C-A9D18C33A0E7} hxxp://192.168.0.201/cab/Dibos80.CAB (D8_Loader.Class)
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} hxxp://192.168.0.90/activex/AMC.cab (AxisMediaControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {F74959B0-1779-472E-BE6E-3023E1DBEC73} hxxp://192.168.0.101/XInit.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ACNotify: DllName - ACNotify.dll - C:\Programme\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo )
O20 - Winlogon\Notify\psfus: DllName - C:\WINDOWS\system32\psqlpwd.dll - C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Programme\Lenovo\HOTKEY\notifyf2.dll - C:\Programme\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Programme\Lenovo\HOTKEY\tphklock.dll - C:\Programme\Lenovo\HOTKEY\tphklock.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.27 03:18:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\##192.168.50.102#MEDIALON PC Inszenierung\Shell - "" = AutoRun
O33 - MountPoints2\##192.168.50.102#MEDIALON PC Inszenierung\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\##192.168.50.102#MEDIALON PC Inszenierung\Shell\AutoRun\command - "" = M:\ws.exe -- File not found
O33 - MountPoints2\##192.168.50.102#MEDIALON PC Inszenierung\Shell\open\Command - "" = M:\ws.exe -- File not found
O33 - MountPoints2\{02afa224-024a-11de-bd94-001de09491c9}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\{5d1938cd-8998-11df-bef7-001e4cfff7c4}\Shell - "" = AutoRun
O33 - MountPoints2\{5d1938cd-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5d1938cd-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{5d1938d1-8998-11df-bef7-001e4cfff7c4}\Shell - "" = AutoRun
O33 - MountPoints2\{5d1938d1-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5d1938d1-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{5d1938d3-8998-11df-bef7-001e4cfff7c4}\Shell - "" = AutoRun
O33 - MountPoints2\{5d1938d3-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5d1938d3-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{5d1938d5-8998-11df-bef7-001e4cfff7c4}\Shell - "" = AutoRun
O33 - MountPoints2\{5d1938d5-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5d1938d5-8998-11df-bef7-001e4cfff7c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8fd08e85-f355-11dd-bd8c-001de09491c9}\Shell\AutoRun\command - "" = F:\setupSNK.exe -- File not found
O33 - MountPoints2\{bfd4d88a-9b8e-11de-be1e-001e372338d6}\Shell - "" = AutoRun
O33 - MountPoints2\{bfd4d88a-9b8e-11de-be1e-001e372338d6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfd4d88a-9b8e-11de-be1e-001e372338d6}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{c8c6c641-c8ac-11de-be46-001de09491c9}\Shell\AutoRun\command - "" = G:\cache\tmp983.exe -- File not found
O33 - MountPoints2\{c8c6c641-c8ac-11de-be46-001de09491c9}\Shell\oPEN\coMmaNd - "" = G:\cache\tmp983.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.30 16:43:37 | 000,000,000 | ---D | C] -- C:\Programme\Axis Communications
[2010.10.30 09:07:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Eigene Dateien\HS+FS Experte 2.5
[2010.10.30 09:07:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\HS+FS Experte 2.5
[2010.10.30 09:07:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Anwendungsdaten\HS+FS Experte 2.5
[2010.10.28 11:03:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macromedia
[2010.10.28 08:42:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Desktop\LOG
[2010.10.25 13:20:52 | 000,103,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSComm32.ocx
[2010.10.25 13:20:51 | 000,647,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Mscomct2.ocx
[2010.10.25 13:20:51 | 000,000,000 | ---D | C] -- C:\Programme\Kramer
[2010.10.19 14:56:17 | 000,018,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010.10.15 17:08:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2010.10.15 17:08:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Mozilla
[2010.10.14 08:27:02 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010.10.14 08:27:02 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010.10.14 08:26:52 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010.10.13 13:46:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\AVM
[2010.10.13 13:46:05 | 000,000,000 | ---D | C] -- C:\Programme\FRITZ!Fernzugang einrichten
[2010.10.13 13:36:27 | 000,000,000 | ---D | C] -- C:\Programme\FRITZ!Fernzugang
[2010.10.13 13:36:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVM
[2010.10.13 12:06:48 | 000,069,120 | R--- | C] (AVM Berlin) -- C:\WINDOWS\System32\avmadd32.dll
[2010.10.13 12:06:48 | 000,016,384 | R--- | C] (AVM Berlin GmbH) -- C:\WINDOWS\System32\avmprmon.dll
[2010.10.13 12:06:44 | 000,000,000 | ---D | C] -- C:\Programme\FRITZ!BoxPrint
[2010.10.13 12:06:44 | 000,000,000 | ---D | C] -- C:\Programme\FRITZ!Box
[2010.10.04 23:15:31 | 000,000,000 | ---D | C] -- C:\Programme\TweakNow RegCleaner
[2010.10.04 23:15:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\TweakNow RegCleaner
[2010.10.04 23:13:17 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.10.04 21:58:46 | 000,315,408 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\2923986.sys
[2010.10.04 21:58:46 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\29239861.sys
[2010.10.04 21:58:46 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\29239862.sys
[2010.10.04 21:58:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\JO\Desktop\Virus Removal Tool
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.01 15:27:43 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2010.11.01 15:27:20 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.11.01 15:27:18 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.11.01 14:39:04 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.11.01 14:29:18 | 000,025,261 | ---- | M] () -- C:\WINDOWS\System32\PROCDB.INI
[2010.11.01 14:28:41 | 000,000,380 | ---- | M] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2010.11.01 14:28:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.11.01 14:28:33 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.11.01 14:27:47 | 011,010,048 | -H-- | M] () -- C:\Dokumente und Einstellungen\JO\NTUSER.DAT
[2010.11.01 14:27:19 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\JO\ntuser.ini
[2010.10.31 11:36:55 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.10.29 16:25:33 | 000,221,731 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2010.10.29 11:18:50 | 000,004,158 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.10.27 15:49:57 | 000,000,312 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Eigene Dateien\spider.sav
[2010.10.27 12:56:41 | 000,002,652 | ---- | M] () -- C:\WINDOWS\cmvpt32.ini
[2010.10.25 13:20:53 | 000,000,752 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Desktop\K-Router.lnk
[2010.10.24 17:08:25 | 000,000,818 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2010.10.19 15:41:51 | 000,205,712 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.10.19 15:10:02 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.10.19 10:50:15 | 000,000,294 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Desktop\JOCONTROL auf JCPC02 (Z).lnk
[2010.10.11 10:25:28 | 000,000,026 | ---- | M] () -- C:\WINDOWS\CsvImExport.INI
[2010.10.08 10:28:44 | 000,089,680 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\JO\MSSSerif120.fon
[2010.10.07 11:36:43 | 001,074,394 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.10.07 11:36:43 | 000,477,636 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.10.07 11:36:43 | 000,457,002 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.10.07 11:36:43 | 000,092,848 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.10.07 11:36:43 | 000,077,964 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.10.06 15:06:33 | 000,326,944 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Desktop\75514001_td-v0.pdf
[2010.10.05 07:56:28 | 000,067,574 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Desktop\IP & MAC address cms.sh.local 2010-10-01.pdf
[2010.10.04 23:15:45 | 000,039,968 | ---- | M] () -- C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.10.25 13:20:53 | 000,000,752 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Desktop\K-Router.lnk
[2010.10.06 15:06:28 | 000,326,944 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Desktop\75514001_td-v0.pdf
[2010.10.05 07:56:28 | 000,067,574 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Desktop\IP & MAC address cms.sh.local 2010-10-01.pdf
[2010.08.20 11:35:49 | 001,087,968 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.07.08 09:33:32 | 000,000,275 | ---- | C] () -- C:\WINDOWS\{D9C15833-DBC0-418C-B27E-921E2534F834}_WiseFW.ini
[2010.06.21 19:05:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WhereIamExe.INI
[2010.06.20 15:29:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\GpsPlatformExe.INI
[2010.04.28 08:09:23 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010.04.28 08:09:23 | 000,763,832 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010.02.24 18:44:04 | 000,066,560 | ---- | C] () -- C:\WINDOWS\System32\usbdrv.sys
[2010.02.24 18:44:03 | 000,131,580 | ---- | C] () -- C:\WINDOWS\System32\DMXCRD32.DLL
[2010.02.24 18:44:03 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\SKEYVDD.DLL
[2010.02.02 09:52:43 | 000,034,639 | ---- | C] () -- C:\WINDOWS\System32\drivers\axblan.sys
[2010.01.22 09:23:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Comms.INI
[2010.01.22 09:18:46 | 000,001,368 | ---- | C] () -- C:\WINDOWS\Soundweb.ini
[2010.01.07 09:08:05 | 000,009,552 | ---- | C] () -- C:\WINDOWS\System32\inetwh16.dll
[2009.12.26 16:21:18 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\VPN.dll
[2009.07.28 13:02:06 | 000,000,161 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Crestron-KNX-Gate.log
[2009.05.07 11:20:31 | 000,106,047 | ---- | C] () -- C:\WINDOWS\System32\NWNETAPI.DLL
[2009.05.07 11:20:31 | 000,035,308 | ---- | C] () -- C:\WINDOWS\System32\NWIPXSPX.DLL
[2009.03.24 11:17:36 | 000,146,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\CprDrvr.sys
[2009.02.23 16:39:09 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\mmatrix.dll
[2009.01.09 10:42:11 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BJE_RC01PlugIn.INI
[2008.12.06 21:06:33 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CsvImExport.INI
[2008.12.06 13:19:57 | 000,000,115 | ---- | C] () -- C:\WINDOWS\CodeControl.INI
[2008.12.06 12:45:36 | 000,479,301 | ---- | C] () -- C:\WINDOWS\System32\DOWCommon.dll
[2008.12.06 12:45:36 | 000,083,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\thomedav.sys
[2008.12.06 12:45:36 | 000,061,514 | ---- | C] () -- C:\WINDOWS\System32\thomevnp.dll
[2008.11.12 17:06:20 | 000,001,028 | ---- | C] () -- C:\WINDOWS\WinScript.INI
[2008.11.12 16:55:32 | 000,000,142 | ---- | C] () -- C:\WINDOWS\BINLOOP.INI
[2008.10.13 14:17:56 | 000,002,652 | ---- | C] () -- C:\WINDOWS\cmvpt32.ini
[2008.10.10 13:06:07 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\SSLeay32.dll
[2008.10.10 13:06:07 | 000,109,568 | ---- | C] () -- C:\WINDOWS\System32\GCL52FW.DLL
[2008.10.10 13:03:15 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\Cmpnl32.dll
[2008.10.10 13:03:15 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\GCL52FWZ.DLL
[2008.10.10 13:03:15 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\CMUpdate.dll
[2008.09.26 12:06:06 | 000,037,376 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.09.08 15:41:00 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat
[2008.09.05 18:31:59 | 000,000,818 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008.09.04 08:45:04 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\dsci.dll
[2008.09.03 15:41:18 | 000,004,158 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008.09.03 15:31:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2008.09.03 11:26:51 | 000,221,731 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.09.03 11:11:55 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2008.09.03 11:11:52 | 000,006,836 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.INI
[2008.09.03 11:09:42 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\nhciClassInstallL.dll
[2008.09.03 10:14:38 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2008.09.03 08:10:09 | 000,000,135 | ---- | C] () -- C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2008.09.03 08:03:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008.09.03 07:52:25 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2008.09.03 07:45:29 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008.09.03 07:43:49 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2008.09.03 07:43:49 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2008.09.03 07:43:49 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2008.09.03 07:43:48 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2008.09.03 07:43:48 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2008.09.03 07:43:48 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2008.09.03 07:35:11 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.09.03 07:35:11 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.09.03 07:35:11 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.09.03 07:35:10 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.09.03 07:31:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008.09.03 07:28:19 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2007.10.12 00:11:58 | 000,059,500 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2007.08.22 09:39:22 | 000,105,848 | ---- | C] () -- C:\WINDOWS\System32\CprIf.dll
[2007.07.27 07:37:40 | 000,025,261 | ---- | C] () -- C:\WINDOWS\System32\PROCDB.INI
[2007.07.27 07:37:29 | 000,000,380 | ---- | C] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2007.02.27 16:48:38 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007.02.27 16:29:32 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2007.01.16 16:12:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2006.09.05 13:20:36 | 000,079,400 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL
[2006.02.03 09:02:58 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\haspds_msi.dll
[2006.01.27 18:18:01 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006.01.27 18:05:14 | 000,002,963 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.12.21 16:57:36 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll
[2005.12.21 16:57:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll
[2005.12.21 16:54:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll
[2005.09.29 13:16:12 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\strtstop.dll
[2005.02.17 10:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005.02.17 10:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2004.04.14 16:53:52 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\retlongpfadnameB.dll
[2003.03.16 13:20:22 | 000,044,480 | ---- | C] () -- C:\WINDOWS\System32\MATRIX16.DLL
[2002.11.15 11:48:58 | 000,107,520 | ---- | C] () -- C:\WINDOWS\System32\retlongpfadnameA.dll
[2002.11.15 11:48:58 | 000,107,520 | ---- | C] () -- C:\WINDOWS\System32\retlongpfadname.dll
[2001.11.14 11:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.06.10 08:51:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\3rd Eye Solutions
[2010.10.14 13:11:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVM
[2008.09.03 11:16:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Elka Shared
[2009.07.28 13:01:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ELKA-Elektronik GmbH
[2008.12.02 19:29:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\espionServerData
[2009.04.14 09:31:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GAEB-Viewer
[2009.03.06 16:38:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN
[2009.04.14 09:31:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GKsrv
[2008.09.03 10:41:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lenovo
[2010.03.30 15:03:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Medialon
[2009.02.23 18:54:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MediaMatrix
[2008.09.03 07:51:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC-Doctor
[2010.07.08 10:16:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Power-Tool
[2010.11.01 15:27:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2008.09.03 07:58:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UIB
[2010.01.13 09:10:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Wiesemann & Theis
[2010.09.17 08:53:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.10.13 13:46:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\AVM
[2010.02.24 09:52:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Centra
[2008.09.05 12:22:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\EIBA sc
[2009.07.28 13:02:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\ELKA-Elektronik GmbH
[2009.12.29 15:53:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Foxit Software
[2009.04.14 09:31:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\GAEB-Viewer
[2009.03.06 16:28:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\GARMIN
[2009.04.14 09:31:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\GKsrv
[2009.02.25 16:53:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\InterVideo
[2009.09.22 07:52:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\IPP
[2010.10.28 10:17:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\IPP2
[2010.02.22 16:23:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Kaxaml
[2008.09.03 08:13:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Leadertech
[2008.09.03 07:58:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Lenovo
[2010.06.20 15:25:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Mobile Action
[2009.11.18 16:37:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\OpenOffice.org
[2010.02.24 09:53:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Saba
[2010.10.12 14:53:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\TeamViewer
[2009.12.29 15:04:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\Thunderbird
[2010.01.07 11:30:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\TPDesign4
[2010.10.04 23:15:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\JO\Anwendungsdaten\TweakNow RegCleaner
[2010.11.01 15:27:43 | 000,000,316 | ---- | M] () -- C:\WINDOWS\Tasks\PMTask.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 88 bytes -> C:\hsclient.exe:SummaryInformation
@Alternate Data Stream - 159 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 01.11.2010 15:32:34 - Run 1
OTL by OldTimer - Version 3.2.12.1     Folder = D:\Installer
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 56,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 30,00 Gb Total Space | 1,74 Gb Free Space | 5,79% Space Free | Partition Type: NTFS
Drive D: | 112,51 Gb Total Space | 40,05 Gb Free Space | 35,59% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: THINKPAD
Current User Name: JO
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5800:TCP" = 5800:TCP:*:Enabled:VNC
"5900:TCP" = 5900:TCP:*:Enabled:VNC
"10001:TCP" = 10001:TCP:*:Enabled:UBOX
"10010:TCP" = 10010:TCP:*:Enabled:Lantronix UBox
"10010:UDP" = 10010:UDP:*:Enabled:Lantronix UBox
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Temp\alg.exe" = C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Temp\alg.exe:*:Enabled:Application Layer Gateway Service -- File not found
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Java\jre1.6.0_07\bin\javaw.exe" = C:\Programme\Java\jre1.6.0_07\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- File not found
"C:\Programme\MediaMatrix\NWare 1.5.0\pandad.exe" = C:\Programme\MediaMatrix\NWare 1.5.0\pandad.exe:*:Enabled:pandad -- ()
"C:\Programme\MediaMatrix\NWare 1.5.0\NWare.exe" = C:\Programme\MediaMatrix\NWare 1.5.0\NWare.exe:*:Enabled:NWare Application -- (Peavey Electronics)
"C:\Programme\MediaMatrix\NWare Kiosk 1.5.0\pandad.exe" = C:\Programme\MediaMatrix\NWare Kiosk 1.5.0\pandad.exe:*:Disabled:pandad -- ()
"C:\Programme\MediaMatrix\NWare Kiosk 1.5.0\NWare.exe" = C:\Programme\MediaMatrix\NWare Kiosk 1.5.0\NWare.exe:*:Enabled:NWare Application -- (Peavey Electronics)
"C:\Programme\Alcorn McBride Inc\Binloop\Binloop.exe" = C:\Programme\Alcorn McBride Inc\Binloop\Binloop.exe:*:Enabled:Binloop Configuration -- (Alcorn McBride, Inc.)
"C:\Programme\MediaMatrix\NWare 1.5.0\pion_emulator.exe" = C:\Programme\MediaMatrix\NWare 1.5.0\pion_emulator.exe:*:Enabled:pion_emulator -- ()
"C:\Crestron\Simpl\cmdnld.dll" = C:\Crestron\Simpl\cmdnld.dll:*:Enabled:cmdnld -- File not found
"C:\Crestron\VtPro-e\CMDnld.dll" = C:\Crestron\VtPro-e\CMDnld.dll:*:Enabled:CMDnld -- File not found
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Claris Corp\FileMaker Pro 4.0\FileMaker Pro.exe" = C:\Programme\Claris Corp\FileMaker Pro 4.0\FileMaker Pro.exe:*:Enabled:FileMaker Pro -- (Claris Corporation)
"C:\Programme\Mediencenter\tonline.exe" = C:\Programme\Mediencenter\tonline.exe:*:Enabled:Mediencenter Software -- (Deutsche Telekom AG)
"C:\totalcmd\TOTALCMD.EXE" = C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows -- (C. Ghisler & Co.)
"D:\Installer\EIB\Hersteller\BAB-TEC\eibPort\bmxClient\BMXClient.exe" = D:\Installer\EIB\Hersteller\BAB-TEC\eibPort\bmxClient\BMXClient.exe:*:Enabled:BMX Client Werkzeug -- (babtec)
"C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Apps\2.0\O12JBZCG.PVV\N5X30XE6.N7B\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe" = C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Apps\2.0\O12JBZCG.PVV\N5X30XE6.N7B\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe:*:Enabled:FRITZ!Box USB-Fernanschluss -- (AVM Berlin)
"C:\Programme\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe" = C:\Programme\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe:*:Enabled:DeviceInstaller -- (Lantronix)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Audia\Audia.exe" = C:\Programme\Audia\Audia.exe:*:Enabled:Audia System Software Executable -- (Biamp Systems)
"C:\Programme\Gemeinsame Dateien\EIBA sc\Eagle\SybaseRT8\Win32\rteng8.exe" = C:\Programme\Gemeinsame Dateien\EIBA sc\Eagle\SybaseRT8\Win32\rteng8.exe:*:Disabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\WINDOWS\system32\javaw.exe" = C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Ets\EtsNg.exe" = C:\Programme\Ets\EtsNg.exe:*:Enabled:ETS3 Professional -- (KNX Association)
"C:\Programme\Gira\HS+FS\exp232\DE\hilfe.exe" = C:\Programme\Gira\HS+FS\exp232\DE\hilfe.exe:*:Enabled:hilfe -- ()
"C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe" = C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe:*:Enabled:Sentinel Protection Server -- (SafeNet, Inc)
"C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe" = C:\Programme\Gemeinsame Dateien\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe:*:Enabled:Sentinel Keys Server -- (SafeNet, Inc.)
"C:\Programme\NPortAdminSuite\bin\npadmer.exe" = C:\Programme\NPortAdminSuite\bin\npadmer.exe:*:Enabled:npadmer -- ()
"C:\Programme\Gemeinsame Dateien\EIBA sc\Falcon\Falcon.exe" = C:\Programme\Gemeinsame Dateien\EIBA sc\Falcon\Falcon.exe:*:Enabled:Falcon -- (KNX Association)
"C:\Programme\Microsoft ActiveSync\wcescomm.exe" = C:\Programme\Microsoft ActiveSync\wcescomm.exe:*:Enabled:Connection Manager -- File not found
"C:\Programme\Gira\HS+FS\exp232\DE\experte.exe" = C:\Programme\Gira\HS+FS\exp232\DE\experte.exe:*:Enabled:experte -- ()
"C:\Programme\AMX Control Disc\NetLinx Studio\NSX.exe" = C:\Programme\AMX Control Disc\NetLinx Studio\NSX.exe:*:Enabled:NetLinx Studio Application -- (AMX LLC)
"C:\Programme\AMX Control Disc\TPDesign4\TPDesign4.exe" = C:\Programme\AMX Control Disc\TPDesign4\TPDesign4.exe:*:Enabled:TPDesign4 2.11 -- (AMX Corporation)
"C:\Programme\OpenVPN\bin\openvpn.exe" = C:\Programme\OpenVPN\bin\openvpn.exe:*:Enabled:openvpn -- ()
"C:\Programme\HS-Tools\c-move.exe" = C:\Programme\HS-Tools\c-move.exe:*:Enabled:c-move -- (Die Homepage des HS-InfoMan)
"C:\Programme\Aston\WinSwitch3\WSKERNEL.exe" = C:\Programme\Aston\WinSwitch3\WSKERNEL.exe:*:Enabled:Classic Runtime / Professional Server -- (ASTON GmbH)
"C:\Programme\Dataton\WATCHOUT 4\WATCHMAKER.exe" = C:\Programme\Dataton\WATCHOUT 4\WATCHMAKER.exe:*:Enabled:WATCHOUT Production Software -- (Dataton AB)
"C:\Programme\Medialon\Medialon AppRemote\AppRemote.exe" = C:\Programme\Medialon\Medialon AppRemote\AppRemote.exe:*:Enabled:Medialon XObject Module -- File not found
"C:\Programme\EIB-Programme\Power-Tool\ToolBApp.exe" = C:\Programme\EIB-Programme\Power-Tool\ToolBApp.exe:*:Enabled:ToolBApp.exe -- File not found
"C:\Programme\Medialon\Medialon Manager 5\MedialonManager.exe" = C:\Programme\Medialon\Medialon Manager 5\MedialonManager.exe:*:Enabled:Medialon Manager 5.5.2 -- (Medialon)
"C:\Programme\IPP\jre\bin\javaw.exe" = C:\Programme\IPP\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Medialon\Medialon Manager 5\MXM\AppRemote.exe" = C:\Programme\Medialon\Medialon Manager 5\MXM\AppRemote.exe:*:Enabled:Medialon XObject Module -- (Medialon)
"C:\Programme\EIB-Programme2\Power-Tool\ToolBApp.exe" = C:\Programme\EIB-Programme2\Power-Tool\ToolBApp.exe:*:Enabled:ToolBApp.exe -- (Busch-Jaeger Elektro GmbH)
"C:\Programme\Gira\HS+FS\exp240\DE\hilfe.exe" = C:\Programme\Gira\HS+FS\exp240\DE\hilfe.exe:*:Enabled:hilfe -- ()
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\TP-Visu\TP-Visu-Configuration.exe" = C:\Programme\TP-Visu\TP-Visu-Configuration.exe:*:Enabled:KNXVision Projekteditor -- (Berger Informationstechnologie GmbH)
"C:\Programme\Gira\HS+FS\exp240\DE\experte.exe" = C:\Programme\Gira\HS+FS\exp240\DE\experte.exe:*:Enabled:experte -- ()
"D:\Installer\EIB\Hersteller\Busch Jaeger\Produktdatenbanken\ETS3\Dali_Inbetriebnahmetool\FalconSupport.dll" = D:\Installer\EIB\Hersteller\Busch Jaeger\Produktdatenbanken\ETS3\Dali_Inbetriebnahmetool\FalconSupport.dll:*:Enabled:FalconSupport -- (LichtVision GmbH)
"O:\fsetup.exe" = O:\fsetup.exe:*:Enabled:AVM FSetup Application -- File not found
"C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Temp\alg.exe" = C:\Dokumente und Einstellungen\JO\Lokale Einstellungen\Temp\alg.exe:*:Enabled:Application Layer Gateway Service -- File not found
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00060000-0000-1004-8002-0000C06B5161}" = WibuKey Setup (WibuKey Remove)
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00CDE1E4-B074-4534-AF8C-12BFB8382FC5}" = Vtpro-e Themes v1.3
"{04726C5B-5B34-4E00-9CA9-693A14559798}" = Lantronix DeviceInstaller 4.2.0.3 (32bit)
"{075473F5-846A-448B-BCB3-104AA1760205}" = RecordNow Data
"{08A7C6C5-394F-4335-B32F-28C938704D2F}" = Lantronix UBox USB Device Server
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message
"{11CEF287-8E26-4E6A-9D54-E3514C002CB8}" = NWare Kiosk 1.5.0
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad-Dienstprogramm 'EasyEject'
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = Dienstprogramm "ThinkPad UltraNav"
"{1B52BC01-2F6E-4FAE-BB09-1F28D2BF1D63}_is1" = Crestron_Toolbox
"{1B90A851-50F3-4040-B28B-07FAC963D50D}" = IT Tools For ETS3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13
"{28B38A2B-05F0-45C9-BB93-3A419492D43C}" = Raum- / Controlpanel Software V1.3
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{335424A2-2C4E-49F3-A066-58635269DB83}" = Sentinel Protection Installer 7.4.2
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{35695AD9-F477-478E-948F-1BAD4C986F21}" = IP-Project Macros für ETS
"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension
"{3A4DBA68-2E00-49AC-BB8A-EAF81E08F636}_is1" = Crestron KNX-Gate V1.2
"{4151A975-4546-45E5-92AD-F9AF3F68D24A}" = BJE Logic Time Plugin
"{41894269-0DD1-4C85-B3DD-1EB41B07621D}" = ThinkVantage Fingerprint Software 5.6
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{443CBE24-0679-4027-9C36-66F129E009C5}" = Crestron Database
"{44CE8AA1-3322-4722-B21E-A39C3913C10F}" = Lantronix CPR 4.1.0.2
"{465914BD-324C-4442-A9F6-E9347AB38EB8}" = OKI LPR-Dienstprogramm
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4C223826-2448-425F-9746-02395DD8450D}" = NWare 1.5.0
"{4F3C4874-D5D9-41A0-B8DE-FD7CA4690CE3}" = BPS650
"{53585E8B-4E7F-4135-B3C2-EF06337E8448}" = Medialon Manager 5
"{5448C223-8C56-41C2-A292-65DE01556B6B}" = WATCHOUT 4
"{55C28EF3-2EA3-46AB-B1E7-54B96C5A6921}" = Viewport v3.110
"{572880F8-A845-48E1-97B8-3800E9155B18}" = ETS3 Professional
"{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02
"{5A3343F2-006E-4524-9654-CD4136F9A3C4}" = b+b EIBTools / FIAVis
"{5C8AE145-C9F7-4883-9750-7ECD2B41CCCA}" = QuickVPN Client
"{5D2B8280-D31B-4D3F-A87D-21010F1D92F9}" = KNX Gate Plugin
"{5DC36978-AB9A-4A23-9C12-D90D2BB781B7}" = AVM FRITZ!Fernzugang
"{5FE1E412-D114-46E8-A891-5BE087B256A5}" = MVision
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Präsentationsdirektor
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6686F38D-1A32-4A8C-94D7-A2AA9C5F3C9B}_is1" = Crestron Device Database30.00.011.00
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" = 
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6E1557F9-8C38-4843-8170-B0131AE8B10B}" = MT-1000 Components
"{7005C601-B415-4D77-B2ED-FF40E3DACDED}" = DEAL for Windows v4.00
"{71B06E52-A152-43DE-B414-C2DD22D81A25}" = Crestron MasterInstaller
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{795A5DA8-D442-42B4-887F-8DCBC7D4AFA7}" = TP-Visu
"{796E076A-82F7-4D49-98C8-DEC0C3BC733A}" = Diskeeper Lite
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = InterVideo WinDVD Creator 3
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = ThinkPad Bluetooth with Enhanced Data Rate Software
"{857DA860-472D-483E-AC6E-B9D7DDCDB0BA}" = Microsoft Expression Design 3
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{89310CBD-CBDA-49D3-96C7-4FA340737FC5}" = Xaml Icon Viewer
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{60CC0F2D-BFA0-4851-903D-809D876DD87B}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{92404FEE-D094-4E87-B09D-5A62946838D2}" = Berker Application Update
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA13DEA-AE2C-46B5-B694-90A9A4BCC266}" = DCIP CO 600-0
"{9B42A6A6-035B-43FC-A7AC-C99F1D084384}" = SIMPL Windows v2.12
"{9D515357-3EC5-487d-0100-000000000000}" = @trip PC
"{9F0E2B6F-ACC6-4E24-A590-46BBC2823385}" = DCIP SC 600-0
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ThinkPad UltraNav Driver
"{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}" = ThinkPad Energie-Manager
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6EAB38D-1890-48FC-90C7-2741956F64AD}" = ABB Logic Time 254 EA
"{A79408B0-345D-42E8-8EB6-00597320B9E0}" = FRITZ!Box-Fernzugang einrichten
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA3983BF-9B72-484E-972A-E47BBAFA9CCA}" = VisionTools Pro-e v4.0
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = RecordNow Audio
"{ADDFADDA-37C5-11D5-8647-005004243571}" = Crestron Database v19
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = RecordNow Copy
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B57A7B53-0662-4AC0-9352-2AE2D8212A9F}" = Garmin Communicator Plugin
"{BA3C8720-9373-496F-B372-39DAA099C23D}" = DaliControl Service and Comissioning Wizard 1.2
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD84EB3B-B835-4A58-9D7F-7D0D7D3584E6}" = Kaxaml
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CD23CF22-1DA2-4351-B6C4-B1A2859C68AC}" = eDrawings 2008
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkPad
"{D9C15833-DBC0-418C-B27E-921E2534F834}" = Power-Tool
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{DDD56CD3-AA61-4403-A7A9-F813732C4210}" = ABB Logic Time 254 EA
"{DE3F165D-D00A-ws-008-ETS3}_is1" = ETS3 - Wetterstation 2v06 Gira
"{DE3F165D-D00A-ws-012-ETS3}_is1" = ETS3 - Wetterstation 2v03 Merten
"{E11AC1A7-2F59-4911-90ED-E0B55D2101D6}" = Berker TS RTR Plugin 0.0.1.0
"{E39F829B-625B-4593-B495-576472A8D0BF}" = HomeServer ETS3 Exporter
"{E44E9DB4-15C3-4050-B465-26BA0AC3DD54}" = W&T COM-Umlenkung
"{E74BC26C-A114-4AE0-990E-BBFBB9F592A4}_is1" = Crestron VisionTools Pro-e v4.2.09.03
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EE2597D7-884D-48B1-8774-B89526A426C8}" = Garmin City Navigator Europe NT 2009.11 Update
"{F055E1B2-8A05-4D87-8039-1BE979BA4193}" = Client Security Solution
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant
"{FB97A745-D1E6-435D-B942-264E94F89938}" = SIMPL+ Cross Compiler
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"080703008_is1" = InfoTerminal Touch-Client 1v00
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (03/08/2007 2.2.1.0)
"ac'tivAid" = ac'tivAid v1.3.1
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"AFPL Ghostscript 8.53" = AFPL Ghostscript 8.53
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"AlcornMcBrideBinloop" = Binloop Config
"AMX IR Database" = AMX IR Database
"Audia" = Audia
"AutoHotkey" = AutoHotkey 1.0.47.06
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"AwayTask" = Maintenance Manager
"AXIS Media Control" = AXIS Media Control
"Az008ETS3_is1" = ETS3 - Alarmzentrale Gira 1v06
"Biq006ETS3_is1" = ETS3 - B.IQ-Display Berker 1v08
"Bosch MPEG ActiveX Control" = Bosch MPEG ActiveX Control
"Bq2006ETS3_is1" = ETS3 - B.IQ-Display Berker 2v02
"Browser Defender_is1" = Browser Defender 2.0.6.15
"CCleaner" = CCleaner
"CentraClient" = Centra Client
"Clean Disk Security" = Clean Disk Security 7.81
"c-move" = c-move
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588" = ThinkPad Modem
"Crestron KNX-Gate_is1" = Crestron KNX-Gate 1.0
"ct006ETS3_is1" = ETS3 - MT 701 CT Berker 1v03
"CtIp008ETS3_is1" = ETS3 - InfoTerminal Touch Gira 1v00
"Design_6.0.1739.0" = Microsoft Expression Design 3
"Encore System_SPII Controller Update" = Encore System_SPII Controller Update
"ETS3 Professional" = ETS3 Professional
"FileMaker Pro 4.0" = FileMaker Pro 4.0
"FileTransfer 2" = FileTransfer 2
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF XP (Remove only)
"HASP4 Gerätetreiber" = HASP4 Gerätetreiber
"HS/FS QuadClient" = QuadClient 1.1 MultiLanguage
"HS_FS Experte 2.3_DE" = HS/FS Experte 2.3.2 MultiLanguage
"HS_FS Experte 2.4_DE" = HS/FS Experte 2.4 
"HS_FS Experte 2.5.100908_DE" = HS/FS Experte 2.5 
"HS_FS QuadClient 1.2" = QuadClient 1.2 
"HSMonitor" = HSMonitor v1.0.090305 RC
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{576EB17A-C8F5-4E16-B466-538F900C91A6}" = elmeg WIN-Tools V7.62
"InstallShield_{BA3C8720-9373-496F-B372-39DAA099C23D}" = DaliControl Service and Comissioning Wizard 1.2
"IP-Project" = IP-Project
"IREdit" = IREdit
"K1006ETS3_is1" = ETS3 - Tastsensor mit RTR und Display Berker 1v02
"Kramer Software" = Kramer Software
"lvdrivers_11.50" = Logitech QuickCam-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mediencenter Software_is1" = Mediencenter Software Version 6.02.15 31.10.08
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Mozilla Thunderbird (3.1.6)" = Mozilla Thunderbird (3.1.6)
"MTCTCOMM&135E&0145" = CP210x USB to UART Bridge Controller MT ct
"NetLinx Studio 2" = NetLinx Studio
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NPort Administration Suite_is1" = NPort Administration Suite Ver1.4
"NVIDIA Drivers" = NVIDIA Drivers
"OnScreenDisplay" = Anzeige am Bildschirm
"OpenVPN" = OpenVPN 2.1.1
"PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows
"PCMCIAPW" = ThinkPad PC Card Power Policy
"Picasa 3" = Picasa 3
"Power Management Driver" = ThinkPad Power Management Driver
"Power-Tool" = Power-Tool
"ProInst" = Intel(R) PROSet/Wireless Software
"PROSet" = Intel(R) PRO Network Connections Drivers
"RealVNC_is1" = VNC Free Edition 4.1.2
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Remove Multimedia Center" = Remove Multimedia Center
"Securepoint Imaging Tool_is1" = Securepoint Imaging Tool 1.9
"Soundweb" = Soundweb
"Spyware Doctor" = Spyware Doctor 7.0
"SystemRequirementsLab" = System Requirements Lab
"THEBEN PHARAO-Software-G" = THEBEN PHARAO-Software-G
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"Totalcmd" = Total Commander (Remove or Repair)
"TPDesign 3.16" = TPDesign 3.16
"TPDesign4" = TPDesign4
"Ts2B008ETS3_is1" = ETS3 - Tastsensor 2 plus Gira 2v10
"TweakNow RegCleaner_is1" = TweakNow RegCleaner
"VISPRO" = Microsoft Office Visio Professional 2007
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinScript" = WinScript
"WinSwitch3_is1" = WinSwitch
"WMCSetup" = Windows Media Connect
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"eibPort (192.168.2.161#8080)" = eibPort (192.168.2.161#8080)
"eibPort (knapp-wfer.dyndns.org#8080)" = eibPort (knapp-wfer.dyndns.org#8080)
"eibPort Application" = eibPort Application
"f6791b188d8f3ff8" = AVM FRITZ!Box USB-Fernanschluss
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
Error - 29.10.2010 11:25:41 | Computer Name = THINKPAD | Source = nview_info | ID = 11141121
Description = 
 
[ System Events ]
Error - 28.10.2010 09:27:44 | Computer Name = THINKPAD | Source = PSched | ID = 14103
Description = QoS [Adapter {13E5CD34-991E-4687-8655-2C1CD5ED046A}]:  Die Abfrage des
 Netzwerkkartentreibers nach OID_GEN_LINK_SPEED ist fehlgeschlagen.
 
Error - 29.10.2010 12:19:23 | Computer Name = THINKPAD | Source = NetBT | ID = 4307
Description = Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen
 der Anfangsadressen verweigerte.
 
Error - 29.10.2010 12:19:33 | Computer Name = THINKPAD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Treiber für parallelen Anschluss" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1058
 
Error - 29.10.2010 12:19:33 | Computer Name = THINKPAD | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Sentinel" ist vom Dienst "Treiber für parallelen Anschluss"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 29.10.2010 12:19:33 | Computer Name = THINKPAD | Source = Service Control Manager | ID = 7023
Description = Der Dienst "IPSEC-Dienste" wurde mit folgendem Fehler beendet:   %%10048
 
Error - 01.11.2010 06:22:34 | Computer Name = THINKPAD | Source = NetBT | ID = 4307
Description = Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen
 der Anfangsadressen verweigerte.
 
Error - 01.11.2010 06:22:54 | Computer Name = THINKPAD | Source = Service Control Manager | ID = 7023
Description = Der Dienst "IPSEC-Dienste" wurde mit folgendem Fehler beendet:   %%10048
 
Error - 01.11.2010 06:25:03 | Computer Name = THINKPAD | Source = System Error | ID = 1003
Description = Fehlercode 00000077, 1. Parameter 00000001, 2. Parameter 00000000,
 3. Parameter 00000000, 4. Parameter acc5ec34.
 
Error - 01.11.2010 09:28:36 | Computer Name = THINKPAD | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 01.11.2010 09:28:55 | Computer Name = THINKPAD | Source = Service Control Manager | ID = 7023
Description = Der Dienst "IPSEC-Dienste" wurde mit folgendem Fehler beendet:   %%10048
 
 
< End of report >

--- --- ---

08.10.2010, 20:10	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	TR/Crypt.XPACK.Gen3 Gibt es noch weitere Logs von Malwarebytes? Wäre sehr sinnfrei, wenn Du nur das ohne Funde gepostet hättest! __________________ __________________

TR/Crypt.XPACK.Gen3

Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPACK.Gen3