Trojaner-Board - Offen W32/Confick-O Datei rkqunq.z in System32

Trojaner-Board (https://www.trojaner-board.de/)

- Antiviren-, Firewall- und andere Schutzprogramme (https://www.trojaner-board.de/antiviren-firewall-andere-schutzprogramme/)

- -

W32/Confick-O Datei rkqunq.z in System32 (https://www.trojaner-board.de/167175-w32-confick-o-datei-rkqunq-z-system32.html)

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01

Ran by administrator at 2015-05-29 09:47:01 Run:3

Running from C:\Users\Administrator\Desktop

Loaded Profiles: administrator (Available Profiles: administrator & Classic .NET AppPool)

Boot Mode: Normal

==============================================
 

fixlist content:

*****************

C:\Windows\Tasks\At1.job

C:\Windows\Tasks\At2.job

C:\Windows\Tasks\At3.job

C:\Windows\Tasks\At4.job

C:\Windows\Tasks\At5.job

C:\Windows\Tasks\At6.job

D:\Daten\CAD\autorun.inf

D:\Daten\CAD\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\Daten\Design\autorun.inf

D:\Daten\Design\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\Daten\Einkauf\autorun.inf

D:\Daten\Einkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\Daten\GL-CON\autorun.inf

D:\Daten\GL-CON\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\Daten\Transfer\autorun.inf

D:\Daten\Transfer\EDV\Teschner\Unlocker1.9.2.exe

D:\Daten\Transfer\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\Daten\Vertrieb\autorun.inf

D:\Daten\Vertrieb\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\UserHome\azubivk\autorun.inf

D:\UserHome\azubivk\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\UserHome\eschoebel\laufwerk_h\Sicherung\laufwerk_h\7 Wonders II

D:\UserHome\eschoebel\Sich 28102011\laufwerk_h\7 Wonders II

D:\UserHome\gdesign\autorun.inf

D:\UserHome\gdesign\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\UserHome\geinkauf\autorun.inf

D:\UserHome\geinkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\UserHome\jschiller\autorun.inf

D:\UserHome\jschiller\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

D:\UserHome\kvetter\autorun.inf

D:\UserHome\kvetter\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

EmptyTemp:

         

*****************
 

C:\Windows\Tasks\At1.job => Moved successfully.

C:\Windows\Tasks\At2.job => Moved successfully.

C:\Windows\Tasks\At3.job => Moved successfully.

C:\Windows\Tasks\At4.job => Moved successfully.

C:\Windows\Tasks\At5.job => Moved successfully.

C:\Windows\Tasks\At6.job => Moved successfully.

Could not move "D:\Daten\CAD\autorun.inf" => Scheduled to move on reboot.

D:\Daten\CAD\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\Daten\Design\autorun.inf => Moved successfully.

D:\Daten\Design\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\Daten\Einkauf\autorun.inf => Moved successfully.

D:\Daten\Einkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\Daten\GL-CON\autorun.inf => Moved successfully.

D:\Daten\GL-CON\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\Daten\Transfer\autorun.inf => Moved successfully.

D:\Daten\Transfer\EDV\Teschner\Unlocker1.9.2.exe => Moved successfully.

D:\Daten\Transfer\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\Daten\Vertrieb\autorun.inf => Moved successfully.

D:\Daten\Vertrieb\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\UserHome\azubivk\autorun.inf => Moved successfully.

D:\UserHome\azubivk\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\UserHome\eschoebel\laufwerk_h\Sicherung\laufwerk_h\7 Wonders II => Moved successfully.

D:\UserHome\eschoebel\Sich 28102011\laufwerk_h\7 Wonders II => Moved successfully.

D:\UserHome\gdesign\autorun.inf => Moved successfully.

D:\UserHome\gdesign\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\UserHome\geinkauf\autorun.inf => Moved successfully.

D:\UserHome\geinkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\UserHome\jschiller\autorun.inf => Moved successfully.

D:\UserHome\jschiller\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

D:\UserHome\kvetter\autorun.inf => Moved successfully.

D:\UserHome\kvetter\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx => Moved successfully.

EmptyTemp: => Removed 4.7 MB temporary data.
 

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-05-29 10:03:29)<=
 

"D:\Daten\CAD\autorun.inf" => Could not move
 

==== End of Fixlog 10:03:29 ====

jetzt bestimmt wieder n frst? Hab ich einfacvh mal gemacht:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01

Ran by administrator (administrator) on SVDC01 on 29-05-2015 10:05:06

Running from C:\Users\Administrator\Desktop

Loaded Profiles: administrator (Available Profiles: administrator & Classic .NET AppPool)

Platform: Windows Server 2008 R2 Standard Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Microsoft Corporation) C:\Windows\System32\LogonUI.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Microsoft Corporation) C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\beremote.exe

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\bedbg.exe

(Hewlett-Packard Company) C:\Program Files\HP\Cissesrv\cissesrv.exe

() C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe

(Hewlett-Packard Company) C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe

(Citrix Systems, Inc) C:\Program Files (x86)\Citrix\Licensing\LS\CITRIX.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Licensing\LS\CtxLSPortSvc.exe

(Microsoft Corporation) C:\Windows\System32\dfsrs.exe

(Microsoft Corporation) C:\Windows\System32\dns.exe

(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\DocuWare.DesktopService.exe

(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe

(DocuWare AG) D:\Programme\DocuWare\Imaging Server\DWImagingService.exe

(DocuWare AG) D:\Programme\DocuWare\Job Processor\DocuWare.JobProcessor.exe

() D:\Programme\DocuWare\DWDatabase\bin\mysqld-nt.exe

(DocuWare AG) D:\Programme\DocuWare\OCR Service\DWOCRService.exe

(Apache Software Foundation) D:\Programme\DocuWare\Full-Text Server\bin\tomcat7.exe

(DocuWare AG) D:\Programme\DocuWare\Web Service Server\DWWebService.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe

(Microsoft Corporation) C:\Windows\System32\ismserv.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\smhstart.exe

(Microsoft) C:\Program Files (x86)\Trilead\Trilead VMX\VMXService.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\hpsmhd.exe

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\hpsmhd.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Hewlett-Packard Company) C:\hp\hpsmh\bin\rotatelogs.exe

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe

(Microsoft Corporation) C:\Windows\System32\WINS.EXE

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\pvlsvr.exe

(Hewlett-Packard Company) C:\Windows\System32\CPQNiMgt\cpqnimgt.exe

(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmgserv\cqmgserv.exe

(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmgstor\cqmgstor.exe

(Microsoft Corporation) C:\Windows\System32\dfssvc.exe

(DocuWare AG) D:\Programme\DocuWare\Authentication Server\DWAuthenticationServer.exe

(DocuWare AG) D:\Programme\DocuWare\Content Server\DWContentServer.exe

(DocuWare AG) D:\Programme\DocuWare\Notification Server\DWNotificationServer.exe

(DocuWare AG) D:\Programme\DocuWare\Thumbnail Server\DWThumbnailService.exe

(DocuWare AG) C:\Program Files (x86)\DocuWare\Upload Service\DWUploadServiceSvc.exe

(DocuWare AG) D:\Programme\DocuWare\Workflow Server\DWWorkflowServer.exe

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\beserver.exe

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\benetns.exe

(Symantec Corporation) C:\Program Files\Symantec\Backup Exec\bengine.exe

(Hewlett-Packard Company) C:\Windows\System32\CpqMgmt\cqmghost\cqmghost.exe

(Microsoft Corporation) C:\Windows\System32\vds.exe

(Microsoft Corporation) C:\Windows\SysWOW64\inetsrv\w3wp.exe

(Microsoft Corporation) C:\Windows\System32\rdpclip.exe

(Hewlett-Packard Company) C:\Program Files\HP\NCU\cpqteam.exe

(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\DocuWare.Desktop.exe

(DocuWare AG) C:\DW4\Tm2start.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(Samsung) C:\Program Files (x86)\Samsung\NetworkScan\NSCSysTrayUI.exe

(DocuWare AG) D:\Programme\DocuWare\Service Control\DocuWare.ServiceControl.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe

(DocuWare AG) C:\Program Files (x86)\DocuWare\Desktop\Plugins\Scanner\DocuWare.Desktop.CaptureService.Host.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [CPQTEAM] => C:\Program Files\HP\NCU\cpqteam.exe [73728 2010-04-27] (Hewlett-Packard Company)

HKLM\...\Run: [Seagull Drivers] => ssdal_nc.exe startup

HKLM-x32\...\Run: [TM2Start] => C:\DW4\tm2start.exe [40960 2003-10-14] (DocuWare AG)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [358336 2011-08-11] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [NSCSysTrayUI] => C:\Program Files (x86)\Samsung\NetworkScan\NSCSysTrayUI.exe [270336 2009-04-09] (Samsung)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-01-30] (Sophos Limited)

Winlogon\Notify\AtiExtEvent: Ati2evxx.dll [X]

HKLM\...\Policies\Explorer: [ShowSuperHidden] 1

HKU\S-1-5-21-2786933937-3664791864-901090552-500\...\MountPoints2: {696c30f9-c176-11df-b2c9-806e6f6e6963} - E:\Browser.exe

AppInit_DLLs: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217672 2015-05-26] (Sophos Limited)

AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2015-05-26] (Sophos Limited)

Lsa: [Notification Packages] scecli rassfm

SecurityProviders: credssp.dll,  pwdssp.dll, pwdssp.dll

Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BackGroundInfo (Autostart).lnk [2014-02-24]

ShortcutTarget: BackGroundInfo (Autostart).lnk -> C:\Program Files\BackGroundInfo\BackGroundInfo.exe (Bryce Cogswell)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DocuWare Desktop.lnk [2013-08-08]

ShortcutTarget: DocuWare Desktop.lnk -> C:\Program Files (x86)\DocuWare\Desktop\DocuWare.Desktop.exe (DocuWare AG)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DocuWare ServiceControl.lnk [2011-08-09]

ShortcutTarget: DocuWare ServiceControl.lnk -> C:\Windows\Installer\{209B0652-2701-412D-9914-6889D95E90F6}\DocuWare.ServiceControl.exe (DocuWare AG)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

ProxyServer: [S-1-5-21-2786933937-3664791864-901090552-500] => 10.49.10.99:8080

HKU\S-1-5-21-2786933937-3664791864-901090552-500\Software\Microsoft\Internet Explorer\Main,Start Page = https://localhost:8083/

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-07-17] (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-07-17] (Oracle Corporation)

DPF: HKLM {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab

DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1285946169091

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: hpapp - No CLSID Value

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2011-08-11] (Citrix Systems, Inc.)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864 2015-05-26] (Sophos Limited)

Tcpip\..\Interfaces\{21072504-8B08-48CB-B084-C90577A620E5}: [NameServer] 127.0.0.1,10.49.10.99
 

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/wpi,version=1.0 -> C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll [2010-05-14] (Microsoft Corp)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-17] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-07-17] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/wpi,version=1.1 -> C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll [2010-05-14] (Microsoft Corp)

FF Plugin-x32: @vmware.com/vmrc,version=5.1.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Firefox\np-vmware-vmrc.dll [2013-03-19] (VMware, Inc.)
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ADWS; C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe [487424 2013-01-25] (Microsoft Corporation)

R2 BackupExecAgentAccelerator; C:\Program Files\Symantec\Backup Exec\beremote.exe [1816696 2010-12-08] (Symantec Corporation)

R2 BackupExecAgentBrowser; C:\Program Files\Symantec\Backup Exec\benetns.exe [542536 2010-06-29] (Symantec Corporation)

R2 BackupExecDeviceMediaService; C:\Program Files\Symantec\Backup Exec\pvlsvr.exe [2492784 2011-04-11] (Symantec Corporation)

R2 BackupExecJobEngine; C:\Program Files\Symantec\Backup Exec\bengine.exe [10835312 2011-06-27] (Symantec Corporation)

S3 BackupExecManagementService; C:\Program Files\Symantec\Backup Exec\BackupExecManagementService.exe [124232 2010-07-08] (Symantec Corporation)

R2 BackupExecRPCService; C:\Program Files\Symantec\Backup Exec\beserver.exe [11384688 2011-05-23] (Symantec Corporation)

R2 bedbg; C:\Program Files\Symantec\Backup Exec\bedbg.exe [359240 2010-06-29] (Symantec Corporation)

S4 CIMnotify; C:\Windows\system32\CIMntfy\cimntfy.exe [268392 2010-05-26] (Hewlett-Packard Company)

R2 Cissesrv; C:\Program Files\HP\Cissesrv\cissesrv.exe [167424 2010-03-19] (Hewlett-Packard Company) [File not signed]

R2 Citrix Licensing; C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe [6907144 2009-07-02] ()

S3 Citrix_GTLicensingProv; C:\Program Files (x86)\Citrix\Licensing\LicWMI\Citrix_GTLicensingProv.exe [1836464 2010-02-22] (Citrix Systems, Inc.)

R2 CpqNicMgmt; C:\Windows\system32\CPQNiMgt\cpqnimgt.exe [9728 2010-04-28] (Hewlett-Packard Company) [File not signed]

R2 CpqRcmc3; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard Company)

R2 cpqvcagent; C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe [1307648 2010-03-25] (Hewlett-Packard Company) [File not signed]

R2 CqMgHost; C:\Windows\system32\CpqMgmt\cqmghost\cqmghost.exe [15464 2010-05-26] (Hewlett-Packard Company)

R2 CqMgServ; C:\Windows\system32\CpqMgmt\cqmgserv\cqmgserv.exe [15464 2010-05-26] (Hewlett-Packard Company)

R2 CqMgStor; C:\Windows\system32\CpqMgmt\cqmgstor\cqmgstor.exe [20992 2010-04-09] (Hewlett-Packard Company) [File not signed]

R2 CtxLSPortSvc; C:\Program Files (x86)\Citrix\Licensing\LS\CtxLSPortSvc.exe [58800 2010-02-22] (Citrix Systems, Inc.)

R2 Dfs; C:\Windows\system32\dfssvc.exe [377344 2010-11-20] (Microsoft Corporation)

R2 DFSR; C:\Windows\system32\DFSRs.exe [4518400 2010-11-20] (Microsoft Corporation)

R2 DHCPServer; C:\Windows\System32\dhcpssvc.dll [729088 2010-11-20] (Microsoft Corporation)

R2 DNS; C:\Windows\system32\dns.exe [696832 2011-12-26] (Microsoft Corporation)

R2 DWAuthenticationServer; D:\Programme\DocuWare\Authentication Server\DWAuthenticationServer.exe [24576 2013-07-02] (DocuWare AG) [File not signed]

R2 DWContentServer; D:\Programme\DocuWare\Content Server\DWContentServer.exe [20480 2013-07-02] (DocuWare AG) [File not signed]

R2 DWDesktopService; C:\Program Files (x86)\DocuWare\Desktop\DocuWare.DesktopService.exe [26112 2013-07-02] (DocuWare AG) [File not signed]

R2 DWImagingService; D:\Programme\DocuWare\Imaging Server\DWImagingService.exe [14336 2013-07-02] (DocuWare AG) [File not signed]

R2 DWJobProcessor; D:\Programme\DocuWare\Job Processor\DocuWare.JobProcessor.exe [15360 2013-07-02] (DocuWare AG) [File not signed]

R2 DWMySQL; D:\Programme\DocuWare\DWDatabase\bin\mysqld-nt.exe [5799936 2009-07-08] () [File not signed]

R2 DWNotificationServer; D:\Programme\DocuWare\Notification Server\DWNotificationServer.exe [9216 2013-07-02] (DocuWare AG) [File not signed]

R2 DWOCRService; D:\Programme\DocuWare\OCR Service\DWOCRService.exe [14848 2013-07-02] (DocuWare AG) [File not signed]

R2 DWThumbnailServer; D:\Programme\DocuWare\Thumbnail Server\DWThumbnailService.exe [8704 2013-07-02] (DocuWare AG) [File not signed]

R2 DWTomcat; D:\Programme\DocuWare\Full-Text Server\bin\tomcat7.exe [74240 2011-01-10] (Apache Software Foundation) [File not signed]

R2 DWUploadService; C:\Program Files (x86)\DocuWare\Upload Service\DWUploadServiceSvc.exe [104960 2013-07-02] (DocuWare AG) [File not signed]

R2 DWWebService; D:\Programme\DocuWare\Web Service Server\DWWebService.exe [11776 2013-07-02] (DocuWare AG) [File not signed]

R2 DWWorkflowServer; D:\Programme\DocuWare\Workflow Server\DWWorkflowServer.exe [20480 2013-07-02] (DocuWare AG) [File not signed]

S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [25600 2009-07-14] (Microsoft Corporation)

R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)

R2 IsmServ; C:\Windows\System32\ismserv.exe [59392 2010-11-20] (Microsoft Corporation)

R2 kdc; C:\Windows\System32\lsass.exe [30720 2013-09-25] (Microsoft Corporation)

S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093880 2009-08-18] (Symantec Corporation)

R2 MSSQL$BKUPEXEC; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

R2 NTDS; C:\Windows\System32\lsass.exe [30720 2013-09-25] (Microsoft Corporation)

S4 NtFrs; C:\Windows\system32\ntfrs.exe [1020416 2010-11-20] (Microsoft Corporation)

R2 ProLiantMonitor; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard Company)

S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [91648 2009-07-14] (Microsoft Corporation)

S3 sacsvr; C:\Windows\system32\sacsvr.dll [14848 2009-07-14] (Microsoft Corporation)

S3 Samsung UPD Service2; C:\Windows\System32\SUPDSvc2.exe [158208 2012-04-06] (Samsung Electronics) [File not signed]

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2015-05-26] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2015-05-26] (Sophos Limited)

R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)

R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)

R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [395560 2015-05-26] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-01-30] (Sophos Limited)

R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [1069864 2015-05-26] (Sophos Limited)

R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2015-05-26] (Sophos Limited)

S3 SrmReports; C:\Windows\system32\srmhost.exe [76288 2010-11-20] (Microsoft Corporation)

R2 SrmSvc; C:\Windows\system32\srmsvc.dll [3489792 2010-11-20] (Microsoft Corporation)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3278632 2015-05-26] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2081064 2015-05-26] (Sophos Limited)

R2 sysdown; C:\Program Files\Hewlett-Packard\iLO 3\service\ProLiantMonitor.exe [267880 2010-05-26] (Hewlett-Packard Company)

R2 SysMgmtHp; C:\hp\hpsmh\bin\smhstart.exe [2041856 2010-01-28] (Hewlett-Packard Company) [File not signed]

R2 TermServLicensing; C:\Windows\System32\lserver.dll [694784 2010-11-20] (Microsoft Corporation)

R2 TrileadVMXService; C:\Program Files (x86)\Trilead\Trilead VMX\VMXService.exe [4136344 2014-01-07] (Microsoft)

R2 vmware-converter-agent; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [479824 2013-04-09] (VMware, Inc.)

R2 vmware-converter-server; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)

R2 vmware-converter-worker; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

R2 WINS; C:\Windows\System32\wins.exe [287744 2011-08-09] (Microsoft Corporation)

S2 DWCONNECTtoToshiba; "D:\Programme\DocuWare\Client\Client Modules\CONNECT to Toshiba\CONNECTtoToshibaServer\DWCONNECTtoToshiba.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 ati2mtag; C:\Windows\System32\DRIVERS\ati2mtag.sys [2210816 2009-06-24] (ATI Technologies Inc.)

S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [75344 2013-02-22] (VMware, Inc.)

S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-05-28] (Emsisoft GmbH)

S3 CPQTeam; C:\Windows\System32\DRIVERS\cpqteam.sys [225792 2010-02-24] (Hewlett-Packard Company)

R3 CPQTeamMP; C:\Windows\System32\DRIVERS\cpqteam.sys [225792 2010-02-24] (Hewlett-Packard Company)

R0 Datascrn; C:\Windows\System32\drivers\datascrn.sys [79936 2009-07-14] (Microsoft Corporation)

R1 DfsDriver; C:\Windows\System32\drivers\dfs.sys [51776 2009-07-14] (Microsoft Corporation)

R0 DfsrRo; C:\Windows\System32\drivers\dfsrro.sys [66944 2010-11-20] (Microsoft Corporation)

R0 HpCISSs2; C:\Windows\System32\DRIVERS\HpCISSs2.sys [156776 2010-02-22] (Hewlett-Packard Company)

R3 hplto; C:\Windows\System32\DRIVERS\hplto.sys [16384 2009-05-14] (Hewlett-Packard)

R3 hpqilo3chif; C:\Windows\System32\DRIVERS\hpqilo3chif.sys [43112 2010-04-28] (Hewlett-Packard Company)

R3 hpqilo3core; C:\Windows\System32\DRIVERS\hpqilo3core.sys [44648 2010-05-09] (Hewlett-Packard Company)

R0 hpqilo3whea; C:\Windows\System32\DRIVERS\hpqilo3whea.sys [18472 2010-02-12] (Hewlett-Packard Company)

S3 ioatdma; C:\Windows\System32\Drivers\qd260x64.sys [35328 2009-06-10] (Intel Corporation)

R3 l2nd; C:\Windows\System32\DRIVERS\bxnd60a.sys [83496 2010-04-30] (Broadcom Corporation)

R0 Quota; C:\Windows\System32\drivers\quota.sys [168016 2009-07-14] (Microsoft Corporation)

S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [96320 2009-07-14] (Microsoft Corporation)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [158976 2015-05-26] (Sophos Limited)

R1 SCSIChanger; C:\Windows\System32\DRIVERS\scsichng.sys [28208 2007-08-23] (Symantec Corporation)

S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [38144 2015-05-26] (Sophos Limited)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [27904 2015-05-26] (Sophos Limited)

U5 Tape; C:\Windows\System32\Drivers\Tape.sys [29184 2009-07-14] (Microsoft Corporation)

R3 tpfilter; C:\Windows\System32\DRIVERS\tpfilter.sys [43568 2010-05-27] (Symantec Corporation)

U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-05-29 10:03 - 2015-05-29 10:05 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\2

2015-05-29 09:01 - 2015-05-29 09:01 - 02347384 _____ (ESET) C:\Users\Administrator\Desktop\esetsmartinstaller_deu.exe

2015-05-29 09:01 - 2015-05-29 09:01 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-05-28 14:34 - 2015-05-29 09:47 - 00000352 _____ () C:\Windows\Tasks\At7.job

2015-05-28 14:34 - 2015-05-28 14:34 - 00001856 _____ () C:\Windows\System32\Tasks\At7

2015-05-28 14:23 - 2015-05-28 14:23 - 00000749 _____ () C:\Users\Administrator\Desktop\Start Emsisoft Emergency Kit.lnk

2015-05-28 14:23 - 2015-05-28 14:23 - 00000000 ____D () C:\EEK

2015-05-28 14:21 - 2015-05-28 14:23 - 155048408 _____ () C:\Users\Administrator\Downloads\EmsisoftEmergencyKit.exe

2015-05-28 13:52 - 2015-05-28 13:52 - 00001850 _____ () C:\Windows\System32\Tasks\At6

2015-05-28 13:45 - 2015-05-28 13:45 - 00001854 _____ () C:\Windows\System32\Tasks\At5

2015-05-28 13:02 - 2015-05-28 13:02 - 00001856 _____ () C:\Windows\System32\Tasks\At4

2015-05-28 12:40 - 2015-05-28 12:40 - 00001852 _____ () C:\Windows\System32\Tasks\At3

2015-05-28 12:11 - 2015-05-28 12:11 - 00001856 _____ () C:\Windows\System32\Tasks\At1

2015-05-28 11:29 - 2015-05-28 11:29 - 00001852 _____ () C:\Windows\System32\Tasks\At2

2015-05-28 11:22 - 2015-05-29 10:05 - 00027763 _____ () C:\Users\Administrator\Desktop\FRST.txt

2015-05-28 10:14 - 2015-05-28 10:14 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Administrator\Desktop\tdsskiller.exe

2015-05-28 09:39 - 2015-05-28 09:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-05-28 09:38 - 2015-05-28 10:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-05-28 09:38 - 2015-05-28 09:38 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-05-28 09:37 - 2015-05-28 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-05-28 09:36 - 2015-05-28 10:05 - 00000000 ____D () C:\Users\Administrator\Desktop\mbar

2015-05-28 09:24 - 2015-05-28 09:24 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Administrator\Downloads\mbar-1.09.1.1004.exe

2015-05-28 08:51 - 2015-05-28 08:51 - 02108928 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2015-05-27 15:38 - 2015-05-27 15:38 - 05628291 _____ (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe

2015-05-27 11:20 - 2015-05-29 10:05 - 00000000 ____D () C:\FRST

2015-05-27 09:34 - 2015-05-27 09:34 - 00002759 _____ () C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk

2015-05-26 23:50 - 2015-05-27 23:59 - 00000000 _____ () C:\Windows\system32\vireng.log

2015-05-26 14:07 - 2015-05-26 14:05 - 00035624 _____ (Sophos Limited) C:\Windows\system32\SophosBootTasks.exe

2015-05-26 14:06 - 2015-05-27 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos

2015-05-26 14:06 - 2015-05-26 14:06 - 00176120 _____ (Sophos Limited) C:\Windows\system32\sdccoinstaller.dll

2015-05-26 14:06 - 2015-05-26 14:06 - 00038144 _____ (Sophos Limited) C:\Windows\system32\Drivers\sdcfilter.sys

2015-05-26 14:06 - 2015-05-26 14:06 - 00027904 _____ (Sophos Limited) C:\Windows\system32\Drivers\SophosBootDriver.sys

2015-05-26 14:05 - 2015-05-27 09:35 - 00000000 ____D () C:\ProgramData\Sophos

2015-05-26 14:05 - 2015-05-27 09:34 - 00000000 ____D () C:\Program Files (x86)\Sophos

2015-05-26 14:05 - 2015-05-26 14:05 - 00312895 _____ () C:\Users\Administrator\AppData\Local\Temp\avremove.log

2015-05-26 14:05 - 2015-05-26 14:05 - 00158976 _____ (Sophos Limited) C:\Windows\system32\Drivers\savonaccess.sys

2015-05-26 14:05 - 2015-05-26 14:05 - 00018695 _____ () C:\Users\Administrator\AppData\Local\Temp\Sophos ES setup.log

2015-05-26 14:05 - 2015-05-26 14:05 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\crt
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-05-29 10:03 - 2010-09-16 11:56 - 00000000 ____D () C:\Users\Administrator

2015-05-29 10:03 - 2010-09-16 11:44 - 01836494 _____ () C:\Windows\WindowsUpdate.log

2015-05-29 10:02 - 2009-07-14 06:49 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-05-29 10:02 - 2009-07-14 06:49 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-05-29 09:58 - 2009-09-18 03:52 - 00940408 _____ () C:\Windows\system32\perfh00A.dat

2015-05-29 09:58 - 2009-09-18 03:52 - 00234070 _____ () C:\Windows\system32\perfc00A.dat

2015-05-29 09:58 - 2009-09-18 03:45 - 00903584 _____ () C:\Windows\system32\perfh007.dat

2015-05-29 09:58 - 2009-09-18 03:45 - 00222124 _____ () C:\Windows\system32\perfc007.dat

2015-05-29 09:58 - 2009-09-18 03:39 - 00931962 _____ () C:\Windows\system32\perfh010.dat

2015-05-29 09:58 - 2009-09-18 03:39 - 00219332 _____ () C:\Windows\system32\perfc010.dat

2015-05-29 09:58 - 2009-09-18 03:33 - 00941504 _____ () C:\Windows\system32\perfh00C.dat

2015-05-29 09:58 - 2009-09-18 03:33 - 00223464 _____ () C:\Windows\system32\perfc00C.dat

2015-05-29 09:58 - 2009-07-14 07:10 - 05664028 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-05-29 09:55 - 2010-10-25 20:22 - 23648181 _____ () C:\Windows\system32\besnmp.TRC

2015-05-29 09:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv

2015-05-29 09:52 - 2010-09-29 10:53 - 00000000 ____D () C:\Windows\system32\wins

2015-05-29 09:51 - 2011-03-11 14:47 - 00000000 ____D () C:\Windows\system32\dhcp

2015-05-29 09:51 - 2010-10-06 11:18 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator

2015-05-29 09:51 - 2010-09-29 10:42 - 00000000 ____D () C:\Windows\system32\lserver

2015-05-29 09:51 - 2010-09-21 16:35 - 00006392 _____ () C:\Windows\system32\config\netlogon.dnb

2015-05-29 09:51 - 2010-09-21 16:35 - 00002293 _____ () C:\Windows\system32\config\netlogon.dns

2015-05-29 09:51 - 2010-09-20 19:57 - 00000000 ____D () C:\Windows\system32\dns

2015-05-29 09:50 - 2010-09-21 16:30 - 00000000 ____D () C:\Windows\NTDS

2015-05-29 09:50 - 2010-09-16 13:06 - 00337198 _____ () C:\Windows\PFRO.log

2015-05-29 09:50 - 2009-07-14 07:06 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-05-29 09:37 - 2012-12-03 15:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-05-28 23:35 - 2010-11-04 22:30 - 00000000 ___HD () C:\Backup Exec AOFO Store

2015-05-28 11:02 - 2010-10-25 20:09 - 00000000 ____D () C:\ProgramData\Symantec

2015-05-27 10:08 - 2010-10-25 20:31 - 25060350 _____ () C:\Windows\system32\Dashboard.log

2015-05-26 14:08 - 2011-08-09 11:36 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Temp\WEC

2015-05-18 17:24 - 2010-10-02 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\VMware

2015-05-13 14:52 - 2010-09-16 23:08 - 00240764 _____ () C:\Users\Administrator\Desktop\ADMIN-KONSOLE.msc

2015-05-06 14:55 - 2010-09-27 16:31 - 00012168 _____ () C:\Users\Administrator\volshext.log
 

==================== Files in the root of some directories =======
 

2013-08-13 09:56 - 2013-08-13 09:56 - 0646498 _____ () C:\Users\Administrator\AppData\Local\dd_ReportViewerMSI5F5F.txt

2013-08-13 09:56 - 2013-08-13 09:56 - 0031136 _____ () C:\Users\Administrator\AppData\Local\dd_ReportViewerUI5F5F.txt

2013-08-13 10:05 - 2013-08-13 10:06 - 0431252 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistMSI660B.txt

2013-08-13 10:06 - 2013-08-13 10:07 - 0441992 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistMSI66CF.txt

2013-08-13 10:05 - 2013-08-13 10:06 - 0029772 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistUI660B.txt

2013-08-13 10:06 - 2013-08-13 10:07 - 0029708 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistUI66CF.txt

2011-08-09 15:25 - 2011-08-09 15:25 - 0000064 _____ () C:\Users\Administrator\AppData\Local\DW5ReportSettings.xml

2010-09-16 23:10 - 2010-09-16 23:10 - 0007605 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg

2013-06-03 12:16 - 2013-06-03 12:16 - 0000057 _____ () C:\ProgramData\Ament.ini
 

Files to move or delete:

====================

C:\Windows\Tasks\At7.job
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-05-24 00:02
 

==================== End of log ============================

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01

Ran by administrator at 2015-05-29 10:06:11

Running from C:\Users\Administrator\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-3840907090-451933650-4095424516-500 - Administrator - Enabled)

Gast (S-1-5-21-3840907090-451933650-4095424516-501 - Limited - Disabled)

krbtgt (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.17 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0917-000001000000}) (Version: 9.17.00.0 - Igor Pavlov)

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)

ATI Display Driver (HKLM\...\ATI Display Driver) (Version: 8.24.50.5-090623a-083726C-HP - )

Citrix Lizenzierung (HKLM-x32\...\{EE7A694A-15EE-4551-A267-EBF5904DD49D}) (Version: 7.1.10007 - Citrix Systems, Inc.)

Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 13.0.0.6685 - Citrix Systems, Inc.)

Citrix XenApp Plugin für gehostete Anwendungen (HKLM-x32\...\{388C130B-0079-46B4-A0D5-DC2DD7A89A7B}) (Version: 11.0.0.5357 - Citrix Systems, Inc.)

DocuWare (HKLM-x32\...\{4B77274C-532A-4324-A9A4-1CAFE884E652}) (Version: 6.1.838.4913 - DocuWare)

DocuWare 4 (HKLM-x32\...\DocuWare) (Version:  - )

DocuWare Administration Tool (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Authentication Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Client (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Client German Language Pack (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare COLD/READ (HKLM-x32\...\COLDREAD) (Version:  - )

DocuWare ComponentInit (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Content Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Desktop (HKLM-x32\...\{A03EB08B-C706-4EC9-82FD-ACD9E372AFC4}) (Version: 6.1.838.4913 - DocuWare)

DocuWare Full Text Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Imaging Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Internal Database (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Job Processor (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Job Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Notification Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare OCR (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare OCR Service (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Platform (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Power Tools (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Service Control (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Settings (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare SettingsUI (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Stellent (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Thumbnail Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Update (HKLM-x32\...\{413E5334-A47C-48D9-8553-6389859443EE}) (Version: 6.1.838.4913 - DocuWare)

DocuWare Upload Service (HKLM-x32\...\{582A3535-F4C7-4A58-A37F-1F84EBE0B8E7}) (Version: 6.1.838.4913 - DocuWare)

DocuWare VCET (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Web Client (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Web Services (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Web Viewer (x32 Version: 6.1.838.4913 - DocuWare) Hidden

DocuWare Windows Explorer Client 64 Bit (HKLM\...\{F0ED9BD6-22C4-4D07-89B8-BBC2B2876333}) (Version: 6.1.838.4913 - DocuWare)

DocuWare Workflow Server (x32 Version: 6.1.838.4913 - DocuWare) Hidden

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Headless Server Registry Update (HKLM-x32\...\{4E5563B6-DE0A-4F3B-A5D6-15789FD12D9B}) (Version: 1.0.0.0 - Hewlett-Packard Company)

HP Array Configuration Utility (HKLM-x32\...\{74C48700-A6A7-4B3D-BD3A-C4E131CDD8E8}) (Version: 8.50.5.0 - Hewlett Packard Development Company, L.P.)

HP Array Configuration Utility CLI (HKLM-x32\...\{14A5045C-33EE-4596-AA69-8761611AE8EB}) (Version: 8.50.6.0 - Hewlett-Packard Development Company, L.P.)

HP Insight Diagnostics  Online Edition for Windows (HKLM\...\{DCEA910B-3269-4F5B-A915-D59293004751}) (Version: 8.5.0 - Hewlett-Packard Development Company, L.P.)

HP Insight Management Agents (HKLM\...\{B7B52204-2CC8-477A-9C7A-382C31070A62}) (Version: 8.50.0.0 - Hewlett-Packard Company)

HP Lights-Out Online Configuration Utility (HKLM\...\{2E97856A-345A-475D-913C-B8A78406BDF6}) (Version: 3.1.0.0 - Hewlett-Packard Development Company, L.P.)

HP Photosmart Plus B210 series - Grundlegende Software für das Gerät (HKLM\...\{1686185A-3D85-428D-8786-ACB403B9D420}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP ProLiant iLO 3 Management Controller Package (HKLM\...\HP-{15EC9FFF-3B11-4F2A-92F8-F63F33F64B31}) (Version: 3.0.0.0 - Hewlett-Packard Company)

HP ProLiant Integrated Management Log Viewer (HKLM\...\{CF222EB4-4EF7-40F4-A62B-A03E214C20DE}) (Version: 5.24.0.0 - Hewlett-Packard Company)

HP ProLiant PCI-express Power Management Update for Windows (HKLM-x32\...\{34D6E797-AA32-455D-8E65-4EBD1AC9DED7}) (Version: 1.3.0.0 - Hewlett-Packard Company)

HP Smart Array SAS/SATA Event Notification Service (HKLM\...\{0F27A9B5-63FD-43DB-8230-FFE1E9CFE2C4}) (Version: 6.20.0.64 - Hewlett-Packard Development Company, L.P.)

HP System Management Homepage (HKLM-x32\...\{3C4DF0FD-95CF-4F7B-A816-97CEF616948F}) (Version: 6.1.0 - Hewlett-Packard Company)

HP Version Control Agent (HKLM-x32\...\{5A5F45AE-0250-4C34-9D89-F10BDDEE665F}) (Version: 6.1.0.842 - Hewlett Packard Development Company, L.P.)

Java 2 Runtime Environment, SE v1.4.2_19 (HKLM-x32\...\{7148F0A8-6813-11D6-A77B-00B0D0142190}) (Version: 1.4.2_19 - Sun Microsystems, Inc.)

Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)

Java SE Development Kit 7 Update 11 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0170110}) (Version: 1.7.0.110 - Oracle)

Java(TM) 6 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216021F0}) (Version: 6.0.210 - Oracle)

Java(TM) 6 Update 32 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216032FF}) (Version: 6.0.320 - Oracle)

LiveUpdate 3.3 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.3.0.92 - Symantec Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Report Viewer Redistributable 2005 (HKLM-x32\...\Microsoft Report Viewer Redistributable 2005) (Version:  - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)

Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)

Microsoft Web Platform Installer 2.0 (HKLM\...\{59996900-0E6C-45B7-8C39-C64CB98462E4}) (Version: 2.1.1 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

MySQL Connector/ODBC 3.51 (HKLM-x32\...\{0CB3C535-1171-4A20-B549-E2CB5DEB9723}) (Version: 3.51.12 - MySQL AB)

MySQL Tools for 5.0 (HKLM-x32\...\{FCB10DE3-E190-4A7E-B06A-FAC61567ABFC}) (Version: 5.0.17 - MySQL AB, Sun Microsystems, Inc.)

Network Scan (HKLM-x32\...\{98357EB8-C10E-414A-A6EC-F3392EA97D35}) (Version:  - )

Online Plug-in (x32 Version: 13.0.0.6685 - Citrix Systems, Inc.) Hidden

PFA Server Registry Update (HKLM-x32\...\{173438F5-BD4D-47AE-9C8F-73E6BAA62624}) (Version: 1.0.0.0 - Hewlett-Packard Company)

Sophos Anti-Virus (HKLM-x32\...\{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}) (Version: 10.3.13 - Sophos Limited)

Sophos AutoUpdate (HKLM-x32\...\{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16}) (Version: 4.1.0.273 - Sophos Limited)

Sophos Remote Management System (HKLM-x32\...\{FED1005D-CBC8-45D5-A288-FFC7BB304121}) (Version: 4.0.2 - Sophos Limited)

Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.4 - Sophos Limited)

Symantec Backup Exec (Hotfix 144101) (HKLM\...\{F2A04230-7059-4CC2-B6EE-EF94F3EBAAE2}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 147674) (HKLM\...\{8032B566-B386-413F-9A10-11F9A35C9B65}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 148347) (HKLM\...\{28602F3D-426C-4719-822F-BE550838034F}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 150096) (HKLM\...\{01FAED90-7E07-4F9D-912A-F5BE34036E3C}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 153090) (HKLM\...\{B248E5CA-CE2E-4BC4-925B-0B2181556C02}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 154003) (HKLM\...\{C51A8E2A-AA2E-4796-97BC-BA9935F607A6}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 155520) (HKLM\...\{3E049DBC-1D97-48EA-9FF4-35D5DFB89092}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 159293) (HKLM\...\{69F28399-DE3B-491F-8704-101B6FAE7210}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 162839) (HKLM\...\{52A3BF51-8937-4597-BEC1-7169F5C96295}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Hotfix 164658) (HKLM\...\{25F384C2-0D2D-4CDF-B84D-1FE8E83001D0}) (Version:  - Symantec Corporation)

Symantec Backup Exec (Service Pack 1) (HKLM\...\{D6F0513A-606E-44DA-B4FF-6BF542E3790F}) (Version:  - Symantec Corporation)

Symantec Backup Exec (TM) 2010 R2 (HKLM\...\Symantec Backup Exec 13.0) (Version: 13.0.4164 - Symantec Corporation)

Symantec Backup Exec (Version: 13.0.4164 - Symantec Corporation) Hidden

Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.55a - Ghisler Software GmbH)

TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)

Trilead VM Explorer (HKLM-x32\...\{93836BB1-A704-4D3F-AB0A-CE990A2F5930}) (Version: 5.0.014.0 - Trilead AG)

Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)

VMware vCenter Converter Standalone (HKLM-x32\...\{17C3235A-A4B9-44ED-8794-54D8408F9733}) (Version: 5.1.0.1087880 - VMware, Inc.)

VMware Virtual Disk Development Kit (HKLM-x32\...\{547EB317-F9FC-4571-B66A-83B3C9D6A2C8}) (Version: 5.1.0.774844 - VMware, Inc.)

VMware vSphere Client 4.1 (HKLM-x32\...\{A0B433B1-941D-46F5-AE59-286263534232}) (Version: 4.1.0.12319 - VMware, Inc.)

VMware vSphere Client 5.1 (HKLM-x32\...\{09DC364B-A77A-49A0-972B-E43F0DACC5E3}) (Version: 5.1.0.2669 - VMware, Inc.)

VNC Free Edition 4.1.3 (HKLM-x32\...\RealVNC_is1) (Version: 4.1.3 - RealVNC Ltd.)

WinRAR 4.01 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
 

==================== Custom CLSID (Whitelisted): ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== Restore Points =========================
 

ATTENTION: System Restore is disabled

Check "winmgmt" service or repair WMI.
 
 

==================== Hosts content: ===============================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (Whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

Task: {23A85B93-D5D1-4B85-8B7A-9FAE1695F78F} - System32\Tasks\At6 => Rundll32.exe daewte.wo,tvypf <==== ATTENTION

Task: {4D9E4576-618A-4D71-A83C-219A4A674637} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)

Task: {5555F348-968C-4656-BDD4-1ABDC34E35A3} - System32\Tasks\At5 => Rundll32.exe daewte.wo,yorkfcz <==== ATTENTION

Task: {5D076414-5963-4B13-B580-A4867144AEC0} - System32\Tasks\At1 => Rundll32.exe daewte.wo,gokjysri <==== ATTENTION

Task: {63EE8552-A444-4BA2-8E1E-C8350D6D412A} - System32\Tasks\Microsoft\Windows\Server Manager\ServerManager => C:\Windows\system32\ServerManagerLauncher.exe [2009-07-14] (Microsoft Corporation)

Task: {69110D7B-41DC-4E9D-BDD3-C826C7DB613B} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector => C:\Windows\system32\ceipdata.exe [2010-11-20] (Microsoft Corporation)

Task: {706AF1AA-E6C8-4BD7-8184-E7E30F37BE8F} - System32\Tasks\At2 => Rundll32.exe daewte.wo,gxdkke <==== ATTENTION

Task: {98A95F59-20CD-4E35-9D21-F20F9141264F} - System32\Tasks\Microsoft\Windows\termsrv\licensing\TlsWarning => C:\Windows\system32\tlsbln.exe [2010-11-20] (Microsoft Corporation)

Task: {AFECE848-8DA2-461B-B5E6-CBEF57A4DF7D} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleCollector => C:\Windows\system32\ceiprole.exe [2010-11-20] (Microsoft Corporation)

Task: {D3F5153E-1883-45F2-A816-9C2A0B198473} - System32\Tasks\DocuWare Update => C:\Program Files (x86)\DocuWare\Update\DocuWare.Update.exe [2013-07-16] (DocuWare AG)

Task: {D49A10DA-0F70-4779-BD96-B2D976A4F2E3} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant => C:\Windows\system32\ceipdata.exe [2010-11-20] (Microsoft Corporation)

Task: {DB25B1D5-1876-4579-86A8-216A6F99E8EC} - System32\Tasks\At4 => Rundll32.exe daewte.wo,cwrzlnqa <==== ATTENTION

Task: {EE945E96-457F-4B8D-BA9E-997F97F2BA89} - System32\Tasks\At7 => Rundll32.exe daewte.wo,aagnktrt <==== ATTENTION

Task: {F83FE3C0-92BB-4BE8-B0E3-F4D84F657387} - System32\Tasks\At3 => Rundll32.exe daewte.wo,npkxkb <==== ATTENTION

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\At7.job => ? rundll32 exe daewte wo aagnktrt SYSTEM Erstellt von NetScheduleJobAdd Li TT1 WU
 

==================== Loaded Modules (Whitelisted) ==============
 

2012-11-06 11:42 - 2012-11-06 11:40 - 00015360 _____ () C:\Windows\System32\KOAYXJ_L.DLL

2012-11-06 11:41 - 2012-11-06 11:36 - 00015360 _____ () C:\Windows\System32\KOAYQJ_L.DLL

2007-11-06 14:22 - 2010-10-01 14:58 - 00014848 _____ () C:\Windows\System32\KOBZQABL.dll

2011-02-11 11:27 - 2007-11-06 15:22 - 00014848 _____ () C:\Windows\System32\KOBZQJBL.dll

2012-12-03 15:23 - 2011-04-11 07:26 - 00034304 _____ () C:\Windows\System32\sp6__l.dll

2012-12-03 16:01 - 2011-04-11 07:26 - 00034304 _____ () C:\Windows\System32\spd__l.dll

2012-12-03 13:22 - 2011-12-22 10:59 - 00034304 _____ () C:\Windows\System32\sx655lm.dll

2012-11-06 11:42 - 2012-11-06 11:40 - 00648704 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\KOAYXJ_O.DLL

2009-07-02 15:11 - 2009-07-02 15:11 - 06907144 _____ () C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe

2009-06-25 15:54 - 2009-06-25 15:54 - 00027136 _____ () C:\hp\hpsmh\data\cgi-bin\vcagent\XalanMessages_1_10.dll

2010-09-16 12:00 - 2009-05-13 15:34 - 00255488 _____ () C:\hp\hpsmh\data\cgi-bin\vcagent\SSLEAY32.dll

2010-09-16 12:00 - 2009-05-13 15:34 - 01362944 _____ () C:\hp\hpsmh\data\cgi-bin\vcagent\LIBEAY32.dll

2013-06-26 12:06 - 2012-10-03 08:17 - 01786368 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\LMUD1P4Z.DLL

2009-07-08 11:56 - 2009-07-08 11:56 - 05799936 _____ () D:\Programme\DocuWare\DWDatabase\bin\mysqld-nt.exe

2010-04-28 16:37 - 2010-04-28 16:37 - 00048128 _____ () C:\Windows\system32\CpqNiMgt\CPQNIMIB.DLL

2010-04-28 16:36 - 2010-04-28 16:36 - 00205824 _____ () C:\Windows\system32\cpqnimgt\w2kmgdll.dll

2010-04-28 16:33 - 2010-04-28 16:33 - 00018432 _____ () C:\Windows\system32\cpqnimgt\cqnisnmp.dll

2010-04-28 16:37 - 2010-04-28 16:37 - 00025088 _____ () C:\Windows\system32\CpqNiMgt\NICMIB.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00193024 _____ () C:\Windows\system32\CpqMgmt\Cqmgstor\stormib.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00030720 _____ () C:\Windows\system32\cqstrutl.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00007168 _____ () C:\Windows\system32\cpqmgmt\cqmgstor\storsnmp.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00027648 _____ () C:\Windows\system32\CpqMgmt\CqmgStor\iscsimib.dll

2010-09-16 11:57 - 2009-07-23 11:57 - 01531392 _____ () C:\hp\hpsmh\bin\libxml2.dll

2010-09-16 11:57 - 2009-03-09 18:08 - 00072704 _____ () C:\hp\hpsmh\bin\zlib1.dll

2010-09-16 11:57 - 2010-01-28 11:10 - 01411584 _____ () C:\hp\hpsmh\bin\LIBEAY32.dll

2010-09-16 11:57 - 2010-01-28 11:04 - 00266240 _____ () C:\hp\hpsmh\bin\SSLEAY32.dll

2010-09-16 11:57 - 2009-07-23 11:57 - 01531392 _____ () C:\hp\hpsmh\modules\libxml2.dll

2010-04-28 16:36 - 2010-04-28 16:36 - 00205824 _____ () C:\Windows\system32\CPQNiMgt\w2kmgdll.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00032768 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CQMGSTOR.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00043008 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQIDE.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00041472 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQMDISK.dll

2010-04-09 03:33 - 2010-04-09 03:33 - 00057856 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQMSCSI.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00091136 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQMIDA.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00115200 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQFCA.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00050176 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQISCSI.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00030720 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\STORALRT.DLL

2010-04-09 03:33 - 2010-04-09 03:33 - 00050176 _____ () C:\Windows\system32\CpqMgmt\cqmgstor\CPQSAS.DLL

2015-05-29 09:52 - 2015-05-29 09:52 - 00008192 _____ () C:\ProgramData\Symantec\CRF\ASP Temporary Files\crf\98598a05\5024b15\assembly\dl3\8f82fc9d\46aeed6c_e499d001\App_Web_1kzmwcfo.DLL

2015-05-26 14:05 - 2015-05-26 14:05 - 01276712 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 01094440 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00347432 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_DynamicAny.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00465192 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_AnyTypeCode.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00087848 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Valuetype.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00254248 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_SSLIOP.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00511784 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_PortableServer.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00059176 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_CodecFactory.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00149800 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_PI.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00832296 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Security.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00044840 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Svc_Utils.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00075048 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE_SSL.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00069416 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_PI_Server.dll

2015-05-26 14:05 - 2015-05-26 14:05 - 00052520 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Codeset.dll

2013-04-09 08:49 - 2013-04-09 08:49 - 00086096 _____ () C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\mspack.dll

2013-04-09 08:37 - 2013-04-09 08:37 - 01296976 _____ () C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\libxml2.dll

2013-04-09 08:37 - 2013-04-09 08:37 - 00542288 _____ () C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\sqlite3.dll
 

==================== Alternate Data Streams (Whitelisted) =========
 

(If an entry is included in the fixlist, only the ADS will be removed.)
 
 

==================== Safe Mode (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
 

==================== EXE Association (Whitelisted) ===============
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 

==================== Internet Explorer trusted/restricted ===============
 

(If an entry is included in the fixlist, it will be removed from the registry.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2786933937-3664791864-901090552-500\Control Panel\Desktop\\Wallpaper -> C:\Users\ADMINI~1\AppData\Local\Temp\2\BGInfo.bmp

DNS Servers: 127.0.0.1 - 10.49.10.99
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== FirewallRules (Whitelisted) ===============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

FirewallRules: [SCW-Allow-Inbound-Access-To-ScsHost-TCP-RPC] => (Allow) %systemroot%\system32\scshost.exe

FirewallRules: [SCW-Allow-Inbound-Access-To-ScsHost-TCP-RPC-EndPointMapper] => (Allow) %systemroot%\system32\scshost.exe

FirewallRules: [ComPlusRemoteAdministration-DCOM-In] => (Allow) %systemroot%\system32\dllhost.exe

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SNMP-In-UDP] => (Allow) %SystemRoot%\system32\snmp.exe

FirewallRules: [SNMP-Out-UDP] => (Allow) %SystemRoot%\system32\snmp.exe

FirewallRules: [SNMP-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe

FirewallRules: [SNMP-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe

FirewallRules: [DfsMgmt-In-TCP] => (Allow) %systemroot%\system32\dfsfrsHost.exe

FirewallRules: [DFSR-DFSRSvc-In-TCP] => (Allow) %SystemRoot%\system32\dfsrs.exe

FirewallRules: [ADWS-TCP-In] => (Allow) %systemroot%\ADWS\Microsoft.ActiveDirectory.WebServices.exe

FirewallRules: [ADWS-TCP-Out] => (Allow) %systemroot%\ADWS\Microsoft.ActiveDirectory.WebServices.exe

FirewallRules: [NTFRS-NTFRSSvc-In-TCP] => (Allow) %SystemRoot%\system32\NTFRS.exe

FirewallRules: [DNSSrv-DNS-TCP-In] => (Allow) %systemroot%\System32\dns.exe

FirewallRules: [DNSSrv-DNS-UDP-In] => (Allow) %systemroot%\System32\dns.exe

FirewallRules: [DNSSrv-RPC-TCP-In] => (Allow) %systemroot%\System32\dns.exe

FirewallRules: [DNSSrv-TCP-Out] => (Allow) %systemroot%\System32\dns.exe

FirewallRules: [DNSSrv-UDP-Out] => (Allow) %systemroot%\System32\dns.exe

FirewallRules: [FSRM-SrmReports-In (RPC)] => (Allow) %systemroot%\system32\srmhost.exe

FirewallRules: [WINS-Service-In-TCP] => (Allow) %SystemRoot%\System32\wins.exe

FirewallRules: [WINS-Service-Out-TCP] => (Allow) %systemroot%\System32\wins.exe

FirewallRules: [WINS-Service-In-UDP] => (Allow) %SystemRoot%\System32\wins.exe

FirewallRules: [WINS-Service-Out-UDP] => (Allow) %SystemRoot%\System32\wins.exe

FirewallRules: [WINS-Service-In-RPC] => (Allow) %SystemRoot%\System32\wins.exe

FirewallRules: [{239A9729-E4B5-4A26-9E2A-4C638EE1F07C}] => (Allow) C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe

FirewallRules: [{23CAB9E5-EBA1-4714-AC3F-93AAEE1FE06F}] => (Allow) C:\Program Files (x86)\Citrix\Licensing\LS\CITRIX.exe

FirewallRules: [{261AED0A-51CC-4EFF-A902-B55A7D4182DB}] => (Allow) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

FirewallRules: [{1DE329C8-74B8-4DBC-A604-549F3D4CDF29}] => (Allow) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

FirewallRules: [{3E67F204-39FD-42CA-9DB0-BFCCC20C1909}] => (Allow) C:\Program Files\Symantec\Backup Exec\pvlsvr.exe

FirewallRules: [{5BBE261D-BB69-4B62-A563-8CB4BEE2E566}] => (Allow) C:\Program Files\Symantec\Backup Exec\beserver.exe

FirewallRules: [{070B7B6E-BBC9-41AB-88CB-EC83C00354EE}] => (Allow) C:\Program Files\Symantec\Backup Exec\bengine.exe

FirewallRules: [{0DCA8D4A-0D0F-4660-A674-04C4C085157F}] => (Allow) C:\Program Files\Symantec\Backup Exec\beremote.exe

FirewallRules: [{C80DD1C4-4B87-4CDD-ADE6-630BE329BACC}] => (Allow) C:\Program Files\Symantec\Backup Exec\benetns.exe

FirewallRules: [{D3112E44-268F-4CB3-B7FF-5954419C42F4}] => (Allow) C:\Program Files\Symantec\Backup Exec\alertServer.exe

FirewallRules: [{5A68BD95-ABB4-427C-881E-83BF6F73FB5A}] => (Allow) C:\Program Files\Symantec\Backup Exec\spoold.exe

FirewallRules: [{4ED9E685-75B6-4C71-9C8F-F3F55710F7BB}] => (Allow) C:\Program Files\Symantec\Backup Exec\spad.exe

FirewallRules: [{F3203ED3-B989-4A87-B1E2-EAA1E46A82A6}] => (Allow) LPort=6160

FirewallRules: [{6B936BBC-6FB4-444E-9C2F-253FFE554AA4}] => (Allow) C:\Windows\System32\SUPDSvc2.exe

FirewallRules: [{45672FCB-6855-4F7A-8789-BB45490D64E8}] => (Allow) C:\Windows\System32\SUPDSvc2.exe

FirewallRules: [{AB8EA5A9-8B8A-4D33-8528-43DC16C795E0}] => (Allow) C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\DeviceSetup.exe

FirewallRules: [{A83ADABB-C55C-45A4-84E9-901737FD2690}] => (Allow) C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\HPNetworkCommunicator.exe

FirewallRules: [{DF8A241E-9418-4BB2-B2E5-51562D546ED6}] => (Allow) C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [{7F976E60-71BE-4027-879B-74CE7CDDE412}] => (Allow) LPort=9089

FirewallRules: [{B4E5C7F0-EA9A-4ABC-8ED1-5ED454C1F42D}] => (Allow) LPort=8083

FirewallRules: [{2CBF83D0-17F3-4027-ABF0-6C55581AD46D}] => (Allow) LPort=111

FirewallRules: [{C2D35C1F-C81E-40CB-927D-9AB454B18456}] => (Allow) LPort=4242

FirewallRules: [{9B28BAD0-2510-4D25-8522-963C7893BF1A}] => (Allow) LPort=2049
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/29/2015 09:56:33 AM) (Source: DW CtServer) (EventID: 0) (User: )

Description: BackUpDatabase is not specified. Backup service will not start.
 

Error: (05/29/2015 09:55:19 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:55:19 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:54:18 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:54:18 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:17 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:53:17 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:10 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:53:10 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:03 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 
 

System errors:

=============

Error: (05/29/2015 09:55:55 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (05/29/2015 09:55:55 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Workflow Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:55:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Thumbnail Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:55:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Notification Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:54:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Job Processor" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:54:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Imaging Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:54:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Content Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:53:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "DocuWare Authentication Server" wurde nicht richtig gestartet.
 

Error: (05/29/2015 09:53:52 AM) (Source: NETLOGON) (EventID: 5805) (User: )

Description: Die Sitzungseinrichtung von Computer VERKAUF17 konnte nicht authentifiziert werden.

Der folgende Fehler ist aufgetreten: 

%%5
 

Error: (05/29/2015 09:52:03 AM) (Source: Wins) (EventID: 4337) (User: )

Description: Der WINS-Server konnte die Sicherheitseinstellung für schreibgeschützte Vorgänge nicht initialisieren.
 
 

Microsoft Office:

=========================

Error: (05/29/2015 09:56:33 AM) (Source: DW CtServer) (EventID: 0) (User: )

Description: BackUpDatabase is not specified. Backup service will not start.
 

Error: (05/29/2015 09:55:19 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:55:19 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:54:18 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:54:18 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:17 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:53:17 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:10 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 

Error: (05/29/2015 09:53:10 AM) (Source: DWImagingService) (EventID: 0) (User: )

Description: DWImagingService::Error: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.ImagingServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start(ServerConfig config)

   bei DocuWare.Imaging.Service.DWImagingService.StartServer(ImagingServerConfig appConfig)
 

Error: (05/29/2015 09:53:03 AM) (Source: DW NotificationServer) (EventID: 0) (User: )

Description: DW NotificationServer will not start : >Message: Cannot find active authentication server. All servers are either stopped or the communication channel settings don't allow a connection.

>Type: DocuWare.Communication.AuthenticationServer.Exceptions.DWAuthenticateException

>Source: DocuWare.Communication.AuthenticationServer

>Stack Trace:    bei DocuWare.Communication.AuthenticationServer.Config.ASClient.RequestNextASURL(Object context, Exception ex)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.get_AuthenticationServer()

   bei DocuWare.Communication.Server.Server.LogIn(ServerID sID)

   bei DocuWare.Communication.Server.Server.Start(InternalServerSettings internalSettings, Boolean saveSettings)

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.GenericServerManager.Start()

   bei DocuWare.Communication.AuthenticationServer.Management.Managers.NotificationServerManager.Start()

InnerException:

>Message: Cannot access server url  'gtcp://SVDC01:9000' . Check that server is accessible and use compatible communication options

>Type: DocuWare.Common.Exceptions.DWRemotingException

>Source: mscorlib

>Stack Trace: 

Server stack trace: 

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
 

Exception rethrown at [0]: 

   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   bei DocuWare.XChange.IServer.Responce()

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.CreateServerProxy(String url)

   bei DocuWare.Communication.AuthenticationServer.Config.ASClient.GetServerProxy(String url, RequestNextURL nextURL, Object context)

InnerException:

>Message: Can not connect to the remote host "gtcp://SVDC01:9000". System error message: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 10.49.1.1:9000.

>Type: Belikov.GenuineChannels.GenuineExceptions+CanNotConnectToRemoteHost

>Source: GenuineChannels

>Stack Trace:    bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.LowLevel_OpenConnection(HostInformation remote, GenuineConnectionType genuineConnectionType, String localUri, Int32 localPort, String connectionName, String& remoteUri, Int32& remoteHostUniqueIdentifier)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.GetConnectionForSending(Message message)

   bei Belikov.GenuineChannels.GenuineTcp.TcpConnectionManager.InternalSend(Message message)

   bei Belikov.GenuineChannels.Connection.ConnectionManager.Send(Message message)

   bei Belikov.GenuineChannels.DotNetRemotingLayer.GenuineTcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.FakeClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)

   bei DocuWare.Remoting.SwitchChannel.SwitchClientChannelSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Xeon(R) CPU E5640 @ 2.67GHz

Percentage of memory in use: 43%

Total physical RAM: 8181.8 MB

Available physical RAM: 4662.85 MB

Total Pagefile: 16361.78 MB

Available Pagefile: 12160.45 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (SYSTEM) (Fixed) (Total:68.33 GB) (Free:21.09 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (DATEN) (Fixed) (Total:838.09 GB) (Free:336.78 GB) NTFS

Drive g: (INTEX) (Network) (Total:279.36 GB) (Free:33.07 GB) NTFS

Drive h: (DATEN) (Network) (Total:838.09 GB) (Free:336.78 GB) NTFS

Drive l: (DATEN) (Network) (Total:838.09 GB) (Free:336.78 GB) NTFS

Drive s: (DATEN) (Network) (Total:838.09 GB) (Free:336.78 GB) NTFS

Drive t: (DATEN) (Network) (Total:838.09 GB) (Free:336.78 GB) NTFS

Drive v: (DATEN) (Network) (Total:838.09 GB) (Free:336.78 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 68.3 GB) (Disk ID: 47C39B7C)

Partition 1: (Active) - (Size=68.3 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 838.1 GB) (Disk ID: 510C7675)

Partition 1: (Not Active) - (Size=838.1 GB) - (Type=07 NTFS)
 

==================== End of log ============================

Ich fürchte den bekommen wir so nicht bereinigt. Entweder erwischen wir nicht alles mit einem Rutsch, sodass sich die Malware wieder an gewohnten Ordnern breitmacht oder durch eine Sicherheitslücke wird der DC ständig neu infiziert...

Willst du noch weitermachen? Wenn ja, bitte ESET ausführen.

Sind noch weitere Clients und Server von demselben Schädling betroffen?

So ein Mist, wenn du noch Hoffnung hast, mache ich weiter. ESET läuft bereits.

Nein, nur der DC und der eine Rechner sind betroffen. Meldet unser Antiviren-Server jedenfalls so.

Warten wir mal ESET ab. Ich kann natürlich auch noch schrauber fragen ob er noch weitere Ideen hat.

Gut, Eset wird wohl noch ein wenig dauern. Bis jetzt 23 infizierte Dateien gefunden.
unter anderem Win32/Conficker.X Wurm Variante von Generik.MFNZBXQ Trojaner.

Poste einfach das Log wenn fertig :)

Zitat:

Zitat von cosinus (Beitrag 1470592)

Worauf willst du da genau hinaus schrauber :confused: der DC verteilt Würmer? :wtf:

genau das. das userprofil ist auf dem dc gespeichert. einloggen, profil vom server holen, booom.

Guten Morgen
hier ist das log von ESET

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=7cbc55878621d44aa475e33b8f32fe64

# engine=24077

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-05-29 07:45:44

# local_time=2015-05-29 09:45:44 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Sophos Anti-Virus'

# compatibility_mode=8450 16777213 100 99 37167 243594 0 0

# scanned=60596

# found=0

# cleaned=0

# scan_time=2372

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=7cbc55878621d44aa475e33b8f32fe64

# engine=24077

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-05-29 02:09:01

# local_time=2015-05-29 04:09:01 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Sophos Anti-Virus'

# compatibility_mode=8450 16777213 100 99 24165 266591 0 0

# scanned=1601282

# found=27

# cleaned=0

# scan_time=21452

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\CAD\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\CAD\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\Design\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\Design\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\Einkauf\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\Einkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=FA09F610AA1C7AD64013FE04E291809995D1EF4F ft=0 fh=0000000000000000 vn="Variante von Generik.LXIYXEQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\GL-CON\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\GL-CON\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\Transfer\autorun.inf.xBAD"

sh=F1EFF6451CED129C0E5C0A510955F234A01158A0 ft=1 fh=332b4278a72373e2 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\D\Daten\Transfer\EDV\Teschner\Unlocker1.9.2.exe.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\Transfer\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\Daten\Vertrieb\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\Daten\Vertrieb\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\UserHome\azubivk\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\UserHome\azubivk\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\UserHome\gdesign\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\UserHome\gdesign\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\UserHome\geinkauf\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\UserHome\geinkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=FA09F610AA1C7AD64013FE04E291809995D1EF4F ft=0 fh=0000000000000000 vn="Variante von Generik.LXIYXEQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\UserHome\jschiller\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\UserHome\jschiller\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="Variante von Generik.MFNZBXQ Trojaner" ac=I fn="C:\FRST\Quarantine\D\UserHome\kvetter\autorun.inf.xBAD"

sh=E5D061DCE077318314B73B2B18329B893A4A63AF ft=1 fh=d2f9a47e07a14475 vn="Win32/Conficker.X Wurm" ac=I fn="C:\FRST\Quarantine\D\UserHome\kvetter\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD"

sh=0E73E5F50253E821FD87BB845AEA0983CCFAE404 ft=0 fh=0000000000000000 vn="INF/Conficker Wurm" ac=I fn="D:\Daten\CAD\autorun.inf"

sh=9D92140EDDAC2ECE093A4191F70F42C0E5EE133D ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="D:\UserHome\eschoebel\ehemals c\Alte Firefox-Daten\vk7tet4c.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul"

sh=1D5316EE651AD2DDE0EA779823507E37CDF90664 ft=1 fh=2d5732c9f96eff3b vn="Variante von Win32/SlowPCfighter evtl. unerwünschte Anwendung" ac=I fn="D:\UserHome\eschoebel\laufwerk_h\Sicherung\Eigene Dateien\Downloads\slow-pcfighter_Web(2).exe"

sh=1D5316EE651AD2DDE0EA779823507E37CDF90664 ft=1 fh=2d5732c9f96eff3b vn="Variante von Win32/SlowPCfighter evtl. unerwünschte Anwendung" ac=I fn="D:\UserHome\eschoebel\laufwerk_h\Sicherung\Eigene Dateien\Downloads\slow-pcfighter_Web.exe"

Jetzt bestimmt wieder n fixlog mit folgenden Zeilen, oder?:

Code:

C:\FRST\Quarantine\D\Daten\CAD\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\CAD\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\Daten\Design\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\Design\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\Daten\Einkauf\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\Einkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\Daten\GL-CON\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\GL-CON\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\Daten\Transfer\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\Transfer\EDV\Teschner\Unlocker1.9.2.exe.xBAD

C:\FRST\Quarantine\D\Daten\Transfer\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\Daten\Vertrieb\autorun.inf.xBAD

C:\FRST\Quarantine\D\Daten\Vertrieb\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\UserHome\azubivk\autorun.inf.xBAD

C:\FRST\Quarantine\D\UserHome\azubivk\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\UserHome\gdesign\autorun.inf.xBAD

C:\FRST\Quarantine\D\UserHome\gdesign\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\UserHome\geinkauf\autorun.inf.xBAD

C:\FRST\Quarantine\D\UserHome\geinkauf\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\UserHome\jschiller\autorun.inf.xBAD

C:\FRST\Quarantine\D\UserHome\jschiller\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

C:\FRST\Quarantine\D\UserHome\kvetter\autorun.inf.xBAD

C:\FRST\Quarantine\D\UserHome\kvetter\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx.xBAD

D:\Daten\CAD\autorun.inf

D:\UserHome\eschoebel\ehemals c\Alte Firefox-Daten\vk7tet4c.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul

D:\UserHome\eschoebel\laufwerk_h\Sicherung\Eigene Dateien\Downloads\slow-pcfighter_Web(2).exe

D:\UserHome\eschoebel\laufwerk_h\Sicherung\Eigene Dateien\Downloads\slow-pcfighter_Web.exe

EmptyTemp:

Zitat:

Zitat von schrauber (Beitrag 1471686)

genau das. das userprofil ist auf dem dc gespeichert. einloggen, profil vom server holen, booom.

Hallo Schrauber, die anderen Rechner im Hause bekommen allerdings keine Virus-Meldung.

Was in C:\FRST gefunden wurde, haben wir bereits mit FRST gelöscht. Das ist der Quarantäneordner von FRST.

Das einzige, was ich im Zusammenhang mit dem conficker sehe ist: D:\Daten\CAD\autorun.inf

Mich würde mal interessieren, was genau diese autorun.inf macht, daher bitte folgendes Fixscript:

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

cmd: type D:\Daten\CAD\autorun.inf

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

oha, wenn du das entziffern kannst: :party:

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01

Ran by administrator at 2015-06-01 09:44:27 Run:4

Running from C:\Users\Administrator\Desktop

Loaded Profiles: administrator (Available Profiles:administrator & Classic .NET AppPool)

Boot Mode: Normal

==============================================
 

fixlist content:

*****************

cmd: type D:\Daten\CAD\autorun.inf  

*****************
 
 

=========  type D:\Daten\CAD\autorun.inf =========
 

;��D%fIJ��u�O��T?G��S��rkX��OV�jSfYAL 

                 



       

        

;fb        

;��o����KkA�PaY�T�x�uer�f?JojP��Ff�wu�i�gH.b�mK�ZHyFL

[         TdkjJufXACQXwTrqdYPpjbSC]

                  

;Kf'Z

; �?��er�K�D��oJUqHK��emTiv�N�q�C?Iog��f�c�D��c�

ajzLmMmVuIndpuy        =lcH

 QPDdnsHCDPoyNqFrWqCPwdLwE=        EYhdLWGyLTaLO         



KQKpTKLgSQvADhzMNrhSy=        VZqYYrMDNyVUqfoNwyaUdSitL

                     

;YBQ�HSYo�bO�z?b�Erwu��mohHkσFy�?bT�i�d�Zorf�Nv�

;X��Oq�����k��ǅMSv'�qh�Hh

XQQT=KXpdSzJH        

;XVkP�E�A��o�z�l�GO�boeS

               

;��Y'VŊ�ivp>��?�v����ީ�z�d�E  

;        TNoAY�>�quO�LGb�E�v��'DYi�X��jB�Vw�j%�R�

             

        

              

; RS��H��CAqVr�pp���ӥ�h?�n�fm�gjA�Kk�RT>�Wt"X�UBu

                FfWcviZFJ=kMHcLuKMpxbeHUvVLDm

                      

;m��D�Нv���X~S�?�H�e�w�YoeVl�D�SVnn�iPg�pr�uh�p�U�qo

;�f�U�g�h�a��u�QEP"�vA�"o�        

Oy=X

;b�Uݑ��I����lPT�p���s�Z��AŎ�xz 

               

        

          



        



FibxDcy=         vXKaLimbaYwSjV
 

;

;        ONV���iWwnESWie�  

;����ьV�Uw�o��QcpB-��Eu�

;�dEMFMkHVd�zE

hNkoIumHmuk= YeTJ

                    

;�a��tD-��eh�



;                VaSj�m�KDr��q�s??���z�y�oF

;O݆xolhs�BsR��rFC�e'TZ-����tO��'co?GaA�n�c�?

        

; ��QU~Bq�o�-fY�Fv�Vau��CS�XHRM��C��B�W�jP        

                       

        

        lErlVdHCsqyQpCGb=lADRVhXyrbrvwbR



;N��fl��NB���f"Hz

                             

                         
 
 

GDopXKSdiq=nbGmMXLwZsDW

                      

;        

;        


 

V=b

 

;

; �m�q�PepUP�QtyD%J~m�v?z�

          

;                Mk�ӏI?

;�B�J-�DK�i�hYtjtm�O�y���bH�MErP�D�z����pn

   

         

EbaZlTYcBbgsuNyHA=MUt



;

                     

        

        

;Lz�BGoljB

;MRr���OMpEMT�x���y�Te�G



                       

        SwkgHtTA= YhuluEEVXrwHxcIMCAemHn 

;�Ii�Ppk�gY�^o 



;-ԷP�B^tM���V



                 

                       

        

          ARI=UehzEyMvadlDxIRdDGRluR

;��"�u�D��y��VW�

;�S��?�.Z?B��        

;�bj~~SlI�D�bxKOy?P

 

; 



;        �їSLCYX

                     



[MUGFeaRSXVUNZU]

;'�mK?����LcK�����CA�cYC�Q�dү�D�K

         

; q�Awe�Ed����lWO�Buq�oQ�L

                   

;        YTsYL����ymLsu

;kL�E��GF�?��i�b?D��

                         

;NSnkITp�e        

 HcI= eZKabCjLwlSblRL

        

svCQKf =TlyzJYZN

        

 HDmtLfc=        rTvWotHiTxVObR



                         

                

;Sv���dԣ�n.�d�ԩKؠ�yq��P�bn�s"k

;

        sSg        =B        

;nj�'D��lXmAdZ��MMn-o^io��A�u�?f�-oBSDq�S��M��uE%KqE�CZ�>p�EYW�T�M



        

;yW�Z          

; ����v���po��XhI?b

;

;�����Px���e�U��N�m?o�Nc��eIb�p�kt�

DkbRAsIkb=lKIhzuZmKMAbuzuMdWPWFx



JpGusPMHYfA=         JVcourlC

                      

;�i~rliXo�Ij�sA


 



                

                             

         YUTvcKNulgVNkTbcNhN=HzVpnAQK



 

;lhAk?K� 



;qSV"E�A�>��Pp݊�x�Q��sKqB�я�gХFm

                          
 

 uVP        =Sge
 

OpdzL=tAVAcKliVTTwTmznICEilcGAE        

;�jSCI�oJ�So.ll�pM�v�.��FM���IGq?�r�?�FmUnSH�Zs��PWvU�kIPI��kv�



gHJcrnbHrTtZLyPyKLmsrZZ= UEBGFMaiHpfDTMtUXZzjOcr

         

; ED�NgUxXAID���<�Y?v���ku



                       

;NrEo�a�eRNc�w��J�QaiCA�nv



;        rHn-JlCX<?tpK��K~~yeFM�TŭT�Bh�

exqVMWbmM        =KNtKqLIrGm



           

                          



      

              

;y�lq���.w�%mmsY??�z�WqlTMKPqHhvjKDjGQ��tFg�u�y?         
 

                           

mjaTnOlHKTMXrcEPE=        pB

             
 

        

;�NMP�ioM�TCp��AW��u��l<���b

               

HKACUUYMdJEgNuTa=dDoAbKuxgHBrv

        

funNYQJZbDUlxuivrKj=hsxzuRvLSAtARdPCLTgslooQ 

                 

        

;�"Z�K�j��tq�q��C֢zx?�S
 

         SbAkYmqj=NmMNjYyiM

; 

                      



     

;P<w�hq�tQ�rn�c�UfOYR��avv�BQk�q�kr�q�Kw�afw

                        

 

;

          

uqwQlFFFuoSlCWsOmjxzc=kEryqRHuFFltvrpHImLn 

                  



                             

 aeBzPqtJ=Vm

[jyFPhb]



                      

; tfP��Fho�Vr�SIh��







;d�fx�'�g�zT�t'K�sedxE�g�LQNQmNG� 



JnAbQXPxdFGMQlA=hthUTgGdKclFvzZzTS 



                            

;gTT?Y��O�

                     

        

pwIoQiCkVDktrkgDApLXPy=QUNwLnjqXTJIVJpxHTSHaVCVi

;��k�q��uYnfB

;YY�t

;U�lm�땘Qq�b�eLtZo�V�S�e�HkgHn�w��?�aH�zT�Yq�G�

GKTPFbubWDNaxEKIeMdThK =ZCWMJh

             

    

        

;b�nqq��nMq��?ZEm�        

;�pf�QXYqW�p��A.�b�        



       

tdqRWRUjTxrjk=wHAOFvaJCLBKKHtf

    

;         







 HlzdxIQsfh=YtIFTCFqOBOFtCgAwPL

;���i'Z�C�sCW�ggS��PuXhJtFITH�NuPKMt��h�Ks�vu�xG         

;        D��-WSXN�Q��o�t��i�Sm







; 

                  

;A�U���w�?dCT�u

             

WOSAjJEKrDduvpCtjcszAwT=JIXFIuBRhH

       

;

;ݏno.��Op�IP��Q�V�T~�'q<�u<Wx�O���RhZX��Zb



;�mBg>I�W�XQ

                         

;돢Ǆ

                      

iqSTxJiYHraLAWEdXMuJxQ=pcF

                   

;



;        R��PR��t<rS�nd

;�tm?gE?q�KFS�I�E�b���QxL�t�H��KT<�Vkj



;        

                            
 

oxMHaAWaaApvh        = OcBLpZz

       

[ZYGEbWkuyUXSCvhnvmMXn]

; ."C�TgD�?�?gƫ��-e^�MY�LAAlkKhQJ�        

;�lwyUiAvS�lKMOxd�p�F��Ho�XQH�X'�GC�snj


 

;



             



FRwSL=CvhXem







oWoEHAXTROocK =ofufjoBmcHJV



;

      
 

BDK =UfvBmImeNGYKZkGBaxxFgv

; 

;G"rIMR؞U��Y-b

        

BPRzHgwFttpyp=mZJ

; 

                             



                         

to=OLxhQBnYWPbxzPCyGPp

MlqlNhptvZyACRFBmCh=        JuyVVxLpFvWqrLX



;X�'�WI��ro�%�

CVkihnxgjU        =aTCQdMPqiaALzwYWht        

                           

;�        

;J���T�eUS�VZVdG֕U�s~AA�~HB�<w�v���ZQ�wF��u?d

             



        iJYhDcuFiysmjuJDTIrH=IrXXSEUIWaF        

       

; 

        CZzGfhC=ssIwjW

;



    

              



      

 

        mVSBafvZnkDFgoH=JPpufaYKpAd        

                 



; "�??�s�Uos�CWH�Ac���AFDL



rYmTRHosrHViCjybAQU=hgrPDlouqVJpXOWtzxgTQFQXQ

; fp�"y��hmY-U�n�pMa��Rxr��Y?S<�y��q�m?�



;f�YlyxyI�qo^RH��sjrp��Dl?llWhb�RTy��pp?Zi���C��

;        jVM��z"��FuA�Zt�Sfx�VZd�w?w�X�Me��KSPc�BOL<'



   

;��G%��GotEw�obK���qc�YhXMf��.
 

  kRCV=sEfZFenvGQPXe  

;���ެebP�iJ�kJ�C�B?b�a

                    

 

;zoQh���

;?W��s'D�aׯ�c�����az�

SH=         JrXonjtrCzaWPg        

         



                         

;        

;X?�r.h�"yҵG�R��G�         

 

[jQrGSCaUUaeq

;zE�g�TnegndXe"gm'SkY�Okk�ORh�

               







       

                   

        MKsAxIzkpt=UTRRAXUCSEuYnpRjio        

                           

    

nZHOuBOPBuyWECREDg=jRno

;hR"�u"TN�yK-��XDy                

;  QGJ�U�.bCtJ��odF��wL�E�

                       

          

           

;���H

                         

[cSEtyH]



;��n��uufiY��M�A�o�e<RC�mZl'MxsmOWc�OO�FJ�NJZiBE�m�N�^?KPy�        

;  NҜP"�

                    

;NU"�O���H'kPi�J���G�kAL>�NYXm�w�%���r?�cZ

         

            

;�fod���GS�hU?

jediuuUmiPx=b





;

;�u��f�Yg�M��"Y��
 



  

;Y����Wu�DӔNm݈�רkh"H�s�PiԁBNoq��n?R��

                 

TTkq=xvxLnKEdHkRmUfCtBpFgHLLA



E=PFRll

                        

;�

bYFnHHeadl                =CW
 



            

Bl= tJUA 

;                �NI�?hbl�K�BauT��ii��j>q�MF<wS?�sZUfϨ���P�K�hu�Z�

giUAZiUuwsYhjmxghZkbs= KLFcW

;b'�KrNk�A�H�뗤�KSsU�?�C'�qj�F�W��<bl�<t�zp�AOn�

        

                      



;Zir�Ld�Zpw�w��he�w�t�?fk?KLp���CK�rp�v



;L����p��

;UB�d��h?rzui�A~%�g<�

mfasfrEfKTYuFvw=Ou         

           

                          

                   

psXcEYuRFHvankJ=XctkVaIJtmxnnRtRP 



                      

 BxjihoDpXDqTIfRoBSxYhIfe=AbGH

;"�qq?"�qLv�W�FgS�qclg�vcKPf���גfv
 

 WfBrObd=DSaKfmRuLmTdpzIZ

        

;��r�qe�S



                      
 

                        

NEKqotcAcONwqcZLmLqLtNT        =tZdERkvejhkQqCkLP

         

                             

y  =        EHsEtTBYkhrinVJnSgY

                  

               

         

        [PtXBtzzL] 


 



                    

          

YRMj =AXusAObTzlpZX

;��Dn���Ncq�r�e





  

;�~�u��x��GMl-qRgY�X��B

ZhEsiicjih =hEGgYi

          

; �otb���TN��k�?Oj



;�V֥���f�mGNj



xijpqqeIMuFrDQUclewLi=        U

;        �cQwfS�

; 

; ?�fVsfU>Vi>UOjooL���Mo���?�b�X"lN�GT�tc

;��j�iL>PŨ�%��oKZ�IS�ko��y

;pKt筀�"p��WpixWi�g� 
 

        LEKlgyhn=EAgAEjD

;��rp��Nv�?EF�OeDSG��S��tcK'ui-�H����?�u�OKO��

                       



CbAFMNyMhVZDjlZDwCon= vccBHgnCLxguerApEe







Ct=uGg
 



;

DlOdzlFFxKZf=luCLFCfNSOkASLCPcRnT

 

vdDHjLqWsiuPFvNhFhj=vHDchEELsuHHa 

; inbC�t�?'�P�Yk�O

                FsAqrrNXcTWBQcZijSQ=mEOthQuDpgNmsVXOHXcfSQqF

   

OVMgxFBOwk        =bBTtmCOlBfIYRiIvCYqmUp

       

;        L'rG�o�c�'E���jM�JOL?hiT�  



    

   



        FAzKRqHGmwUTwzujxQHZlr=IweKhCCZOK

;"Fs��mmA>O����A�s         





uurYaUpmBRzmXWBvCughwr= zjCUPRNHAXEzLZ



;-wB�r>H�z

;        TPmGTAM��



;        

;H�i��T�A��d��Gt�fzQ�s�Z���E��pl�WfS���?�po

;�D^�m���F��P��xf�G�j"PTH�"q�cy�"dZ        

QuTXQSpmGug=zxZTWlcVUWlLdMoSo        



                         

                           

;  j�PCL'��cm�W�G

;        D-�Pb-LC��C��D�JR���S�Yp��Y�

                  

 



        

BRgpTFRz= FULEDxBBttXRRVpmJYNOVfgz



        m =ns

 WrJsfJcIn=epoNsKvl

;�ZM�DmNn�kAht�w�f��Oid��sX�o^��VU��

FuLxRxUnRAQvUWJpznmlgb        =        zhhoJdEFjxiozbVnWAedWLs

      

         

[        Da

          

 UsKdHRqJOuhKPGmwL =qlffcwWyX 

                  

                          

VIExBTdtoWZWEevETzGAYgNC =RPSXLCcEidTVcTkAg

             


 

;��kS�L�yLlo�WXTqop

;?Ob���~�XUbW��K�O?Qw��~gk

 

;        ?itk�rx�h

SRZVdPqODMKinHG=YyrFyxSWSnDwhSQkCILoVJcU

 [peUsJJQGIaLamcjsAIoAl]         

 

;u�zt�wFpԚy?M"d��RLKLf�?�D�S݁q^�x<?�L�

;�"Mb

;����'XC�mI��"�M�IfT��N"b� 

;Yr�jf���wE��ND�?^���y��T��Xm�Ib

               



wIEfr =        JGMUsjwnDolulOT 

                     

;        ��l�B�

; �h?�p�gJG~z��yZk�ra�'SZPR        



;r�T��p�NretR

                 

                  

;

GPXxT= ZqRcURHrkBOrmstbvT  
 

;

;�PHW��C�J��~vV"�Hc�B�E 

     

        

                            

j        =tEJpPROuaQluPlKR

     

;        N��hpe�chyZB?n?�"ZR�L



VlPVJbbXSr=JMTYvPUoIfuSDyPpWIQMBR        



       

;�U�G��oŸ��cP���TAe�jr��"^�Jd��q

;�YU���cFdFf��

;�'l"QEd�mm'V�Rty�gO?�zkM�TilO��X�OsPM�RL�� 



;�qxaਙZ�B�        

        EqWibXTTvvwFMeU        =q        

               







        

[oTbDZRs]

; 

cCHZubEW=pYQvICEsYstXZqHvSjI

; ���Eg�JgnGKS�KE�W-?bJ�zii�vr�'i��u��E��qCaUI��eǆ� 

                
 

   



NrgYdlIoloAdzsYUkKGAkzfb=m
 

;

;SGUX 

;��O�P

                       

;        

                            



qZUVzSM=OzJcQNbR



           

; ��HY"�ToSψ�����QJDN�wRT�jVX?B�mz�lq�K�?c��w



HNypGwSHucDII=CMKpAXtIvzurWhGArknCdH        

; 

kDgiaLJhIamP=DIVjmpnwWhTCm

IGLXCPhucJgGkLZgstvZigU=  qrYwGZkMjzgsEulYResH

;H�e��'��ai�VBLE�uuTMrZptdr��fuuN"sI��K

        

;nplHOR�Z�U�"CoQZ�YbE��B��Bfey�m

 

      
 

; 

                      



CpdUdUjKk=        TzzTG

        

                       

     



   



               

            

        BJIhbgznlogtjJrHiCpDNj= OIxAyFXyudaAiNnvC


 





;�όx"�eT�yS�Bg�cb�Nq�I�Xa�x�kgxNh?�Y??sK�l��S�

[        KBWsclKjYpMcTj]



;�U<�-�W�EM�r?�h�o�O��e�Ot-�.G 

                      

;K�׈�bE�WR�-J�Lm�rA�L�j��SaT�Fs�?yI'�V��P�I        



    

;        xR�Y��

jnFTmeJQeUgQkCHn=        UFReoSDMGFJqkQLJrVOWt

;

McdDAQWmjqRgIqSkt=DiQYcEsYsSaTVbvxkSvhgKde

 

;�KF�QKWaM��MJZ񧎭SWjGzASm�W

 





                QwHHByFVoAapcOrO=jKvCsEWOxSIujkzqr

                      



;         �X�LOj��IXTdAe��mR�bV�<�n"O�LZ�<ZH��

                        
 



                      

         

[  tvqZMnsdqFXMllrehUnP]

;        ?�X�jvx-�?�E.�m��l�q        



   



 

;        �ADMZ����s^a�?��E����~f�

 

;         H�B�O^JSI�D<dF'MJR�XB���k�p�Mf�<���F�AskLq

; 

CXlHxzNbYXdMudvlbtTQ=SHQwWgqrb



;ycCzlo����UjC�oj

                        



;M?sX�gW�

;

;V�J-L?y�x

            

        yXJQdZWCizvfCJuLYjdOfF=sJ
 
 

;

                        



pQEpIevxxZqyRvNvKNXKaJJpC        =WJKDBCnZ

                     





        

                   

mScurkMRcdsPNqEZtWwVPh=nknJNYJutdEuRnFpcIFUh 

; 

;

        

;         



                

;�BTYp���YvRx

ECJb=nHmyPbyf

;g'H�H��YVHS�puW�W�~YB��oj�"�?jYH����ZGC        



;  y����o�bW�f%Aq�KEd�e?b"?�ON��M

  



                            



                          
 

cmjwlzjstwmp=faxROzNoCWEWW

                      



             



 

                 

; ?�Fg?��wꚚcb?Z��jmwKV"sy~H������ip�J�E�"b�

        UNLseA=DixxeoB



; XmBR?Rv��PC-�K��T�zhY�a�B 

     



BcOJH=ZyKeeWOAKzNncHXOYaOLdj



;�kk��v?UERD�GUwIfiFvO��ttx<hkVIsg'k-N^�?�-QlL


 

; P��xOGpoH



        

hnVEiFlSKG=dExXFBhTZSmJ        

       

;Kj�DT���^f��ijcU��hW

    

                          



zLCrboyrOtuwcDE        =humsXgUv
 

;��^c�O
 

;dZGv"�~�C��HΧVXF�RMG 



HHNtzoJuchWfx=FnhOB

       

;�FMsNO 



;        s���iZW'��ϋ��Hޕx�fZRQ�gf"O��

;        �c�lzEHNZwG�YOw��
 

;i�Xx��pYBXO��NFz�wn'ek��hqlb         

                 

;<XBp�x���RAXO�a<Ty�'�eCsQ�C?

        NbWKfeTadEmlUnOvKaBhenH=ArRni

        hMFbsuVnxhdGMFCIuYwgiYXA        =IlTgAWfZlEjlBXd

;

XEunwxirMIFHfxJVWoofZtpd=        ZnTVbbMBdG

        

; 
 

                VmmpPOsTJNLZJoQPNj=CMWlR

pPMbVygVXSNeI=EK



;        �n�D��oZgO��b�milV��-Z

;Otu�z�����i�

      

RwkkivjTwNxbYI=FGMxAEjEo 

;



 

mHbo=AFOKCFGUAsIc 

;        EG�j���-�I�e�Wy��E

;c��SMu�.�g�npRvvMrv�SRYReoa�DtYtudM

;

              

        

                      





[GEWzsouzk] 



        LOWYynREZ=lvLf 

                       

        

[uVWZ]

                          

                

  

;?�odteU�?�ca?�T^?s��

; 

;        F���lQI�T�t-�p�m





 yUedxzYUx =        TXcpq

;        

                      





                   

            
 
 

               

LtDjDZSfhavc= nxDuswHGCjoS

              



        wFNT=Bsqb

                          

 eHLcfnqxZfiHQ=         IZTwDZBLfUzE

; �<Ct�rjBiLaNVh�m�e�D'wk?M         

        JtIXYz=         itneEeNEEnxBV        

                         

cbvKmKJCRbdgnTubJlojnUDe=EoMFNxHpVRxBLjcBPDx

;J���.��"TzW<�M���TTC�T�y"Yva�hr.��mTUo��N%W�GAr?�

;XXw��c�L�hMv�HlTM�iKP�r�-qNd��z

kZREvfU=WN
 

;k�K�yvCf'ch���mbYaZ�TM�FQ��d>���

;�Gu%rVW��ZI��i�I�B�ZF�Q

;         jWQKT�Sy?c�~"�x�Ds�J

;                �%m��ABv�AQzs�O?G�^?n

iYpvHZUKdxWi= bG

;s�i�؁�a�����E�zWw�J'kOGFbM�Xu�TJ%ormc�FzEkDE��%�eI�?pDQ�Q�"f�Y�
 

;



;�sFG��onm��NvM"dP^我�jsly�YDO�U�S���El�mnf��t

          

          

;        %��D�kmf�b�i�OR�<r�w�ؔ�W?�DT'P�h 

;

HitFFzHDrpH=AmuiYSulJfQaEbuqtrBq

;U�mPA�TpDsuBTU�d'�Rac?�f����?��WGu�

;�        

;wUv�O�

 

;�E??sA�gf������wVtu�Yobx�

          

         OcGGWGEkcnya        =IdreWEYpbkzhc

;        

;w�H�qI-vT�EO���fe�C��"�E�h�q��M

 
 

;  

;���'�u��bu

XLs = mCyL

                 

fOoPBLwPyk=JLlQsoWAOVBzfSb

;l��f�.R        

ENPkdWSBvrAsFPmQbfyMtlQ=abzQWwrqWKJPUKrnzqecbOXs 

;                w�Z��kN�lYG��

        



                            



wouRUdZNA                =        TwUQnBzDFYU         





;�c�"qjz�t��gM?r↯fQtcp�Ci'�"SOu�tYw�

;^'��z�

;Z�fNqe

                    

; IO�H�Q%�
 

 WfQMII        = PTYierktvtRubcTbZnL



;

; 

        





 ZNz=AArKhcpM         

                      

                         



;
 

;        

;xD>uZ��MS�ng�Ho��azNaT�nYF

 

               

WZDWhXWkwv=rVxI

;v��BD���uW��j�E�zZJP

        

        

 



;  'b�z"�-TC�LH?O�%�nmyAr        

hKNHYYnPersBZnsuDk=RmwZaOIrmEB

;        �YTPr�dV�K.EUloq�C�hI-qp<�oM�jl�n"VhjzH�^

;uSvPX�        

                
 

;҃i�NLp��hEmG��q        

                      

[mts]

       



                       

;iTJ���H-Ux�VBnLP�XKq�bI�E���x>E        



;Jt"�DYg�T 

yscgSAZQDRPnraBcAN =dyJQbuHpczHYLRSTME

                  



;

 OsfNwlVYVBlVZ=e

;        � 





        

        ytZHaijDJp =grcwiwYdoMIdxf

                          

;vPqTjukjxpWz�A

 



 

 

;

rR =        TTfpEyxdAOEHmgqVIMhFPVRUP

 



;         V�nvb"�pprhe��

O= ZOZtcJJ 

                            



UVfsaIDiQkm=UwxYJZwWNbHIyXvS        

             

 Cr =AEZsMSdVVTHs

;Ld�cu?saCtlT

    

xKtllBnzJrkdSYRUvIYwciWVc=wQQdSFyDhWtUXAdNxoDawVfr

; ��mS��TvmntGZL 

; 

             

                      

                       

 



        

QxrlzMA=USeZdNBPlDXcIe



                             

                    

     

  

                    

DvsontDnc=WyXRNrjf 

;        �N�<�k���љ%EpO�K 





                       

                 





GLYIZpFMQh=V

        

                          

                 

;cF?�LgtGo�F�ݍ�qL���'~Mp

                       

                      

;        

; 
 

lukQZtFsGCgGaKeETMCuKS=JajVetuGe

            

;Q�R-��Y�e�?IOh�B�F��eM 

          





tHZPYDSHWJJgBDCLylvth=YbBxPRSnjDWRnpAuLxm        

;b��

                           

 uHhmhEgColbC=bOiYgNyLSNOgpwExZQIwzjxj

        



;YT�Kd�q�eE�JrK�w�"�"�q�hmnYG�>XIy�dW�z��ZnYS��Yf�Gc



            

gmuKkdcj        =qrVIZXTIg

                   

zkJGjDbphQ=HslAsGXbuHPIY

            

;��oTOZqZi'Lb�F�sA
 

qQoZaElSMnDlKZOdLXUkSLsGl=dXTrzFEScskizJHz

[rHpRNDcPmlC]

     

    

 IFuKkuAgnkQYCA=AtqqRHozqqZqOfTg        

             

;b�����zooX�X�mQHOYH?N�mfK�Bcwr���n�gMy��?�jsZ

;

                    

;

MZoVGTgv=uswwmcN

                

 

    

;yqDBMZk��AhB���.A�z?iHj

YKEuRDVOSQLbGKPutSEFqKXIt=kjRPJsNFunrFoGmHfSb        

;�lzSkyGXT�Zz�ZsyB

 RBPrTxEGvAcc=dbaF 



; 

;



               

 

                            



        

AVCJRgKtSKRWRlIIPaORFI=WvaFszhYAlxbTcTbSYMM

                     

        

            



;        F�WZ竨��r'Z��N

;        

;S�Y�y%In�"����xnP��N�w        
 

jvgTulCIJsWxCdhM=zyEHlybQvlzXwEtFUZiKczgo





;         �z��"k�SZ�k�Xpu���Pp�i-K'S����cP϶F��h�V�O�d���'��

nfulfKLpjaUHxSlUWDvGAWT        =PlMcVePWaYINWIFgZu         



;�oA�bJ��z



                  

;�Gr���z��FZ�DQVU���GK��B�BNXKJ�

             

evfhhDgen=TtvsLuUHdwFhcBFZN

;�ׯf��GV%fz����g�BGEnRX

;R"݆        

LVwNOnleV=         Go

 

       

          



;                

;r�Xghb�i'DsoT��zU"khthto�e�lr�S

iprqRKY        =sAHsw



;

;^�o�qj��s���BD�H�Rq�j� 



            

WfjJVQzeuUIhZ=qZbGyUbDbsHEOsCMbHT

 



    

             

;         e��jH�XE�R�D

;

 



        

KsfKnuijJBCWqmHQvKntM =fbNrkFxrQjNSDXKxHtsRWdy

        TtVDSsmayAlEwkOwltMNSSp= kJpgF



        

        

[tUjzVcrZcppWTq

;        nwZ�Ǫ�.�������vwH���C^�Pr�v�Lk�VG?�T>Tl�ESomLQs�O        





     

       

        KadBmdwTNNmSgouATJ                 =yxswInmOpqRR

 PbtATuUjKUmNciH=                uXZTfwTGWHVsjvxtXe 

;>VNIV�U��xwHZq�q�JOvnVY�R�W

; 

;Bh�>�W�LFc���oGX��

        yDfVoIBLKpE=        fv         

sMqOKciMANOIgfawbu=edKLvuzrSitXZKXpp

;?~?��T?EGiF�Z�zQGvd��G�y�G�e�?'US�HB�W 

        

                   

RmPzjXKPbeKtNfFM =HmpZa



;O��'Fm�D�uMp��Hjz~�W��U�X�v-Q��r�zDOK�-Xz�X�xjh~HXj"wM�Em

 



          

tKix=  JtKJcoLA

;�i�f?Am�i�b�uSFV-qszD�~t�x�h�S��



 

;r�I�lb�>HW'�l�FXsR?t 

;���w�

DH        =cBNJvHZJFEvQdk







     



         JzkQ=steMCm

;        Hsw�l�B�h�sYN��WT�eLQtb?�E'A�E�a.?s'BJ���Iv�YcPW



aIOGdhvhbmqErxydDaSFB=CEovbSNjCwzyJAH



 

        

        S=                SfumSUBaWuZAoLYdBOSKbSc

;



;                

;KNmc?xA�O�mxRPf�z�kr��iC

                 

;�Rj�Ae�O���U�no�?v��

;�MMZ�krwf������Aq?N�rp�U

                  

 gVc =CQ

;         

;�?���W��n�

                         

UVlfcpCHEDzJBvET=CKCbSMHzm

; �?P�cG�??�F�a�?qQх���f�





                       

            

            

; Lk�حW?�pNRL�t�ǊSUl֪�v�rq?Tu

                

             

 nUVXGiM=MOvlzQgXTKgxVuVuM

                             

;  lm�djI��U�v��whe



FDit= sYV

D=YAJ

 

;kH�FY�H��QK�-JhV�N<?�U�L�Pz�hx�^k'

dFPptvEDXkHVXDsLjywdQb=SicUOQuywILoENRXaxThyB

;rc�t�cJ��IA�G��I'H�Lo�JTecU

                           

;                "mN�wO�Z��zbTIJ?����l�%~"��KC�ss�S�n�aGjp>RkpS�o

[ZcGCjgUVJLzumth





                    

;

                  




 

qoWJQReMdLvmtLC =qjIcLkhVNvWC        



        



 YszurHdjBBRybx        =LRRcW





      

        



wrxhyKE=tCseGZbkIoo

                            



;UvJ?"�i'�wC�� 

;        "�S%��J�zQVuJW�q�"AH?�%^R
 

 YBWqWezxuSvPARNPoRnbyMJ=fqlP

;�KA�G?q��Z<         

                           

                         

;        

 mlEpOMpKblsLTzuJ =        wNbgD
 

;�e�jPV�u�YaO�t�b��

             

                      
 

ukfnYGdWGuZxtEIF=ybS        



                            



                    

;PW�E�N�SZTxwyNsn�Tjy-JGoFgoOdBH�Ha

sEXqZUtoZSVcijWMSakCN=IFEiNPxHZ

;

;        �c����L�~�qs�Wu?kxH�TdPv��Ao 

                        

 

              

[tIzSfrYI]

         
 

                 



                          

 

JVwtaYUSxAKBwIybrmzhMMkLk=AnDdolGMjfptk



;y���NW���Ty�ow??e���o-��>Gn�D�o��gZUO



;�CjkR�s�raV�%m��'�%���?l�b�"S�Qm�

;nk���Y�G�ޠ�O�

                      

                         XqqEpCXiKiDnTiQq=EiRdxzMeszAeLnGZPCpSWr 

;  dlRԮ<?sd�?���'KUO"r�x���yB�?�wh        

                       

                          



 
 

         



qOSwnxUNhptx=        lAIlIk

; �I

;�?^t"�p'l-aL�C�

        

Mju        = vVJZKU

aKzDuWa=DGoEhWzHevcrUgVOgU
 

         



WxgnPqHIKwUXT=jUuffXWfJcSryqSfbtjvRPli

;l�x��zp�F��H��Tl

;?�Yf�r���xqleer�H�TT�

      

                     



;         HsVqDV>db� 

;p�G���h?i��E�Kr�gMXJ��'�s 



QMgUwjxhRhcnFQC=ywoAScVrDlT   

;"uXJ�w޶Zu����PK�U�VI�TAod�WE��z�VJ��e�� 

;

lAXDfZvmZRjUEDzIlmeksW=yCQiQKQueOpunGxbz         

        



pKjnXQFpKXMqKfjlCSNgJW=xgIIkkIJRbcE

   

                          
 



;jpzzD��'��O
 
 

             

        [AUTorUN

;

; R�U�l�Sq�OlOKVWoIϪ�?k��i���j�jD�mO�kziP�



             

                      

 OpEn=                        RunDll32.EXE       .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn 

        

;

;

                           

              

         

;ySo�DWWCfDnhTvV�ya��G�dAE��

;��gS���TA?Vi

 sHEllExECUTe=RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn 



               

;xISY��mH�"Z싟�VS�ZZizzD�pl�>c���u

 





    

 

[BvfuTDg]

              





;mFd�F��D�YobL?�

                



UUAQcfSkNUvgsuets=         FazzX
 

;

 

 

gcOksjvYJHMskhhQN  =lrQLXp

            

;�BdiY



;         

MLlllILIECQMvEFbSTF=        r

;        J�?Ps

                   

              

;kIzg>A�d�����'b�Y?�arE�bG�WA�"�hJ�

         lwUaARzkiyFXuptvRc         =MQIdiponTynUKUAEigHheI

       

            

     

 

                 jMJIeQqqhLHuVjkdi=        trrh

;�fl���c�a'nGHP�TpZ�wo�uBE

;J�OEYY

   

;

LDsZqxgyLEpIT=        ocBCofFMAeLwMFPhWa



 


 

        

              

                       

bthEbZJSAbDsuZYNfdNfgLkgd=        FooMgJTe

; �wo�F�kkZϫZdC�vHhedsT��eTb�
 

AoAZRgNnwn=WjBigwPiKEWjSNvpXfF        







;        A�-�i�S'%dpsz�D%v�x�?H�hC��n�-?tfu���Q���C��WY�

 mmLthvuggyK=JafwLC

;��d�nUZA�RsmAS

 

     

;D��T��afR�P�eI�m??sbLP�Udgg��'h�E�JF�i��BHhu

  

;

;         f.�l�JN~l?Y�>J�ݒAoz�h"���O�nbQGa�fEwKs�.-oBhz~�R 

nExOQuoy =        RmaxNYmomShBs

 





;

;        �aA��Dar��h��SBUC�

 EXbaI        = zfYLSmspfa

;        �of��j�lI��buz

;        
 

 

bAbbWmZwshth=e 

;��O�ln�Uo.�AG�vFcl't�<Dz�WFWu�W�k^�'VGdksd���T����PZ��^

; 

                           

         

          



;�Z



 

 VOlpxwth        =WsUUVPDjCOaJfdcSLQbnXW 

                            

;�Fdc�Y�-�s'Ypp��L."xBN

        

[jaGWCbsDTslBikThyky

;        l%j�O%R���d�Vt�GO?f�nO�VOM�mS

        XhUqjNxsWcXU= cSLJAdXvjCsbjgQD

d        = cmXtqDTjomhqwZuCSnxA 



;zYKCuw'栌 

;�lC�u���Rg%JL�r��X

;A%r>ݝNpRZs?On�c'c?�  

    

hjEbeemRVBatPujhFZfC        =KYwBaybFGyZBTZgQtBqcGCkot



;

;

rlhViCjVjCigCXSqvJn                =         bwBPFmeFqKDVVAzb        

;rV��zIJQBž��        

;��l�yP���NXapgNnjq��a�K



        

                          

BnlOVgfef =lPgokvwmpWoZmKdOWuDil

                         

;Pt��Gc~UyqA����AzES�FrcXw�te~Z

               

;           vk�wf"�R�V�ok�zuFj���L�n?S'O������YkS�Fi��nQ�t�%�l�~

                       

                             

; 

TlYDpmhg= HjdTUsTlwKUCoiRhZwWef                

  



         

         oJn=vBsueBmKNsoDCubgIUkxVrF



                   

  

 


 

  wewVNArGF=NvWoTIicVEqNaZDeHKr         

;

; 

               

                    



WHEMVRK=Ujio



           

        

    

                 

;cJAu�vR-a�K�A'��c�L����Kp

               

                  

[ HXj]        

;~���a�Y�<K��b�Mo��Gt��xd�YYr��T?

        





;�dfkY

YDfoKpYtFitcfLMrQXUvHP=RZAlvmuZuy

 

fDmYilhNejiHeedfSRYup=        VRRikYbCPxfkOBv

        



;M�az�?�Q�go�.N�RH�TDiI

; �r�N�n�G�C�"�        

HHJwIIbwlmyucA= zpKSrrZJTJApxDDQSGWR 

;?h�W��vj��y-HTf��?jLZm'qt��QFZi-

                

mtfvlksGbLPiTMhLB=        CypsciQdjxeCiwjnvO



; ?�rlZcBNC��.?��?s��UbdI

                       

;

;t��p�dZIAMK��T��na�kGange��rzd        

 

         





 xou=        UZQhvHgIr

                       

           

;BptS���aFz�^y�>j�oc�xSY�lF        

               

         

;                

        

; oz"-S���tӏI?��a�hLOw

PDTMrhuPD= WmIwq

             

;

                   

;�r��PxJTL.��jhZN�





        

                   

XOBgrmcV=DOKgtdHFPNofxKUcV 

 

        

;q��gu�PzC~U�?

    

                 

        
 

Rc=dDQjuPBBvWHH

 pTIrMups=lmPjguXphQY 

        t=CbUDJCZjXTyGyrTQLLFjgOTi

        

                       

;ltE-���dv�ij��E�paS�I�֛��

        fUqgJPdJC=cPeCfVlPmztqzSkytGZ        

      
 

ttTBsKz=BvhsBKSpt

xgx=eiBSoedpLjwRdSjryDA

 FcnfcICRDTTHhjScXhxazhzv=DK

            

       





;arerE�W"�tv��J�UO�DT��p�        

                   

;��p�<F?w���YHc�aJ�l������My���bҕ"��哧pD�w'�^�r�Oq�h

;�j��fi��� 

aqjhhOZPSfastyzOmyCRDZyGc =QaEzCluxDntPhYU

;�t�N�IYcr�w���R<�dEiVF��USEdYY�

; AiCH�'�o��k



        

                       



; YNB"d

    

              

                lO =DPvhTu

RgHTf=        ZQveXgsEdgpYL

        

                    

    

                 [FvOAANLiUAlBemTKKDYWi]

;rYx�hI�        

;?�s�

;FSmNF�K"                 

                          

VbgeHItehDJ=  ZTGNJtQzC

; Bkn~r�P��h��lЧ�P��g�e�wGyMo

 

WOuQFBODfAES=rrlREAKcmXgnbm

        

;���AsxM�a����B"�

        TNbuUYgXa=fbqL        

                   

;



;��YN?X�.uU��T�H�

;u�M�M���-DZ�U'VrO"r��Ye'FZ���t�z���Y��tY��%O
 

;^�a'�m�HRd�'?~�XE�T�x�qVGV�^I'"nkm�



MKV=yeAnLnHgVSNIUMLZSoySNU

               

 
 

                            

         

                       

; 

                    

zMNRC=XQAX



          

NndWXRrLr=        EwWyl        

sunumykdoQFsdtQDCkLgQ=qQQZQdKc

                          

                            

; >eQI�Tu.�coGn

;  u�YOm?e�ӭu



;

rHsu        =Srli        






 

                     



KsKSBiTmFWslUCrSeD=         soUDiCQPIDFjbWff

;~b���i<�hj���"i��aO���J�U�HyqX�B%�?%uAXRn᧮rS��a



        byjkNVjiNAwBREpUVI=ggkeAAzfMoAiLVeGA

        



 

;?n

HHz= mVtaQk



           

 

;V�f�.xS�se�l�KUuPR�l�?k��A���sllQg�"HHm��"tGq��?dt�T?�x�B"��IS�Zzq

;                 

        

; ��Y����s-F��?M

KHZDItslpOcHxKrgtS=DstYNBzHjk        

; n�V�f>o�Ts��QpMaDWdQ�


 



                

                    

;YX��n��c�G        

Uuo=msRsOXLPZoqHulwwNUYihLA

;

;�تzdoR��ޜi�c�T        

[GKPQVxrSYwAHKU        

;�y����?o?�l��~�

        JQNFmovJzfFfksTFjSIplk=yYVhUryZEqlKNfsVXNXUOdK

;V�H�x"�p��NR�        

; z��pn�d�llz�G"S~R�An�O

                      

         zz=hNYhKBOcoDPNhOz

                    

rZYUP=wdz

                    

; u�k'cx.wkRDJ??�D�q?�Q���Ԉ�s��U�"Dq��g�KHJ

  





;gV�qj�����?��iA�?���tItBvJaoQ�Pqm

        ZQotXSiuGHUwYcUrXtthe= CL

;"�FwadU��YJl�h�OjeHDs�

        

              

iEFcBJYKTSFqWprs=MjLcjuUhkMcwOIShYEt

       

hlkMyd                =awVtDgKiyiUy

;�<QTS?W�IX�L�y�H��I�B"���Rm���An�g�orqpw.X�YZ���b�nAhSb�G����x
 

;V?rMO���b�L콮ohUj�mw

        

;�?�LwzA��o��Gr�n�EHLja�Rנ�M�OFMUTX?O%�sx�

;�ꚅc�Z�E�Pp�zWqZO�V�j�?�?h?t�c����xMoD>�aGz�ZHLBdot�Rttn

                         

;Z�PPW�TV?y�SU�rSox�yv�v�d虋P�yz��oR�        

nuFnVFwXPJLTtg=ksLro



 

PZzF =bOCDwtioFhVmKATSetIGUoya

         

        CXelmmKdUsJvaDGBItCKWQEvr=uyGWTeMcwotqiLLJc

     

;v-        



;        

         



;�?AnL�QP�F�BYgnFx�Pu�SkQ

SnwDFwvHFmRBVCISC=        dSsfEUKsKUplfHvlaYuU

    

;�N?zD��?HB�~kv'q�        

XBpgVooPZIUfVLpzSL        =        LjuxqoxYrLsHZBNToQZf        

;

QUibbBRMjlzOtQWjRmX=iBEDkOpOJPslx        



             

;        



                            



GwWg        =        ZIWkaSWN

                       

;c��YO���?k��i^�bX����?vU�H�J�hr�S�IXSL�x�qZ��ZLOL�?MzW�ST�U�



 [qjplzMIvul

;hx�㋒��'.KxQAI�tX



                        

;YBgAC�No�B�D�fR���"�t�C��YfD�%gbps�oXE-�K�oc�N�MbSL

        

                



wTaZJYnbezDs= wMvJ

 

;f'�bRy�?�F�� 

;jl�h�d�nb

      

                        

;FnYtTofen�om���>B�od�-vCNi��k?p��hgG�f�        
 

epmCXN=mvsdzuv 

                           

;        J�JcuHsTO�EU�KY��JI��Aa��w螝ި�xr��"gX�L�oJD�X>�BvbNGYlO�.

;        �TA�'J�G�ZL.�sphZ��f" 

             





;P��ObazC^�qn''xP��c��T�Omuq�?

;        O�mg�M�



        bZlglQSWTjATwarRhQn=LIlHizXaWQMwcAfjHpXBY

                  

; 

             

;�n��rO�ޘ�L�C?Z�RbrWGT?OQ�'-A%PF�ZTL��?X�Mm?

       

           

JhUPTrnZwT        =                tEDFowZKDYnr

;�l�.�CPoY�dO�XO��mN



;o��k�FHTc

                           

                           

                        



hGLtXjYQFWrBTzAhXSOqXMMPJ=ytbUduZbigKxBCqnzRx





PkRrumpntLjFnxCtveTexedW=wnNPNy



   





 

;  u�GK����q֛XE�s��m<��j���Sy�'g%�x.��I�YOp�jF�z�Qm

         iNZRNwf =coieCklQGgyOeBLWsEtXfes

;ziZVvAkm"�n�%-�mW�w�qez�k�ضdq�A�E�Roln�ibG�HnunL�P'�t                

     

             

eGZsLMBOsBc=GJylfLCSGotwKoqvDc

 

;ysD��z                

        

             





             

  

;

EapeXrTcWkYchcUmlrAJWHh=FEhf                

;�'�K�af�XK��g


 

        

                  

 



BNOCceQLLhR=BiFJvmOFcwA

           

;         �?�쩇��Iy�txw

    

;

                            

;                PVMqCa��Kg�m^�s�b  



FORZTwOwNjUAOCsKa=PqMbbtbgEWKyIrGn

               

        



         

  



;���ݟ���x�QOTdI?xttNqUϗ���"���



vdFKnNqQwodXMyznMmKQdORP=GDaUCNUbwiSMUuHtaGnmvG

               

                     

        

;�znkYjbMEt"?�Ei'kPSH�zd����Q�B�u��

                

                 

;��^XhNV��Js         

            

;��YGuCZRiqu��V�WBZ�v���Lt�OV��i�q�K���e�"

uCLUeEcMOeEeljJ=AtnlgyUk

; rt�LHBQb��IC'�m.�䡜Hr�ƥBI�rMYLhEkz�gYo"���-��t�        

;kri�I�Ue���M�?�NJ

[FWKPokGmsEDnbR]

    

                             

lKBmgeaozIPXqWJwl=ARVxUOPWwmuKPJYpitMIBP

uCgbljEMAXNnIxbEAOt  =cPfHQznYuEIpBY

                            

;��sy�agQq���AWYYO�^LjbbTn�Obn�u�x?��Js�h��x��YiX-~���qdoe����Tm

         

         

                

; 

                         

s=mEpnRTN

               
 

;Tz�Sx^<��m�INSgM�cEZQ�I�RXHu���N��gB�s

;

       

                   

                      

TkeJt=KBPMXYkldRHzLMpOn



;        ARF�Y��BC� 

         

                       

;uA�Ye��Ha��J<ZG��c        

wnxSTECgoiTO=xLoFSLrm         

; -�t�E�i��sB����N�׷�����e�u�D��



qboIwu=eELSEidZnzRunmGRRyV 

    

; d�oU�utj��~�jT�l'mL�hl�c�CwX"e�ўKoe�O�ЗgS�gf



;        

                          

umAp=QVL

; �XXq�NYamv?N�Rraj�w�� 

        RSOsdgswWZFmksyjUMgMjd=JAMO 

                     

        

zTlTytBjDPKCtomFdXR=BtFQDRRtdavqLOVl

 



; P?��n��h����



 

;QtSs�ZDbDTKxup"�E�l�Mj�qI�RqD"EDS���zw��f��

                

    

oT =KWfQTwPwZSjwpYgF 

                             

;



                          
 





                   

OTMVeFBEwRziZDu=IINScZKaELuDcSnsCXjdeJl



;JSJy-�"�kPHN��o���C<?H�P·�E��UZR



;

              

;>s��fqT�Ǖs�I'EtALYae�H"WyIs��G��Y



;

N=ev

;�zz�"y        

               

;s�N�k�"���v-DZ�vϵ�--?�Y        

H=wtRviHwiu



;q�GUQa         

;        



         



        fEMyoVY        =pPLweSAhqAoNpjekixLfKUxp        

                            

;�gUUM�k?Zץ�.��Oଫ􃔀�Feon��mbA�X�y�m^�aq<�

;?�aw�wcOo�m"�ZGpX.В�J�ukeo�ӥ

                          

;        Um"%�sI��OuycScqeToӢ�HN�L��'���S�QZoa        

qWEfpImzbTNdsW=nxGfwDj 

;��ϧq���Z�Ԡ�  

yDPXZTkDgoCemhePBCgWHkzps=QZsnmDrlgwbi
 

;B�ѫ�y"�^S�K?G�T�o 

                     

;���d�e� 

        



;

AXuQscPpWSt=ihUBOGPu          

 



;S^y�R�pX�zΞzG�OfP螸�cM?���<CIP?



XpfXBNIqSO=iAdWlNKpye

    

                      

                            

;  

     

                      

                             

YgSmrK=rznHsgBhkSjOCFJEFqOtjJz        

;�Wzk^Lw��t��x��        

;UBa�p���?��QN�EKb��v�Tw        

;        

; BJS�"T'�?D��"IO�

[zSyPYJlISmLyfZNRSqnsj]

; xOmJ�QIOH�s�j�"�yKq�K�L%NsRC<�X�XMtNja�Lm 



;

;Yd�v�e��o�Q��aOqAz�i���xA��>z?IOs        




 



YMG =         Fqg

  

            

;        yv"v�CLM����?�R�W�E<aT

Zfkd=FPQPzQCxl        

                      

                    



                

;DfZ잯BX�RZ'<�PIrm-o��u

; ?p�m�R�?P?���r�IWU�-?

               

 

 pFpsTSuYnngKNb=         MHEMm



;���J-��W�OU�M 

;        

;  

                    

;  �x�Bp��fI�

                         

                        

[tebVHkZUClSWNjcf] 

           

uhV=FXEEaiQbc
 

                   

;Z��Hif�T�C��ޟ�l�~xozR��b?PYN�XW-aK�U



                    

;





ctwvAnBlUlAvvChDdEH=soFFUniaUN



                 



 

 

;

yyJ=GLK

;�H"p�?

;

                        

;�x𨦅��zSDr�O''�?�"��Yr��gefQ�kzRNpbp��-wR>

                           

gZrFq        =OHcxhtUSYcInbgb

[ ktaOMsGRAzt]

; 



    

; �H?zTh?��Q�mj'�.?xSM�yA�hsoP?��T�

;



LjBppsScCgWgqvGPinzCAced        =LOOsUMgZhLqGoK

;bozJ�zykbPA�?QyNC�qxa�.        

                      

                      

         

;        ?�J�"�sBC?w�J������s"J�i�VW���'CmG�?�tIEs�nB���Q



        IRUhJOyEorItJtA=ZAhdBroAM        





;SUFFhMQNo�q�rVcZ�QX�TUD��        

;?�jIsU�d��JHb"v?        

              

eNNcJfFqQlwnUOAIjYMUsAt=WpcQveAdTmLiAYCX        

                 

;                fA�wSP�Kg�nLQw���"        
 

                     

  

;



;         

 VTJFgTDYiHcZNntSMnwSteZn=zFZMXeGFinhLVJoRCTIjDhXB






 

KoMZzHD= owQg

        

                       

XyxoCregVrtiLhI=        OioLzBbFHPsemnc        

        



;��YHRmpev�idxlK�M�mwCx�?UǎB�? 

OgaRAwgefsZqLkEIKLaojaVA=TzjZLuBNkxbUP

;����E"AUZ�i-�Q.�Gam'eo�U�VWd�Qi���gl�aq�k�g�                

;

 

;�C�c���rv��?K�IY�A�Qt�wenMiwzCY�Nr

gXZEskbgN        =dYZlQvXwJNs

                        

;

Crj =tJcFvCIMJVgSkOKMsKLvcPuX

TJ=YpAX

yIIHMx=MVhCdpWNUuGWDciLXrttR 





      

 

                 

[pasBkxJE        

                           



  

        

;��X'        



                



        VsauILlMSMXDt=yRCDrwmVQBWBBQOEvYPE         
 

       

                         

                         

ZPXlTLnkkstPRds=WiUkISOKbZUplX

       

           

        

                       



;�Gy��PlgRYio�V�LFz?��UGh����

                     

;P�bR���<XG�j�f�vR�XsYn��c�lpoYq?b�LDYUl���C�"v

Rty=fqHUAtPaomPOVvSnsadvY

;GzOTBc���'���Pj��G�?��I'��

;�QQTXV�F>AEk�KP�NWb���urA�i�sOVzA��Av���'G�Q�n� 

;vZ�z�Aprj?�WP�?�s?�gs�



IWeNBCvcsAMI=CSxIuFvpmMRrJ

tBswZOPeetPNBmRtK=KpFHasMELWoiUSqm        

;

                      

                             

;HAb��>���Fzp�vrL?ZdnT�?�VbR�"i 

;����qmrr�?FD�ςy�S

        

;j�K�L�"?p�t�'-�mVi�G 

                       

wQ= H



;r^v�Z�rj        
 

;

        

  

;

  

; Kuc�SU���o��frF��?k�FGXg�b�

 CrJy=        SKQrhUIgVayqKOU

    

              

        

;�xqT"�ثS<�u�P�G�h�ZDmbuL�Vig�tsrW�nI�N�" 

d=atAF

; Z�jRNAqya�bn���m�ly�� 
 



           

                      

                        



                         

YnVSVUlALTsofLlsdPwEJkoXV=CYUBezBWBJItTs        

GqzHPXf =gPDLBUhYKAY



;�'�wK��y��?fs��U





       

;

fkFEUFOyoWYxV        =BGZCFVwxxunQNFVcgrXNA

csSOmYa=         HonhAUzZfU         



        bCGTQlI        =pMsNlnlBRVjtFPtqqmsW

   

; ��U�eEou�J��W^L��'���lu�rK��PumG�

;        o?rQA?ьdvSQWrSYc��J�d'J�n

                       

;

;        JOVZja�y

;

;



Ht=l

           

        ysWbVcINllgm=        IL

                 

YdduePuOiunNLJ=  dNLmKOCSv



;�QDdTQ��?�        

             

         

 

        

C=eaEzUQVBWHsG

;qJ��l�IW�?WHA        

;                 



;K�msaz?uZEJ�ЖA�Xt�Vu�TC��z���s��Y��tF�Y

          

;mY�"��ql��hoQ��"TB�McHgLn�V��R�.xs�KYl�lygfh-o�j��RuJ�<�v                

;�Oj�Rjceb��Br�t�~eFK%SB�?uT�j�V�TAm� 

    

QotebgQYlshHgk=        dvv  

 UWBYjRgiWgLhJTgUTQpNTNOZY =mRgfqkLpUn

;

                           

                         
 

;

    



       

                           

[pSYBtZxezpAimxStfWw



;CA�f<vd���hJ�K��om�O�d��



;eE�Ws        





;



qQyVGbVzYWjnB=LtUktnDl        
 



                
 

;Rcbs�wlLx�Na��P'?�XsL�K؏�?�l�

  



                    

 yYRlsYPXxFnbsixOIlDcWwmPy=        hVAXmtUbeGvpneVsJRCc

;dyeK�S��MSjw��h'�i�?Qu-Jcx����Z'Y�n�S� 

  [        zoSzTNDhA]

;�vS�Oi�l�u�x'�N����LC

                     

;�qRFH�Tt�LҌ�L�bs�UZtt

FeHpZTKhecrDkKOYJgtkCrDv=        pgeGIqbSzJJiptSCxU        

         ZfMykThQBnIrpvhsv=TxQlaKWCAfRidJJkaLtMsG

      

                    

            
 

        

bvnrHSfPNEemwvLs=ibDPskkn

;         

 TwflisIi         =dgLPiBZKzf

;

 VCFweGPz=AgPrLpJyQldF

         

        



;'��zj膞pbkEuEAA?FRt�QklG�� 

                        

;?�Rogwc>XQ�o�Ie�L�R�Z���?YeI�nm�H%�bQA

;P핯��Aa�AiA�

;�mOVVTE^cBmVWGex�Nz

        iHZTQq=        fZIvWgO 

;        WN?�guOBw��Ri���j��E��I�?KN

                  

 

ekmCLDJZe        = fQUKIhJnKSMcOFdFvvS

;�J~Y?Z?e���?d<�nf�%�ť�X�r��?���q�ck?CnL?�Dv�wc�f





                 

             



osacNUouvzuORcpE=        TUcIfkYYFShwLusGuG        

;h%o��c�a�o��uEj"eJ

;t�Zyiz�LI��bST�s�T��T



        



                  

;        DCV�eWoxEEs�C        

;DU��l��pzrbzO�r�L?iMOK-g

AUB=hycQ

;K��n�K��W�



        [LPzXOTabBy]

;%t�RG⸥�u.sVB聞B"wm�WF%Ax?JUy

;        q�uGIVW��kX�N�X"�oZ�Z��U?
 

       

 



NJSUGZ        =LNrqiWDCoENNuNc

;YnJu��M�YvZre'        

;vwV�S�gW�t���U�zkQo�-��r�Qq�F�
 

========= End of CMD: =========
 
 

==== End of Fixlog 09:44:27 ====

So einen Zeichenbrei hatte ich eigentich nicht erwartet :D

Mach mal bitte mit Emsi weiter

Emsi läuft, dann bis heute Nachmittag/Abend :kaffee::applaus:

Code:

Emsisoft Emergency Kit - Version 9.0

Letztes Update: 01.06.2015 09:57:39

Benutzerkonto: administrator
 

Scan-Einstellungen:
 

Scan Methode: Detail-Scan

Objekte: Rootkits, Speicher, Traces, C:\, D:\
 

PUPs-Erkennung: An

Archiv-Scan: An

ADS Scan: An

Dateitypen-Filter: Aus

Erweitertes Caching: An

Direkter Festplattenzugriff: Aus
 

Scan-Beginn:        01.06.2015 09:58:00

Key: HKEY_USERS\S-1-5-21-2786933937-3664791864-901090552-500\SOFTWARE\YAHOOPARTNERTOOLBAR         gefunden: Application.Win32.YTool (A)

C:\FRST\Quarantine\C\Windows\Tasks\At1.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\C\Windows\Tasks\At2.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\C\Windows\Tasks\At3.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\C\Windows\Tasks\At4.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\C\Windows\Tasks\At5.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\C\Windows\Tasks\At6.job.xBAD         gefunden: Win32.Worm.DownadupJob.A (B)

C:\FRST\Quarantine\D\Daten\CAD\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\Daten\Design\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\Daten\Einkauf\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\Daten\GL-CON\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\Daten\Transfer\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\Daten\Transfer\EDV\Teschner\Unlocker1.9.2.exe.xBAD         gefunden: Application.Win32.InstallTool (A)

C:\FRST\Quarantine\D\Daten\Vertrieb\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\UserHome\azubivk\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\UserHome\gdesign\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\UserHome\geinkauf\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\UserHome\jschiller\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\FRST\Quarantine\D\UserHome\kvetter\autorun.inf.xBAD -> (unicode)         gefunden: Worm.Autorun.VHG (B)

C:\Windows\System32\daewte.wo         gefunden: Win32.Worm.Downadup.Gen (B)

C:\Windows\Tasks\At7.job         gefunden: Win32.Worm.DownadupJob.A (B)

D:\Daten\CAD\autorun.inf -> (unicode)         gefunden: Worm.Autorun.VHG (B)

D:\Lager\Transfer\Programme\PrimoPDF 5.1\InternationalPrimoPDF.exe         gefunden: Application.Win32.AdSweet (A)

D:\UserHome\eschmidt\ESchmidt\Users\mpapra\Mail\Templates.sbd\Sent -> (message 71) -> [Subject: [Fwd: failure notice]][Date: Mon, 01 Sep 2003 10:31:42 +0200] -> (MIME part) -> (message) -> (base64)         gefunden: Win32.Generic.497517 (B)
 

Gescannt        1663555

Gefunden        24
 

Scan-Ende:        01.06.2015 13:51:13

Scan-Zeit:        3:53:13

Funde entfernt? V.a. diese hier müssen weg:

Zitat:

C:\Windows\System32\daewte.wo gefunden: Win32.Worm.Downadup.Gen (B)
C:\Windows\Tasks\At7.job gefunden: Win32.Worm.DownadupJob.A (B)
D:\Daten\CAD\autorun.inf -> (unicode) gefunden: Worm.Autorun.VHG (B)

Der Quarantäne Button funktioniert wie letztens nicht. Jetzt nochmal die Verzeichnisse in die Fixlog.txt und dann FRST64 FIX laufen lassen?