Hallo kira,
vielen Dank für deine Hilfe !!
Hier die log vom Malwarebyte = keine Funde: Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Datenbank Version: v2012.08.01.03
Windows Server 2008 Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: *** [***]
01.08.2012 09:16:59
mbam-log-2012-08-01 (09-16-59).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 421629
Laufzeit: 8 Minute(n), 16 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
Hier die log von OTL:
OTL Logfile: Code:
OTL logfile created on: 01.08.2012 09:33:53 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\***\Desktop
64bit-Windows Vista Server Standard Edition (full installation) Service Pack 2 (Version = 6.0.6002) - Type = NTServer
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
11,99 Gb Total Physical Memory | 9,07 Gb Available Physical Memory | 75,68% Memory free
24,20 Gb Paging File | 18,30 Gb Available in Paging File | 75,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 70,72 Gb Free Space | 63,26% Space Free | Partition Type: NTFS
Drive D: | 149,04 Gb Total Space | 108,69 Gb Free Space | 72,92% Space Free | Partition Type: NTFS
Drive E: | 698,51 Gb Total Space | 346,76 Gb Free Space | 49,64% Space Free | Partition Type: NTFS
Computer Name: **** | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe (iAnywhere Solutions, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\SpeedFan\speedfan.exe (Almico Software (www.almico.com))
PRC - C:\Program Files (x86)\Cobian Backup 10\cbInterface.exe (Luis Cobian, CobianSoft)
PRC - C:\Program Files (x86)\Cobian Backup 10\Cobian.exe (Luis Cobian, CobianSoft)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\FRITZ!\FriFax32.exe (AVM Berlin)
PRC - C:\Program Files (x86)\aborange Scheduler\aboScheduler.exe (aborange.de - Mathias Gerlach)
PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
PRC - C:\Programme\ASUS\Six Engine\SixEngine.exe ()
========== Modules (No Company Name) ==========
MOD - C:\Users\***\AppData\Local\Temp\1\sfamcc00001.dll ()
MOD - C:\Users\***\AppData\Local\Temp\1\sfareca00001.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\SysWOW64\AsIO.dll ()
MOD - C:\Programme\ASUS\Six Engine\SixEngine.exe ()
MOD - C:\Programme\ASUS\Six Engine\AsusService.dll ()
MOD - C:\Programme\ASUS\Six Engine\pngio.dll ()
MOD - C:\Programme\ASUS\Six Engine\AsSpindownTimeout.dll ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (RSoPProv) -- C:\Windows\SysNative\RSoPProv.exe (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (sacsvr) -- C:\Windows\SysNative\sacsvr.dll (Microsoft Corporation)
SRV:64bit: - (FCRegSvc) -- C:\Windows\SysNative\FCRegSvc.dll (Microsoft Corporation)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (!SASCORE) -- C:\Programme\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV - (cbVSCService) -- C:\Program Files (x86)\Cobian Backup 10\cbVSCService.exe (CobianSoft, Luis Cobian)
SRV - (OO DiskImage) -- C:\Programme\OO Software\DiskImage\oodiag.exe ()
SRV - (GatewayAgentService) -- C:\Program Files (x86)\OO Software\Shared\GatewayAgent\ooemcgats.exe (O&O Software GmbH)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (de_serv) -- C:\Program Files (x86)\Common Files\AVM\de_serv.exe (AVM Berlin)
========== Driver Services (SafeList) ==========
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (oodivdh) -- C:\Windows\SysNative\DRIVERS\oodivdh.sys (O&O Software GmbH)
DRV:64bit: - (oodivd) -- C:\Windows\SysNative\DRIVERS\oodivd.sys (O&O Software GmbH)
DRV:64bit: - (oodisrh) -- C:\Windows\SysNative\DRIVERS\oodisrh.sys (O&O Software GmbH)
DRV:64bit: - (oodisr) -- C:\Windows\SysNative\DRIVERS\oodisr.sys (O&O Software GmbH)
DRV:64bit: - (auusb) -- C:\Windows\SysNative\DRIVERS\auusb.sys (Auerswald GmbH & Co.KG )
DRV:64bit: - (mv61xx) -- C:\Windows\SysNative\DRIVERS\mv61xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (storvsp) -- C:\Windows\SysNative\drivers\storvsp.sys (Microsoft Corporation)
DRV:64bit: - (Vid) -- C:\Windows\SysNative\drivers\vid.sys (Microsoft Corporation)
DRV:64bit: - (mv64xx) -- C:\Windows\SysNative\DRIVERS\mv64xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (TEAM) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTTEAMPT) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (sacdrv) -- C:\Windows\SysNative\DRIVERS\sacdrv.sys (Microsoft Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\storflt.sys (Microsoft Corporation)
DRV:64bit: - (ioatdma) -- C:\Windows\SysNative\drivers\qd260x64.sys (Intel Corporation)
DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\s3cap.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\Drivers\RootMdm.sys (Microsoft Corporation)
DRV:64bit: - (RtNdPt60) -- C:\Windows\SysNative\DRIVERS\RtNdPt60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (VLAN) -- C:\Windows\SysNative\DRIVERS\RtVLAN60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (RTVLANPT) -- C:\Windows\SysNative\DRIVERS\RtVlan60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\DRIVERS\ASACPI.sys ()
DRV:64bit: - (FPCIBASE) -- C:\Windows\SysNative\DRIVERS\fpcibase.sys (AVM Berlin)
DRV:64bit: - (AVMCOWAN) -- C:\Windows\SysNative\DRIVERS\AVMCOWAN.sys (AVM GmbH)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (NPF_devolo) -- C:\Windows\SysWOW64\drivers\npf_devolo.sys (CACE Technologies)
DRV - (AVMPORT) -- C:\Windows\SysWOW64\drivers\avmport.sys (AVM Berlin)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/HardAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "google.de"
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.29 02:26:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.05 17:48:39 | 000,000,000 | ---D | M]
[2010.12.29 02:26:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions
[2012.04.30 08:38:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\8kuf66bv.default\extensions
[2011.01.03 15:18:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\8kuf66bv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.29 02:26:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.12.03 20:14:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 20:14:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.03 20:14:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.12.03 20:14:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.12.03 20:14:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4:64bit: - HKLM..\Run: [OODITRAY.EXE] C:\Programme\OO Software\DiskImage\ooditray.exe (O&O Software GmbH)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClearProg.lnk = C:\Program Files (x86)\ClearProg\ClearProg.exe (privat)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!fax.lnk = C:\Program Files (x86)\FRITZ!\FriFax32.exe (AVM Berlin)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NasControl.lnk = C:\Admin\NasControl\NasControl.exe (eriso.org)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 1
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0D1B5EC5-D8B2-41EB-AFF8-E1A873FA5C3E}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{86CA9858-92AF-4C89-99E6-0B2E6E2CF54A}: NameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.07.31 14:37:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.07.31 14:37:53 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.07.31 14:37:53 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.07.31 14:36:21 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2012.07.31 14:36:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.31 14:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.31 14:36:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.31 14:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.20 07:35:58 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.07.20 07:35:58 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.07.20 07:35:58 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.07.20 07:35:58 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.07.20 07:35:57 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.07.20 07:35:57 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.07.20 07:35:57 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.07.20 07:35:57 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.07.20 07:35:57 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.07.20 07:35:57 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.07.20 07:35:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.07.20 07:35:56 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.07.20 07:35:56 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.07.11 07:42:49 | 000,254,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[4 C:\Users\Administrator\AppData\Local\*.tmp files -> C:\Users\Administrator\AppData\Local\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.08.01 09:33:27 | 000,003,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.01 09:33:27 | 000,003,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.01 09:31:19 | 000,137,561 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.08.01 07:40:46 | 001,485,920 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.01 07:40:46 | 000,642,910 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.01 07:40:46 | 000,608,078 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.01 07:40:46 | 000,133,388 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.01 07:40:46 | 000,110,564 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.01 07:34:45 | 000,137,561 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.08.01 07:34:37 | 000,000,304 | ---- | M] () -- C:\Windows\tasks\RtlNICDiagVistaStart.job
[2012.08.01 07:33:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.01 07:33:24 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\BackupLX.job
[2012.07.31 14:37:55 | 000,001,655 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.07.31 14:36:13 | 000,000,843 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.20 07:41:42 | 000,264,544 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[4 C:\Users\Administrator\AppData\Local\*.tmp files -> C:\Users\Administrator\AppData\Local\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.07.31 14:37:55 | 000,001,655 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.07.31 14:36:13 | 000,000,843 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011.09.27 12:17:26 | 000,198,144 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll
[2011.09.27 12:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll
[2011.09.27 12:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll
[2011.09.27 12:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll
[2010.12.31 12:02:03 | 000,315,444 | ---- | C] () -- C:\Windows\SysWow64\isdnapi32.dll
[2010.12.31 12:02:03 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\AuerCapiJNINative.dll
[2010.12.29 02:26:55 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.12.28 13:14:10 | 000,005,956 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\FritzAdr.dbf
[2010.12.28 13:14:10 | 000,004,096 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\FritzAdr.mdx
[2010.12.27 19:31:12 | 000,000,638 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.12.27 12:42:02 | 000,000,198 | ---- | C] () -- C:\Windows\ODBCINST.ini
[2010.12.27 12:31:11 | 000,000,141 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.12.26 18:24:27 | 001,464,990 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.12.26 16:47:18 | 000,137,561 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.12.26 16:47:17 | 000,137,561 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.12.26 16:39:10 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2010.12.26 16:39:10 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2010.12.26 16:39:07 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010.12.26 16:39:07 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010.12.26 16:21:25 | 000,028,311 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2010.12.26 16:21:01 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.12.26 16:20:52 | 000,020,218 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.12.26 16:18:45 | 000,000,732 | ---- | C] () -- C:\Users\Administrator\AppData\Local\d3d9caps64.dat
[2010.10.21 15:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2010.10.21 15:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2010.10.21 15:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
< End of report > --- --- ---
Hier die log von Extras:
OTL Logfile: Code:
OTL Extras logfile created on: 01.08.2012 09:33:53 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\***\Desktop
64bit-Windows Vista Server Standard Edition (full installation) Service Pack 2 (Version = 6.0.6002) - Type = NTServer
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
11,99 Gb Total Physical Memory | 9,07 Gb Available Physical Memory | 75,68% Memory free
24,20 Gb Paging File | 18,30 Gb Available in Paging File | 75,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 70,72 Gb Free Space | 63,26% Space Free | Partition Type: NTFS
Drive D: | 149,04 Gb Total Space | 108,69 Gb Free Space | 72,92% Space Free | Partition Type: NTFS
Drive E: | 698,51 Gb Total Space | 346,76 Gb Free Space | 49,64% Space Free | Partition Type: NTFS
Computer Name: **** | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DisabledInterfaces" = {51867718-8A5D-4A6C-8E11-AAE79FAC99D0},{4471582E-141C-458B-B8F1-7CE806F3B98C}
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0368CE0C-BEA8-4A11-B003-9602B850CA22}" = lport=445 | protocol=6 | dir=in | app=system |
"{0FC2587B-51DC-49C7-8C68-6C11D8A2F28E}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{11074376-7A53-432D-920C-6EF8408A7FDA}" = lport=138 | protocol=17 | dir=in | app=system |
"{191F4E06-EA10-4FD8-BDED-5048DCC1FEC7}" = rport=138 | protocol=17 | dir=out | app=system |
"{19D8065A-D2AF-4E24-A786-63EAE478C6AC}" = lport=139 | protocol=6 | dir=in | app=system |
"{19FFC750-2EB3-40C3-A50E-C2FBB7D80868}" = lport=139 | protocol=6 | dir=in | app=system |
"{1B0AF0FA-164B-4C63-A93D-731B5B8ABD54}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{1EBA0DF7-F5E5-4D70-8FCC-E8B86E42C0D0}" = rport=138 | protocol=17 | dir=out | app=system |
"{1ED288C1-8919-4BD5-87C4-4E9BC660A50F}" = lport=5358 | protocol=6 | dir=in | app=system |
"{23FDAC94-2D8C-4AA4-A614-D43934582AC5}" = rport=137 | protocol=17 | dir=out | app=system |
"{2DA5549A-CF63-4957-93F1-DFC80B6CEA95}" = lport=3389 | protocol=6 | dir=in | app=system |
"{2FD541F7-A4AE-48E4-B5B9-0EFC840DEC0B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{327A8B62-1FD6-45AD-8193-A5E1FEA99E1E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3C70C02A-D2F8-4D2A-BF4A-162652C613B6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{3E88D464-11AB-4360-BAEB-4FA0A05335F3}" = rport=137 | protocol=17 | dir=out | app=system |
"{42A74DFD-4866-4ABD-9441-F12085D934E0}" = lport=138 | protocol=17 | dir=in | app=system |
"{46286766-6C7A-484F-8DF8-B00B4DD9862B}" = lport=137 | protocol=17 | dir=in | app=system |
"{4CCFCC58-9803-4949-824E-8F76A230C13F}" = rport=445 | protocol=6 | dir=out | app=system |
"{513809DE-6989-4B4C-936B-A3480C6A7F03}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5796BBCB-8ACE-4129-AB8F-6DE07465A913}" = rport=138 | protocol=17 | dir=out | app=system |
"{606A9E37-F473-498F-9A98-A5B38FC39351}" = rport=5358 | protocol=6 | dir=out | app=system |
"{647D2B92-676D-45E1-88F5-E4E51CBD8BC1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{68C686AD-BA53-4B70-9B2E-6CAA3D099A32}" = lport=445 | protocol=6 | dir=in | app=system |
"{71578490-1187-426F-9100-573D5F65836F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{82304730-EA5E-48EB-A6DE-AEE68061BE58}" = lport=5357 | protocol=6 | dir=in | app=system |
"{834B1899-F6F6-4BDE-9426-28B37132B44D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{857490B4-314D-48C0-8AA8-F7B137A354E4}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8717A1ED-87AD-42A1-B5D0-67FC9D25373A}" = lport=137 | protocol=17 | dir=in | app=system |
"{9602485D-748B-48C4-8978-09A97D41748B}" = rport=139 | protocol=6 | dir=out | app=system |
"{99580526-EE35-4732-835C-705E27FE0764}" = lport=10300 | protocol=6 | dir=in | app=c:\program files (x86)\devolo\informer\devinf.exe |
"{AABC9606-F8CA-4A99-B39A-AAF675B81F97}" = rport=137 | protocol=17 | dir=out | app=system |
"{B8FD16D6-536E-49BD-85A7-3F12FAB046CE}" = rport=5357 | protocol=6 | dir=out | app=system |
"{BD432014-04C6-4CE9-B642-6214480D01B0}" = lport=137 | protocol=17 | dir=in | app=system |
"{C2D3B6BA-B719-4049-84E7-4E27C89DD299}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C376FD55-8263-4A2C-AAC2-14CC3009E7E7}" = lport=138 | protocol=17 | dir=in | app=system |
"{DC56CBF2-8E6E-49F7-BE35-B85D3D635999}" = lport=10301 | protocol=17 | dir=in | app=c:\program files (x86)\devolo\informer\devinf.exe |
"{DC60185E-7F9F-4B37-BFCC-CB1B2820E4F5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E947A990-4FEA-4D9A-8710-A2160C4D66D3}" = rport=139 | protocol=6 | dir=out | app=system |
"{EC360F41-C4D0-4FE3-8D47-41B999251AC5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F25F09C1-FD6C-48E8-A687-C36E6E02FDAF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FCEBE7CB-CF04-427C-9900-CC0FF27814AE}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1478F452-A72D-4E44-B045-DFDF3679A47B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{1E2CBCAA-D949-4B11-8546-E343A6B86DE5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{40251F11-798C-475F-91C9-C21CB6A3978E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{52F08C73-0F76-404E-BD6E-55F6458E463B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{62C0F37B-4BAE-4E8F-BBD3-AA4ACD677646}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{69DEEDE9-4B2A-4B16-896F-A00DCFA05F1E}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{6A5327C9-6651-4F43-9BFF-92B3E9481ECC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{A66DA751-F9E7-4F8C-B05E-164CCA67D3B4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{A9FE3339-2C84-45CE-829F-18EF077878D7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C2BCA411-5C4F-4020-8CCF-DB4556224808}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{DD1BC9AD-68A5-4883-BE7C-F3DA437A06D3}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{E6F0479A-CB0D-45FA-AB72-1330B8ACF0D3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F52010AF-7BEB-47D6-BFE3-59ECF7FBD4FE}" = protocol=6 | dir=out | app=system |
"{FA895649-4CA7-46E9-9FB4-9E23F1145C89}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"TCP Query User{0217D3E8-D3F5-4C99-AF96-F8D761A8DCFC}C:\program files (x86)\cobian backup 10\cobian.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cobian backup 10\cobian.exe |
"TCP Query User{33013156-D6E6-4E25-B0B2-22BC0B070AC3}D:\download\umzug sachsenkam\software\buffalo\tftp boot recovery\tftpservermt.exe" = protocol=6 | dir=in | app=d:\download\umzug sachsenkam\software\buffalo\tftp boot recovery\tftpservermt.exe |
"TCP Query User{609D6DE8-E729-4A22-99D5-76106A63E8C7}C:\program files (x86)\smartwizard discovery\smartwizard discovery.exe" = protocol=6 | dir=in | app=c:\program files (x86)\smartwizard discovery\smartwizard discovery.exe |
"TCP Query User{690B7CDF-19DE-4F6D-9444-540A08024364}C:\windows\syswow64\ftp.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\ftp.exe |
"TCP Query User{927AA82F-1827-4E0A-8684-123963CA2578}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
"TCP Query User{F5CCFC9D-218D-491B-AE78-6ACFB87FEA60}C:\program files (x86)\smartwizard discovery\smartwizard discovery.exe" = protocol=6 | dir=in | app=c:\program files (x86)\smartwizard discovery\smartwizard discovery.exe |
"UDP Query User{2AC1E24C-5D97-4394-A312-C034B6C5BD76}C:\program files (x86)\smartwizard discovery\smartwizard discovery.exe" = protocol=17 | dir=in | app=c:\program files (x86)\smartwizard discovery\smartwizard discovery.exe |
"UDP Query User{2DC2B310-4FB2-4AA0-980F-6716BEEEC0C1}C:\windows\syswow64\ftp.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\ftp.exe |
"UDP Query User{2FE9624C-66A9-4BE1-A7F6-88958D6D03FD}C:\program files (x86)\smartwizard discovery\smartwizard discovery.exe" = protocol=17 | dir=in | app=c:\program files (x86)\smartwizard discovery\smartwizard discovery.exe |
"UDP Query User{3CC7BDE4-EE67-46C1-A475-8EC3C646F7D1}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |
"UDP Query User{9FC2D3DE-2764-4ACB-8BE7-DE4F3D4B02B8}D:\download\umzug sachsenkam\software\buffalo\tftp boot recovery\tftpservermt.exe" = protocol=17 | dir=in | app=d:\download\umzug sachsenkam\software\buffalo\tftp boot recovery\tftpservermt.exe |
"UDP Query User{BDC0F8F2-5724-423A-A9B0-1ADF459D5BF2}C:\program files (x86)\cobian backup 10\cobian.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cobian backup 10\cobian.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E729E93C-3E62-4ED7-83BF-1234A27B8BE2}" = O&O DiskImage Server
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 23
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56B83336-FBC1-4C46-8613-90A9E3B440D6}" = EPU-6 Engine
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Diagnostic Utility
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B9B124-A592-40B1-917B-CE8FE9247E48}" = BackupLX
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BF23011-599F-4854-8D15-6111A9550385}" = Datenaktualisierung
"{A31951C5-DCD8-4DFE-A525-CFC701F54792}" = TurboV
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{B1D2A138-D53E-4D3F-B547-EA2277007746}" = Auerswald COMset 2.7.2
"{B256C380-AC47-4681-8342-7F42E4F0F434}" = JRE 1.6.1
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"aborange Scheduler_is1" = aborange Scheduler - Deinstallation
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVM ISDN CAPI Port" = AVM ISDN CAPI Port
"ClamWin Free Antivirus_is1" = ClamWin Free Antivirus 0.96.5.0
"ClearProg" = ClearProg 1.6.0 Final
"CobBackup10" = Cobian Backup 10
"dlanconf" = devolo dLAN-Konfigurationsassistent
"dslmon" = devolo Informer
"FRITZ! 2.0" = AVM FRITZ!
"FRITZ! LAN Assistent" = AVM FRITZ! LAN Assistent
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"mv61xxDriver" = marvell 61xx
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Smartwizard Discovery_is1" = 2.05.05
"SpeedFan" = SpeedFan (remove only)
"TuneUp Utilities 2011" = TuneUp Utilities 2011
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 02.07.2012 12:30:03 | Computer Name = **** | Source = VSS | ID = 8194
Description =
Error - 05.07.2012 14:29:37 | Computer Name = **** | Source = BackupLX | ID = 0
Description = FTP Fehler: In die Übertragungsverbindung können keine Daten geschrieben
werden: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.
Error - 09.07.2012 12:30:03 | Computer Name = **** | Source = VSS | ID = 8194
Description =
Error - 13.07.2012 15:34:41 | Computer Name = **** | Source = BackupLX | ID = 0
Description = FTP Fehler: In die Übertragungsverbindung können keine Daten geschrieben
werden: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.
Error - 16.07.2012 12:30:03 | Computer Name = **** | Source = VSS | ID = 8194
Description =
Error - 23.07.2012 12:30:03 | Computer Name = **** | Source = VSS | ID = 8194
Description =
Error - 25.07.2012 16:26:02 | Computer Name = **** | Source = BackupLX | ID = 0
Description = FTP Fehler: In die Übertragungsverbindung können keine Daten geschrieben
werden: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.
Error - 30.07.2012 12:30:04 | Computer Name = **** | Source = VSS | ID = 8194
Description =
Error - 30.07.2012 16:43:56 | Computer Name = **** | Source = BackupLX | ID = 0
Description = FTP Fehler: In die Übertragungsverbindung können keine Daten geschrieben
werden: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.
Error - 31.07.2012 08:40:10 | Computer Name = **** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
0x4cf9293f, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.18449, Zeitstempel
0x4da47a32, Ausnahmecode 0xe06d7363, Fehleroffset 0x0001c83b, Prozess-ID 0x930,
Anwendungsstartzeit 01cd6f18959c35e2.
[ Cobian Backup Boletus VSC Service Events ]
Error - 03.01.2011 13:59:59 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Protocol inconsistency. Purging the current snapshot set
Error - 03.01.2011 14:01:13 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 03.01.2011 15:15:24 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Protocol inconsistency. Purging the current snapshot set
Error - 03.01.2011 15:16:46 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 25.01.2011 06:54:11 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 28.02.2011 14:04:37 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Protocol inconsistency. Purging the current snapshot set
Error - 28.02.2011 14:15:19 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Protocol inconsistency. Purging the current snapshot set
Error - 01.03.2011 17:41:49 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 02.03.2011 07:55:50 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Timeout für den Vorgang wurde überschritten.
Error - 16.01.2012 15:35:10 | Computer Name = **** | Source = Cobian Backup Boletus VSC Service | ID = 0
Description = Deletion of snapshot failed: The requested object does not exist.
[ System Events ]
Error - 30.07.2012 13:52:00 | Computer Name = **** | Source = volsnap | ID = 393251
Description = Die Schattenkopien von Volume "E:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht vergrößert werden kann.
Error - 30.07.2012 17:10:35 | Computer Name = **** | Source = Service Control Manager | ID = 7043
Description =
Error - 31.07.2012 01:49:25 | Computer Name = **** | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 31.07.2012 01:50:52 | Computer Name = **** | Source = Service Control Manager | ID = 7001
Description =
Error - 31.07.2012 01:50:52 | Computer Name = **** | Source = Service Control Manager | ID = 7000
Description =
Error - 31.07.2012 01:50:52 | Computer Name = **** | Source = Service Control Manager | ID = 7000
Description =
Error - 01.08.2012 01:33:31 | Computer Name = **** | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 01.08.2012 01:34:58 | Computer Name = **** | Source = Service Control Manager | ID = 7001
Description =
Error - 01.08.2012 01:34:58 | Computer Name = **** | Source = Service Control Manager | ID = 7000
Description =
Error - 01.08.2012 01:34:58 | Computer Name = **** | Source = Service Control Manager | ID = 7000
Description =
< End of report > --- --- ---
Hier die Programme: Code:
2.05.05 27.12.2010 2,25MB
aborange Scheduler - Deinstallation Mathias Gerlach [aborange.de] 13.04.2011 2,38MB 2.60
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 28.06.2012 11.3.300.262
Adobe Reader X (10.0.1) - Deutsch Adobe Systems Incorporated 04.03.2011 115MB 10.0.1
AVM FRITZ! AVM Berlin 27.12.2010 27,1MB
AVM FRITZ! LAN Assistent 27.12.2010 352KB
AVM ISDN CAPI Port 27.12.2010
BackupLX AIH Service GmbH 06.03.2011 10,8MB 1.4
CCleaner Piriform 24.07.2012 9,88MB 3.21
ClamWin Free Antivirus 0.96.5.0 alch 26.12.2010 24,9MB
ClearProg 1.6.0 Final Sven Hoffman 26.12.2010 636KB 1.6.0 Final
Cobian Backup 10 02.01.2011 28,5MB
devolo dLAN-Konfigurationsassistent devolo AG 28.12.2010 19.0.0.0
devolo Informer devolo AG 28.12.2010 27.0.0.0
Diagnostic Utility Realtek 05.01.2011 1,93MB 1.00.0000
EPU-6 Engine 25.12.2010 1,29MB 1.01.17
Java(TM) 6 Update 2 Sun Microsystems, Inc. 26.12.2010 160MB 1.6.0.20
Java(TM) 6 Update 23 Oracle 26.12.2010 95,0MB 6.0.230
JRE 1.6.1 Auerswald GmbH & Co.KG 30.12.2010 83,7MB 1.6.1
Malwarebytes Anti-Malware Version 1.62.0.1300 Malwarebytes Corporation 31.07.2012 11,8MB 1.62.0.1300
marvell 61xx Marvell 25.12.2010 1,36MB 1.2.0.7100
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 25.12.2010 42,1MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 25.12.2010 42,1MB
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.12.2010 189MB 4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 25.12.2010 46,4MB 4.0.30319
Microsoft .NET Framework 4 Extended Microsoft Corporation 25.12.2010 46,4MB 4.0.30319
Microsoft .NET Framework 4 Extended DEU Language Pack Microsoft Corporation 25.12.2010 12,0MB 4.0.30319
Microsoft Silverlight Microsoft Corporation 26.12.2010 20,3MB 4.0.50524.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 26.12.2010 422KB 8.0.56336
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 27.12.2010 834KB 8.0.50727.42
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 Microsoft Corporation 26.12.2010 2,51MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 04.12.2011 590KB 9.0.30729
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 04.12.2011 11,1MB 10.0.40219
Microsoft WSE 3.0 Runtime Microsoft Corp. 26.12.2010 942KB 3.0.5305.0
Mozilla Firefox (3.6.13) Mozilla 28.12.2010 27,9MB 3.6.13 (de)
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 26.12.2010 1,27MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 26.12.2010 1,33MB 4.20.9876.0
NVIDIA Display Control Panel NVIDIA Corporation 25.12.2010 1,28MB 6.14.12.5721
NVIDIA Drivers NVIDIA Corporation 25.12.2010 1,28MB 1.10.61.39
NVIDIA Stereoscopic 3D Driver NVIDIA Corporation 25.12.2010 15,1MB 1.0
O&O DiskImage Server O&O Software GmbH 26.12.2010 45,6MB 5.5.126
OpenOffice.org 3.2 OpenOffice.org 26.12.2010 364MB 3.2.9502
Realtek 8169 8168 8101E 8102E Ethernet Driver Realtek 25.12.2010 1,71MB 1.00.0000
SpeedFan (remove only) 25.12.2010 5,23MB
SUPERAntiSpyware SUPERAntiSpyware.com 31.07.2012 127MB 5.5.1006
TuneUp Utilities 2011 TuneUp Software 16.02.2012 65,3MB 10.0.4600.4
TurboV 25.12.2010 9,18MB 1.02.02
Vielen Dank |