| stefgig12 | 14.06.2012 15:30 |
Hallo,
Hier die Angabe
Windows XP SP3 Code:
16:22:49.0640 3384 TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
16:22:49.0781 3384 ============================================================
16:22:49.0781 3384 Current date / time: 2012/06/14 16:22:49.0781
16:22:49.0781 3384 SystemInfo:
16:22:49.0781 3384
16:22:49.0781 3384 OS Version: 5.1.2600 ServicePack: 3.0
16:22:49.0781 3384 Product type: Workstation
16:22:49.0781 3384 ComputerName: NPC18
16:22:49.0781 3384 UserName: npc18
16:22:49.0781 3384 Windows directory: C:\WINDOWS
16:22:49.0781 3384 System windows directory: C:\WINDOWS
16:22:49.0781 3384 Processor architecture: Intel x86
16:22:49.0781 3384 Number of processors: 2
16:22:49.0781 3384 Page size: 0x1000
16:22:49.0781 3384 Boot type: Normal boot
16:22:49.0781 3384 ============================================================
16:22:51.0656 3384 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:22:51.0656 3384 ============================================================
16:22:51.0656 3384 \Device\Harddisk0\DR0:
16:22:51.0656 3384 MBR partitions:
16:22:51.0656 3384 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x5E6C014
16:22:51.0656 3384 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x5E6FF0E, BlocksNum 0x369E5B3
16:22:51.0656 3384 ============================================================
16:22:51.0718 3384 D: <-> \Device\Harddisk0\DR0\Partition1
16:22:51.0765 3384 C: <-> \Device\Harddisk0\DR0\Partition0
16:22:51.0765 3384 ============================================================
16:22:51.0765 3384 Initialize success
16:22:51.0765 3384 ============================================================
16:23:23.0500 1448 ============================================================
16:23:23.0500 1448 Scan started
16:23:23.0500 1448 Mode: Manual; SigCheck; TDLFS;
16:23:23.0500 1448 ============================================================
16:23:23.0843 1448 Abiosdsk - ok
16:23:23.0906 1448 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
16:23:25.0468 1448 abp480n5 - ok
16:23:25.0515 1448 ACPI (95cdd68b6dca09f581b043734854c87d) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:23:25.0515 1448 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: 95cdd68b6dca09f581b043734854c87d, Fake md5: ac407f1a62c3a300b4f2b5a9f1d55b2c
16:23:25.0515 1448 ACPI ( Virus.Win32.Rloader.a ) - infected
16:23:25.0515 1448 ACPI - detected Virus.Win32.Rloader.a (0)
16:23:25.0546 1448 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
16:23:25.0734 1448 ACPIEC - ok
16:23:25.0828 1448 AcrSch2Svc (1b77cac441b53553db0122468926ad73) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
16:23:25.0843 1448 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning
16:23:25.0843 1448 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1)
16:23:25.0890 1448 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
16:23:26.0078 1448 adpu160m - ok
16:23:26.0125 1448 adpu320 (5e30228eaebf369c24cd0b87a93a2a4a) C:\WINDOWS\System32\DRIVERS\adpu320.sys
16:23:26.0250 1448 adpu320 - ok
16:23:26.0281 1448 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:23:26.0468 1448 aec - ok
16:23:26.0515 1448 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
16:23:26.0609 1448 AFD - ok
16:23:26.0640 1448 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
16:23:26.0828 1448 agp440 - ok
16:23:26.0859 1448 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
16:23:27.0046 1448 agpCPQ - ok
16:23:27.0078 1448 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
16:23:27.0187 1448 Aha154x - ok
16:23:27.0203 1448 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
16:23:27.0421 1448 aic78u2 - ok
16:23:27.0437 1448 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
16:23:27.0671 1448 aic78xx - ok
16:23:27.0718 1448 ALCXSENS (d3fb0a70fa3e3a62f1b2faa88daabae8) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
16:23:27.0875 1448 ALCXSENS - ok
16:23:27.0937 1448 ALCXWDM (36585ee98345223e2963c8edd27fc40d) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
16:23:28.0062 1448 ALCXWDM - ok
16:23:28.0093 1448 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
16:23:28.0281 1448 Alerter - ok
16:23:28.0312 1448 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
16:23:28.0453 1448 ALG - ok
16:23:28.0500 1448 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
16:23:28.0687 1448 AliIde - ok
16:23:28.0718 1448 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys
16:23:28.0890 1448 alim1541 - ok
16:23:28.0937 1448 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
16:23:29.0156 1448 amdagp - ok
16:23:29.0203 1448 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
16:23:29.0312 1448 amsint - ok
16:23:29.0359 1448 AN983 (e2ad6cc7d407f2b5cb2899775cf84f51) C:\WINDOWS\system32\DRIVERS\AN983.sys
16:23:29.0406 1448 AN983 - ok
16:23:29.0437 1448 AppMgmt (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
16:23:29.0640 1448 AppMgmt - ok
16:23:29.0656 1448 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
16:23:29.0875 1448 asc - ok
16:23:29.0890 1448 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
16:23:30.0000 1448 asc3350p - ok
16:23:30.0015 1448 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
16:23:30.0203 1448 asc3550 - ok
16:23:30.0343 1448 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
16:23:30.0375 1448 aspnet_state - ok
16:23:30.0406 1448 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:23:30.0546 1448 AsyncMac - ok
16:23:30.0578 1448 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
16:23:30.0718 1448 atapi - ok
16:23:30.0718 1448 Atdisk - ok
16:23:30.0750 1448 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:23:30.0953 1448 Atmarpc - ok
16:23:30.0984 1448 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
16:23:31.0171 1448 AudioSrv - ok
16:23:31.0218 1448 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:23:31.0421 1448 audstub - ok
16:23:31.0453 1448 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:23:31.0687 1448 Beep - ok
16:23:31.0734 1448 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
16:23:31.0953 1448 BITS - ok
16:23:31.0984 1448 bizVSerial (66f655b08eed3230e059d197c8a1969b) C:\WINDOWS\system32\drivers\bizVSerialNT.sys
16:23:32.0046 1448 bizVSerial ( UnsignedFile.Multi.Generic ) - warning
16:23:32.0046 1448 bizVSerial - detected UnsignedFile.Multi.Generic (1)
16:23:32.0125 1448 Bonjour Service (9efe4236f8670846b6e7c5b0eff6e715) C:\Programme\Bonjour\mDNSResponder.exe
16:23:32.0140 1448 Bonjour Service - ok
16:23:32.0187 1448 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
16:23:32.0343 1448 Browser - ok
16:23:32.0375 1448 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
16:23:32.0578 1448 cbidf - ok
16:23:32.0578 1448 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:23:32.0750 1448 cbidf2k - ok
16:23:32.0765 1448 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
16:23:32.0859 1448 cd20xrnt - ok
16:23:32.0890 1448 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:23:33.0078 1448 Cdaudio - ok
16:23:33.0125 1448 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:23:33.0296 1448 Cdfs - ok
16:23:33.0328 1448 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:23:33.0500 1448 Cdrom - ok
16:23:33.0515 1448 Changer - ok
16:23:33.0562 1448 CiSvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
16:23:33.0734 1448 CiSvc - ok
16:23:33.0796 1448 cjpcsc (cf5cf5aa461883812c1ee234f01779d8) C:\WINDOWS\system32\cjpcsc.exe
16:23:33.0859 1448 cjpcsc ( UnsignedFile.Multi.Generic ) - warning
16:23:33.0859 1448 cjpcsc - detected UnsignedFile.Multi.Generic (1)
16:23:33.0906 1448 cjusb (466d2beca5f06145a3cb2bbe14ace79d) C:\WINDOWS\system32\DRIVERS\cjusb.sys
16:23:33.0968 1448 cjusb - ok
16:23:34.0000 1448 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
16:23:34.0156 1448 ClipSrv - ok
16:23:34.0281 1448 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:23:34.0437 1448 clr_optimization_v2.0.50727_32 - ok
16:23:34.0515 1448 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:23:34.0609 1448 clr_optimization_v4.0.30319_32 - ok
16:23:34.0625 1448 CmdIde (c687f81290303d90099b027a6474f99f) C:\WINDOWS\System32\DRIVERS\cmdide.sys
16:23:34.0828 1448 CmdIde - ok
16:23:34.0843 1448 COMSysApp - ok
16:23:34.0875 1448 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
16:23:35.0062 1448 Cpqarray - ok
16:23:35.0093 1448 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
16:23:35.0250 1448 CryptSvc - ok
16:23:35.0312 1448 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
16:23:35.0546 1448 dac2w2k - ok
16:23:35.0562 1448 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
16:23:35.0750 1448 dac960nt - ok
16:23:35.0812 1448 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:23:35.0906 1448 DcomLaunch - ok
16:23:35.0953 1448 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
16:23:36.0093 1448 Dhcp - ok
16:23:36.0125 1448 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:23:36.0281 1448 Disk - ok
16:23:36.0296 1448 dmadmin - ok
16:23:36.0359 1448 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
16:23:36.0609 1448 dmboot - ok
16:23:36.0656 1448 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
16:23:36.0828 1448 dmio - ok
16:23:36.0859 1448 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:23:37.0062 1448 dmload - ok
16:23:37.0093 1448 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
16:23:37.0250 1448 dmserver - ok
16:23:37.0281 1448 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:23:37.0453 1448 DMusic - ok
16:23:37.0484 1448 Dnscache (8c9ed3b2834aae63081ab2da831c6fe9) C:\WINDOWS\System32\dnsrslvr.dll
16:23:37.0625 1448 Dnscache - ok
16:23:37.0656 1448 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
16:23:37.0859 1448 Dot3svc - ok
16:23:37.0890 1448 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
16:23:38.0093 1448 dpti2o - ok
16:23:38.0125 1448 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:23:38.0281 1448 drmkaud - ok
16:23:38.0343 1448 DwMirror (383182215a2c238e76b86e3b5ede40eb) C:\WINDOWS\system32\DRIVERS\DamewareMini.sys
16:23:38.0406 1448 DwMirror - ok
16:23:38.0421 1448 DWMRCS - ok
16:23:38.0453 1448 dwvkbd (5a402c57f621114c99f813c6ae7bc37a) C:\WINDOWS\system32\DRIVERS\dwvkbd.sys
16:23:38.0546 1448 dwvkbd - ok
16:23:38.0578 1448 E100B (a6de5342417fec3c0aa8efebb899c431) C:\WINDOWS\system32\DRIVERS\e100b325.sys
16:23:38.0796 1448 E100B - ok
16:23:38.0828 1448 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
16:23:39.0015 1448 EapHost - ok
16:23:39.0046 1448 epmntdrv (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys
16:23:39.0125 1448 epmntdrv ( UnsignedFile.Multi.Generic ) - warning
16:23:39.0125 1448 epmntdrv - detected UnsignedFile.Multi.Generic (1)
16:23:39.0156 1448 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
16:23:39.0312 1448 ERSvc - ok
16:23:39.0343 1448 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys
16:23:39.0375 1448 EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
16:23:39.0375 1448 EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
16:23:39.0421 1448 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:23:39.0437 1448 Eventlog - ok
16:23:39.0484 1448 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\System32\es.dll
16:23:39.0515 1448 EventSystem - ok
16:23:39.0562 1448 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:23:39.0718 1448 Fastfat - ok
16:23:39.0765 1448 FastUserSwitchingCompatibility (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:23:39.0906 1448 FastUserSwitchingCompatibility - ok
16:23:39.0921 1448 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
16:23:40.0078 1448 Fdc - ok
16:23:40.0109 1448 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
16:23:40.0281 1448 Fips - ok
16:23:40.0312 1448 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:23:40.0468 1448 Flpydisk - ok
16:23:40.0531 1448 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
16:23:40.0687 1448 FltMgr - ok
16:23:40.0828 1448 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:23:40.0859 1448 FontCache3.0.0.0 - ok
16:23:40.0921 1448 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:23:41.0109 1448 Fs_Rec - ok
16:23:41.0140 1448 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:23:41.0359 1448 Ftdisk - ok
16:23:41.0390 1448 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:23:41.0562 1448 Gpc - ok
16:23:41.0640 1448 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:23:41.0796 1448 helpsvc - ok
16:23:41.0812 1448 HidServ - ok
16:23:41.0843 1448 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:23:42.0000 1448 HidUsb - ok
16:23:42.0046 1448 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
16:23:42.0218 1448 hkmsvc - ok
16:23:42.0250 1448 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
16:23:42.0421 1448 hpn - ok
16:23:42.0500 1448 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:23:42.0562 1448 HTTP - ok
16:23:42.0578 1448 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
16:23:42.0750 1448 HTTPFilter - ok
16:23:42.0812 1448 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
16:23:42.0953 1448 i2omgmt - ok
16:23:43.0000 1448 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys
16:23:43.0156 1448 i2omp - ok
16:23:43.0187 1448 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:23:43.0359 1448 i8042prt - ok
16:23:43.0453 1448 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
16:23:43.0546 1448 IDriverT ( UnsignedFile.Multi.Generic ) - warning
16:23:43.0546 1448 IDriverT - detected UnsignedFile.Multi.Generic (1)
16:23:43.0625 1448 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:23:43.0765 1448 idsvc - ok
16:23:43.0796 1448 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:23:43.0968 1448 Imapi - ok
16:23:44.0000 1448 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\System32\imapi.exe
16:23:44.0140 1448 ImapiService - ok
16:23:44.0171 1448 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
16:23:44.0359 1448 ini910u - ok
16:23:44.0406 1448 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\System32\DRIVERS\intelide.sys
16:23:44.0578 1448 IntelIde - ok
16:23:44.0609 1448 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:23:44.0765 1448 intelppm - ok
16:23:44.0812 1448 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
16:23:44.0984 1448 ip6fw - ok
16:23:45.0015 1448 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:23:45.0156 1448 IpFilterDriver - ok
16:23:45.0171 1448 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:23:45.0328 1448 IpInIp - ok
16:23:45.0375 1448 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:23:45.0515 1448 IpNat - ok
16:23:45.0546 1448 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:23:45.0718 1448 IPSec - ok
16:23:45.0750 1448 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:23:45.0906 1448 IRENUM - ok
16:23:45.0937 1448 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:23:46.0093 1448 isapnp - ok
16:23:46.0187 1448 JavaQuickStarterService (381b25dc8e958d905b33130d500bbf29) C:\Programme\Java\jre6\bin\jqs.exe
16:23:46.0218 1448 JavaQuickStarterService - ok
16:23:46.0250 1448 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:23:46.0406 1448 Kbdclass - ok
16:23:46.0437 1448 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:23:46.0593 1448 kmixer - ok
16:23:46.0640 1448 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:23:46.0750 1448 KSecDD - ok
16:23:46.0796 1448 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
16:23:46.0859 1448 lanmanserver - ok
16:23:46.0890 1448 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
16:23:46.0937 1448 lanmanworkstation - ok
16:23:46.0953 1448 lbrtfdc - ok
16:23:47.0000 1448 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
16:23:47.0140 1448 LmHosts - ok
16:23:47.0187 1448 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
16:23:47.0218 1448 MBAMProtector - ok
16:23:47.0296 1448 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
16:23:47.0328 1448 MBAMService - ok
16:23:47.0421 1448 MDM (11f714f85530a2bd134074dc30e99fca) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
16:23:47.0437 1448 MDM - ok
16:23:47.0453 1448 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
16:23:47.0609 1448 Messenger - ok
16:23:47.0656 1448 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:23:47.0828 1448 mnmdd - ok
16:23:47.0875 1448 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
16:23:48.0046 1448 mnmsrvc - ok
16:23:48.0078 1448 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
16:23:48.0250 1448 Modem - ok
16:23:48.0281 1448 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:23:48.0453 1448 Mouclass - ok
16:23:48.0484 1448 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:23:48.0671 1448 mouhid - ok
16:23:48.0687 1448 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:23:48.0859 1448 MountMgr - ok
16:23:48.0906 1448 MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
16:23:48.0984 1448 MozillaMaintenance - ok
16:23:49.0015 1448 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
16:23:49.0203 1448 mraid35x - ok
16:23:49.0250 1448 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:23:49.0421 1448 MRxDAV - ok
16:23:49.0500 1448 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:23:49.0656 1448 MRxSmb - ok
16:23:49.0687 1448 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
16:23:49.0843 1448 MSDTC - ok
16:23:49.0906 1448 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:23:50.0062 1448 Msfs - ok
16:23:50.0078 1448 MSIServer - ok
16:23:50.0109 1448 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:23:50.0281 1448 MSKSSRV - ok
16:23:50.0296 1448 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:23:50.0453 1448 MSPCLOCK - ok
16:23:50.0484 1448 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:23:50.0640 1448 MSPQM - ok
16:23:50.0687 1448 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:23:50.0828 1448 mssmbios - ok
16:23:50.0890 1448 MSSQL$SQLEXPRESS - ok
16:23:50.0937 1448 MSSQLServerADHelper (adaf062116b4e6d96e44d26486a87af6) C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe
16:23:50.0968 1448 MSSQLServerADHelper - ok
16:23:51.0000 1448 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
16:23:51.0171 1448 Mup - ok
16:23:51.0218 1448 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
16:23:51.0437 1448 napagent - ok
16:23:51.0453 1448 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:23:51.0640 1448 NDIS - ok
16:23:51.0671 1448 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:23:51.0828 1448 NdisTapi - ok
16:23:51.0859 1448 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:23:52.0015 1448 Ndisuio - ok
16:23:52.0046 1448 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:23:52.0218 1448 NdisWan - ok
16:23:52.0265 1448 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:23:52.0359 1448 NDProxy - ok
16:23:52.0406 1448 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
16:23:52.0562 1448 NetBIOS - ok
16:23:52.0625 1448 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
16:23:52.0796 1448 NetBT - ok
16:23:52.0843 1448 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:23:53.0031 1448 NetDDE - ok
16:23:53.0031 1448 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:23:53.0171 1448 NetDDEdsdm - ok
16:23:53.0203 1448 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:53.0359 1448 Netlogon - ok
16:23:53.0406 1448 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
16:23:53.0546 1448 Netman - ok
16:23:53.0656 1448 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:23:53.0703 1448 NetTcpPortSharing - ok
16:23:53.0750 1448 Nla (acd8bd448a74f344d46fcaf21bab92af) C:\WINDOWS\System32\mswsock.dll
16:23:53.0812 1448 Nla - ok
16:23:53.0859 1448 NMSAccess (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Programme\CDBurnerXP\NMSAccessU.exe
16:23:53.0875 1448 NMSAccess - ok
16:23:53.0921 1448 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:23:54.0093 1448 Npfs - ok
16:23:54.0156 1448 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:23:54.0406 1448 Ntfs - ok
16:23:54.0437 1448 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:54.0578 1448 NtLmSsp - ok
16:23:54.0640 1448 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
16:23:54.0859 1448 NtmsSvc - ok
16:23:54.0921 1448 ntrtscan (cec052d67b20f5be1d46cb73aa169b38) C:\Programme\Trend Micro\OfficeScan Client\ntrtscan.exe
16:23:54.0968 1448 ntrtscan ( UnsignedFile.Multi.Generic ) - warning
16:23:54.0968 1448 ntrtscan - detected UnsignedFile.Multi.Generic (1)
16:23:55.0031 1448 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:23:55.0218 1448 Null - ok
16:23:55.0234 1448 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:23:55.0421 1448 NwlnkFlt - ok
16:23:55.0421 1448 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:23:55.0609 1448 NwlnkFwd - ok
16:23:55.0671 1448 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
16:23:55.0718 1448 ose - ok
16:23:55.0968 1448 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:23:56.0375 1448 osppsvc - ok
16:23:56.0593 1448 P3 (a7af0c0860f1c43fc6581ba8a99eabef) C:\WINDOWS\system32\DRIVERS\p3.sys
16:23:56.0781 1448 P3 - ok
16:23:56.0828 1448 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
16:23:57.0000 1448 Parport - ok
16:23:57.0046 1448 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:23:57.0203 1448 PartMgr - ok
16:23:57.0234 1448 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
16:23:57.0390 1448 ParVdm - ok
16:23:57.0421 1448 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
16:23:57.0625 1448 PCI - ok
16:23:57.0625 1448 PCIDump - ok
16:23:57.0640 1448 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
16:23:57.0812 1448 PCIIde - ok
16:23:57.0859 1448 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:23:58.0046 1448 Pcmcia - ok
16:23:58.0062 1448 PDCOMP - ok
16:23:58.0078 1448 PDFRAME - ok
16:23:58.0093 1448 PDRELI - ok
16:23:58.0109 1448 PDRFRAME - ok
16:23:58.0140 1448 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
16:23:58.0328 1448 perc2 - ok
16:23:58.0343 1448 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
16:23:58.0515 1448 perc2hib - ok
16:23:58.0578 1448 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:23:58.0593 1448 PlugPlay - ok
16:23:58.0625 1448 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:58.0765 1448 PolicyAgent - ok
16:23:58.0796 1448 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:23:58.0968 1448 PptpMiniport - ok
16:23:59.0000 1448 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
16:23:59.0171 1448 Processor - ok
16:23:59.0187 1448 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:23:59.0328 1448 ProtectedStorage - ok
16:23:59.0343 1448 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:23:59.0515 1448 PSched - ok
16:23:59.0578 1448 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:23:59.0718 1448 Ptilink - ok
16:23:59.0765 1448 PxHelp20 (1962166e0ceb740704f30fa55ad3d509) C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:23:59.0812 1448 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
16:23:59.0812 1448 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
16:23:59.0828 1448 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
16:24:00.0015 1448 ql1080 - ok
16:24:00.0031 1448 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
16:24:00.0203 1448 Ql10wnt - ok
16:24:00.0234 1448 ql12160 (c7fc707980dd382f92b6d88b2258a0dc) C:\WINDOWS\System32\DRIVERS\ql12160.sys
16:24:00.0328 1448 ql12160 - ok
16:24:00.0343 1448 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
16:24:00.0531 1448 ql1240 - ok
16:24:00.0562 1448 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
16:24:00.0734 1448 ql1280 - ok
16:24:00.0765 1448 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:24:00.0906 1448 RasAcd - ok
16:24:00.0953 1448 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
16:24:01.0125 1448 RasAuto - ok
16:24:01.0156 1448 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:24:01.0328 1448 Rasl2tp - ok
16:24:01.0375 1448 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
16:24:01.0531 1448 RasMan - ok
16:24:01.0578 1448 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:24:01.0796 1448 RasPppoe - ok
16:24:01.0843 1448 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
16:24:02.0000 1448 Raspti - ok
16:24:02.0046 1448 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:24:02.0218 1448 Rdbss - ok
16:24:02.0265 1448 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:24:02.0421 1448 RDPCDD - ok
16:24:02.0484 1448 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:24:02.0656 1448 rdpdr - ok
16:24:02.0718 1448 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
16:24:02.0890 1448 RDPWD - ok
16:24:02.0921 1448 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
16:24:03.0125 1448 RDSessMgr - ok
16:24:03.0156 1448 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
16:24:03.0328 1448 redbook - ok
16:24:03.0359 1448 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
16:24:03.0531 1448 RemoteAccess - ok
16:24:03.0578 1448 RemoteRegistry (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
16:24:03.0718 1448 RemoteRegistry - ok
16:24:03.0765 1448 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\System32\locator.exe
16:24:03.0937 1448 RpcLocator - ok
16:24:04.0000 1448 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:24:04.0046 1448 RpcSs - ok
16:24:04.0109 1448 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\System32\rsvp.exe
16:24:04.0281 1448 RSVP - ok
16:24:04.0390 1448 SageDeploymentService (c3b35487cfb25357d313625a691e1200) C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe
16:24:04.0421 1448 SageDeploymentService - ok
16:24:04.0453 1448 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:24:04.0593 1448 SamSs - ok
16:24:04.0640 1448 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
16:24:04.0781 1448 SCardSvr - ok
16:24:04.0828 1448 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
16:24:05.0015 1448 Schedule - ok
16:24:05.0093 1448 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:24:05.0250 1448 Secdrv - ok
16:24:05.0281 1448 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
16:24:05.0437 1448 seclogon - ok
16:24:05.0453 1448 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
16:24:05.0593 1448 SENS - ok
16:24:05.0656 1448 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:24:05.0812 1448 serenum - ok
16:24:05.0859 1448 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
16:24:06.0031 1448 Serial - ok
16:24:06.0109 1448 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
16:24:06.0265 1448 Sfloppy - ok
16:24:06.0328 1448 SFUSVC (5944ecbcf555dedd7f48f9982d5ddff4) C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe
16:24:06.0328 1448 SFUSVC ( UnsignedFile.Multi.Generic ) - warning
16:24:06.0328 1448 SFUSVC - detected UnsignedFile.Multi.Generic (1)
16:24:06.0390 1448 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
16:24:06.0562 1448 SharedAccess - ok
16:24:06.0609 1448 ShellHWDetection (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:24:06.0750 1448 ShellHWDetection - ok
16:24:06.0765 1448 Simbad - ok
16:24:06.0828 1448 SiS315 (94f6eea8a688a37f71bf9c9aeaa42666) C:\WINDOWS\system32\DRIVERS\sisgrp.sys
16:24:07.0109 1448 SiS315 - ok
16:24:07.0140 1448 sisagp (61ca562def09a782d26b3e7edec5369a) C:\WINDOWS\system32\DRIVERS\SISAGPX.sys
16:24:07.0187 1448 sisagp - ok
16:24:07.0203 1448 SiSide (b4485881bd8aed9b157a2e6cf43c2d51) C:\WINDOWS\system32\DRIVERS\siside.sys
16:24:07.0265 1448 SiSide - ok
16:24:07.0296 1448 SiSkp (837d26f79a1647066d75c5c811887475) C:\WINDOWS\system32\DRIVERS\srvkp.sys
16:24:07.0328 1448 SiSkp - ok
16:24:07.0390 1448 snapman (90257773f4b4065bd0c6cc2164fd52e5) C:\WINDOWS\system32\DRIVERS\snapman.sys
16:24:07.0453 1448 snapman ( UnsignedFile.Multi.Generic ) - warning
16:24:07.0453 1448 snapman - detected UnsignedFile.Multi.Generic (1)
16:24:07.0500 1448 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
16:24:07.0593 1448 Sparrow - ok
16:24:07.0640 1448 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:24:07.0781 1448 splitter - ok
16:24:07.0828 1448 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
16:24:07.0906 1448 Spooler - ok
16:24:07.0984 1448 SQLBrowser (5673e79bbb62a4c35b10d821ff1b4aca) C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
16:24:08.0015 1448 SQLBrowser - ok
16:24:08.0046 1448 SQLWriter (9263c8898732e2b890f7e954e7729ab7) C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
16:24:08.0093 1448 SQLWriter - ok
16:24:08.0125 1448 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
16:24:08.0296 1448 sr - ok
16:24:08.0359 1448 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\System32\srsvc.dll
16:24:08.0500 1448 srservice - ok
16:24:08.0546 1448 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
16:24:08.0656 1448 Srv - ok
16:24:08.0687 1448 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
16:24:08.0843 1448 SSDPSRV - ok
16:24:08.0875 1448 StarOpen (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
16:24:08.0906 1448 StarOpen ( UnsignedFile.Multi.Generic ) - warning
16:24:08.0906 1448 StarOpen - detected UnsignedFile.Multi.Generic (1)
16:24:08.0953 1448 StillCam (a2dbcc4c8860449df1ab758ea28b4de0) C:\WINDOWS\system32\DRIVERS\serscan.sys
16:24:09.0109 1448 StillCam - ok
16:24:09.0156 1448 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
16:24:09.0328 1448 stisvc - ok
16:24:09.0359 1448 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:24:09.0515 1448 swenum - ok
16:24:09.0562 1448 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:24:09.0718 1448 swmidi - ok
16:24:09.0734 1448 SwPrv - ok
16:24:09.0781 1448 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
16:24:09.0937 1448 symc810 - ok
16:24:09.0953 1448 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
16:24:10.0140 1448 symc8xx - ok
16:24:10.0171 1448 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
16:24:10.0343 1448 sym_hi - ok
16:24:10.0359 1448 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
16:24:10.0531 1448 sym_u3 - ok
16:24:10.0578 1448 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:24:10.0765 1448 sysaudio - ok
16:24:10.0812 1448 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
16:24:11.0000 1448 SysmonLog - ok
16:24:11.0046 1448 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
16:24:11.0187 1448 TapiSrv - ok
16:24:11.0250 1448 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:24:11.0359 1448 Tcpip - ok
16:24:11.0390 1448 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:24:11.0546 1448 TDPIPE - ok
16:24:11.0578 1448 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:24:11.0734 1448 TDTCP - ok
16:24:11.0750 1448 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
16:24:11.0921 1448 TermDD - ok
16:24:11.0984 1448 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
16:24:12.0156 1448 TermService - ok
16:24:12.0187 1448 Themes (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:24:12.0328 1448 Themes - ok
16:24:12.0375 1448 tifsfilter (7369f74dd9172c6527a8aceb010e28f1) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
16:24:12.0421 1448 tifsfilter ( UnsignedFile.Multi.Generic ) - warning
16:24:12.0421 1448 tifsfilter - detected UnsignedFile.Multi.Generic (1)
16:24:12.0437 1448 timounter (53fec95b844c46489f6683dc0a606e01) C:\WINDOWS\system32\DRIVERS\timntr.sys
16:24:12.0593 1448 timounter ( UnsignedFile.Multi.Generic ) - warning
16:24:12.0593 1448 timounter - detected UnsignedFile.Multi.Generic (1)
16:24:12.0625 1448 TlntSvr (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\System32\tlntsvr.exe
16:24:12.0812 1448 TlntSvr - ok
16:24:12.0906 1448 TmFilter (ac940a15959be57958b91cdb914aaa6c) C:\Programme\Trend Micro\OfficeScan Client\TmXPFlt.sys
16:24:12.0953 1448 TmFilter - ok
16:24:13.0000 1448 tmlisten (74efd08250cb5830e8acbd6eeae7418a) C:\Programme\Trend Micro\OfficeScan Client\tmlisten.exe
16:24:13.0046 1448 tmlisten ( UnsignedFile.Multi.Generic ) - warning
16:24:13.0046 1448 tmlisten - detected UnsignedFile.Multi.Generic (1)
16:24:13.0093 1448 TmPreFilter (8651a867c78bd2b69f1d5f982138a074) C:\Programme\Trend Micro\OfficeScan Client\TmPreFlt.sys
16:24:13.0125 1448 TmPreFilter - ok
16:24:13.0156 1448 TosIde (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\System32\DRIVERS\toside.sys
16:24:13.0296 1448 TosIde - ok
16:24:13.0343 1448 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
16:24:13.0500 1448 TrkWks - ok
16:24:13.0578 1448 TuneUp.Defrag (6a29cd69d1128bdf49a705befc614a5b) C:\WINDOWS\System32\TuneUpDefragService.exe
16:24:13.0640 1448 TuneUp.Defrag - ok
16:24:13.0703 1448 TuneUp.ProgramStatisticsSvc (51ee2913ed525de18fda96dccbc5386a) C:\WINDOWS\System32\TUProgSt.exe
16:24:13.0734 1448 TuneUp.ProgramStatisticsSvc - ok
16:24:13.0781 1448 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:24:13.0953 1448 Udfs - ok
16:24:14.0000 1448 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
16:24:14.0109 1448 ultra - ok
16:24:14.0156 1448 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:24:14.0375 1448 Update - ok
16:24:14.0421 1448 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
16:24:14.0593 1448 upnphost - ok
16:24:14.0625 1448 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
16:24:14.0796 1448 UPS - ok
16:24:14.0828 1448 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:24:15.0000 1448 usbccgp - ok
16:24:15.0031 1448 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:24:15.0187 1448 usbehci - ok
16:24:15.0234 1448 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:24:15.0390 1448 usbhub - ok
16:24:15.0437 1448 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
16:24:15.0593 1448 usbohci - ok
16:24:15.0625 1448 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:24:15.0796 1448 usbscan - ok
16:24:15.0828 1448 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:24:16.0000 1448 USBSTOR - ok
16:24:16.0031 1448 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:24:16.0187 1448 usbuhci - ok
16:24:16.0234 1448 UxTuneUp (2e2e93041c8058bc7de6f0d743c4a0c6) C:\WINDOWS\System32\uxtuneup.dll
16:24:16.0265 1448 UxTuneUp - ok
16:24:16.0296 1448 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:24:16.0453 1448 VgaSave - ok
16:24:16.0484 1448 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
16:24:16.0640 1448 viaagp - ok
16:24:16.0671 1448 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys
16:24:16.0828 1448 ViaIde - ok
16:24:16.0843 1448 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
16:24:17.0031 1448 VolSnap - ok
16:24:17.0125 1448 VSApiNt (71a53597bfb4bad7218ad2beaba5c564) C:\Programme\Trend Micro\OfficeScan Client\VSApiNt.sys
16:24:17.0203 1448 VSApiNt - ok
16:24:17.0343 1448 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
16:24:17.0546 1448 VSS - ok
16:24:17.0609 1448 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\System32\w32time.dll
16:24:17.0750 1448 W32Time - ok
16:24:17.0828 1448 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:24:18.0000 1448 Wanarp - ok
16:24:18.0000 1448 WDICA - ok
16:24:18.0046 1448 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:24:18.0218 1448 wdmaud - ok
16:24:18.0265 1448 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
16:24:18.0406 1448 WebClient - ok
16:24:18.0484 1448 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
16:24:18.0625 1448 winmgmt - ok
16:24:18.0703 1448 winvnc (b84873b030e66ddf3964a31793bb4211) D:\Programme\RealVNC\WinVNC\WinVNC.exe
16:24:18.0750 1448 winvnc ( UnsignedFile.Multi.Generic ) - warning
16:24:18.0750 1448 winvnc - detected UnsignedFile.Multi.Generic (1)
16:24:18.0781 1448 WmdmPmSN (6e18978b749f0696a774de3f2cb142dd) C:\WINDOWS\system32\mspmsnsv.dll
16:24:18.0937 1448 WmdmPmSN - ok
16:24:19.0015 1448 Wmi (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
16:24:19.0078 1448 Wmi - ok
16:24:19.0125 1448 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\System32\wbem\wmiapsrv.exe
16:24:19.0312 1448 WmiApSrv - ok
16:24:19.0468 1448 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:24:19.0578 1448 WPFFontCache_v0400 - ok
16:24:19.0625 1448 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
16:24:19.0796 1448 wscsvc - ok
16:24:19.0812 1448 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
16:24:19.0968 1448 wuauserv - ok
16:24:20.0031 1448 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
16:24:20.0187 1448 WZCSVC - ok
16:24:20.0218 1448 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
16:24:20.0406 1448 xmlprov - ok
16:24:20.0421 1448 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
16:24:20.0921 1448 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
16:24:20.0921 1448 \Device\Harddisk0\DR0 - detected TDSS File System (1)
16:24:20.0921 1448 Boot (0x1200) (8fed00eaa87fc9a3d1c5a52232bb0ee8) \Device\Harddisk0\DR0\Partition0
16:24:20.0921 1448 \Device\Harddisk0\DR0\Partition0 - ok
16:24:20.0953 1448 Boot (0x1200) (1bbc1b3ed6fbfe61fa2ad89e49c32fac) \Device\Harddisk0\DR0\Partition1
16:24:20.0953 1448 \Device\Harddisk0\DR0\Partition1 - ok
16:24:20.0953 1448 ============================================================
16:24:20.0953 1448 Scan finished
16:24:20.0953 1448 ============================================================
16:24:21.0093 3396 Detected object count: 17
16:24:21.0093 3396 Actual detected object count: 17
16:25:03.0937 3396 ACPI ( Virus.Win32.Rloader.a ) - skipped by user
16:25:03.0937 3396 ACPI ( Virus.Win32.Rloader.a ) - User select action: Skip
16:25:03.0937 3396 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0937 3396 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 bizVSerial ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 bizVSerial ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 cjpcsc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 cjpcsc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0968 3396 EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0968 3396 EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0968 3396 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0968 3396 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 ntrtscan ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 ntrtscan ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 SFUSVC ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 SFUSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 snapman ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 timounter ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 tmlisten ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 tmlisten ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 winvnc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 winvnc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0031 3396 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
16:25:04.0031 3396 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
OTL.txt
OTL Logfile: Code:
OTL logfile created on: 14.06.2012 16:35:20 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 65,58% Memory free
3,79 Gb Paging File | 3,24 Gb Available in Paging File | 85,57% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 47,21 Gb Total Space | 15,70 Gb Free Space | 33,26% Space Free | Partition Type: NTFS
Drive D: | 27,31 Gb Total Space | 17,25 Gb Free Space | 63,17% Space Free | Partition Type: NTFS
Drive F: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive G: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive M: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive W: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive X: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive Z: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Computer Name: NPC18 | User Name: npc18 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe (Sage Software)
PRC - C:\WINDOWS\system32\DWRCST.EXE (DameWare Development)
PRC - C:\WINDOWS\system32\DWRCS.EXE (DameWare Development LLC)
PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation)
PRC - C:\WINDOWS\system32\cjpcsc.exe (REINER SCT)
PRC - C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Programme\Trend Micro\OfficeScan Client\PccNTMon.exe (Trend Micro Inc.)
PRC - C:\Programme\Trend Micro\OfficeScan Client\OfcDog.exe (Trend Micro Inc.)
PRC - C:\Programme\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.)
PRC - C:\Programme\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Programme\Kyocera Mita\FileUtility\NsCatCom.exe (KYOCERA MITA)
PRC - C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe (KYOCERA MITA CORPORATION)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - D:\Programme\RealVNC\WinVNC\winvnc.exe (RealVNC Ltd.)
PRC - C:\WINDOWS\system32\NILaunch.exe ()
========== Modules (No Company Name) ==========
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - C:\Programme\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Programme\Trend Micro\OfficeScan Client\TimeString.dll ()
MOD - D:\Programme\RealVNC\WinVNC\othread2.dll ()
MOD - C:\Programme\Kyocera Mita\FileUtility\HgTiff2Pdf.dll ()
MOD - C:\WINDOWS\system32\NILaunch.exe ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\jDocPrc.dll ()
========== Win32 Services (SafeList) ==========
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SageDeploymentService) -- C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe (Sage Software)
SRV - (DWMRCS) -- C:\WINDOWS\system32\DWRCS.EXE (DameWare Development LLC)
SRV - (NMSAccess) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (cjpcsc) -- C:\WINDOWS\system32\cjpcsc.exe (REINER SCT)
SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ntrtscan) -- C:\Programme\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.)
SRV - (tmlisten) -- C:\Programme\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.)
SRV - (SFUSVC) -- C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe (KYOCERA MITA CORPORATION)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (winvnc) -- D:\Programme\RealVNC\WinVNC\winvnc.exe (RealVNC Ltd.)
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (Changer) -- File not found
DRV - (VSApiNt) -- C:\Programme\Trend Micro\OfficeScan Client\vsapint.sys (Trend Micro Inc.)
DRV - (TmFilter) -- C:\Programme\Trend Micro\OfficeScan Client\tmxpflt.sys (Trend Micro Inc.)
DRV - (TmPreFilter) -- C:\Programme\Trend Micro\OfficeScan Client\tmpreflt.sys (Trend Micro Inc.)
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (timounter) -- C:\WINDOWS\system32\drivers\timntr.sys (Acronis)
DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\drivers\snapman.sys (Acronis)
DRV - (epmntdrv) -- C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (dwvkbd) -- C:\WINDOWS\system32\drivers\dwvkbd.sys (DameWare)
DRV - (DwMirror) -- C:\WINDOWS\system32\drivers\DamewareMini.sys (DameWare Development, LLC)
DRV - (cjusb) -- C:\WINDOWS\system32\drivers\cjusb.sys (REINER SCT)
DRV - (bizVSerial) -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys (franson.biz)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (sisagp) -- C:\WINDOWS\system32\drivers\SISAGPX.SYS (Silicon Integrated Systems Corporation)
DRV - (SiSide) -- C:\WINDOWS\system32\drivers\siside.sys (Silicon Integrated Systems Corp.)
DRV - (AN983) -- C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {4DFEA8C9-2FF7-467A-9DCA-68844DF1D641}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{4DFEA8C9-2FF7-467A-9DCA-68844DF1D641}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://www.vtl.de/route/vtlsdg/index.asp"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Programme\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.14 08:18:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.26 08:06:54 | 000,000,000 | ---D | M]
[2011.09.27 14:34:25 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Extensions
[2012.06.14 16:06:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Firefox\Profiles\fs5g9u5i.default\extensions
[2011.09.27 14:34:29 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Firefox\Profiles\fs5g9u5i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.01.11 10:26:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.14 16:06:29 | 000,634,964 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\NPC18\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\FS5G9U5I.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.14 08:18:17 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.28 17:50:02 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.11.11 10:01:11 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.11 10:01:11 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.11.11 10:01:11 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.11 10:01:11 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.11 10:01:11 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.11 10:01:11 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2012.06.14 12:27:20 | 000,000,736 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Net-It Launcher] C:\WINDOWS\system32\NILaunch.exe ()
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Programme\Trend Micro\OfficeScan Client\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [SfWinStartInfo] C:\Programme\SFirm32\sfWinStartupInfo.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH)
O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [WinVNC] D:\Programme\RealVNC\WinVNC\WinVNC.exe (RealVNC Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\npc18\Startmenü\Programme\Autostart\Picture Motion Browser Medien-Prüfung.lnk = C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} hxxp://dialog.net-w.de/viewer/activeXViewer/activexviewer.cab (Crystal Report Smart Viewer 7)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GerbethDomain.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0058D2A4-C4D4-4FE8-AE73-9F597B7A9B96}: NameServer = 8.8.8.8,101.0.0.9,101.0.0.250
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003.04.08 11:35:38 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell - "" = AutoRun
O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.06.14 16:22:30 | 000,000,000 | ---D | C] -- C:\tddsskiller
[2012.06.14 12:34:59 | 000,200,976 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2012.06.13 17:37:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Malwarebytes
[2012.06.13 17:37:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.06.13 17:37:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.06.13 17:37:45 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.06.13 17:37:45 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.06.13 17:19:10 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys
[2012.06.13 17:18:30 | 000,000,000 | ---D | C] -- C:\Programme\stinger
[2012.06.13 17:06:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\Desktop\backups
[2012.06.13 16:51:03 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\npc18\Desktop\HiJackThis204.exe
[2012.06.13 16:22:10 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\npc18\Recent
[2012.06.13 12:36:40 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2012.06.13 12:36:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2012.06.11 09:56:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\php
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\npc18\*.tmp files -> C:\Dokumente und Einstellungen\npc18\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.06.14 16:43:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8BA56005-620F-4DA5-883B-32E1B8466A6C}.job
[2012.06.14 16:43:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{668B4AD5-14D1-4536-984E-AF6082338C9D}.job
[2012.06.14 16:42:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{764DBD1D-5439-4A7F-92DC-14B508F5DEBC}.job
[2012.06.14 16:41:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D4C8872C-3536-4E03-BFE5-033DEA1971A0}.job
[2012.06.14 16:00:01 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2012.06.14 15:23:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.14 15:10:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.14 15:07:50 | 000,303,967 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.14 15:07:48 | 000,179,666 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.14 12:35:24 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.14 12:27:20 | 000,000,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012.06.14 09:55:06 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Desktop\Microsoft Office Outlook 2003.lnk
[2012.06.14 08:03:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.06.13 17:37:48 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.13 17:19:10 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys
[2012.06.13 17:06:51 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.newold
[2012.06.13 16:14:31 | 000,102,400 | ---- | M] () -- C:\WINDOWS\RegBootClean.exe
[2012.06.13 13:08:41 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2012.06.13 12:47:42 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\npc18\Desktop\HiJackThis204.exe
[2012.06.13 09:56:32 | 000,015,888 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Desktop\Mimberg Kosten.123
[2012.06.11 09:58:01 | 000,000,761 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.old
[2012.06.11 09:56:23 | 000,000,002 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\uz.dat
[2012.05.29 19:50:14 | 000,020,672 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Amex-Rg.lwp
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\npc18\*.tmp files -> C:\Dokumente und Einstellungen\npc18\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.06.13 17:37:48 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.13 16:13:38 | 000,102,400 | ---- | C] () -- C:\WINDOWS\RegBootClean.exe
[2012.06.13 16:03:05 | 000,303,967 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.13 16:02:52 | 000,179,666 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.13 13:22:03 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.11 09:56:23 | 000,000,002 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\uz.dat
[2012.05.02 08:32:09 | 000,000,029 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini.lock
[2012.05.02 08:31:10 | 000,000,103 | ---- | C] () -- C:\WINDOWS\Setup_tmp.ini
[2011.10.10 11:16:29 | 002,469,760 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2011.10.10 11:16:29 | 000,019,840 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2011.10.10 11:16:28 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2011.10.10 11:16:28 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2011.10.10 11:16:28 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2011.10.04 13:15:12 | 000,003,209 | ---- | C] () -- C:\WINDOWS\cfgrs.ini
[2011.10.04 13:15:12 | 000,002,481 | ---- | C] () -- C:\WINDOWS\cfgrs_ex.ini
[2011.09.26 13:09:35 | 000,000,024 | ---- | C] () -- C:\WINDOWS\pccntmon.INI
[2011.01.25 12:51:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\0mandanten.ini
[2010.10.19 09:53:23 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
< End of report >
--- --- ---
[/CODE]
OTL EXTRA
OTL Logfile: Code:
OTL Extras logfile created on: 14.06.2012 16:35:20 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 65,58% Memory free
3,79 Gb Paging File | 3,24 Gb Available in Paging File | 85,57% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 47,21 Gb Total Space | 15,70 Gb Free Space | 33,26% Space Free | Partition Type: NTFS
Drive D: | 27,31 Gb Total Space | 17,25 Gb Free Space | 63,17% Space Free | Partition Type: NTFS
Drive F: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive G: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive M: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive W: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive X: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive Z: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Computer Name: NPC18 | User Name: npc18 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"6129:TCP" = 6129:TCP:*:Enabled:DameWare Mini Remote Control Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\n.e.t.z\MULTI-TE\TermMan.exe" = C:\Programme\n.e.t.z\MULTI-TE\TermMan.exe:*:Disabled:Manager für die Terminalemulation -- (n.e.t.z software-partner gmbh)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00180407-78E1-11D2-B60F-006097C998E7}" = Microsoft Access 2000 SR-1 Runtime
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0EB1536E-1888-4330-95C9-F89135786CDD}" = COALA
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{20F1FFAF-1BFF-450C-A8C7-03D1BE24B950}" = Microsoft .NET Framework (German)
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359FCAA7-B544-4147-AE3B-8C8A526E2427}" = Sony Image Data Suite
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{61C79AE1-5403-4687-AC68-28BFA5EF3895}" = KyoceraMita Scanner File Utility
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{76D1AA2B-A434-4D63-BE2C-80286F23C223}" = Microsoft Interop Forms Redistributable Package 2.0a
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-001C-0000-0000-0000000FF1CE}" = Microsoft Office Access Runtime 2010
"{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{FA978F90-F7AB-4CF6-BCF5-885CF559DE7C}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{90140000-001C-0407-0000-0000000FF1CE}" = Microsoft Office Access Runtime MUI (German) 2010
"{90140000-001C-0407-0000-0000000FF1CE}_Office14.AccessRT_{264417E7-E622-456E-9666-3298344AF72C}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.AccessRT_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{901C0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Access 2003 Runtime
"{90840407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{90E00407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Outlook 2003
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A600A500-6AAC-48AB-B29C-145483B3A127}" = SFirm
"{A6473724-A851-11D5-986D-00500443CF9F}" = Moorhuhn 3
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{BAC94BFC-10E3-4094-855F-C9F92C8ED1F2}" = Personalwirtschaft
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA83357B-931E-44DC-AD43-9996FEEB8116}" = Acronis*True*Image
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF78AB2B-1CA0-42D2-A2F1-FDEBC7876EF0}" = Microsoft SQL Server 2005 (SQLEXPRESS)
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D5945672-BA86-4095-865F-58E9C8A48205}" = Lotus Notes 6.0.3 de
"{EA2D9BC0-75E9-4975-9A0A-DD82198DDC53}" = MSXML 6.0 Parser
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FF4E0135-C210-4E21-9C24-496DFDF956FD}" = Microsoft SQL Server 2008 R2 Native Client
"{FF748561-FFFE-11D3-A06B-00E02939A7B1}" = dakota.ag
"7-Zip" = 7-Zip 4.42
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"Delphi5" = Borland Delphi 5
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"FastImageResizer" = FastImageResizer (remove only)
"FileZilla Client" = FileZilla Client 3.5.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Informix Client SDK" = Informix Client SDK
"InstallShield_{BAC94BFC-10E3-4094-855F-C9F92C8ED1F2}" = Sage Personalwirtschaft 2012.1+
"InstallShield_{BFF9FC50-EDAE-4D81-BB5B-7F73C2ACF3A1}" = Hotfix 004 PW 2008.1+
"InstallShield_{DB3DC857-9EBD-43C5-8C7A-999617A2A87E}" = Masterpatch 2005.1+
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework Full v1.0.3705 (1031)" = Microsoft .NET Framework (German) v1.0.3705
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Moorhuhn" = Moorhuhn
"Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office14.AccessRT" = Microsoft Access Runtime 2010
"OfficeScanNT" = Trend Micro OfficeScan Client
"SiS VGA Utilities" = SiS VGA Utilities
"SmartSuite V99.0" = Lotus SmartSuite Version 9.5
"VLC media player" = VLC media player 1.1.4
"Winmail Opener" = Winmail Opener 1.4
"WinVNC_is1" = VNC 3.3.7
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 14.06.2012 03:54:45 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:03:01 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:03:16 | Computer Name = NPC18 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 14.06.2012 06:03:31 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:31:37 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Der
RPC-Server ist nicht verfügbar. ). Die Verarbeitung der Gruppenrichtlinie wurde
abgebrochen.
Error - 14.06.2012 06:32:56 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Der
RPC-Server ist nicht verfügbar. ). Die Verarbeitung der Gruppenrichtlinie wurde
abgebrochen.
Error - 14.06.2012 09:10:42 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 09:10:43 | Computer Name = NPC18 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 14.06.2012 09:10:58 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 09:23:03 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Die
angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung hergestellt
werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
[ System Events ]
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.06.2012 07:16:00 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1722. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 13.06.2012 11:16:15 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 04:46:15 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 05:39:53 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 119 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 14.06.2012 06:02:46 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 06:02:50 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 14.06.2012 06:03:05 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
[ TuneUp Events ]
Error - 14.06.2012 02:18:57 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 08:18:57', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3772',0)
Error - 14.06.2012 02:19:17 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 08:19:17', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3888',0)
Error - 14.06.2012 03:54:10 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 09:54:10', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1884',0)
Error - 14.06.2012 03:55:21 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 09:55:21', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','3140',0)
Error - 14.06.2012 05:57:16 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 11:57:16', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','2912',0)
Error - 14.06.2012 06:02:37 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 12:02:37', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1900',0)
Error - 14.06.2012 06:03:53 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 12:03:53', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','3320',0)
Error - 14.06.2012 09:10:33 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:10:33', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1948',0)
Error - 14.06.2012 09:11:33 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:11:33', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','2972',0)
Error - 14.06.2012 09:23:27 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:23:27', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','2612',0)
< End of report >
--- --- --- |
