Trojaner-Board - msiecex Windows-installer wünscht ausgehende verbindung bing.com freefinder.com puppyclothesshop1.net

Sorry, wo ist das #-Sysmbol ?
(? Warum auf Desktop ?) Hier die Log-Dateien: {Danke schon mal für deine Mühe !}
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:02-06-2014

Ran by demo (administrator) on COMPUTER on 04-06-2014 08:56:05

Running from E:\eigene dateien\temp\Farbar's Recovery Scan Tool (FRST32Bit

Platform: Microsoft Windows XP Professional Service Pack 2 (X86) OS Language: German Standard

Internet Explorer Version 6

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 

Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) E:\WINDOWS\System32\MSIEXEC.EXE

(by Leo) E:\Programme\Trojancheck5\TC.EXE

(H+BEDV Datentechnik GmbH) E:\Programme\AVPersonal\AVGNT.EXE

(Webroot Software, Inc.) E:\Programme\Webroot\Spy Sweeper\SpySweeper.exe

(TuneUp Software GmbH) E:\Programme\TuneUp Utilities\MemOptimizer.exe

(H+BEDV Datentechnik GmbH) E:\Programme\AVPersonal\AVGUARD.EXE

(H+BEDV Datentechnik GmbH, Germany) E:\Programme\AVPersonal\AVWUPSRV.EXE

(Microsoft Corporation) E:\WINDOWS\System32\INETSRV\INETINFO.EXE

(Agnitum) E:\Programme\Agnitum\Outpost Firewall 1.0\OUTPOST.EXE

(Microsoft Corporation) E:\WINDOWS\System32\TCPSVCS.EXE

(United Internet AG) E:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe

(Microsoft Corporation) E:\WINDOWS\System32\FXSSVC.EXE

(Vodafone) E:\Programme\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe

(Crazy Browser - Enhance your Web browsing experience with this tabbed web browser!) E:\Programme\Crazy Browser\Crazy Browser.exe

(United Internet) E:\Programme\WEB.DE\WEB.DE SmartSurfer\SmartSurfer.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Outpost Firewall] => E:\Programme\Agnitum\Outpost Firewall 1.0\outpost.exe [78848 2002-06-14] (Agnitum)

HKLM\...\Run: [TrojanCheck Autostart] => E:\Programme\Trojancheck5\tc.exe [1324032 2001-10-07] (by Leo)

HKLM\...\Run: [AVGCtrl] => E:\Programme\AVPersonal\AVGNT.EXE [180327 2005-11-03] (H+BEDV Datentechnik GmbH)

HKLM\...\Policies\Explorer\Run: [214986046] => E:\Dokumente und Einstellungen\All Users\msqck.exe [76288 2002-12-31] ( (Red Swoosh Inc))

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Run: [SpySweeper] => E:\Programme\Webroot\Spy Sweeper\SpySweeper.exe [665088 2004-02-25] (Webroot Software, Inc.)

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Run: [TuneUp MemOptimizer] => E:\Programme\TuneUp Utilities\MemOptimizer.exe [196096 2002-11-13] (TuneUp Software GmbH)

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Policies\Explorer: [NoDriveTypeAutoRun] 0xB1000000

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Policies\Explorer: [CDRAutoRun] 0

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {43e721d3-3030-11e3-9ad7-f12d9b6db9eb} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {645c85ee-38c7-11e2-8e3d-bd763089ede9} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {816d1668-207e-11e3-aadb-d36b44f6a0e7} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {acecfd6a-d8ea-11e3-947a-d2fc4ec4e6e6} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {acecfd70-d8ea-11e3-947a-d2fc4ec4e6e6} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {b1c414ee-2f0f-11e2-8df7-001cf05ba9b0} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

HKU\S-1-5-21-1844237615-838170752-725345543-1003\...\MountPoints2: {f6601b02-2ae0-11e3-aae5-8b1908c22ee6} - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.vodafone.de/sbb/welcome?SESSION_TARGET_URL=http%3A%2F%2Fwww.n24media.de%2F

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.vodafone.de/sbb/welcome?SESSION_TARGET_URL=http%3A%2F%2Fwww.n24media.de%2F

SearchScopes: HKCU - DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}

SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}

BHO: No Name - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - E:\Programme\FreshDevices\FreshDownload\fdcatch.dll (FreshDevices Corp.)

Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - E:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - E:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File

Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Winsock: Catalog5 04 E:\WINDOWS\system32\pnrpnsp.dll [48640] (Microsoft Corporation)

Winsock: Catalog5 05 E:\WINDOWS\system32\pnrpnsp.dll [48640] (Microsoft Corporation)
 

FireFox:

========

FF ProfilePath: E:\Dokumente und Einstellungen\demo\Anwendungsdaten\Mozilla\Firefox\Profiles\1wh5ny86.default-1366655384093

FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");

FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");

FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");

FF SelectedSearchEngine: Wikipedia (de)

FF Homepage: https://rimon.safe-mail.net/cgi-bin/Safe-mail.net/display?N1R-eC-PMbqr&frames/startPage.html

FF Keyword.URL: user_pref("keyword.URL", "");

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - E:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF Plugin ProgramFiles/Appdata: E:\Programme\mozilla firefox\plugins\npnul32.dll (mozilla.org)

FF Plugin ProgramFiles/Appdata: E:\Programme\mozilla firefox\plugins\npqtplugin.dll (Apple Computer, Inc.)

FF SearchPlugin: E:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: E:\Programme\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: E:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: E:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - E:\Programme\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\

FF Extension: Bytemobile Optimization Client - E:\Programme\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ []
 

Chrome: 

=======

CHR Extension: (Barowsoe2sAve) - E:\Dokumente und Einstellungen\demo\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\hippgjmcmmkoghfbpaijmfbemapenelp [2013-04-22]
 

========================== Services (Whitelisted) =================
 

Locked "deroerj" service was unlocked successfully. <===== ATTENTION
 

R2 6to4; E:\WINDOWS\System32\6to4svc.dll [100352 2002-12-31] (Microsoft Corporation)

R2 AntiVirService; E:\Programme\AVPersonal\AVGUARD.EXE [208424 2005-11-03] (H+BEDV Datentechnik GmbH)

R2 AVWUpSrv; E:\Programme\AVPersonal\AVWUPSRV.EXE [45096 2005-10-13] (H+BEDV Datentechnik GmbH, Germany)

S2 deroerj; E:\WINDOWS\system32\gnbpbgl.dll [167765 2002-12-31] ()

S4 HidServ; E:\WINDOWS\System32\svchost.exe [14336 2002-12-31] (Microsoft Corporation)

R2 IISADMIN; E:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2002-12-31] (Microsoft Corporation)

R2 Iprip; E:\WINDOWS\System32\iprip.dll [36864 2002-12-31] (Microsoft Corporation)

R2 OutpostFirewall; E:\Programme\Agnitum\Outpost Firewall 1.0\outpost.exe [78848 2002-06-14] (Agnitum)

S3 p2pgasvc; E:\WINDOWS\system32\p2pgasvc.dll [86016 2002-12-31] (Microsoft Corporation)

R2 SmartSurferManager; E:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [132560 2007-12-18] (United Internet AG)

R2 SMTPSVC; E:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2002-12-31] (Microsoft Corporation)

R2 VmbService; E:\Programme\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2013-02-05] (Vodafone)

R2 W3SVC; E:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2002-12-31] (Microsoft Corporation)

S3 rpcapd; No ImagePath
 

==================== Drivers (Whitelisted) ====================
 

R3 ADBLOCK.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\ADBLOCK.dll [15552 2002-06-14] (Agnitum)

R3 Afc; E:\WINDOWS\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)

R3 avgntdw; E:\Programme\AVPersonal\AVGNTDW.SYS [32896 2005-04-29] (H+BEDV Datentechnik GmbH)

S3 CoachUsb; E:\WINDOWS\System32\DRIVERS\CoachUsb.sys [50976 2004-11-24] (FotoNation Inc.)

R3 CONTENT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Content.dll [3904 2002-06-14] (Agnitum)

R3 DNSCACHE.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Dnscache.dll [6144 2002-06-14] (Agnitum)

S3 epmntdrv; E:\WINDOWS\system32\epmntdrv.sys [13896 2012-12-21] ()

S3 EuGdiDrv; E:\WINDOWS\system32\EuGdiDrv.sys [9160 2012-12-21] ()

S3 FETNDIS; E:\WINDOWS\System32\DRIVERS\fetnd5.sys [27165 2001-08-17] (VIA Technologies, Inc.              )

R3 FTPFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Ftpfilt.dll [6304 2002-06-14] (Agnitum)

S3 gameenum; E:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2004-08-03] (Microsoft Corporation)

S3 gmer; E:\WINDOWS\System32\DRIVERS\gmer.sys [85969 2013-01-07] (GMER)

R3 HCF_MSFT; E:\WINDOWS\System32\DRIVERS\HCF_MSFT.sys [908352 2001-08-18] (Conexant)

R3 HTMLFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Htmlfilt.dll [7776 2002-06-14] (Agnitum)

R3 HTTPFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Httpfilt.dll [9152 2002-06-14] (Agnitum)

R3 IMAPFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Imapfilt.dll [7072 2002-06-14] (Agnitum)

R3 MAILFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Mailfilt.dll [9920 2002-06-14] (Agnitum)

S3 nm; E:\WINDOWS\System32\DRIVERS\NMnt.sys [40320 2002-12-31] (Microsoft Corporation)

R3 NNTPFILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Nntpfilt.dll [6656 2002-06-14] (Agnitum)

S3 NPF; E:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)

R2 NwlnkIpx; E:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88448 2002-12-31] (Microsoft Corporation)

R2 NwlnkNb; E:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2002-12-31] (Microsoft Corporation)

R2 NwlnkSpx; E:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2002-12-31] (Microsoft Corporation)

R3 POP3FILT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Pop3filt.dll [7136 2002-06-14] (Agnitum)

R3 PROTECT.DLL; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\Protect.dll [15584 2002-06-14] (Agnitum)

S3 Secdrv; E:\WINDOWS\System32\DRIVERS\secdrv.sys [27440 2002-12-31] ()

R1 Tcpip6; E:\WINDOWS\System32\DRIVERS\tcpip6.sys [223616 2002-12-31] (Microsoft Corporation)

R1 VFILT; E:\Programme\Agnitum\Outpost Firewall 1.0\Kernel\2000\Filtnt.sys [90368 2002-06-14] (Agnitum)

R3 VIAudio; E:\WINDOWS\System32\drivers\viaudio.sys [43776 2002-03-11] (VIA Technologies, Inc.)

S3 vodafone_K3805-z_dc_enum; E:\WINDOWS\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys [80000 2010-09-01] (Vodafone)

S3 ZTEusbnet; E:\WINDOWS\System32\DRIVERS\ZTEusbnet.sys [114688 2009-12-01] (ZTE Corporation)

S3 ZTEusbvoice; E:\WINDOWS\System32\DRIVERS\ZTEusbvoice.sys [105088 2009-10-09] (ZTE Incorporated)

S3 AR5416; system32\DRIVERS\athw.sys [X]

U5 es137140; E:\Windows\System32\Drivers\es137140.sys [313344 1998-09-17] (ENSONIQ Corp.)

S4 IntelIde; No ImagePath

U5 P3; E:\Windows\System32\Drivers\P3.sys [46592 2002-12-31] (Microsoft Corporation)

S3 rt2870; system32\DRIVERS\rt2870.sys [X]

U1 WS2IFSL; 
 

==================== NetSvcs (Whitelisted) ===================
 

NETSVC: deroerj -> E:\WINDOWS\system32\gnbpbgl.dll ()
 

==================== One Month Created Files and Folders ========
 

2014-06-04 08:55 - 2014-06-04 08:55 - 00000000 ____D () E:\FRST

2014-06-03 22:15 - 2014-06-04 00:51 - 00000216 _____ () E:\WINDOWS\wiadebug.log

2014-06-03 22:15 - 2014-06-04 00:51 - 00000050 _____ () E:\WINDOWS\wiaservc.log

2014-06-03 22:15 - 2014-06-03 22:15 - 00014360 _____ () E:\Dokumente und Einstellungen\demo\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2014-06-03 22:15 - 2014-06-03 22:15 - 00000000 _____ () E:\WINDOWS\Sti_Trace.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00007098 _____ () E:\WINDOWS\iis6.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00002821 _____ () E:\WINDOWS\tsoc.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00002053 _____ () E:\WINDOWS\comsetup.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00001355 _____ () E:\WINDOWS\imsins.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00001247 _____ () E:\WINDOWS\ntdtcsetup.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00000971 _____ () E:\WINDOWS\KB893803v2Uninst.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00000342 _____ () E:\WINDOWS\ocmsn.log

2014-06-03 22:05 - 2014-06-03 22:06 - 00000311 _____ () E:\WINDOWS\tabletoc.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00006158 _____ () E:\WINDOWS\FaxSetup.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00002916 _____ () E:\WINDOWS\ocgen.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00001834 _____ () E:\WINDOWS\msmqinst.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00001083 _____ () E:\WINDOWS\netfxocm.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000425 _____ () E:\WINDOWS\MedCtrOC.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000309 _____ () E:\WINDOWS\msgsocm.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000000 _____ () E:\WINDOWS\setuperr.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000000 _____ () E:\WINDOWS\setupact.log

2014-06-03 20:13 - 2014-06-03 20:13 - 00098256 _____ () E:\WINDOWS\system32\FNTCACHE.DAT

2014-06-03 20:12 - 2014-06-04 00:51 - 00000312 _____ () E:\WINDOWS\WindowsUpdate.log

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SYSTEM.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SOFTWARE.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SECURITY.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SAM.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\DEFAULT.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\NetworkService\NTUSER.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\LocalService\NTUSER.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\demo\NTUSER.tmp.LOG

2014-05-28 20:26 - 2014-05-28 20:27 - 00000656 _____ () E:\Dokumente und Einstellungen\demo\Desktop\torchat.exe.lnk

2014-05-28 20:26 - 2014-05-28 20:26 - 00000000 ____D () E:\Programme\torchat-windows-0.9.9.553

2014-05-26 02:32 - 2014-05-26 02:32 - 00000000 __SHD () E:\FOUND.000

2014-05-24 21:52 - 2014-05-24 21:52 - 00000723 _____ () E:\Dokumente und Einstellungen\All Users\Desktop\aTube Catcher.lnk

2014-05-24 21:52 - 2014-05-24 21:52 - 00000000 ____D () E:\Dokumente und Einstellungen\All Users\Startmenü\Programme\aTube Catcher

2014-05-24 21:49 - 2014-05-24 21:49 - 00000000 ____D () E:\Programme\WinPcap

2014-05-24 21:49 - 2014-05-24 21:49 - 00000000 ____D () E:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WinPcap

2014-05-24 16:13 - 2014-05-24 16:13 - 00000574 _____ () E:\Dokumente und Einstellungen\demo\Desktop\Start Tor Browser.exe.lnk

2014-05-24 16:08 - 2014-05-24 16:08 - 00000000 ____D () E:\Programme\Tor Browser

2014-05-24 00:22 - 2014-05-24 00:22 - 00000000 ____D () E:\Dokumente und Einstellungen\demo\Data
 

==================== One Month Modified Files and Folders =======
 

2014-06-04 08:55 - 2014-06-04 08:55 - 00000000 ____D () E:\FRST

2014-06-04 08:41 - 2012-11-13 01:33 - 00000006 ____H () E:\WINDOWS\Tasks\SA.DAT

2014-06-04 00:51 - 2014-06-03 22:15 - 00000216 _____ () E:\WINDOWS\wiadebug.log

2014-06-04 00:51 - 2014-06-03 22:15 - 00000050 _____ () E:\WINDOWS\wiaservc.log

2014-06-04 00:51 - 2014-06-03 20:12 - 00000312 _____ () E:\WINDOWS\WindowsUpdate.log

2014-06-04 00:51 - 2012-11-13 01:36 - 00000190 ___SH () E:\Dokumente und Einstellungen\demo\ntuser.ini

2014-06-04 00:51 - 2012-11-13 01:33 - 00032622 _____ () E:\WINDOWS\SchedLgU.Txt

2014-06-03 22:15 - 2014-06-03 22:15 - 00014360 _____ () E:\Dokumente und Einstellungen\demo\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2014-06-03 22:15 - 2014-06-03 22:15 - 00000000 _____ () E:\WINDOWS\Sti_Trace.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00007098 _____ () E:\WINDOWS\iis6.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00002821 _____ () E:\WINDOWS\tsoc.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00002053 _____ () E:\WINDOWS\comsetup.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00001355 _____ () E:\WINDOWS\imsins.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00001247 _____ () E:\WINDOWS\ntdtcsetup.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00000971 _____ () E:\WINDOWS\KB893803v2Uninst.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00000342 _____ () E:\WINDOWS\ocmsn.log

2014-06-03 22:06 - 2014-06-03 22:05 - 00000311 _____ () E:\WINDOWS\tabletoc.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00006158 _____ () E:\WINDOWS\FaxSetup.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00002916 _____ () E:\WINDOWS\ocgen.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00001834 _____ () E:\WINDOWS\msmqinst.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00001083 _____ () E:\WINDOWS\netfxocm.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000425 _____ () E:\WINDOWS\MedCtrOC.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000309 _____ () E:\WINDOWS\msgsocm.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000000 _____ () E:\WINDOWS\setuperr.log

2014-06-03 22:05 - 2014-06-03 22:05 - 00000000 _____ () E:\WINDOWS\setupact.log

2014-06-03 20:13 - 2014-06-03 20:13 - 00098256 _____ () E:\WINDOWS\system32\FNTCACHE.DAT

2014-06-03 20:13 - 2012-11-13 01:33 - 00229376 _____ () E:\Dokumente und Einstellungen\NetworkService\NTUSER.bak

2014-06-03 20:13 - 2012-11-13 01:33 - 00225280 _____ () E:\Dokumente und Einstellungen\LocalService\NTUSER.bak

2014-06-03 20:13 - 2012-11-13 01:00 - 00262144 _____ () E:\WINDOWS\system32\config\SECURITY.bak

2014-06-03 20:13 - 2012-11-13 01:00 - 00028672 _____ () E:\WINDOWS\system32\config\SAM.bak

2014-06-03 20:13 - 2012-11-13 00:59 - 16252928 _____ () E:\WINDOWS\system32\config\SOFTWARE.bak

2014-06-03 20:13 - 2012-11-13 00:59 - 04718592 _____ () E:\WINDOWS\system32\config\SYSTEM.bak

2014-06-03 20:13 - 2012-11-13 00:59 - 00262144 _____ () E:\WINDOWS\system32\config\DEFAULT.bak

2014-06-03 20:12 - 2014-05-01 23:32 - 05505024 _____ () E:\Dokumente und Einstellungen\demo\NTUSER.bak

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SYSTEM.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SOFTWARE.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SECURITY.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\SAM.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\WINDOWS\system32\config\DEFAULT.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\NetworkService\NTUSER.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\LocalService\NTUSER.tmp.LOG

2014-06-03 20:10 - 2014-06-03 20:10 - 00000000 ____H () E:\Dokumente und Einstellungen\demo\NTUSER.tmp.LOG

2014-06-03 19:31 - 2002-12-31 12:00 - 00002206 _____ () E:\WINDOWS\system32\wpa.dbl

2014-05-31 00:12 - 2012-11-13 04:20 - 00215552 _____ () E:\Dokumente und Einstellungen\demo\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-05-28 20:27 - 2014-05-28 20:26 - 00000656 _____ () E:\Dokumente und Einstellungen\demo\Desktop\torchat.exe.lnk

2014-05-28 20:26 - 2014-05-28 20:26 - 00000000 ____D () E:\Programme\torchat-windows-0.9.9.553

2014-05-26 02:32 - 2014-05-26 02:32 - 00000000 __SHD () E:\FOUND.000

2014-05-26 01:26 - 2013-03-14 15:45 - 00000568 _____ () E:\Dokumente und Einstellungen\demo\Desktop\Neu Textdokument.txt

2014-05-24 21:52 - 2014-05-24 21:52 - 00000723 _____ () E:\Dokumente und Einstellungen\All Users\Desktop\aTube Catcher.lnk

2014-05-24 21:52 - 2014-05-24 21:52 - 00000000 ____D () E:\Dokumente und Einstellungen\All Users\Startmenü\Programme\aTube Catcher

2014-05-24 21:52 - 2012-11-13 03:08 - 00001643 _____ () E:\Dokumente und Einstellungen\All Users\Desktop\Video Search.lnk

2014-05-24 21:49 - 2014-05-24 21:49 - 00000000 ____D () E:\Programme\WinPcap

2014-05-24 21:49 - 2014-05-24 21:49 - 00000000 ____D () E:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WinPcap

2014-05-24 16:13 - 2014-05-24 16:13 - 00000574 _____ () E:\Dokumente und Einstellungen\demo\Desktop\Start Tor Browser.exe.lnk

2014-05-24 16:08 - 2014-05-24 16:08 - 00000000 ____D () E:\Programme\Tor Browser

2014-05-24 00:22 - 2014-05-24 00:22 - 00000000 ____D () E:\Dokumente und Einstellungen\demo\Data
 

Files to move or delete:

====================

E:\Dokumente und Einstellungen\All Users\msqck.exe
 
 

==================== Bamital & volsnap Check =================
 

E:\WINDOWS\explorer.exe

[2002-12-31 12:00] - [2002-12-31 12:00] - 1035264 ____A (Microsoft Corporation) 22fe1be02eadde1632e478e4125639e0 
 

E:\WINDOWS\system32\winlogon.exe

[2002-12-31 12:00] - [2002-12-31 12:00] - 0507392 ____A (Microsoft Corporation) 2b6a0baf33a9918f09442d873848ff72 
 

E:\WINDOWS\system32\svchost.exe

[2002-12-31 12:00] - [2002-12-31 12:00] - 0014336 ____A (Microsoft Corporation) 65a819b121eb6fdab4400ea42bdffe64 
 

E:\WINDOWS\system32\services.exe

[2002-12-31 12:00] - [2002-12-31 12:00] - 0108544 ____A (Microsoft Corporation) edb6b81761bd60f32f740bbc40afb676 
 

E:\WINDOWS\system32\User32.dll

[2002-12-31 12:00] - [2002-12-31 12:00] - 0578560 ____A (Microsoft Corporation) 56785fd5236d7b22cf471a6da9db46d8 
 

E:\WINDOWS\system32\userinit.exe

[2002-12-31 12:00] - [2002-12-31 12:00] - 0025088 ____A (Microsoft Corporation) d1e53dc57143f2584b1dd53b036c0633 
 

E:\WINDOWS\system32\rpcss.dll

[2002-12-31 12:00] - [2002-12-31 12:00] - 0395776 ____A (Microsoft Corporation) 9f28ff58d6d67b123272869d89d14004 
 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.

E:\WINDOWS\system32\Drivers\volsnap.sys

[2002-12-31 12:00] - [2002-12-31 12:00] - 0053760 ____A (Microsoft Corporation) d6888520ff56d72a50437e371ca25fc9 
 
 

==================== End Of Log ============================

--- --- ---
FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:02-06-2014

Ran by demo at 2014-06-04 09:00:18

Running from E:\eigene dateien\temp\Farbar's Recovery Scan Tool (FRST32Bit

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: AntiVir PersonalEdition Classic (Disabled - Up to date) {F50D9AC1-6409-476C-A8D6-8F5F82336C8F}
 

==================== Installed Programs ======================
 

3ivx MPEG-4 5.0.2 (remove only) (HKLM\...\3ivx MPEG-4 5.0.2) (Version: 5.0.2 - 3ivx Technologies, Pty. Ltd.)

A.F.7 Merge your files 1.3 (HKLM\...\{C576C82C-EE87-11D6-B031-0000CB597465}) (Version: 1.3.0.0 - Alex Fauland)

AAC Parser (remove only) (HKLM\...\AAC Parser) (Version:  - )

AC3+DTS XForm (remove only) (HKLM\...\AC3+DTS XForm) (Version:  - )

AC3Filter (remove only) (HKLM\...\AC3Filter) (Version:  - )

AC3Filter 2.5b (HKLM\...\AC3Filter_is1) (Version: 2.5b - Alexander Vigovsky)

Adobe Flash Player 10 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 10.3.183.43 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.5.502.110 - Adobe Systems Incorporated)

Agnitum Outpost Firewall 1.0 (HKLM\...\Agnitum Outpost Firewall 1.0) (Version: 1.0.1817.1645 - Agnitum Ltd)

Alternate File Shredder 1.203 (HKLM\...\Alternate File Shredder_is1) (Version:  - Alternate Tools)

AntiVir/XP (HKLM\...\AntiVir/XP) (Version:  - H+BEDV Datentechnik GmbH)

ArcSoft PhotoImpression 5 (HKLM\...\{93F599DF-519B-4706-A3F1-9530DF2590B4}) (Version:  - ArcSoft)

aTube Catcher (HKLM\...\aTube Catcher) (Version: 3.8.7955 - DsNET Corp)

Bass Audio Decoder (remove only) (HKLM\...\Bass Audio Decoder) (Version:  - )

CCleaner (HKLM\...\CCleaner) (Version: 3.14 - Piriform)

CD Audio Reader Filter (remove only) (HKLM\...\CD Audio Reader Filter) (Version:  - )

CDXA Image Reader Filter (SVCD/XCD) (remove only) (HKLM\...\CDXA Image Reader Filter (SVCD/XCD)) (Version:  - )

CleanReg3 (HKLM\...\CleanReg3) (Version:  - )

ClearProg 1.6.0 Final (HKLM\...\ClearProg) (Version: 1.6.0 Final - Sven Hoffman)

Compress it v1.94 (HKLM\...\Compress it_is1) (Version: 1.94 - RG-Software)

Core AAC Decoder (remove only) (HKLM\...\Core AAC Decoder) (Version:  - )

CoreVorbis Audio Decoder (remove only) (HKLM\...\CoreVorbis Audio Decoder) (Version:  - )

Crazy Browser version 2.0.1 (HKLM\...\Crazy Browser 2.0.1_is1) (Version:  - )

DC-Bass Source 1.1.1 (HKLM\...\DC-Bass Source) (Version:  - )

DCoder Image Source (remove only) (HKLM\...\DCoder Image Source) (Version:  - )

DirectVobSub (remove only) (HKLM\...\DirectVobSub) (Version:  - )

Ditto (HKLM\...\Ditto_is1) (Version:  - Scott Brogden)

DScaler 5 Mpeg Decoders (HKLM\...\DScaler 5 Mpeg Decoders_is1) (Version:  - )

DV Ts (HKLM\...\{54266945-8A11-424D-B20F-4F747A714FBA}) (Version:  - )

EaseUS Partition Master 9.2.1 Home Edition (HKLM\...\EaseUS Partition Master Home Edition_is1) (Version:  - EaseUS)

ffdshow v1.2.4453 [2012-05-21] (HKLM\...\ffdshow_is1) (Version: 1.2.4453.0 - )

FFMPEG Core Files (remove only) (HKLM\...\FFMPEG Core Files) (Version:  - )

FreshDownload (HKLM\...\FreshDevices FreshDownload_is1) (Version:  - )

Gabest MPEG Splitter (remove only) (HKLM\...\Gabest MPEG Splitter) (Version:  - )

Glary Utilities 2.5 (HKLM\...\Glary Utilities_is1) (Version:  - GlaryUtilities.com)

Haali Media Splitter (HKLM\...\HaaliMkx) (Version:  - )

Hotfix für Windows XP (KB918997) (HKLM\...\KB918997) (Version: 6 - Microsoft Corporation)

ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.0.0 - LIGHTNING UK!)

JGsoft EditPad Lite 4.5.2 (HKLM\...\EditPad Lite) (Version:  - )

LAV Filters 0.54.1 (HKLM\...\lavfilters_is1) (Version: 0.54.1 - Hendrik Leppkes)

MadVR (remove only) (HKLM\...\MadVR) (Version:  - )

MediaInfo 0.7.20 (HKLM\...\MediaInfo) (Version: 0.7.20 - MediaArea.net)

Microsoft .NET Framework 2.0 (HKLM\...\Microsoft .NET Framework 2.0) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 2.0 (Version: 2.0.50727 - Microsoft Corporation) Hidden

Microsoft .NET Framework 3.0 (HKLM\...\Microsoft .NET Framework 3.0) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.0 (Version: 3.0.04506.30 - Microsoft Corporation) Hidden

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 (Version:  - Microsoft Corporation) Hidden

Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.030.01.06.335 - Huawei Technologies Co.,Ltd)

Mozilla Firefox (3.0) (HKLM\...\Mozilla Firefox (3.0)) (Version: 3.0 (de) - Mozilla)

MSXML 6.0 Parser (KB925673) (HKLM\...\{FE9126DB-5F84-495A-BB46-3C724F1C2D08}) (Version: 6.00.3888.0 - Microsoft Corporation)

Notepad++ (HKLM\...\Notepad++) (Version:  - )

OpenSource AVI Splitter (remove only) (HKLM\...\OpenSource AVI Splitter) (Version:  - )

OpenSource DTS/AC3/DD+ Source Filter (remove only) (HKLM\...\OpenSource DTS/AC3/DD+ Source Filter) (Version:  - )

OpenSource Flash Video Splitter (remove only) (HKLM\...\OpenSource Flash Video Splitter) (Version:  - )

OpenSource MPEG Splitter (remove only) (HKLM\...\OpenSource MPEG Splitter) (Version:  - )

OpenSource MPEG2 Video Decoder (remove only) (HKLM\...\OpenSource MPEG2 Video Decoder) (Version:  - )

RealMedia (remove only) (HKLM\...\RealMedia) (Version:  - )

RegCure 1.5.0.0 (HKLM\...\RegCure) (Version: 1.5.0.0 - RegCure, Inc.)

Sound Blaster AudioPCI 64V (HKLM\...\Sound Blaster AudioPCI 64V) (Version:  - )

Spy Sweeper (HKLM\...\SpySweeper) (Version:  - )

TuneUp Utilities 2003 (HKLM\...\{9665B325-3F96-11D6-A1FA-000374890932}) (Version: 1.0.13 - TuneUp Software)

Uniblue RegistryBooster 2 (HKLM\...\RegistryBooster 2_is1) (Version:  - Uniblue)

VCW VicMan's Photo Editor 8.1 (HKLM\...\VCW VicMan's Photo Editor_is1) (Version:  - VicMan Software)

VIA Audio Driver Setup Program (HKLM\...\VIA Audio Driver Setup Program) (Version:  - )

WEB.DE SmartSurfer (HKLM\...\WEB.DE SmartSurfer) (Version:  - )

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

Windows Communication Foundation (Version: 3.0.04506.30 - Microsoft Corporation) Hidden

Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)

Windows Installer 3.1 (KB893803) (HKLM\...\KB893803v2) (Version:  - Microsoft Corporation)

Windows Media Format Runtime (HKLM\...\Windows Media Format Runtime) (Version:  - )

Windows Presentation Foundation (Version: 3.0.6920.0 - Microsoft Corporation) Hidden

Windows Registry Repair Pro (HKLM\...\Windows Registry Repair Pro_is1) (Version:  - 3B Software, Inc.)

Windows Workflow Foundation (Version: 3.0.4203.2 - Microsoft Corporation) Hidden

WinPcap 4.1.3 (HKLM\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)

WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

WinZip (HKLM\...\WinZip) (Version:  8.1  (4331g) - WinZip Computing, Inc.)

XML Paper Specification Shared Components Pack 1.0 (Version:  - Microsoft Corporation) Hidden

XnView 1.95 (HKLM\...\XnView_is1) (Version: 1.95 - Gougelet Pierre-e)

XVID Decoder (remove only) (HKLM\...\XVID Decoder) (Version:  - )

Zoom Player (remove only) (HKLM\...\ZoomPlayer) (Version:  - )

Zoom Player deutsche Sprachdateien (entfernen) (HKLM\...\ZoomPlayer_German) (Version:  - )

Zoom Player deutsche Sprachdateien (entfernen) (HKLM\...\ZoomPlayerLang) (Version:  - )
 

==================== Restore Points  =========================
 

03-05-2014 19:15:31 sa3mai 21uhr15

25-05-2014 17:07:30 Systemprüfpunkt

28-05-2014 18:44:33 Systemprüfpunkt

31-05-2014 11:48:51 Systemprüfpunkt
 

==================== Hosts content: ==========================
 

2002-12-31 12:00 - 2002-12-31 12:00 - 00000820 ____A E:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: E:\WINDOWS\Tasks\GlaryInitialize.job => E:\Programme\Glary Utilities\initialize.exe

Task: E:\WINDOWS\Tasks\RegCure.job => E:\Programme\RegCure\RegCure.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-02-22 11:53 - 2005-06-28 13:59 - 00053248 _____ () E:\Programme\ArcSoft\PhotoImpression 5\share\pihook.dll

2012-11-13 02:30 - 2001-07-05 16:05 - 00047616 _____ () E:\Programme\Trojancheck5\if3scan.dll

2002-05-17 02:26 - 2002-05-17 02:26 - 00265216 _____ () E:\Programme\TuneUp Utilities\DEC.bpl

2002-11-13 18:52 - 2002-11-13 18:52 - 00174080 _____ () E:\Programme\TuneUp Utilities\CommonForms.bpl

2002-10-14 16:10 - 2002-10-14 16:10 - 00481280 _____ () E:\Programme\TuneUp Utilities\Html.bpl

2002-10-05 13:08 - 2002-10-05 13:08 - 00039936 _____ () E:\Programme\TuneUp Utilities\Indicators.bpl

2002-11-04 12:02 - 2002-11-04 12:02 - 00051200 _____ () E:\Programme\TuneUp Utilities\ehs_d6.bpl

2006-03-09 18:33 - 2006-03-09 18:33 - 00049152 _____ () E:\Programme\WEB.DE\WEB.DE SmartSurfer\xmlparse.dll

2006-03-09 18:33 - 2006-03-09 18:33 - 00073728 _____ () E:\Programme\WEB.DE\WEB.DE SmartSurfer\xmltok.dll

2006-03-09 18:33 - 2006-03-09 18:33 - 00159744 _____ () E:\Programme\WEB.DE\WEB.DE SmartSurfer\ssleay32.dll

2006-03-09 18:33 - 2006-03-09 18:33 - 00876544 _____ () E:\Programme\WEB.DE\WEB.DE SmartSurfer\LIBEAY32.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 

==================== EXE Association (whitelisted) =============
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 11:21:54 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 11:21:54 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 11:16:53 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 11:16:53 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 09:38:51 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 

Error: (06/03/2014 09:38:51 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
 
 

System errors:

=============

Error: (06/04/2014 08:47:00 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1460
 

Error: (06/04/2014 08:43:15 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Monitor Task" wurde mit folgendem Fehler beendet: 

%%1114
 

Error: (06/04/2014 00:49:45 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Outpost Firewall Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (06/03/2014 09:43:55 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1460
 

Error: (06/03/2014 09:40:17 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Monitor Task" wurde mit folgendem Fehler beendet: 

%%1114
 

Error: (06/03/2014 08:55:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Outpost Firewall Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (06/03/2014 08:51:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1460
 

Error: (06/03/2014 08:47:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Monitor Task" wurde mit folgendem Fehler beendet: 

%%1114
 

Error: (06/03/2014 08:39:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Outpost Firewall Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (06/03/2014 08:19:42 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1460
 
 

Microsoft Office Sessions:

=========================

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {7B849a69-220F-451E-B3FE-2CB811AF94AE}
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
 

Error: (06/04/2014 08:41:57 AM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {7B849a69-220F-451E-B3FE-2CB811AF94AE}
 

Error: (06/03/2014 11:21:54 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
 

Error: (06/03/2014 11:21:54 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {7B849a69-220F-451E-B3FE-2CB811AF94AE}
 

Error: (06/03/2014 11:16:53 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
 

Error: (06/03/2014 11:16:53 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {7B849a69-220F-451E-B3FE-2CB811AF94AE}
 

Error: (06/03/2014 09:38:51 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
 

Error: (06/03/2014 09:38:51 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)

Description: {7B849a69-220F-451E-B3FE-2CB811AF94AE}
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 53%

Total physical RAM: 511.48 MB

Available physical RAM: 236.62 MB

Total Pagefile: 1249.8 MB

Available Pagefile: 972.53 MB

Total Virtual: 2047.88 MB

Available Virtual: 1973.23 MB
 

==================== Drives ================================
 

Drive c: (2GB_98) (Fixed) (Total:2 GB) (Free:0.19 GB) FAT32 ==>[Drive with boot components (Windows XP)]

Drive e: (6_5GB_XP) (Fixed) (Total:6.49 GB) (Free:1.48 GB) FAT32

Drive f: (KNOPPIX 7_1) (Fixed) (Total:3 GB) (Free:3 GB) FAT32

Drive g: (LINUX-SWAP) (Fixed) (Total:1.15 GB) (Free:1.15 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 38 GB) (Disk ID: E9CB9832)

Partition 1: (Active) - (Size=2 GB) - (Type=0B)

Partition 2: (Not Active) - (Size=11 GB) - (Type=OF Extended)
 

==================== End Of Log ============================

--- --- ---