| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPACK.Gen' [trojan]Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.03.2012, 14:00
| #1 |
 | ![TR/Crypt.XPACK.Gen' [trojan] - Standard](images/icons/icon1.gif){kind=icon} TR/Crypt.XPACK.Gen' [trojan] Hallo, heute hat mein Avira AntiVir einen Virus gefunden: Code:
ATTFilter In der Datei 'C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Dann habe ich einen Drucker installiert. Danach bin ich auf dem Desktop gegangen, doch alle Programme, Ordner und Dokumente waren nicht mehr drauf. Außer den Papierkorb und 3 Drucker Programme. In den Ordnern Bilder, Dokumente, Downloads usw. ist nichts mehr drin. Meine Bilder, Dokumente (und ...) sind wohl gelöscht. Wenn ich auf START klicke und dann auf Alle Programme, da sind die Programme auch nicht drinnen. Auf der Festplatte, kann ich unter "Programme" diese öffnen. Was muss ich denn jetzt machen? |
|
25.03.2012, 15:40
| #2 |
| /// Malware-holic   | TR/Crypt.XPACK.Gen' [trojan] hi,
__________________Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
25.03.2012, 17:09
| #3 |
| | TR/Crypt.XPACK.Gen' [trojan] OTL.txt
__________________Code:
ATTFilter OTL logfile created on: 25.03.2012 17:18:40 - Run 1 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Karout\Desktop Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,25 Gb Total Physical Memory | 0,53 Gb Available Physical Memory | 42,46% Memory free 2,75 Gb Paging File | 1,23 Gb Available in Paging File | 44,59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 141,05 Gb Total Space | 84,66 Gb Free Space | 60,02% Space Free | Partition Type: NTFS Drive D: | 8,00 Gb Total Space | 5,91 Gb Free Space | 73,82% Space Free | Partition Type: NTFS Computer Name: KAROUT-PC | User Name: Nadine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.03.25 17:16:21 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Karout\Desktop\OTL.exe PRC - [2012.02.29 17:19:35 | 000,949,104 | ---- | M] (Opera Software) -- C:\Programme\Opera\opera.exe PRC - [2011.10.24 17:51:19 | 000,801,792 | ---- | M] (Yuna Software) -- C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe PRC - [2011.07.01 13:48:40 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.04.28 11:24:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.02.22 21:00:27 | 001,174,152 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe PRC - [2010.05.20 15:27:24 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX1000.exe PRC - [2010.05.20 15:27:24 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\LifeEnC2.exe PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe PRC - [2010.05.20 15:27:24 | 000,095,088 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\LifeTray.exe PRC - [2010.04.16 23:12:28 | 003,872,080 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.04.11 00:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.01.14 18:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe PRC - [2007.02.14 21:46:20 | 000,278,608 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapSvc.exe PRC - [2007.02.14 21:45:48 | 000,159,744 | ---- | M] (CyberLink Corp.) -- C:\Programme\Powercinema\PCMService.exe PRC - [2007.01.11 12:40:22 | 000,232,184 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe PRC - [2007.01.11 12:40:18 | 000,017,656 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe PRC - [2006.11.14 15:47:54 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Programme\Common Files\aol\1298400348\ee\aolsoftware.exe PRC - [2006.11.09 11:57:52 | 003,784,704 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2006.11.08 14:42:27 | 000,194,240 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe PRC - [2006.10.24 23:08:40 | 000,107,112 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\ccApp.exe PRC - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\ccSvcHst.exe PRC - [2006.09.20 19:05:16 | 000,046,736 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\AppCore\AppSvc32.exe PRC - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe ========== Modules (No Company Name) ========== MOD - [2012.02.20 13:30:57 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll MOD - [2012.02.20 13:30:24 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2598077ccea480c6120d3a1ad4455be0\System.Web.ni.dll MOD - [2012.02.20 13:30:10 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll MOD - [2012.02.20 13:29:56 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll MOD - [2012.02.18 12:40:09 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll MOD - [2012.02.18 12:37:38 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll MOD - [2012.02.18 12:37:02 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll MOD - [2012.02.18 12:32:01 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll MOD - [2011.12.24 18:10:15 | 000,064,000 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstautodetect.dll MOD - [2011.12.24 18:10:14 | 000,275,968 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwebmdec.dll MOD - [2011.12.24 18:10:14 | 000,078,336 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwavparse.dll MOD - [2011.12.24 18:10:14 | 000,046,592 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwaveform.dll MOD - [2011.12.24 18:10:14 | 000,045,568 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gsttypefindfunctions.dll MOD - [2011.12.24 18:10:13 | 000,316,928 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstoggdec.dll MOD - [2011.12.24 18:10:13 | 000,168,448 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstffmpegcolorspace.dll MOD - [2011.12.24 18:10:13 | 000,099,840 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstcoreplugins.dll MOD - [2011.12.24 18:10:13 | 000,098,816 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstaudioresample.dll MOD - [2011.12.24 18:10:13 | 000,076,800 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstdirectsound.dll MOD - [2011.12.24 18:10:13 | 000,068,608 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstdecodebin2.dll MOD - [2011.12.24 18:10:12 | 000,783,360 | ---- | M] () -- C:\Programme\Opera\gstreamer\gstreamer.dll MOD - [2011.12.24 18:10:12 | 000,098,816 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstaudioconvert.dll MOD - [2011.10.14 15:24:32 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll MOD - [2011.08.07 15:54:16 | 000,004,096 | ---- | M] () -- C:\Programme\Yuna Software\Messenger Plus!\Detour32.dll MOD - [2011.02.22 20:30:51 | 000,225,280 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2564.38865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2011.02.22 20:30:51 | 000,184,320 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2564.38919__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2011.02.22 20:30:51 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2564.38897__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2011.02.22 20:30:50 | 001,671,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2564.38906__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll MOD - [2011.02.22 20:30:50 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2564.39149__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll MOD - [2011.02.22 20:30:50 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2564.39137__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2011.02.22 20:30:50 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2564.39090__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2011.02.22 20:30:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2564.38918__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll MOD - [2011.02.22 20:30:50 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2564.38884__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2011.02.22 20:30:50 | 000,011,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2564.39023__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2011.02.22 20:30:48 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2537.29860__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2011.02.22 20:30:48 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2536.35576__90ba9c70f846762e\LOG.Foundation.dll MOD - [2011.02.22 20:30:48 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2536.35581__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2536.35589__90ba9c70f846762e\MOM.Foundation.dll MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2536.35599__90ba9c70f846762e\DEM.OS.I0602.dll MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2536.35599__90ba9c70f846762e\DEM.OS.dll MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2536.35598__90ba9c70f846762e\DEM.Graphics.dll MOD - [2011.02.22 20:30:47 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2536.35577__90ba9c70f846762e\CLI.Foundation.dll MOD - [2011.02.22 20:30:47 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2536.35587__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2011.02.22 20:30:47 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2536.35642__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2011.02.22 20:30:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2536.35590__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2011.02.22 20:30:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2536.35580__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2011.02.22 20:30:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2531.19989__90ba9c70f846762e\DEM.Foundation.dll MOD - [2011.02.22 20:30:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2011.02.22 20:30:45 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll MOD - [2011.02.22 20:30:45 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2011.02.22 20:30:44 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2561.34688__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2011.02.22 20:30:44 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2536.35597__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2011.02.22 20:30:44 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2536.35592__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2011.02.22 20:30:44 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2536.35605__90ba9c70f846762e\APM.Foundation.dll MOD - [2011.02.22 20:30:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2536.35592__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2011.02.22 20:30:44 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2536.35589__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2011.02.22 20:30:43 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2564.39156_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll MOD - [2011.02.22 20:30:43 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2536.35576__90ba9c70f846762e\AEM.Foundation.dll MOD - [2011.02.22 20:30:43 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2531.19989__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll MOD - [2011.02.22 20:30:39 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2564.39164__90ba9c70f846762e\MOM.Implementation.dll MOD - [2011.02.22 20:30:39 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2564.39162__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2011.02.22 20:30:39 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2536.35581__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2011.02.22 20:30:39 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2536.35591__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2011.02.22 20:30:38 | 000,466,944 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2564.38893__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2011.02.22 20:30:38 | 000,278,528 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2564.39156__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2011.02.22 20:30:38 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2536.35590__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2011.02.22 20:30:38 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2536.35606__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2011.02.22 20:30:38 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2536.35583__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2011.02.22 20:30:37 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2564.38863__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2011.02.22 20:30:36 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2564.38864__90ba9c70f846762e\ATIDEMOS.dll MOD - [2011.02.22 20:30:36 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2536.35586__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2011.02.22 20:30:36 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2011.02.22 20:30:36 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2564.39163__90ba9c70f846762e\CCC.Implementation.dll MOD - [2011.02.22 20:30:36 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2536.35600__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2011.02.22 20:30:35 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2564.38862__90ba9c70f846762e\AEM.Server.dll MOD - [2009.03.29 22:42:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll MOD - [2009.03.29 22:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2007.03.08 12:22:00 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll MOD - [2007.02.14 21:46:24 | 000,339,968 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLTinyDB.dll MOD - [2007.02.14 21:46:06 | 000,241,750 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapEngine.dll MOD - [2007.02.14 21:46:06 | 000,114,768 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLSchMgr.dll MOD - [2007.02.14 21:46:06 | 000,032,768 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapSvcps.dll MOD - [2007.01.11 12:02:14 | 004,587,520 | R--- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll MOD - [2007.01.08 13:08:56 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll MOD - [2006.12.19 21:16:04 | 000,073,728 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll MOD - [2006.11.08 17:15:50 | 000,009,384 | ---- | M] () -- C:\Programme\Norton Internet Security\Norton AntiVirus\NAVShExt.loc ========== Win32 Services (SafeList) ========== SRV - [2012.03.23 14:37:47 | 000,221,184 | ---- | M] (Works Ltd.) [Auto | Running] -- C:\Windows\System32\aptwdhlrc.dll -- (LanmanWorkstation) SRV - [2011.12.24 18:37:22 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service) SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2011.07.01 13:48:40 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.28 11:24:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.04.01 12:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.02.22 21:00:27 | 001,174,152 | ---- | M] (Symantec Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC) SRV - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.12.10 19:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) SRV - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2010.12.10 19:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc) SRV - [2010.04.28 08:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2009.02.23 12:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) SRV - [2009.01.14 18:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort) SRV - [2008.01.19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 00:33:40 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2007.02.14 21:46:24 | 000,110,677 | ---- | M] () [Auto | Stopped] -- c:\Programme\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS) SRV - [2007.02.14 21:46:20 | 000,278,608 | ---- | M] () [Auto | Running] -- c:\Programme\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS) SRV - [2006.11.08 14:42:27 | 002,541,248 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate) SRV - [2006.11.08 14:42:27 | 000,194,240 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler) SRV - [2006.10.27 01:18:36 | 000,080,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Norton Internet Security\isPwdSvc.exe -- (ISPwdSvc) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService) SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [On_Demand | Stopped] -- C:\Programme\Common Files\aol\acs\AOLacsd.exe -- (AOL ACS) SRV - [2006.10.13 16:29:12 | 000,049,296 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\VAScanner\comHost.exe -- (comHost) SRV - [2006.09.20 19:05:16 | 000,046,736 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- (SymAppCore) SRV - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVEX15.SYS -- (NAVEX15) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVENG.SYS -- (NAVENG) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys -- (IDSvix86) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.03.23 15:33:50 | 000,464,384 | ---- | M] (New Technology Quality, Ltd.) [Kernel | System | Unknown] -- C:\Windows\System32\ntqjxeh5.sys -- (ntqjxeh5) DRV - [2011.07.05 10:12:16 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd) DRV - [2011.07.01 13:48:43 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.01 13:48:43 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.02.22 21:02:14 | 000,109,744 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.05.20 15:27:26 | 001,961,072 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VX1000.sys -- (VX1000) DRV - [2007.01.08 13:16:50 | 002,313,216 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2006.11.17 11:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid) DRV - [2006.11.06 03:00:00 | 000,387,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2006.11.03 19:23:02 | 000,275,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtspl.sys -- (SRTSPL) DRV - [2006.11.03 19:23:00 | 000,024,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\srtspx.sys -- (SRTSPX) DRV - [2006.11.03 19:22:56 | 000,245,880 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtsp.sys -- (SRTSP) DRV - [2006.11.02 09:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp) DRV - [2006.11.01 22:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW) DRV - [2006.10.30 10:22:00 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO) DRV - [2006.10.24 14:40:22 | 000,185,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\symtdi.sys -- (SYMTDI) DRV - [2006.10.24 14:40:22 | 000,026,384 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\symredrv.sys -- (SYMREDRV) DRV - [2006.10.06 15:26:16 | 000,406,672 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKLM\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://search.iminent.com/?appId=&ref=toolbox&q={searchTerms} IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com [2011.05.14 12:59:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.01 18:11:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.01 18:11:10 | 000,000,000 | ---D | M] [2011.05.25 21:44:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.02.22 20:32:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011.03.15 16:47:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.03.15 16:45:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.01.01 18:11:03 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.01 18:11:03 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.01.01 18:11:03 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.07.10 02:21:02 | 000,002,157 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchTheWeb.xml [2012.01.01 18:11:03 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.01 18:11:03 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Google-Suche = \Users\Karout\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.18_0\ O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll (SimplyGen) O2 - BHO: (Reg Error: Value error.) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\1.0\NppBHO.dll (Symantec Corporation) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) O2 - BHO: (Iminent.BHO.NavigationError) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - C:\Programme\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll (Iminent) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Google\Google_BAE\BAE.dll (Packard Bell) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll File not found O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [HostManager] C:\Programme\Common Files\aol\1298400348\ee\aolsoftware.exe (America Online, Inc.) O4 - HKLM..\Run: [Iminent.Notifier] C:\Programme\Iminent\SearchTheWeb\Iminent.Notifier.exe (Iminent) O4 - HKLM..\Run: [InstallProcess] c:\OEM\process\PROCESS.CMD () O4 - HKLM..\Run: [IS CfgWiz] C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe (Symantec Corporation) O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation) O4 - HKLM..\Run: [PCMService] c:\Program Files\Powercinema\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [PlusService] C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software) O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [VX1000] C:\Windows\vVX1000.exe (Microsoft Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll File not found O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{74A5E7D9-4091-4390-887E-6688178ACBF3}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Adobe Shockwave Director 10.1 ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: ccc-core-static - msiexec /fums {B9701D86-3D63-7F49-9948-27670574B4CC} /qb NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.03.25 14:27:19 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2012.03.25 13:44:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Messenger Plus! [2012.03.25 13:38:32 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG [2012.03.25 13:33:07 | 000,000,000 | ---D | C] -- C:\ProgramData\HPSSUPPLY [2012.03.25 13:29:10 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup [2012.03.25 13:25:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP [2012.03.25 13:25:47 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant [2012.03.25 13:24:12 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard [2012.03.25 13:21:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard [2012.03.25 13:10:58 | 000,000,000 | ---D | C] -- C:\Users\Default\AppData [2012.03.25 13:03:41 | 000,000,000 | ---D | C] -- C:\ProgramData\HP [2012.03.25 12:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\AOL [2012.03.23 15:33:50 | 000,704,512 | ---- | C] (Discrete Cosine LLC) -- C:\Windows\System32\jpgm0109.dll [2012.03.23 15:33:50 | 000,464,384 | ---- | C] (New Technology Quality, Ltd.) -- C:\Windows\System32\ntqjxeh5.sys [2012.03.19 17:17:18 | 000,000,000 | ---D | C] -- C:\Program Files\simfy [2012.03.08 17:11:36 | 000,000,000 | ---D | C] -- C:\Program Files\Kingsoft ========== Files - Modified Within 30 Days ========== [2012.03.25 17:09:00 | 000,000,364 | ---- | M] () -- C:\Windows\tasks\WpsUpdateTask_Nadine.job [2012.03.25 16:57:11 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.25 15:56:03 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.25 15:44:03 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.25 15:44:03 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.25 15:08:04 | 000,695,718 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.03.25 15:08:04 | 000,651,072 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.03.25 15:08:04 | 000,154,226 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.03.25 15:08:04 | 000,125,322 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.03.25 13:43:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.25 13:43:45 | 1341,448,192 | -HS- | M] () -- C:\hiberfil.sys [2012.03.25 13:38:49 | 000,160,363 | ---- | M] () -- C:\Windows\hpoins15.dat [2012.03.25 13:34:54 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\HP Photosmart Essential 2.01.lnk [2012.03.25 13:33:09 | 000,001,873 | ---- | M] () -- C:\Users\Public\Desktop\Shop für HP Zubehör.lnk [2012.03.25 13:29:11 | 000,001,975 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012.03.25 13:26:59 | 000,001,207 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2012.03.23 15:33:50 | 000,704,512 | ---- | M] (Discrete Cosine LLC) -- C:\Windows\System32\jpgm0109.dll [2012.03.23 15:33:50 | 000,464,384 | ---- | M] (New Technology Quality, Ltd.) -- C:\Windows\System32\ntqjxeh5.sys [2012.03.23 14:37:47 | 000,221,184 | ---- | M] (Works Ltd.) -- C:\Windows\System32\aptwdhlrc.dll [2012.03.16 14:23:18 | 000,441,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.03.25 13:34:54 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\HP Photosmart Essential 2.01.lnk [2012.03.25 13:33:09 | 000,001,873 | ---- | C] () -- C:\Users\Public\Desktop\Shop für HP Zubehör.lnk [2012.03.25 13:32:19 | 000,000,817 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk [2012.03.25 13:29:11 | 000,001,975 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2012.03.25 13:26:59 | 000,001,207 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2012.03.25 13:05:26 | 000,160,363 | ---- | C] () -- C:\Windows\hpoins15.dat [2012.03.08 17:16:21 | 000,000,364 | ---- | C] () -- C:\Windows\tasks\WpsUpdateTask_Nadine.job [2011.06.30 19:10:21 | 000,921,624 | ---- | C] () -- \img2-001.raw [2011.03.18 20:32:09 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2011.03.18 20:30:14 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2011.03.18 20:30:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2011.02.23 04:58:35 | 000,695,718 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.02.23 04:58:35 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.02.23 04:58:35 | 000,154,226 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.02.23 04:58:35 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2011.02.23 04:53:39 | 000,008,192 | R-S- | C] () -- \BOOTSECT.BAK [2011.02.23 04:53:35 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat [2011.02.23 04:53:35 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2011.02.23 04:53:35 | 000,145,112 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.02.22 21:07:16 | 000,000,382 | ---- | C] () -- \PB.iss [2011.02.22 20:45:39 | 000,001,811 | -H-- | C] () -- \IPH.PH [2011.02.22 20:45:33 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat [2011.02.22 20:31:20 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe [2011.02.22 20:26:23 | 000,049,152 | ---- | C] () -- C:\Windows\System32\ChCfg.exe [2011.02.22 20:22:36 | 1341,448,192 | -HS- | C] () -- \hiberfil.sys [2011.02.22 19:41:24 | 000,333,257 | RHS- | C] () -- \bootmgr ========== LOP Check ========== [2012.03.25 13:42:19 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.03.25 17:09:00 | 000,000,364 | ---- | M] () -- C:\Windows\Tasks\WpsUpdateTask_Nadine.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.11.27 19:18:39 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.03.18 17:30:40 | 000,000,000 | ---D | M] -- C:\2819f8fffcf595e3c0 [2011.02.26 11:51:23 | 000,000,000 | ---D | M] -- C:\597ea0f10aad1dc5cdf1 [2011.03.18 21:19:16 | 000,000,000 | -HSD | M] -- C:\boot [2012.03.25 13:43:41 | 000,000,000 | -H-D | M] -- C:\Config.Msi [2006.11.02 14:59:44 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.02.22 21:22:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.02.23 04:47:37 | 000,000,000 | ---D | M] -- C:\drivers [2011.07.04 12:56:57 | 000,000,000 | -HSD | M] -- C:\found.000 [2011.07.11 16:25:31 | 000,000,000 | -HSD | M] -- C:\found.001 [2011.10.14 15:15:50 | 000,000,000 | -HSD | M] -- C:\found.002 [2011.11.27 13:51:05 | 000,000,000 | ---D | M] -- C:\Games [2011.02.22 20:33:30 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.02.23 05:13:46 | 000,000,000 | ---D | M] -- C:\OEM [2012.02.18 17:19:29 | 000,000,000 | ---D | M] -- C:\output [2011.03.18 19:51:01 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.03.25 13:24:12 | 000,000,000 | R--D | M] -- C:\Program Files [2012.03.25 13:44:54 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.02.22 21:22:24 | 000,000,000 | -HSD | M] -- C:\Programme [2012.03.25 17:37:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.05.14 13:04:24 | 000,000,000 | ---D | M] -- C:\temp [2012.03.25 17:16:59 | 000,000,000 | R--D | M] -- C:\Users [2012.03.25 13:47:27 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\OEM\boot\winpe\Windows\System32\drivers\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\OEM\boot\winpe\Windows\System32\drivers\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2011.02.27 15:36:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2011.02.27 15:36:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2011.02.27 15:36:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\OEM\boot\winpe\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.27 15:35:00 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2011.02.27 15:34:57 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2011.02.27 15:34:56 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2011.03.01 15:01:18 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe [2011.03.01 15:01:18 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2011.02.27 15:34:59 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe [2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe [2008.01.19 00:33:12 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTORV.SYS > [2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\OEM\boot\winpe\Windows\System32\drivers\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\OEM\boot\winpe\Windows\System32\netlogon.dll [2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll [2008.01.19 00:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\OEM\boot\winpe\Windows\System32\drivers\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys [2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2008.01.19 00:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\OEM\boot\winpe\Windows\System32\scecli.dll [2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll [2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2011.02.25 13:49:33 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll [2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll [2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\Temp\user32.dll [2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2011.02.25 13:49:35 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll [2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2008.01.19 00:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\OEM\boot\winpe\Windows\System32\user32.dll [2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\OEM\boot\winpe\Windows\System32\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\OEM\boot\winpe\Windows\System32\winlogon.exe [2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe [2008.01.19 00:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\OEM\boot\winpe\Windows\System32\drivers\ws2ifsl.sys [2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys [2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys [2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < > ========== Hard Links - Junction Points - Mount Points - Symbolic Links ========== [C:\Windows\oem\mp] -> Volume{99aedc4e-3eaf-11e0-ad2d-806e6f6e6963}\ -> Mount Point < End of report > |
|
25.03.2012, 17:11
| #4 |
| | TR/Crypt.XPACK.Gen' [trojan] Extras.txt Code:
ATTFilter OTL Extras logfile created on: 25.03.2012 17:18:40 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Karout\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,25 Gb Total Physical Memory | 0,53 Gb Available Physical Memory | 42,46% Memory free
2,75 Gb Paging File | 1,23 Gb Available in Paging File | 44,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,05 Gb Total Space | 84,66 Gb Free Space | 60,02% Space Free | Partition Type: NTFS
Drive D: | 8,00 Gb Total Space | 5,91 Gb Free Space | 73,82% Space Free | Partition Type: NTFS
Computer Name: KAROUT-PC | User Name: Nadine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03286FEC-A749-4561-A9F3-8A09CAC6D0C9}" = lport=137 | protocol=17 | dir=in | app=system |
"{044CBE36-409D-45BA-BD3F-DF295F2A7A72}" = rport=139 | protocol=6 | dir=out | app=system |
"{10B07AE5-65EC-4B66-9D06-D79BA284A433}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{3215BFAE-8CD1-48D5-BF36-2BE5912F9B4D}" = rport=137 | protocol=17 | dir=out | app=system |
"{39C5AD1F-E029-4B78-8DEA-5472F70A6A70}" = rport=138 | protocol=17 | dir=out | app=system |
"{40E5D532-35F5-4FAB-86CD-64A21BB313A3}" = lport=445 | protocol=6 | dir=in | app=system |
"{8596A8A7-0F69-4777-8ED3-0CDC40D08E93}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{91392756-6023-45CE-BCC3-17521D7B9932}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{B3C9CCCD-227A-4627-9F95-82D0C7282AB0}" = rport=445 | protocol=6 | dir=out | app=system |
"{C77873D9-1D7D-4F2E-BB2E-4BE987E99D4E}" = lport=138 | protocol=17 | dir=in | app=system |
"{D0B0EC63-0A1A-4F2D-9B7D-F3240848E9A5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{DDD897A3-5520-454E-9209-5F8E127DCEE5}" = lport=139 | protocol=6 | dir=in | app=system |
"{E5BB99F8-CAEF-4F5B-A8BC-0D9A4C01852E}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00AE702B-2B38-4876-B70B-CD51255FB446}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{06D6C232-E4B9-422E-B909-8059DBDB3171}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{0770DCF6-AF8B-4FC3-9F9A-D751E78BDA3F}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{084CE2B3-7348-4643-A112-6617948C0A1E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{11FAC405-F4FF-4774-BB46-4BAA005809AE}" = protocol=6 | dir=in | app=c:\program files\powercinema\powercinema.exe |
"{1BBAAD9B-9E1C-48D5-A4A6-102AAEA0156A}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{2007E066-CCE6-4C5B-B1C5-3DC4D506A0CA}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{2290F4B7-BCE9-41D0-B12C-55FEA65D58EE}" = dir=in | app=c:\program files\powercinema\kernel\dms\clmsservice.exe |
"{235AB811-65F6-4564-A428-9977D874AF03}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{23B81CA7-C3D9-4D4D-AB82-4EC0FE51F3FE}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{2FC97CCB-E9C9-4BE3-87CC-06F2EE4B9EF4}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{3752926B-A7E6-4DAE-B02B-64415665EF17}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{3EB1343C-5D2F-4E1E-8F98-E8FCBDA8BFA1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3EF9358E-74A8-49FB-9E03-10874DD8194C}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{45B579BA-A879-4771-8FE7-9C8912C1F286}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{4FD5B76E-A8C8-4E11-8389-197223CB44E9}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{541B4445-5206-438A-ACB9-80C128F0B4BD}" = protocol=17 | dir=in | app=c:\program files\powercinema\powercinema.exe |
"{55414428-6732-4C13-AAE3-6164E2832F79}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{557B8736-3BB6-483C-A928-3A2ED40B9F7F}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{5676ED70-284A-4374-AAE2-11E3994C0B6A}" = protocol=6 | dir=in | app=c:\program files\powercinema\pcmservice.exe |
"{595C1B14-2F1D-4B58-86BD-FD4A85BD0545}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{66477BFB-D270-4B8C-9581-A59926D08C6E}" = protocol=17 | dir=in | app=c:\program files\powercinema\pcmservice.exe |
"{6825C0C5-9022-441C-86B8-FE89E35A28B1}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{78ED9E83-36DF-46ED-8982-7564B7A670B1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{80CBEF3C-C4D8-4B33-905D-08EC216804AA}" = dir=in | app=c:\program files\powercinema\powercinema.exe |
"{8EB09E1E-4CC2-4D68-8DFC-58EDC9AFB7CD}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{9346B39C-20B6-418E-A9BD-AF09262FE2B2}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{95E44B3B-C4B6-4F12-926F-A3227A95B33D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A31811AB-53AE-485B-AAB2-9D742860D7E3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{AE12DB2C-C45F-4707-8FEE-14DC0794DC30}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{B22E3C37-124E-4814-BA27-9742979CF0F2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B3CF341F-1DB3-4A0E-A88E-02791FC398CD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B6316D68-C3DE-495A-91CD-95F29268089A}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{B71C6C5F-FEBB-48DF-937C-E0BE64921F13}" = dir=in | app=c:\program files\powercinema\pcmservice.exe |
"{C5C55218-B0B0-4F68-9121-BDEB6A491142}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{C64DA8CB-CBF7-4C2B-8837-50E86338BBF1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{CF7DDE00-457E-43DE-9686-E433B07FF251}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{DE7F8A63-4612-4BA8-8504-050340831509}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{E24E57B0-F372-407F-B759-7E7D798221D4}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{E45DE126-E6AA-422E-B110-578AD4A2ADB1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{EF66B37E-794E-4D7B-AD12-88C9FA63BB14}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F57CDAB2-1E0D-43C3-80F8-53110D711BB5}" = dir=in | app=c:\program files\powercinema\kernel\dmp\clbrowserengine.exe |
"{F61249DB-6362-44AD-ABC2-C016A75984AE}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{FF6222F0-0357-4925-917B-AE181EB5B54B}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"TCP Query User{06517BF7-1A4F-421F-B354-ED16D9FDE8F7}C:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe |
"TCP Query User{118EE256-F3CB-4C3B-8808-B3490E3F95AF}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2A2A885B-9105-483C-9E0F-A19423436907}C:\users\nadine\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nadine\appdata\roaming\spotify\spotify.exe |
"TCP Query User{38033693-386D-4CC7-B482-18C9DB169E53}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{4E6FDABB-441C-4748-915A-811054A7AA1A}C:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe |
"TCP Query User{59F65AE6-B3CF-49C3-B4E4-22A047B0A8F5}C:\games\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\games\counter-strike 1.6\hl.exe |
"TCP Query User{7DC0246C-C1BB-49F3-AF2C-40935F619334}C:\games\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\games\counter-strike 1.6\hl.exe |
"TCP Query User{855F6D63-D1FC-42FF-A572-9AB579062A31}C:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe" = protocol=6 | dir=in | app=c:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe |
"TCP Query User{A3CDCC38-D43A-422F-8356-BBED2B916527}C:\users\karout\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\roaming\spotify\spotify.exe |
"TCP Query User{B3BF47D7-6B4C-4CDB-BF59-B16BAA5A6DE9}C:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru)\hl.exe" = protocol=6 | dir=in | app=c:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru)\hl.exe |
"UDP Query User{2BB16509-AB2F-40AA-A40B-3A5F2825ABDE}C:\users\nadine\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nadine\appdata\roaming\spotify\spotify.exe |
"UDP Query User{608E5A17-15EC-4BB0-A04D-ADE6E3AA6B69}C:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe" = protocol=17 | dir=in | app=c:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe |
"UDP Query User{66E47E44-9B29-490F-B67B-5C4FA98ADB0B}C:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe |
"UDP Query User{7F6FCCDA-6545-4D94-A4CA-9277653F6D07}C:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru)\hl.exe" = protocol=17 | dir=in | app=c:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru)\hl.exe |
"UDP Query User{864170B2-9AEF-4AB2-AF8D-ABE95CB2AFE6}C:\games\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\games\counter-strike 1.6\hl.exe |
"UDP Query User{C1F4CFFE-699D-4751-9ED8-005A7338EF95}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{E3B76813-08F2-473B-BC94-954BFF15880A}C:\users\karout\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\roaming\spotify\spotify.exe |
"UDP Query User{E6EB2DD6-6220-4983-AA61-12B51D82452B}C:\games\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\games\counter-strike 1.6\hl.exe |
"UDP Query User{F8282610-7C6C-49FC-805B-75F11A5356EE}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{FB03CCC0-FF4F-4995-8999-ED2E6FBA237B}C:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{04441EE4-3631-43DB-813A-9D031380C8E5}" = MarketingReg
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24EE4523-711A-4BD1-95EA-F73A8A6950D3}" = Audials TV
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = PowerCinema
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{48185814-A224-447A-81DA-71BD20580E1B}" = Norton Internet Security
"{4843B611-8FCB-4428-8C23-31D0A5EAE164}" = Norton Confidential Browser Component
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56624BBF-8925-D5F8-7662-3ABE1BA7EC28}" = Catalyst Control Center Graphics Light
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{58A8820A-CCF4-4A6E-A4B9-CECD87D3C7F2}" = ccc-Branding
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security
"{5EE48155-BD54-46E2-8D81-A57A69726A95}" = SearchTheWeb
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61E7C563-8BDA-4E44-F9A8-F21E29F0F6A8}" = Catalyst Control Center Core Implementation
"{620CAD2D-0757-43A9-AA5F-C8D48A1E4D85}_is1" = BigMacroTool 1.5
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{830D8CBD-C668-49e2-A969-C2C2106332E0}" = Norton AntiVirus
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{924901FC-88E8-B25B-C0DD-9E029A6570FC}" = Catalyst Control Center Localization German
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}" = Norton Protection Center
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A7DB362E-16DC-4E29-8A34-E74381E00B5B}" = Adobe Shockwave Player
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{ACA85783-8EEA-4f0a-B2A3-A8173F30209F}" = C4200_doccd
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B09BCBF6-87EE-4403-A336-3A9510856535}" = HP Photosmart All-In-One Software 9.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Creator 9 LE
"{B834524D-C302-F626-87D6-5E7352FBE502}" = simfy
"{B9701D86-3D63-7F49-9948-27670574B4CC}" = ccc-core-static
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BFDE4176-5DFE-4db9-AA00-8F30CB001BDA}" = c4200_Help
"{C222C293-2B1F-C94F-088E-D3F55CF732FC}" = ccc-utility
"{C39E671D-0528-4c5e-A034-8470C5BC393A}" = C4200
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" = Norton Confidential Web Protection Component
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" = Symantec Real Time Storage Protection Component
"{D8B7A682-20DA-4797-8415-B1FB14D4D32B}" = PS_AIO_Software
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E28750A2-45F2-4b63-99F7-9F81A94B1E2D}" = PS_AIO_Software_min
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E5EE9939-259F-4DE2-8023-5C49E16A4F43}" = Norton Internet Security
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F4DB525F-A986-4249-B98B-42A8066251CA}" = AV
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FAD800F2-B263-49B5-BDA6-7FF8D625D49A}" = Audials
"{FD7F242B-9AA0-40c3-941E-3A9821D19C09}" = PS_AIO_ProductContext
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AdobeReader" = Adobe Reader 8
"AOL Deinstallation" = AOL Deinstallation
"AOL_DE" = AOL 9.0 VR
"Audacity_is1" = Audacity 1.2.6
"AUDIO_REALTEK" = Realtek HD Audio V6.0.1.5322
"AutocompletePro2_is1" = AutocompletePro
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"conduitEngine" = Conduit Engine
"Counter-Strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru) v1.1.2.6 (4554)" = Counter-Strike 1.6 v1.1.2.6 (4554) (cs.theabyss.ru) v1.1.2.6 (4554)
"Counter-Strike Source [no-steam] v1.0.0.66 The Abyss (cs.theabyss.ru) v1.0.0.66" = Counter-Strike Source [no-steam] v1.0.0.66 The Abyss (cs.theabyss.ru) v1.0.0.66
"CREATOR9" = Creator 9
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"FirefoxDE" = Firefox
"Flashplayer" = Flash Player 9 Internet Explorer
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Sound Recorder_is1" = Free Sound Recorder 2010 v9.2.1
"Free Studio_is1" = Free Studio version 5.0.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"GOOGLE_EARTH" = Google Earth
"GoogleBAE" = Google BAE
"GoogleDesktop" = Google Desktop
"GoogleToolbar" = Google Toolbar
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"HPOCR" = HP OCR Software 9.0
"ImageWriter" = Packard Bell ImageWriter
"Infocentre" = Infocentre Rev. 2.0
"kikin Plugin (NO23 Edition)" = kikin Plugin (NO23 Edition) 1.11
"Kingsoft Writer" = Kingsoft Writer (8.1.0.2948)
"LCDTest" = Packard Bell LCD Test
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Messenger Plus!" = Messenger Plus! 5
"METABOLI" = Metaboli
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.25)" = Mozilla Firefox (3.6.25)
"Music Editor Free" = Music Editor Free
"NIS2007_DE" = NIS2007
"OFFICE Ready" = OFFICE Ready
"Opera 11.60.1185" = Opera 11.60
"PhotoScape" = PhotoScape
"PHPNukeDE Toolbar" = PHPNukeDE Toolbar
"Picasa 3" = Picasa 3
"Picasa2" = Picasa2
"PowerCinema5" = Power Cinema 5
"PROHYBRIDR" = 2007 Microsoft Office system
"SearchTheWebARP" = SearchTheWeb
"SETUPMYPC_DE" = SetUp My PC
"Shockwave" = Shockwave player 10
"Simfy" = simfy
"SKYPE" = Skype 2.5.2.151
"Skype_is1" = Packard Bell - Skype 2.5
"SymSetup.{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security (Symantec Corporation)
"Synthesia" = Synthesia (remove only)
"Uninstall_is1" = Uninstall 1.0.0.1
"Updator" = Packard Bell Updator
"VIDEO_RIO" = Video ATI v8.332
"ViewpointMediaPlayer" = Viewpoint Media Player
"WinLiveSuite_Wave3" = Windows Live Essentials
"X10Hardware" = X10 Hardware(TM)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Resetting to Probing: 4 Karout-PC.local.
Addr 192.168.0.100
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.0.103:5353 4 Karout-PC.local.
Addr 192.168.0.103
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Resetting to Probing: 16 Karout-PC.local.
AAAA FE80:0000:0000:0000:D42D:39DF:93C7:6C6D
Error - 21.03.2012 12:52:22 | Computer Name = Karout-PC | Source = Perflib | ID = 1010
Description =
Error - 21.03.2012 12:52:28 | Computer Name = Karout-PC | Source = Perflib | ID = 1008
Description =
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.0.103:5353 4 Karout-PC.local.
Addr 192.168.0.103
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 Karout-PC.local.
Addr 192.168.0.100
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = Local Hostname Karout-PC.local already in use; will try Karout-PC-2.local
instead
Error - 23.03.2012 08:39:30 | Computer Name = Karout-PC | Source = Perflib | ID = 1010
Description =
Error - 23.03.2012 08:39:50 | Computer Name = Karout-PC | Source = Perflib | ID = 1008
Description =
[ OSession Events ]
Error - 13.07.2011 13:19:39 | Computer Name = Karout-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3604
seconds with 1200 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 25.03.2012 07:51:51 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
Error - 25.03.2012 07:51:51 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
< End of report >
|
|
25.03.2012, 17:21
| #5 |
| /// Malware-holic | TR/Crypt.XPACK.Gen' [trojan] lade unhide: Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren. Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
25.03.2012, 17:45
| #6 |
| | TR/Crypt.XPACK.Gen' [trojan] 1. Habe mir unhide heruntergeladen und habe es gestartet. Da steht gerade folgendes: Code:
ATTFilter Program started at 03/25/2012 06:26:53 PM
......................appdata doesn't exist! Unhide Terminated!
Code:
ATTFilter There was a problem retrieving a necessary environment variable.
Unhide has terminated!
2. Habe keinen Download-Link zum ComboFix gefunden. |
|
25.03.2012, 17:49
| #7 |
| /// Malware-holic | TR/Crypt.XPACK.Gen' [trojan] im tutorial stehen 2 links, bitte lesen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
25.03.2012, 17:56
| #8 |
| | TR/Crypt.XPACK.Gen' [trojan] Okay habs gefunden. Was muss ich mit dem Unhide jetzt machen? Kann ich eigentlich den ComboFix schon ausführen? |
|
27.03.2012, 15:27
| #9 |
| | TR/Crypt.XPACK.Gen' [trojan] Sorry, gibt es aber noch ne Lösung dafür? |
|
27.03.2012, 16:20
| #10 |
| /// Malware-holic | TR/Crypt.XPACK.Gen' [trojan] na ich warte auf das combofix log.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
30.03.2012, 15:18
| #11 |
| | TR/Crypt.XPACK.Gen' [trojan] Heute habe ich mal Zeit das ComboFix durchzuführen: Code:
ATTFilter ComboFix 12-03-22.01 - SYSTEM 30.03.2012 15:58:14.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.49.1031.18.1279.717 [GMT 2:00]
ausgeführt von:: C:\Users\Karout\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
- REDUZIERTER FUNKTIONALITÄTSMODUS -
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\AutocompletePro
C:\Program Files\AutocompletePro\AcRemoteUpdate.exe
C:\Program Files\AutocompletePro\AutocompletePro.dll
C:\Program Files\AutocompletePro\InstTracker.exe
C:\Program Files\AutocompletePro\support@predictad.com\chrome.manifest
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.js
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.xul
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\utils.js
C:\Program Files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
C:\Program Files\AutocompletePro\support@predictad.com\install.rdf
C:\Program Files\AutocompletePro\TaskScheduler.dll
C:\Program Files\AutocompletePro\unins000.dat
C:\Program Files\AutocompletePro\unins000.exe
C:\Windows\system32\AutoRun.inf
((((((((((((((((((((((( Dateien erstellt von 2012-02-28 bis 2012-03-30 ))))))))))))))))))))))))))))))
2012-03-30 13:12:08 . 2012-03-30 13:12:08 -------- d-----w- C:\Users\Karout\AppData\Roaming\Simfy
2012-03-29 15:58:39 . 2012-03-29 15:58:39 -------- d-----w- C:\Users\Karout\AppData\Local\Mozilla
2012-03-29 15:58:05 . 2012-03-29 15:58:09 -------- d-----w- C:\Users\Karout\AppData\Local\Mozilla Firefox
2012-03-28 18:01:25 . 2012-03-28 18:01:25 -------- d--h--w- C:\ProgramData\CanonBJ
2012-03-28 17:14:08 . 2012-03-28 17:14:08 -------- d-----w- C:\Users\Karout\AppData\Local\Apple
2012-03-25 12:58:40 . 2012-03-25 13:16:58 -------- d-----w- C:\Users\Karout\AppData\Roaming\Skype
2012-03-25 12:58:19 . 2012-03-28 17:33:11 -------- d-----w- C:\Users\Karout\AppData\Local\Adobe
2012-03-25 11:53:09 . 2012-03-25 11:53:09 -------- d-----w- C:\Users\Karout\AppData\Local\HP
2012-03-25 11:50:55 . 2012-03-25 11:50:55 -------- d-----w- C:\Users\Karout\AppData\Roaming\HP
2012-03-25 11:46:03 . 2012-03-25 11:46:03 -------- d-----w- C:\Users\Karout\AppData\Local\Opera
2012-03-25 11:45:24 . 2012-03-25 11:45:24 -------- d-----w- C:\Users\Karout\AppData\Roaming\Avira
2012-03-25 11:45:20 . 2012-03-25 11:45:20 -------- d-----w- C:\Users\Karout\AppData\Roaming\ATI
2012-03-25 11:45:20 . 2012-03-25 11:45:20 -------- d-----w- C:\Users\Karout\AppData\Local\ATI
2012-03-25 11:44:54 . 2012-03-25 11:44:57 -------- d-----w- C:\ProgramData\Messenger Plus!
2012-03-25 11:44:40 . 2012-03-25 11:44:43 -------- d-----w- C:\Users\Karout\AppData\Roaming\Apple Computer
2012-03-23 13:33:50 . 2012-03-23 13:33:50 704512 ------w- C:\Windows\system32\jpgm0109.dll
2012-03-23 13:33:50 . 2012-03-23 13:33:50 464384 ----a-w- C:\Windows\system32\ntqjxeh5.sys
2012-03-23 13:01:25 . 2012-03-14 02:15:38 6582328 ------w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{888AD71F-8F0B-46B3-B72C-89B0CB86DC46}\mpengine.dll
2012-03-19 15:17:18 . 2012-03-19 15:17:23 -------- d-----w- C:\Program Files\simfy
2012-03-14 15:19:38 . 2012-02-02 15:16:25 2044416 ----a-w- C:\Windows\system32\win32k.sys
2012-03-14 15:19:33 . 2012-02-14 15:45:30 219648 ----a-w- C:\Windows\system32\d3d10_1core.dll
2012-03-14 15:19:33 . 2012-02-13 13:44:40 1068544 ----a-w- C:\Windows\system32\DWrite.dll
2012-03-14 15:19:32 . 2012-02-14 15:45:30 160768 ----a-w- C:\Windows\system32\d3d10_1.dll
2012-03-14 15:19:32 . 2012-02-13 14:12:08 1172480 ----a-w- C:\Windows\system32\d3d10warp.dll
2012-03-14 15:19:32 . 2012-02-13 13:47:57 683008 ----a-w- C:\Windows\system32\d2d1.dll
2012-03-14 15:19:27 . 2012-01-31 10:59:56 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2012-03-14 15:18:19 . 2012-01-09 15:54:08 613376 ----a-w- C:\Windows\system32\rdpencom.dll
2012-03-14 15:18:19 . 2012-01-09 13:58:29 180736 ----a-w- C:\Windows\system32\drivers\rdpwd.sys
2012-03-08 15:11:36 . 2012-03-08 15:11:36 -------- d-----w- C:\Program Files\Kingsoft
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
2012-03-23 12:37:47 . 2011-12-26 11:02:14 221184 ----a-w- C:\Windows\system32\aptwdhlrc.dll
2012-02-23 07:18:36 . 2011-02-24 16:13:08 237072 ------w- C:\Windows\system32\MpSigStub.exe
2012-01-11 13:34:23 . 2012-01-11 13:34:23 614400 ------w- C:\Windows\system32\pngjmhgf.dll
2011-02-22 19:31:14 . 2011-02-22 19:31:17 119808 ----a-w- C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 14:02:22 3863136 ----a-w- C:\Program Files\ConduitEngine\ConduitEngine.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
2011-01-26 15:52:08 101096 ----a-w- C:\Program Files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54:02 175912 ----a-w- C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c9508125-4747-4733-b048-e4b82dc9716d}]
2010-09-12 14:02:22 3863136 ----a-w- C:\Program Files\PHPNukeDE\tbPHPN.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c9508125-4747-4733-b048-e4b82dc9716d}"= "C:\Program Files\PHPNukeDE\tbPHPN.dll" [2010-09-12 14:02:22 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "C:\Program Files\ConduitEngine\ConduitEngine.dll" [2010-09-12 14:02:22 3863136]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-01-17 14:54:02 175912]
[HKEY_CLASSES_ROOT\clsid\{c9508125-4747-4733-b048-e4b82dc9716d}]
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 09:57:52 3784704]
"InstallProcess"="c:\oem\process\process.cmd" [2007-02-01 15:25:36 16183]
"HostManager"="C:\Program Files\Common Files\AOL\1298400348\ee\AOLSoftware.exe" [2006-11-14 13:47:54 50736]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 10:40:22 232184]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-02-22 19:31:14 30192]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-24 21:08:40 107112]
"IS CfgWiz"="C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2006-10-24 07:19:18 46728]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-26 23:18:38 22696]
"PCMService"="c:\Program Files\Powercinema\PCMService.exe" [2007-02-14 19:45:48 159744]
"VX1000"="C:\Windows\vVX1000.exe" [2010-05-20 13:27:24 762736]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 13:22:55 281768]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 10:44:46 248552]
"Iminent.Notifier"="C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe" [2011-01-26 15:52:14 1863168]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 13:27:24 119152]
"PlusService"="C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-10-24 15:51:19 801792]
"NetFxUpdate_v1.1.4322"="C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 15:20:00 106496]
"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 22:25:58 59240]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 19:34:40 49152]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
--- Andere Dienste/Treiber im Speicher ---
*NewlyCreated* - COMHOST
*Deregistered* - ntqjxeh5
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
Update-Service-Installer-Service REG_MULTI_SZ Update-Service-Installer-Service
Update-Service REG_MULTI_SZ Update-Service
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Inhalt des "geplante Tasks" Ordners
2012-03-30 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 15:10:00 . 2011-04-15 15:09:34]
2012-03-30 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 15:10:00 . 2011-04-15 15:09:34]
2012-03-30 C:\Windows\Tasks\WpsUpdateTask_Nadine.job
- C:\Program Files\Kingsoft\Kingsoft Writer\office6\wpsupdate.exe [2011-08-24 16:00:00 . 2011-08-24 16:00:00]
------- Zusätzlicher Suchlauf -------
mStart Page = hxxp://home.sweetim.com
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath -
- - - - Entfernte verwaiste Registrierungseinträge - - - -
BHO-{E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll
HKLM_ActiveSetup-ccc-core-static - msiexec
AddRemove-Activation Assistant for the 2007 Microsoft Office suites - C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe
AddRemove-AutocompletePro2_is1 - C:\Program Files\AutocompletePro\unins000.exe
|
|
30.03.2012, 18:25
| #12 |
| /// Malware-holic | TR/Crypt.XPACK.Gen' [trojan] ist das das ganze log, bitte mal als txt anhängen
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
30.03.2012, 18:33
| #13 |
| | TR/Crypt.XPACK.Gen' [trojan] Auf C:/ war dieses ComboFix.txt nicht drin. Habe sie als C:/ComboFix/ComboFix.txt gefunden. -> Was mit noch eingefallen ist: Als ich ComboFix gestartet habe, hat es mir angezeigt, dass ComboFix abgelaufen ist. Man konnte es aber in "reduzierter Funktionalität" auszuführen. Geändert von 3Kay (30.03.2012 um 18:44 Uhr) Grund: Zusatz |
|
31.03.2012, 19:26
| #14 |
| /// Malware-holic | TR/Crypt.XPACK.Gen' [trojan] tdss killer nutzen, log bitte posten: http://www.trojaner-board.de/82358-t...entfernen.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
31.03.2012, 19:54
| #15 |
| | TR/Crypt.XPACK.Gen' [trojan]Code:
ATTFilter 20:50:26.0749 50888 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
20:50:26.0921 50888 ============================================================
20:50:26.0921 50888 Current date / time: 2012/03/31 20:50:26.0921
20:50:26.0921 50888 SystemInfo:
20:50:26.0921 50888
20:50:26.0921 50888 OS Version: 6.0.6002 ServicePack: 2.0
20:50:26.0921 50888 Product type: Workstation
20:50:26.0921 50888 ComputerName: KAROUT-PC
20:50:26.0921 50888 UserName: Nadine
20:50:26.0921 50888 Windows directory: C:\Windows
20:50:26.0921 50888 System windows directory: C:\Windows
20:50:26.0921 50888 Processor architecture: Intel x86
20:50:26.0921 50888 Number of processors: 1
20:50:26.0921 50888 Page size: 0x1000
20:50:26.0921 50888 Boot type: Normal boot
20:50:26.0921 50888 ============================================================
20:50:28.0452 50888 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:50:28.0530 50888 \Device\Harddisk0\DR0:
20:50:28.0546 50888 MBR used
20:50:28.0546 50888 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1000000
20:50:28.0561 50888 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1000800, BlocksNum 0x11A18EB0
20:50:28.0593 50888 Initialize success
20:50:28.0593 50888 ============================================================
20:50:30.0968 61212 ============================================================
20:50:30.0968 61212 Scan started
20:50:30.0968 61212 Mode: Manual;
20:50:30.0968 61212 ============================================================
20:50:32.0233 61212 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
20:50:32.0249 61212 ACPI - ok
20:50:32.0405 61212 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:50:32.0499 61212 adp94xx - ok
20:50:32.0608 61212 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:50:32.0640 61212 adpahci - ok
20:50:32.0780 61212 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:50:32.0811 61212 adpu160m - ok
20:50:32.0936 61212 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:50:32.0968 61212 adpu320 - ok
20:50:33.0077 61212 AeLookupSvc (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:50:33.0093 61212 AeLookupSvc - ok
20:50:33.0233 61212 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
20:50:33.0249 61212 AFD - ok
20:50:33.0358 61212 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:50:33.0374 61212 agp440 - ok
20:50:33.0483 61212 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:50:33.0515 61212 aic78xx - ok
20:50:33.0624 61212 ALG (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
20:50:33.0640 61212 ALG - ok
20:50:33.0827 61212 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
20:50:33.0858 61212 aliide - ok
20:50:33.0983 61212 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:50:34.0015 61212 amdagp - ok
20:50:34.0155 61212 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
20:50:34.0171 61212 amdide - ok
20:50:34.0436 61212 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:50:34.0499 61212 AmdK7 - ok
20:50:34.0702 61212 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
20:50:34.0718 61212 AmdK8 - ok
20:50:34.0952 61212 AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:50:34.0968 61212 AntiVirSchedulerService - ok
20:50:35.0155 61212 AntiVirService (72d90e56563165984224493069c69ed4) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:50:35.0218 61212 AntiVirService - ok
20:50:35.0436 61212 AOL ACS (85180cf88c5ebad73b452a43a004ca51) C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
20:50:35.0515 61212 AOL ACS - ok
20:50:35.0655 61212 Appinfo (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
20:50:35.0686 61212 Appinfo - ok
20:50:35.0936 61212 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:50:35.0968 61212 arc - ok
20:50:36.0077 61212 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:50:36.0108 61212 arcsas - ok
20:50:36.0280 61212 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
20:50:36.0296 61212 AsyncMac - ok
20:50:36.0515 61212 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
20:50:36.0515 61212 atapi - ok
20:50:36.0655 61212 Ati External Event Utility (b488fc27338b83c9fc91d684467eeb7e) C:\Windows\system32\Ati2evxx.exe
20:50:36.0686 61212 Ati External Event Utility - ok
20:50:36.0921 61212 AtiPcie (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
20:50:36.0936 61212 AtiPcie - ok
20:50:37.0171 61212 AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:50:37.0186 61212 AudioEndpointBuilder - ok
20:50:37.0296 61212 Audiosrv (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:50:37.0296 61212 Audiosrv - ok
20:50:37.0483 61212 Automatisches LiveUpdate - Scheduler (018fe8992fe4d70b69ae866ea0d83f0d) C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
20:50:37.0530 61212 Automatisches LiveUpdate - Scheduler - ok
20:50:37.0718 61212 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
20:50:37.0749 61212 avgntflt - ok
20:50:37.0968 61212 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
20:50:37.0999 61212 avipbb - ok
20:50:38.0296 61212 BBSvc (0d1ea7509f394d8b705b239ee71f5118) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
20:50:38.0327 61212 BBSvc - ok
20:50:38.0468 61212 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
20:50:38.0515 61212 BcmSqlStartupSvc - ok
20:50:38.0702 61212 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
20:50:38.0718 61212 Beep - ok
20:50:39.0046 61212 BFE (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll
20:50:39.0061 61212 BFE - ok
20:50:39.0296 61212 BITS (93952506c6d67330367f7e7934b6a02f) C:\Windows\system32\qmgr.dll
20:50:39.0327 61212 BITS - ok
20:50:39.0483 61212 blbdrive - ok
20:50:39.0655 61212 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
20:50:39.0702 61212 Bonjour Service - ok
20:50:39.0874 61212 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
20:50:39.0890 61212 bowser - ok
20:50:40.0015 61212 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:50:40.0046 61212 BrFiltLo - ok
20:50:40.0280 61212 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:50:40.0327 61212 BrFiltUp - ok
20:50:40.0546 61212 Browser (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
20:50:40.0546 61212 Browser - ok
20:50:40.0671 61212 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:50:40.0702 61212 Brserid - ok
20:50:40.0890 61212 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:50:40.0936 61212 BrSerWdm - ok
20:50:41.0108 61212 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:50:41.0140 61212 BrUsbMdm - ok
20:50:41.0358 61212 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:50:41.0421 61212 BrUsbSer - ok
20:50:41.0515 61212 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:50:41.0546 61212 BTHMODEM - ok
20:50:41.0640 61212 catchme - ok
20:50:41.0811 61212 ccEvtMgr (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:41.0843 61212 ccEvtMgr - ok
20:50:41.0905 61212 ccSetMgr (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:41.0905 61212 ccSetMgr - ok
20:50:42.0077 61212 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
20:50:42.0093 61212 cdfs - ok
20:50:42.0233 61212 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
20:50:42.0265 61212 cdrom - ok
20:50:42.0436 61212 CertPropSvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:50:42.0436 61212 CertPropSvc - ok
20:50:42.0561 61212 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
20:50:42.0593 61212 circlass - ok
20:50:42.0905 61212 CLCapSvc (cd6d23e3adf57035c30b53843f21a416) c:\Program Files\Powercinema\Kernel\TV\CLCapSvc.exe
20:50:42.0983 61212 CLCapSvc - ok
20:50:43.0140 61212 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
20:50:43.0155 61212 CLFS - ok
20:50:43.0311 61212 clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:50:43.0358 61212 clr_optimization_v2.0.50727_32 - ok
20:50:43.0530 61212 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:50:43.0546 61212 clr_optimization_v4.0.30319_32 - ok
20:50:43.0765 61212 CLSched (4fa0b771df428de79ce96108e5370841) c:\Program Files\Powercinema\Kernel\TV\CLSched.exe
20:50:43.0811 61212 CLSched - ok
20:50:43.0968 61212 CLTNetCnService (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:43.0968 61212 CLTNetCnService - ok
20:50:44.0108 61212 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
20:50:44.0140 61212 cmdide - ok
20:50:44.0327 61212 comHost (7ce352882828c12dd7632b172253a02c) C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
20:50:44.0358 61212 comHost - ok
20:50:44.0499 61212 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
20:50:44.0546 61212 Compbatt - ok
20:50:44.0655 61212 COMSysApp - ok
20:50:44.0827 61212 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:50:44.0858 61212 crcdisk - ok
20:50:45.0061 61212 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:50:45.0077 61212 Crusoe - ok
20:50:45.0358 61212 CryptSvc (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll
20:50:45.0374 61212 CryptSvc - ok
20:50:45.0640 61212 DcomLaunch (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:50:45.0671 61212 DcomLaunch - ok
20:50:45.0811 61212 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
20:50:45.0858 61212 DfsC - ok
20:50:46.0311 61212 DFSR (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
20:50:46.0530 61212 DFSR - ok
20:50:46.0686 61212 Dhcp (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
20:50:46.0702 61212 Dhcp - ok
20:50:46.0874 61212 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
20:50:46.0936 61212 disk - ok
20:50:47.0140 61212 Dnscache (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
20:50:47.0155 61212 Dnscache - ok
20:50:47.0327 61212 dot3svc (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
20:50:47.0327 61212 dot3svc - ok
20:50:47.0483 61212 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
20:50:47.0561 61212 Dot4 - ok
20:50:47.0686 61212 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
20:50:47.0702 61212 Dot4Print - ok
20:50:48.0015 61212 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
20:50:48.0046 61212 dot4usb - ok
20:50:48.0218 61212 DPS (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
20:50:48.0218 61212 DPS - ok
20:50:48.0530 61212 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
20:50:48.0546 61212 drmkaud - ok
20:50:48.0765 61212 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
20:50:48.0780 61212 DXGKrnl - ok
20:50:48.0874 61212 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:50:48.0905 61212 E1G60 - ok
20:50:48.0999 61212 EapHost (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
20:50:48.0999 61212 EapHost - ok
20:50:49.0171 61212 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
20:50:49.0218 61212 Ecache - ok
20:50:49.0452 61212 eeCtrl (fb069d8270853023f6e315745b5bbad4) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
20:50:49.0515 61212 eeCtrl - ok
20:50:49.0796 61212 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:50:49.0858 61212 elxstor - ok
20:50:50.0061 61212 EMDMgmt (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
20:50:50.0077 61212 EMDMgmt - ok
20:50:50.0452 61212 EventSystem (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
20:50:50.0468 61212 EventSystem - ok
20:50:50.0765 61212 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
20:50:50.0796 61212 exfat - ok
20:50:50.0936 61212 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
20:50:50.0968 61212 fastfat - ok
20:50:51.0061 61212 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:50:51.0077 61212 fdc - ok
20:50:51.0265 61212 fdPHost (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
20:50:51.0280 61212 fdPHost - ok
20:50:51.0405 61212 FDResPub (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:50:51.0405 61212 FDResPub - ok
20:50:51.0499 61212 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
20:50:51.0530 61212 FileInfo - ok
20:50:51.0640 61212 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
20:50:51.0655 61212 Filetrace - ok
20:50:51.0765 61212 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:50:51.0780 61212 flpydisk - ok
20:50:51.0890 61212 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
20:50:51.0905 61212 FltMgr - ok
20:50:52.0061 61212 FontCache (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
20:50:52.0093 61212 FontCache - ok
20:50:52.0218 61212 FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:50:52.0233 61212 FontCache3.0.0.0 - ok
20:50:52.0343 61212 fssfltr (491e9d9a26a745f6ae7d570849f4bd87) C:\Windows\system32\DRIVERS\fssfltr.sys
20:50:52.0343 61212 fssfltr - ok
20:50:52.0530 61212 fsssvc (45b52394f9624237f33a8a3d73c0b221) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
20:50:52.0624 61212 fsssvc - ok
20:50:52.0733 61212 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
20:50:52.0749 61212 Fs_Rec - ok
20:50:52.0827 61212 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:50:52.0858 61212 gagp30kx - ok
20:50:53.0015 61212 GoogleDesktopManager-051210-111108 (9f5f2f0fb0a7f5aa9f16b9a7b6dad89f) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
20:50:53.0015 61212 GoogleDesktopManager-051210-111108 - ok
20:50:53.0140 61212 gpsvc (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
20:50:53.0155 61212 gpsvc - ok
20:50:53.0358 61212 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
20:50:53.0358 61212 gupdate - ok
20:50:53.0468 61212 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
20:50:53.0468 61212 gupdatem - ok
20:50:53.0686 61212 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
20:50:53.0733 61212 gusvc - ok
20:50:53.0921 61212 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:50:53.0936 61212 HDAudBus - ok
20:50:54.0124 61212 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:50:54.0140 61212 HidBth - ok
20:50:54.0405 61212 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:50:54.0468 61212 HidIr - ok
20:50:54.0733 61212 hidserv (84067081f3318162797385e11a8f0582) C:\Windows\System32\hidserv.dll
20:50:54.0749 61212 hidserv - ok
20:50:54.0952 61212 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
20:50:54.0968 61212 HidUsb - ok
20:50:55.0155 61212 hkmsvc (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
20:50:55.0155 61212 hkmsvc - ok
20:50:55.0530 61212 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:50:55.0546 61212 HpCISSs - ok
20:50:55.0765 61212 hpqcxs08 (38d6b51f04def7fb248fa56e4c47407e) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
20:50:55.0780 61212 hpqcxs08 - ok
20:50:55.0999 61212 hpqddsvc (3ee4a63539ec04ee2d4bd293985087ab) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
20:50:55.0999 61212 hpqddsvc - ok
20:50:56.0530 61212 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
20:50:56.0608 61212 HTTP - ok
20:50:56.0749 61212 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:50:56.0796 61212 i2omp - ok
20:50:56.0952 61212 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
20:50:56.0999 61212 i8042prt - ok
20:50:57.0327 61212 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:50:57.0374 61212 iaStorV - ok
20:50:57.0530 61212 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
20:50:57.0561 61212 IDriverT - ok
20:50:57.0952 61212 idsvc (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:50:58.0108 61212 idsvc - ok
20:50:58.0218 61212 IDSvix86 - ok
20:50:58.0561 61212 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:50:58.0577 61212 iirsp - ok
20:50:58.0874 61212 IKEEXT (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
20:50:58.0921 61212 IKEEXT - ok
20:50:59.0546 61212 IntcAzAudAddService (a47b2875680ad67b35c6150bd0203056) C:\Windows\system32\drivers\RTKVHDA.sys
20:50:59.0671 61212 IntcAzAudAddService - ok
20:51:00.0093 61212 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
20:51:00.0108 61212 intelide - ok
20:51:00.0436 61212 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
20:51:00.0436 61212 intelppm - ok
20:51:00.0624 61212 IPBusEnum (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
20:51:00.0640 61212 IPBusEnum - ok
20:51:00.0905 61212 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:51:00.0952 61212 IpFilterDriver - ok
20:51:01.0233 61212 iphlpsvc (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll
20:51:01.0265 61212 iphlpsvc - ok
20:51:01.0452 61212 IpInIp - ok
20:51:01.0577 61212 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:51:01.0593 61212 IPMIDRV - ok
20:51:01.0718 61212 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
20:51:01.0749 61212 IPNAT - ok
20:51:01.0936 61212 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
20:51:01.0983 61212 IRENUM - ok
20:51:02.0093 61212 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:51:02.0155 61212 isapnp - ok
20:51:02.0311 61212 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
20:51:02.0311 61212 iScsiPrt - ok
20:51:02.0749 61212 ISPwdSvc (36474fde02f8422b8b1a52ead9894dbc) C:\Program Files\Norton Internet Security\isPwdSvc.exe
20:51:02.0765 61212 ISPwdSvc - ok
20:51:02.0858 61212 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:51:02.0874 61212 iteatapi - ok
20:51:03.0061 61212 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:51:03.0093 61212 iteraid - ok
20:51:03.0233 61212 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:51:03.0280 61212 kbdclass - ok
20:51:03.0405 61212 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
20:51:03.0436 61212 kbdhid - ok
20:51:03.0546 61212 KeyIso (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:03.0546 61212 KeyIso - ok
20:51:03.0655 61212 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
20:51:03.0733 61212 KSecDD - ok
20:51:03.0843 61212 KtmRm (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
20:51:03.0858 61212 KtmRm - ok
20:51:03.0968 61212 LanmanServer (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\System32\srvsvc.dll
20:51:03.0983 61212 LanmanServer - ok
20:51:04.0093 61212 LanmanWorkstation (534d0e286fbcdf35b5d5933f0fb03132) C:\Windows\System32\aptwdhlrc.dll
20:51:04.0108 61212 LanmanWorkstation - ok
20:51:04.0265 61212 LiveUpdate (3c7fcbbc35e0a52ce9b12e9cc4f5b991) C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
20:51:04.0421 61212 LiveUpdate - ok
20:51:04.0546 61212 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
20:51:04.0561 61212 lltdio - ok
20:51:04.0671 61212 lltdsvc (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
20:51:04.0702 61212 lltdsvc - ok
20:51:04.0796 61212 lmhosts (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:51:04.0796 61212 lmhosts - ok
20:51:04.0936 61212 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:51:04.0968 61212 LSI_FC - ok
20:51:05.0218 61212 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:51:05.0265 61212 LSI_SAS - ok
20:51:05.0358 61212 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:51:05.0374 61212 LSI_SCSI - ok
20:51:05.0530 61212 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
20:51:05.0546 61212 luafv - ok
20:51:05.0733 61212 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:51:05.0780 61212 megasas - ok
20:51:05.0952 61212 MMCSS (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:51:05.0952 61212 MMCSS - ok
20:51:06.0186 61212 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
20:51:06.0233 61212 Modem - ok
20:51:06.0499 61212 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
20:51:06.0499 61212 monitor - ok
20:51:06.0796 61212 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
20:51:06.0874 61212 mouclass - ok
20:51:07.0296 61212 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
20:51:07.0327 61212 mouhid - ok
20:51:07.0593 61212 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
20:51:07.0640 61212 MountMgr - ok
20:51:07.0843 61212 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:51:07.0890 61212 mpio - ok
20:51:08.0140 61212 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
20:51:08.0202 61212 mpsdrv - ok
20:51:08.0499 61212 MpsSvc (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll
20:51:08.0530 61212 MpsSvc - ok
20:51:08.0733 61212 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:51:08.0780 61212 Mraid35x - ok
20:51:09.0155 61212 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
20:51:09.0186 61212 MRxDAV - ok
20:51:09.0421 61212 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:51:09.0452 61212 mrxsmb - ok
20:51:09.0624 61212 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:51:09.0686 61212 mrxsmb10 - ok
20:51:09.0827 61212 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:51:09.0858 61212 mrxsmb20 - ok
20:51:10.0030 61212 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
20:51:10.0046 61212 msahci - ok
20:51:10.0186 61212 MSCamSvc (d98350792a7ce82e7459a7c36481beda) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
20:51:10.0233 61212 MSCamSvc - ok
20:51:10.0405 61212 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:51:10.0436 61212 msdsm - ok
20:51:10.0546 61212 MSDTC (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
20:51:10.0593 61212 MSDTC - ok
20:51:10.0733 61212 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
20:51:10.0749 61212 Msfs - ok
20:51:10.0905 61212 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
20:51:10.0983 61212 msisadrv - ok
20:51:11.0108 61212 MSiSCSI (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
20:51:11.0171 61212 MSiSCSI - ok
20:51:11.0374 61212 msiserver - ok
20:51:11.0530 61212 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
20:51:11.0561 61212 MSKSSRV - ok
20:51:11.0733 61212 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
20:51:11.0733 61212 MSPCLOCK - ok
20:51:11.0952 61212 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
20:51:12.0030 61212 MSPQM - ok
20:51:12.0343 61212 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
20:51:12.0421 61212 MsRPC - ok
20:51:12.0686 61212 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
20:51:12.0702 61212 mssmbios - ok
20:51:13.0015 61212 MSSQL$MSSMLBIZ - ok
20:51:13.0186 61212 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
20:51:13.0218 61212 MSSQLServerADHelper - ok
20:51:13.0515 61212 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
20:51:13.0515 61212 MSTEE - ok
20:51:13.0640 61212 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
20:51:13.0655 61212 Mup - ok
20:51:13.0827 61212 napagent (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
20:51:13.0843 61212 napagent - ok
20:51:14.0061 61212 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
20:51:14.0124 61212 NativeWifiP - ok
20:51:14.0343 61212 NAVENG - ok
20:51:14.0530 61212 NAVEX15 - ok
20:51:14.0780 61212 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
20:51:14.0796 61212 NDIS - ok
20:51:15.0077 61212 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
20:51:15.0202 61212 NdisTapi - ok
20:51:15.0327 61212 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
20:51:15.0374 61212 Ndisuio - ok
20:51:15.0577 61212 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
20:51:15.0624 61212 NdisWan - ok
20:51:15.0749 61212 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
20:51:15.0780 61212 NDProxy - ok
20:51:15.0921 61212 Net Driver HPZ12 (51c6d8bfbd4ea5b62a1ba7f4469250d3) C:\Windows\system32\HPZinw12.dll
20:51:15.0952 61212 Net Driver HPZ12 - ok
20:51:16.0108 61212 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
20:51:16.0155 61212 NetBIOS - ok
20:51:16.0577 61212 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
20:51:16.0671 61212 netbt - ok
20:51:16.0811 61212 Netlogon (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:16.0811 61212 Netlogon - ok
20:51:16.0999 61212 Netman (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
20:51:17.0030 61212 Netman - ok
20:51:17.0140 61212 netprofm (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
20:51:17.0140 61212 netprofm - ok
20:51:17.0265 61212 NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:51:17.0296 61212 NetTcpPortSharing - ok
20:51:17.0390 61212 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:51:17.0405 61212 nfrd960 - ok
20:51:17.0530 61212 NlaSvc (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
20:51:17.0546 61212 NlaSvc - ok
20:51:17.0655 61212 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
20:51:17.0671 61212 Npfs - ok
20:51:17.0780 61212 nsi (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
20:51:17.0780 61212 nsi - ok
20:51:17.0890 61212 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
20:51:17.0905 61212 nsiproxy - ok
20:51:18.0077 61212 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
20:51:18.0171 61212 Ntfs - ok
20:51:18.0374 61212 ntqjxeh5 (df37d15f5638882b823e4070b80533d3) C:\Windows\system32\ntqjxeh5.sys
20:51:18.0452 61212 ntqjxeh5 - ok
20:51:18.0530 61212 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:51:18.0546 61212 ntrigdigi - ok
20:51:18.0671 61212 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
20:51:18.0686 61212 Null - ok
20:51:18.0796 61212 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
20:51:18.0811 61212 nvraid - ok
20:51:18.0890 61212 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
20:51:18.0905 61212 nvstor - ok
20:51:18.0999 61212 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:51:19.0015 61212 nv_agp - ok
20:51:19.0093 61212 NwlnkFlt - ok
20:51:19.0155 61212 NwlnkFwd - ok
20:51:19.0249 61212 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:51:19.0311 61212 odserv - ok
20:51:19.0421 61212 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
20:51:19.0421 61212 ohci1394 - ok
20:51:19.0515 61212 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:51:19.0546 61212 ose - ok
20:51:19.0671 61212 p2pimsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:19.0702 61212 p2pimsvc - ok
20:51:19.0765 61212 p2psvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:19.0780 61212 p2psvc - ok
20:51:19.0905 61212 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:51:19.0936 61212 Parport - ok
20:51:20.0390 61212 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
20:51:20.0452 61212 partmgr - ok
20:51:20.0655 61212 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:51:20.0702 61212 Parvdm - ok
20:51:21.0061 61212 PcaSvc (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
20:51:21.0077 61212 PcaSvc - ok
20:51:21.0468 61212 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
20:51:21.0499 61212 pci - ok
20:51:21.0702 61212 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
20:51:21.0749 61212 pciide - ok
20:51:21.0968 61212 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
20:51:22.0015 61212 pcmcia - ok
20:51:22.0280 61212 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:51:22.0452 61212 PEAUTH - ok
20:51:22.0733 61212 pla (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
20:51:22.0796 61212 pla - ok
20:51:23.0061 61212 PlugPlay (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
20:51:23.0077 61212 PlugPlay - ok
20:51:23.0202 61212 Pml Driver HPZ12 (79834aa2fbf9fe81eebb229024f6f7fc) C:\Windows\system32\HPZipm12.dll
20:51:23.0202 61212 Pml Driver HPZ12 - ok
20:51:23.0390 61212 PNRPAutoReg (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:23.0405 61212 PNRPAutoReg - ok
20:51:23.0499 61212 PNRPsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:23.0499 61212 PNRPsvc - ok
20:51:23.0765 61212 PolicyAgent (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
20:51:23.0811 61212 PolicyAgent - ok
20:51:24.0218 61212 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
20:51:24.0249 61212 PptpMiniport - ok
20:51:24.0358 61212 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:51:24.0390 61212 Processor - ok
20:51:24.0593 61212 ProfSvc (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
20:51:24.0593 61212 ProfSvc - ok
20:51:24.0843 61212 ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:24.0843 61212 ProtectedStorage - ok
20:51:25.0015 61212 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
20:51:25.0030 61212 PSched - ok
20:51:25.0327 61212 PxHelp20 (f7bb4e7a7c02ab4a2672937e124e306e) C:\Windows\system32\Drivers\PxHelp20.sys
20:51:25.0405 61212 PxHelp20 - ok
20:51:25.0765 61212 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:51:25.0905 61212 ql2300 - ok
20:51:26.0108 61212 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:51:26.0140 61212 ql40xx - ok
20:51:26.0390 61212 QWAVE (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
20:51:26.0452 61212 QWAVE - ok
20:51:26.0577 61212 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
20:51:26.0624 61212 QWAVEdrv - ok
20:51:27.0155 61212 R300 (e52b7a5010011c29063684cac1a6bbf0) C:\Windows\system32\DRIVERS\atikmdag.sys
20:51:27.0296 61212 R300 - ok
20:51:27.0452 61212 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
20:51:27.0468 61212 RasAcd - ok
20:51:27.0561 61212 RasAuto (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
20:51:27.0593 61212 RasAuto - ok
20:51:27.0811 61212 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:51:27.0843 61212 Rasl2tp - ok
20:51:28.0140 61212 RasMan (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll
20:51:28.0218 61212 RasMan - ok
20:51:28.0390 61212 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
20:51:28.0436 61212 RasPppoe - ok
20:51:28.0561 61212 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
20:51:28.0593 61212 RasSstp - ok
20:51:28.0874 61212 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
20:51:28.0936 61212 rdbss - ok
20:51:29.0499 61212 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:51:29.0546 61212 RDPCDD - ok
20:51:29.0952 61212 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:51:30.0046 61212 rdpdr - ok
20:51:30.0280 61212 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
20:51:30.0311 61212 RDPENCDD - ok
20:51:30.0640 61212 RDPWD (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
20:51:30.0702 61212 RDPWD - ok
20:51:30.0999 61212 RemoteAccess (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
20:51:31.0046 61212 RemoteAccess - ok
20:51:31.0405 61212 RemoteRegistry (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll
20:51:31.0436 61212 RemoteRegistry - ok
20:51:31.0686 61212 RoxMediaDB9 (9638e5820858593a12005c753b03ceae) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
20:51:31.0749 61212 RoxMediaDB9 - ok
20:51:32.0061 61212 RoxWatch9 (910fba95ee4f56449aa81315884c8efd) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
20:51:32.0093 61212 RoxWatch9 - ok
20:51:32.0265 61212 RpcLocator (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:51:32.0265 61212 RpcLocator - ok
20:51:32.0483 61212 RpcSs (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:51:32.0483 61212 RpcSs - ok
20:51:32.0671 61212 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
20:51:32.0733 61212 rspndr - ok
20:51:32.0952 61212 RTL8023xp (959ef612d2ccfdb6d9e443f8e3655013) C:\Windows\system32\DRIVERS\Rtnicxp.sys
20:51:32.0968 61212 RTL8023xp - ok
20:51:33.0155 61212 SamSs (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:33.0155 61212 SamSs - ok
20:51:33.0515 61212 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:51:33.0530 61212 sbp2port - ok
20:51:33.0749 61212 SCardSvr (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
20:51:33.0780 61212 SCardSvr - ok
20:51:33.0952 61212 Schedule (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
20:51:33.0999 61212 Schedule - ok
20:51:34.0233 61212 SCPolicySvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:51:34.0233 61212 SCPolicySvc - ok
20:51:34.0374 61212 SDRSVC (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
20:51:34.0405 61212 SDRSVC - ok
20:51:34.0624 61212 SeaPort (d358e077a0a05d9b12da22d137ee8464) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
20:51:34.0624 61212 SeaPort - ok
20:51:34.0733 61212 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:51:34.0749 61212 secdrv - ok
20:51:34.0905 61212 seclogon (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
20:51:34.0921 61212 seclogon - ok
20:51:35.0061 61212 SENS (a9bbab5759771e523f55563d6cbe140f) C:\Windows\system32\sens.dll
20:51:35.0077 61212 SENS - ok
20:51:35.0202 61212 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
20:51:35.0358 61212 Serenum - ok
20:51:35.0593 61212 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:51:35.0624 61212 Serial - ok
20:51:35.0733 61212 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
20:51:35.0749 61212 sermouse - ok
20:51:35.0983 61212 SessionEnv (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
20:51:36.0015 61212 SessionEnv - ok
20:51:36.0108 61212 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:51:36.0124 61212 sffdisk - ok
20:51:36.0327 61212 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:51:36.0343 61212 sffp_mmc - ok
20:51:36.0640 61212 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:51:36.0655 61212 sffp_sd - ok
20:51:36.0765 61212 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:51:36.0780 61212 sfloppy - ok
20:51:36.0936 61212 SharedAccess (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
20:51:36.0968 61212 SharedAccess - ok
20:51:37.0124 61212 ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
20:51:37.0171 61212 ShellHWDetection - ok
20:51:37.0265 61212 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:51:37.0311 61212 sisagp - ok
20:51:37.0405 61212 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:51:37.0421 61212 SiSRaid2 - ok
20:51:37.0546 61212 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:51:37.0593 61212 SiSRaid4 - ok
20:51:37.0780 61212 slsvc (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
20:51:37.0874 61212 slsvc - ok
20:51:38.0015 61212 SLUINotify (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
20:51:38.0061 61212 SLUINotify - ok
20:51:38.0171 61212 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
20:51:38.0202 61212 Smb - ok
20:51:38.0327 61212 SNMPTRAP (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:51:38.0343 61212 SNMPTRAP - ok
20:51:38.0546 61212 SPBBCDrv (905782bcf15b6e5af9905b77923c7fa2) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
20:51:38.0655 61212 SPBBCDrv - ok
20:51:38.0780 61212 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
20:51:38.0811 61212 spldr - ok
20:51:38.0921 61212 Spooler (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
20:51:38.0936 61212 Spooler - ok
20:51:39.0046 61212 SQLBrowser (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
20:51:39.0093 61212 SQLBrowser - ok
20:51:39.0202 61212 SQLWriter (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
20:51:39.0202 61212 SQLWriter - ok
20:51:39.0327 61212 SRTSP (15e29eb26dd53eb6385629f4622b5519) C:\Windows\system32\Drivers\SRTSP.SYS
20:51:39.0390 61212 SRTSP - ok
20:51:39.0483 61212 SRTSPL (fd0c0333fae09dbd1170e0d607eca5c8) C:\Windows\system32\Drivers\SRTSPL.SYS
20:51:39.0530 61212 SRTSPL - ok
20:51:39.0655 61212 SRTSPX (7e60a4a4035be470f47c6806da57db99) C:\Windows\system32\Drivers\SRTSPX.SYS
20:51:39.0686 61212 SRTSPX - ok
20:51:39.0811 61212 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
20:51:39.0858 61212 srv - ok
20:51:39.0983 61212 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
20:51:39.0999 61212 srv2 - ok
20:51:40.0108 61212 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
20:51:40.0140 61212 srvnet - ok
20:51:40.0249 61212 SSDPSRV (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
20:51:40.0265 61212 SSDPSRV - ok
20:51:40.0343 61212 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:51:40.0374 61212 ssmdrv - ok
20:51:40.0483 61212 SstpSvc (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
20:51:40.0499 61212 SstpSvc - ok
20:51:40.0765 61212 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
20:51:40.0780 61212 StillCam - ok
20:51:40.0890 61212 stisvc (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
20:51:40.0905 61212 stisvc - ok
20:51:41.0030 61212 stllssvr (51778fd315c9882f1cbd932743e62a72) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
20:51:41.0046 61212 stllssvr - ok
20:51:41.0171 61212 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
20:51:41.0202 61212 swenum - ok
20:51:41.0452 61212 swprv (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
20:51:41.0483 61212 swprv - ok
20:51:41.0718 61212 Symantec Core LC (2698cd77f4d73ea7988f0bc63de8e3d6) C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
20:51:42.0077 61212 Symantec Core LC - ok
20:51:42.0296 61212 SymAppCore (2fe779b1a07747fed8074c433c3c4604) C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
20:51:42.0311 61212 SymAppCore - ok
20:51:42.0405 61212 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:51:42.0421 61212 Symc8xx - ok
20:51:42.0593 61212 SymEvent (9d98270b5f10a4c84e8da417c30756e1) C:\Windows\system32\Drivers\SYMEVENT.SYS
20:51:42.0624 61212 SymEvent - ok
20:51:42.0780 61212 SYMREDRV (7f4011a719bf30e3dbd84d3a0a45c91c) C:\Windows\System32\Drivers\SYMREDRV.SYS
20:51:42.0811 61212 SYMREDRV - ok
20:51:42.0936 61212 SYMTDI (2f03cbdb0f22278d05d5d616c993ab58) C:\Windows\System32\Drivers\SYMTDI.SYS
20:51:42.0983 61212 SYMTDI - ok
20:51:43.0171 61212 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:51:43.0218 61212 Sym_hi - ok
20:51:43.0593 61212 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:51:43.0624 61212 Sym_u3 - ok
20:51:43.0921 61212 SysMain (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
20:51:43.0952 61212 SysMain - ok
20:51:44.0249 61212 TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:51:44.0265 61212 TabletInputService - ok
20:51:44.0452 61212 TapiSrv (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll
20:51:44.0530 61212 TapiSrv - ok
20:51:44.0718 61212 tbhsd (77bd6143c6dce0a1bf7b5571bed860dc) C:\Windows\system32\drivers\tbhsd.sys
20:51:44.0749 61212 tbhsd - ok
20:51:44.0890 61212 TBS (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
20:51:44.0905 61212 TBS - ok
20:51:45.0515 61212 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
20:51:45.0624 61212 Tcpip - ok
20:51:45.0999 61212 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
20:51:45.0999 61212 Tcpip6 - ok
20:51:46.0436 61212 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
20:51:46.0499 61212 tcpipreg - ok
20:51:46.0640 61212 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
20:51:46.0671 61212 TDPIPE - ok
20:51:46.0811 61212 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
20:51:46.0858 61212 TDTCP - ok
20:51:47.0311 61212 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
20:51:47.0374 61212 tdx - ok
20:51:47.0577 61212 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
20:51:47.0593 61212 TermDD - ok
20:51:47.0890 61212 TermService (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll
20:51:47.0905 61212 TermService - ok
20:51:48.0061 61212 Themes (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
20:51:48.0061 61212 Themes - ok
20:51:48.0186 61212 THREADORDER (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:51:48.0186 61212 THREADORDER - ok
20:51:48.0311 61212 TrkWks (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
20:51:48.0311 61212 TrkWks - ok
20:51:48.0436 61212 TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
20:51:48.0436 61212 TrustedInstaller - ok
20:51:48.0577 61212 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:51:48.0593 61212 tssecsrv - ok
20:51:48.0796 61212 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
20:51:48.0811 61212 tunmp - ok
20:51:48.0999 61212 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
20:51:49.0015 61212 tunnel - ok
20:51:49.0171 61212 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:51:49.0186 61212 uagp35 - ok
20:51:49.0483 61212 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
20:51:49.0546 61212 udfs - ok
20:51:49.0780 61212 UI0Detect (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
20:51:49.0780 61212 UI0Detect - ok
20:51:49.0983 61212 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:51:50.0015 61212 uliagpkx - ok
20:51:50.0202 61212 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:51:50.0265 61212 uliahci - ok
20:51:50.0452 61212 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:51:50.0468 61212 UlSata - ok
20:51:50.0593 61212 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:51:50.0640 61212 ulsata2 - ok
20:51:50.0796 61212 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
20:51:50.0890 61212 umbus - ok
20:51:50.0999 61212 Update-Service (d6acd2c46857250fdb0d832e47bbb4d8) C:\Windows\System32\UpdSvc.dll
20:51:51.0046 61212 Update-Service - ok
20:51:51.0233 61212 upnphost (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
20:51:51.0265 61212 upnphost - ok
20:51:51.0405 61212 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
20:51:51.0436 61212 usbaudio - ok
20:51:51.0608 61212 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
20:51:51.0640 61212 usbccgp - ok
20:51:51.0749 61212 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:51:51.0780 61212 usbcir - ok
20:51:51.0890 61212 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
20:51:51.0905 61212 usbehci - ok
20:51:51.0999 61212 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
20:51:52.0108 61212 usbhub - ok
20:51:52.0249 61212 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
20:51:52.0249 61212 usbohci - ok
20:51:52.0374 61212 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
20:51:52.0405 61212 usbprint - ok
20:51:52.0546 61212 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
20:51:52.0546 61212 usbscan - ok
20:51:52.0671 61212 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:51:52.0733 61212 USBSTOR - ok
20:51:52.0843 61212 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
20:51:52.0858 61212 usbuhci - ok
20:51:52.0968 61212 UxSms (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
20:51:52.0983 61212 UxSms - ok
20:51:53.0093 61212 vds (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
20:51:53.0108 61212 vds - ok
20:51:53.0186 61212 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:51:53.0218 61212 vga - ok
20:51:53.0327 61212 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
20:51:53.0343 61212 VgaSave - ok
20:51:53.0421 61212 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:51:53.0421 61212 viaagp - ok
20:51:53.0499 61212 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:51:53.0515 61212 ViaC7 - ok
20:51:53.0624 61212 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
20:51:53.0655 61212 viaide - ok
20:51:53.0765 61212 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
20:51:53.0765 61212 volmgr - ok
20:51:53.0890 61212 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
20:51:53.0952 61212 volmgrx - ok
20:51:54.0046 61212 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
20:51:54.0061 61212 volsnap - ok
20:51:54.0171 61212 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:51:54.0186 61212 vsmraid - ok
20:51:54.0327 61212 VSS (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
20:51:54.0358 61212 VSS - ok
20:51:54.0577 61212 VX1000 (d22c6b9c2f840d403fd387ad207a4b16) C:\Windows\system32\DRIVERS\VX1000.sys
20:51:54.0686 61212 VX1000 - ok
20:51:54.0796 61212 W32Time (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
20:51:54.0811 61212 W32Time - ok
20:51:54.0999 61212 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:51:55.0015 61212 WacomPen - ok
20:51:55.0218 61212 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:51:55.0280 61212 Wanarp - ok
20:51:55.0343 61212 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:51:55.0343 61212 Wanarpv6 - ok
20:51:55.0561 61212 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\Windows\system32\DRIVERS\wanatw4.sys
20:51:55.0577 61212 wanatw - ok
20:51:55.0811 61212 wcncsvc (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
20:51:55.0858 61212 wcncsvc - ok
20:51:55.0999 61212 WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:51:56.0015 61212 WcsPlugInService - ok
20:51:56.0233 61212 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
20:51:56.0249 61212 Wd - ok
20:51:56.0421 61212 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
20:51:56.0530 61212 Wdf01000 - ok
20:51:56.0718 61212 WdiServiceHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:51:56.0733 61212 WdiServiceHost - ok
20:51:56.0780 61212 WdiSystemHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:51:56.0796 61212 WdiSystemHost - ok
20:51:57.0202 61212 WebClient (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
20:51:57.0218 61212 WebClient - ok
20:51:57.0343 61212 Wecsvc (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
20:51:57.0405 61212 Wecsvc - ok
20:51:57.0515 61212 wercplsupport (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
20:51:57.0530 61212 wercplsupport - ok
20:51:57.0733 61212 WerSvc (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
20:51:57.0780 61212 WerSvc - ok
20:51:57.0952 61212 WinDefend (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
20:51:57.0952 61212 WinDefend - ok
20:51:57.0999 61212 WinHttpAutoProxySvc - ok
20:51:58.0249 61212 Winmgmt (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
20:51:58.0280 61212 Winmgmt - ok
20:51:58.0577 61212 WinRM (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
20:51:58.0671 61212 WinRM - ok
20:51:58.0936 61212 Wlansvc (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
20:51:58.0999 61212 Wlansvc - ok
20:51:59.0171 61212 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
20:51:59.0186 61212 WmiAcpi - ok
20:51:59.0499 61212 wmiApSrv (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
20:51:59.0499 61212 wmiApSrv - ok
20:51:59.0749 61212 WMPNetworkSvc (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:51:59.0780 61212 WMPNetworkSvc - ok
20:51:59.0968 61212 WPCSvc (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
20:51:59.0999 61212 WPCSvc - ok
20:52:00.0155 61212 WPDBusEnum (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
20:52:00.0171 61212 WPDBusEnum - ok
20:52:00.0311 61212 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
20:52:00.0311 61212 WpdUsb - ok
20:52:00.0624 61212 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:52:00.0718 61212 WPFFontCache_v0400 - ok
20:52:00.0858 61212 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
20:52:00.0905 61212 ws2ifsl - ok
20:52:01.0186 61212 wscsvc (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\system32\wscsvc.dll
20:52:01.0218 61212 wscsvc - ok
20:52:01.0280 61212 WSearch - ok
20:52:01.0796 61212 wuauserv (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:52:01.0874 61212 wuauserv - ok
20:52:02.0249 61212 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:52:02.0249 61212 WUDFRd - ok
20:52:02.0374 61212 wudfsvc (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
20:52:02.0374 61212 wudfsvc - ok
20:52:02.0577 61212 X10Hid (ab2d77bf7222b007717abb61b15f9ae2) C:\Windows\system32\Drivers\x10hid.sys
20:52:02.0608 61212 X10Hid - ok
20:52:02.0827 61212 x10nets (5a0c788c5bc5f2c993cb60940adcf95e) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
20:52:02.0874 61212 x10nets - ok
20:52:02.0936 61212 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
20:52:03.0061 61212 \Device\Harddisk0\DR0 - ok
20:52:03.0093 61212 Boot (0x1200) (7dfbe882cd523ccab456f03c3e364095) \Device\Harddisk0\DR0\Partition0
20:52:03.0124 61212 \Device\Harddisk0\DR0\Partition0 - ok
20:52:03.0171 61212 Boot (0x1200) (27f1e6389c260f4e9fadef4a8dc218f8) \Device\Harddisk0\DR0\Partition1
20:52:03.0171 61212 \Device\Harddisk0\DR0\Partition1 - ok
20:52:03.0171 61212 ============================================================
20:52:03.0171 61212 Scan finished
20:52:03.0171 61212 ============================================================
20:52:03.0186 61436 Detected object count: 0
20:52:03.0186 61436 Actual detected object count: 0
Code:
ATTFilter In der Datei 'C:\Windows\System32\jpgm0109.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Code:
ATTFilter Die Datei 'C:\Windows\System32\jpgm0109.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan].
Durchgeführte Aktion(en):
Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
Die Datei konnte nicht gelöscht werden!
Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
Die Datei konnte nicht gelöscht werden!
-> Habe den PC neugestartet und nun lässt sich der Trojaner in die Quarantäneverzeichnis verschieben: Code:
ATTFilter Die Datei 'C:\Windows\System32\jpgm0109.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a83e652.qua' verschoben!
|
|
| Themen zu TR/Crypt.XPACK.Gen' [trojan] |
| .dll, antivir, avira, avira antivir, bilder, code, datei, desktop, drucker, festplatte, files, klicke, nicht mehr, nichts, ordner, papierkorb, programm, programme, start, symantec, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen', trojan, unerwünschtes programm, virus, zugriff |
![TR/Crypt.XPACK.Gen' [trojan]](iconimages/plagegeister-aller-art-deren-bekaempfung/tr-crypt-xpack-gen-trojan_ltr.gif)
Linear-Darstellung
