Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPACK.Gen' [trojan]

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 25.03.2012, 14:00   #1
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Hallo,

heute hat mein Avira AntiVir einen Virus gefunden:
Code:
ATTFilter
In der Datei 'C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
         
Ich habe durch Avira den Virus entfernt.
Dann habe ich einen Drucker installiert. Danach bin ich auf dem Desktop gegangen, doch alle Programme, Ordner und Dokumente waren nicht mehr drauf. Außer den Papierkorb und 3 Drucker Programme.
In den Ordnern Bilder, Dokumente, Downloads usw. ist nichts mehr drin. Meine Bilder, Dokumente (und ...) sind wohl gelöscht.
Wenn ich auf START klicke und dann auf Alle Programme, da sind die Programme auch nicht drinnen.
Auf der Festplatte, kann ich unter "Programme" diese öffnen.

Was muss ich denn jetzt machen?

Alt 25.03.2012, 15:40   #2
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



hi,
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________

Alt 25.03.2012, 17:09   #3
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



OTL.txt
Code:
ATTFilter
OTL logfile created on: 25.03.2012 17:18:40 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Karout\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,25 Gb Total Physical Memory | 0,53 Gb Available Physical Memory | 42,46% Memory free
2,75 Gb Paging File | 1,23 Gb Available in Paging File | 44,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,05 Gb Total Space | 84,66 Gb Free Space | 60,02% Space Free | Partition Type: NTFS
Drive D: | 8,00 Gb Total Space | 5,91 Gb Free Space | 73,82% Space Free | Partition Type: NTFS
 
Computer Name: KAROUT-PC | User Name: Nadine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.25 17:16:21 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Karout\Desktop\OTL.exe
PRC - [2012.02.29 17:19:35 | 000,949,104 | ---- | M] (Opera Software) -- C:\Programme\Opera\opera.exe
PRC - [2011.10.24 17:51:19 | 000,801,792 | ---- | M] (Yuna Software) -- C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe
PRC - [2011.07.01 13:48:40 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.28 11:24:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.02.22 21:00:27 | 001,174,152 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.05.20 15:27:24 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX1000.exe
PRC - [2010.05.20 15:27:24 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\LifeEnC2.exe
PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe
PRC - [2010.05.20 15:27:24 | 000,095,088 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\LifeTray.exe
PRC - [2010.04.16 23:12:28 | 003,872,080 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.11 00:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.01.14 18:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2007.02.14 21:46:20 | 000,278,608 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapSvc.exe
PRC - [2007.02.14 21:45:48 | 000,159,744 | ---- | M] (CyberLink Corp.) -- C:\Programme\Powercinema\PCMService.exe
PRC - [2007.01.11 12:40:22 | 000,232,184 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2007.01.11 12:40:18 | 000,017,656 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006.11.14 15:47:54 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Programme\Common Files\aol\1298400348\ee\aolsoftware.exe
PRC - [2006.11.09 11:57:52 | 003,784,704 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2006.11.08 14:42:27 | 000,194,240 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2006.10.24 23:08:40 | 000,107,112 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\ccApp.exe
PRC - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2006.09.20 19:05:16 | 000,046,736 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\AppCore\AppSvc32.exe
PRC - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.20 13:30:57 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll
MOD - [2012.02.20 13:30:24 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2598077ccea480c6120d3a1ad4455be0\System.Web.ni.dll
MOD - [2012.02.20 13:30:10 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll
MOD - [2012.02.20 13:29:56 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll
MOD - [2012.02.18 12:40:09 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll
MOD - [2012.02.18 12:37:38 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll
MOD - [2012.02.18 12:37:02 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll
MOD - [2012.02.18 12:32:01 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll
MOD - [2011.12.24 18:10:15 | 000,064,000 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2011.12.24 18:10:14 | 000,275,968 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2011.12.24 18:10:14 | 000,078,336 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2011.12.24 18:10:14 | 000,046,592 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2011.12.24 18:10:14 | 000,045,568 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gsttypefindfunctions.dll
MOD - [2011.12.24 18:10:13 | 000,316,928 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2011.12.24 18:10:13 | 000,168,448 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2011.12.24 18:10:13 | 000,099,840 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2011.12.24 18:10:13 | 000,098,816 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2011.12.24 18:10:13 | 000,076,800 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2011.12.24 18:10:13 | 000,068,608 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2011.12.24 18:10:12 | 000,783,360 | ---- | M] () -- C:\Programme\Opera\gstreamer\gstreamer.dll
MOD - [2011.12.24 18:10:12 | 000,098,816 | ---- | M] () -- C:\Programme\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2011.10.14 15:24:32 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll
MOD - [2011.08.07 15:54:16 | 000,004,096 | ---- | M] () -- C:\Programme\Yuna Software\Messenger Plus!\Detour32.dll
MOD - [2011.02.22 20:30:51 | 000,225,280 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2564.38865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:51 | 000,184,320 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2564.38919__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2011.02.22 20:30:51 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2564.38897__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2011.02.22 20:30:50 | 001,671,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2564.38906__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2011.02.22 20:30:50 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2564.39149__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2011.02.22 20:30:50 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2564.39137__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:50 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2564.39090__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2564.38918__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:50 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2564.38884__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:50 | 000,011,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2564.39023__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2011.02.22 20:30:48 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2537.29860__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2011.02.22 20:30:48 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2536.35576__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2011.02.22 20:30:48 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2536.35581__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2536.35589__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2536.35599__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2536.35599__90ba9c70f846762e\DEM.OS.dll
MOD - [2011.02.22 20:30:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2536.35598__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2011.02.22 20:30:47 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2536.35577__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2011.02.22 20:30:47 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2536.35587__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2011.02.22 20:30:47 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2536.35642__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2011.02.22 20:30:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2536.35590__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2011.02.22 20:30:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2536.35580__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2011.02.22 20:30:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2531.19989__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2011.02.22 20:30:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2011.02.22 20:30:45 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll
MOD - [2011.02.22 20:30:45 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2536.35593__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2011.02.22 20:30:44 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2561.34688__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2011.02.22 20:30:44 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2536.35597__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2011.02.22 20:30:44 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2536.35592__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2011.02.22 20:30:44 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2536.35605__90ba9c70f846762e\APM.Foundation.dll
MOD - [2011.02.22 20:30:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2536.35592__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2011.02.22 20:30:44 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2536.35589__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2011.02.22 20:30:43 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2564.39156_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll
MOD - [2011.02.22 20:30:43 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2536.35576__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2011.02.22 20:30:43 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2531.19989__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2011.02.22 20:30:39 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2564.39164__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2011.02.22 20:30:39 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2564.39162__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2011.02.22 20:30:39 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2536.35581__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2011.02.22 20:30:39 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2536.35591__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2011.02.22 20:30:38 | 000,466,944 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2564.38893__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2011.02.22 20:30:38 | 000,278,528 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2564.39156__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2011.02.22 20:30:38 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2536.35590__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2011.02.22 20:30:38 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2536.35606__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2011.02.22 20:30:38 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2536.35583__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2011.02.22 20:30:37 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2564.38863__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2011.02.22 20:30:36 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2564.38864__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2011.02.22 20:30:36 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2536.35586__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2011.02.22 20:30:36 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2011.02.22 20:30:36 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2564.39163__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2011.02.22 20:30:36 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2536.35600__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2011.02.22 20:30:35 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2564.38862__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.03.29 22:42:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.29 22:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2007.03.08 12:22:00 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2007.02.14 21:46:24 | 000,339,968 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLTinyDB.dll
MOD - [2007.02.14 21:46:06 | 000,241,750 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapEngine.dll
MOD - [2007.02.14 21:46:06 | 000,114,768 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLSchMgr.dll
MOD - [2007.02.14 21:46:06 | 000,032,768 | ---- | M] () -- c:\Programme\Powercinema\Kernel\TV\CLCapSvcps.dll
MOD - [2007.01.11 12:02:14 | 004,587,520 | R--- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
MOD - [2007.01.08 13:08:56 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2006.12.19 21:16:04 | 000,073,728 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
MOD - [2006.11.08 17:15:50 | 000,009,384 | ---- | M] () -- C:\Programme\Norton Internet Security\Norton AntiVirus\NAVShExt.loc
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.03.23 14:37:47 | 000,221,184 | ---- | M] (Works Ltd.) [Auto | Running] -- C:\Windows\System32\aptwdhlrc.dll -- (LanmanWorkstation)
SRV - [2011.12.24 18:37:22 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.07.01 13:48:40 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.28 11:24:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.04.01 12:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.22 21:00:27 | 001,174,152 | ---- | M] (Symantec Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 19:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2010.12.10 19:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010.04.28 08:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009.02.23 12:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2009.01.14 18:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008.01.19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 00:33:40 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.02.14 21:46:24 | 000,110,677 | ---- | M] () [Auto | Stopped] -- c:\Programme\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2007.02.14 21:46:20 | 000,278,608 | ---- | M] () [Auto | Running] -- c:\Programme\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2006.11.08 14:42:27 | 002,541,248 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2006.11.08 14:42:27 | 000,194,240 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2006.10.27 01:18:36 | 000,080,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Norton Internet Security\isPwdSvc.exe -- (ISPwdSvc)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2006.10.24 23:08:20 | 000,107,624 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [On_Demand | Stopped] -- C:\Programme\Common Files\aol\acs\AOLacsd.exe -- (AOL ACS)
SRV - [2006.10.13 16:29:12 | 000,049,296 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\VAScanner\comHost.exe -- (comHost)
SRV - [2006.09.20 19:05:16 | 000,046,736 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- (SymAppCore)
SRV - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys -- (IDSvix86)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.03.23 15:33:50 | 000,464,384 | ---- | M] (New Technology Quality, Ltd.) [Kernel | System | Unknown] -- C:\Windows\System32\ntqjxeh5.sys -- (ntqjxeh5)
DRV - [2011.07.05 10:12:16 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2011.07.01 13:48:43 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.01 13:48:43 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.02.22 21:02:14 | 000,109,744 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.20 15:27:26 | 001,961,072 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VX1000.sys -- (VX1000)
DRV - [2007.01.08 13:16:50 | 002,313,216 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.17 11:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)
DRV - [2006.11.06 03:00:00 | 000,387,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2006.11.03 19:23:02 | 000,275,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2006.11.03 19:23:00 | 000,024,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2006.11.03 19:22:56 | 000,245,880 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtsp.sys -- (SRTSP)
DRV - [2006.11.02 09:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006.11.01 22:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2006.10.30 10:22:00 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2006.10.24 14:40:22 | 000,185,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\symtdi.sys -- (SYMTDI)
DRV - [2006.10.24 14:40:22 | 000,026,384 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\symredrv.sys -- (SYMREDRV)
DRV - [2006.10.06 15:26:16 | 000,406,672 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKLM\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://search.iminent.com/?appId=&ref=toolbox&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com [2011.05.14 12:59:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.01 18:11:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.01 18:11:10 | 000,000,000 | ---D | M]
 
[2011.05.25 21:44:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.02.22 20:32:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011.03.15 16:47:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.15 16:45:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.01 18:11:03 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.01 18:11:03 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.01 18:11:03 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.07.10 02:21:02 | 000,002,157 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchTheWeb.xml
[2012.01.01 18:11:03 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.01 18:11:03 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Google-Suche = \Users\Karout\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.18_0\
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (Reg Error: Value error.) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\1.0\NppBHO.dll (Symantec Corporation)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Iminent.BHO.NavigationError) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - C:\Programme\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll (Iminent)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Google\Google_BAE\BAE.dll (Packard Bell)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll File not found
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Programme\PHPNukeDE\tbPHPN.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HostManager] C:\Programme\Common Files\aol\1298400348\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [Iminent.Notifier] C:\Programme\Iminent\SearchTheWeb\Iminent.Notifier.exe (Iminent)
O4 - HKLM..\Run: [InstallProcess] c:\OEM\process\PROCESS.CMD ()
O4 - HKLM..\Run: [IS CfgWiz] C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe (Symantec Corporation)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [PCMService] c:\Program Files\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PlusService] C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [VX1000] C:\Windows\vVX1000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll File not found
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{74A5E7D9-4091-4390-887E-6688178ACBF3}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Adobe Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: ccc-core-static - msiexec /fums {B9701D86-3D63-7F49-9948-27670574B4CC} /qb
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.25 14:27:19 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft
[2012.03.25 13:44:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Messenger Plus!
[2012.03.25 13:38:32 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2012.03.25 13:33:07 | 000,000,000 | ---D | C] -- C:\ProgramData\HPSSUPPLY
[2012.03.25 13:29:10 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012.03.25 13:25:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012.03.25 13:25:47 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2012.03.25 13:24:12 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
[2012.03.25 13:21:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard
[2012.03.25 13:10:58 | 000,000,000 | ---D | C] -- C:\Users\Default\AppData
[2012.03.25 13:03:41 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2012.03.25 12:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\AOL
[2012.03.23 15:33:50 | 000,704,512 | ---- | C] (Discrete Cosine LLC) -- C:\Windows\System32\jpgm0109.dll
[2012.03.23 15:33:50 | 000,464,384 | ---- | C] (New Technology Quality, Ltd.) -- C:\Windows\System32\ntqjxeh5.sys
[2012.03.19 17:17:18 | 000,000,000 | ---D | C] -- C:\Program Files\simfy
[2012.03.08 17:11:36 | 000,000,000 | ---D | C] -- C:\Program Files\Kingsoft
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.25 17:09:00 | 000,000,364 | ---- | M] () -- C:\Windows\tasks\WpsUpdateTask_Nadine.job
[2012.03.25 16:57:11 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.25 15:56:03 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.25 15:44:03 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.25 15:44:03 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.25 15:08:04 | 000,695,718 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.25 15:08:04 | 000,651,072 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.25 15:08:04 | 000,154,226 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.25 15:08:04 | 000,125,322 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.25 13:43:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.25 13:43:45 | 1341,448,192 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.25 13:38:49 | 000,160,363 | ---- | M] () -- C:\Windows\hpoins15.dat
[2012.03.25 13:34:54 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\HP Photosmart Essential 2.01.lnk
[2012.03.25 13:33:09 | 000,001,873 | ---- | M] () -- C:\Users\Public\Desktop\Shop für HP Zubehör.lnk
[2012.03.25 13:29:11 | 000,001,975 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012.03.25 13:26:59 | 000,001,207 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk
[2012.03.23 15:33:50 | 000,704,512 | ---- | M] (Discrete Cosine LLC) -- C:\Windows\System32\jpgm0109.dll
[2012.03.23 15:33:50 | 000,464,384 | ---- | M] (New Technology Quality, Ltd.) -- C:\Windows\System32\ntqjxeh5.sys
[2012.03.23 14:37:47 | 000,221,184 | ---- | M] (Works Ltd.) -- C:\Windows\System32\aptwdhlrc.dll
[2012.03.16 14:23:18 | 000,441,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.03.25 13:34:54 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\HP Photosmart Essential 2.01.lnk
[2012.03.25 13:33:09 | 000,001,873 | ---- | C] () -- C:\Users\Public\Desktop\Shop für HP Zubehör.lnk
[2012.03.25 13:32:19 | 000,000,817 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
[2012.03.25 13:29:11 | 000,001,975 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012.03.25 13:26:59 | 000,001,207 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk
[2012.03.25 13:05:26 | 000,160,363 | ---- | C] () -- C:\Windows\hpoins15.dat
[2012.03.08 17:16:21 | 000,000,364 | ---- | C] () -- C:\Windows\tasks\WpsUpdateTask_Nadine.job
[2011.06.30 19:10:21 | 000,921,624 | ---- | C] () -- \img2-001.raw
[2011.03.18 20:32:09 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.03.18 20:30:14 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.03.18 20:30:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.02.23 04:58:35 | 000,695,718 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.02.23 04:58:35 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.02.23 04:58:35 | 000,154,226 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.02.23 04:58:35 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2011.02.23 04:53:39 | 000,008,192 | R-S- | C] () -- \BOOTSECT.BAK
[2011.02.23 04:53:35 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2011.02.23 04:53:35 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2011.02.23 04:53:35 | 000,145,112 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.02.22 21:07:16 | 000,000,382 | ---- | C] () -- \PB.iss
[2011.02.22 20:45:39 | 000,001,811 | -H-- | C] () -- \IPH.PH
[2011.02.22 20:45:33 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.02.22 20:31:20 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2011.02.22 20:26:23 | 000,049,152 | ---- | C] () -- C:\Windows\System32\ChCfg.exe
[2011.02.22 20:22:36 | 1341,448,192 | -HS- | C] () -- \hiberfil.sys
[2011.02.22 19:41:24 | 000,333,257 | RHS- | C] () -- \bootmgr
 
========== LOP Check ==========
 
[2012.03.25 13:42:19 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.03.25 17:09:00 | 000,000,364 | ---- | M] () -- C:\Windows\Tasks\WpsUpdateTask_Nadine.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2011.11.27 19:18:39 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.03.18 17:30:40 | 000,000,000 | ---D | M] -- C:\2819f8fffcf595e3c0
[2011.02.26 11:51:23 | 000,000,000 | ---D | M] -- C:\597ea0f10aad1dc5cdf1
[2011.03.18 21:19:16 | 000,000,000 | -HSD | M] -- C:\boot
[2012.03.25 13:43:41 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2006.11.02 14:59:44 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.02.22 21:22:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.02.23 04:47:37 | 000,000,000 | ---D | M] -- C:\drivers
[2011.07.04 12:56:57 | 000,000,000 | -HSD | M] -- C:\found.000
[2011.07.11 16:25:31 | 000,000,000 | -HSD | M] -- C:\found.001
[2011.10.14 15:15:50 | 000,000,000 | -HSD | M] -- C:\found.002
[2011.11.27 13:51:05 | 000,000,000 | ---D | M] -- C:\Games
[2011.02.22 20:33:30 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.02.23 05:13:46 | 000,000,000 | ---D | M] -- C:\OEM
[2012.02.18 17:19:29 | 000,000,000 | ---D | M] -- C:\output
[2011.03.18 19:51:01 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.25 13:24:12 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.25 13:44:54 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.02.22 21:22:24 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.03.25 17:37:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.05.14 13:04:24 | 000,000,000 | ---D | M] -- C:\temp
[2012.03.25 17:16:59 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.25 13:47:27 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\OEM\boot\winpe\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\OEM\boot\winpe\Windows\System32\drivers\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2011.02.27 15:36:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011.02.27 15:36:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011.02.27 15:36:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\OEM\boot\winpe\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.27 15:35:00 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2011.02.27 15:34:57 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2011.02.27 15:34:56 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2011.03.01 15:01:18 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2011.03.01 15:01:18 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2011.02.27 15:34:59 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[2008.01.19 00:33:12 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\OEM\boot\winpe\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\OEM\boot\winpe\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
[2008.01.19 00:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\OEM\boot\winpe\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\OEM\boot\winpe\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2008.01.19 00:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\OEM\boot\winpe\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2011.02.25 13:49:33 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\Temp\user32.dll
[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2011.02.25 13:49:35 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2008.01.19 00:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\OEM\boot\winpe\Windows\System32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\OEM\boot\winpe\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\OEM\boot\winpe\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[2008.01.19 00:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\OEM\boot\winpe\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<           >
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\oem\mp] -> Volume{99aedc4e-3eaf-11e0-ad2d-806e6f6e6963}\ -> Mount Point

< End of report >
         
__________________

Alt 25.03.2012, 17:11   #4
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Extras.txt
Code:
ATTFilter
OTL Extras logfile created on: 25.03.2012 17:18:40 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Karout\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,25 Gb Total Physical Memory | 0,53 Gb Available Physical Memory | 42,46% Memory free
2,75 Gb Paging File | 1,23 Gb Available in Paging File | 44,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,05 Gb Total Space | 84,66 Gb Free Space | 60,02% Space Free | Partition Type: NTFS
Drive D: | 8,00 Gb Total Space | 5,91 Gb Free Space | 73,82% Space Free | Partition Type: NTFS
 
Computer Name: KAROUT-PC | User Name: Nadine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03286FEC-A749-4561-A9F3-8A09CAC6D0C9}" = lport=137 | protocol=17 | dir=in | app=system | 
"{044CBE36-409D-45BA-BD3F-DF295F2A7A72}" = rport=139 | protocol=6 | dir=out | app=system | 
"{10B07AE5-65EC-4B66-9D06-D79BA284A433}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{3215BFAE-8CD1-48D5-BF36-2BE5912F9B4D}" = rport=137 | protocol=17 | dir=out | app=system | 
"{39C5AD1F-E029-4B78-8DEA-5472F70A6A70}" = rport=138 | protocol=17 | dir=out | app=system | 
"{40E5D532-35F5-4FAB-86CD-64A21BB313A3}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8596A8A7-0F69-4777-8ED3-0CDC40D08E93}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{91392756-6023-45CE-BCC3-17521D7B9932}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{B3C9CCCD-227A-4627-9F95-82D0C7282AB0}" = rport=445 | protocol=6 | dir=out | app=system | 
"{C77873D9-1D7D-4F2E-BB2E-4BE987E99D4E}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D0B0EC63-0A1A-4F2D-9B7D-F3240848E9A5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{DDD897A3-5520-454E-9209-5F8E127DCEE5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E5BB99F8-CAEF-4F5B-A8BC-0D9A4C01852E}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00AE702B-2B38-4876-B70B-CD51255FB446}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{06D6C232-E4B9-422E-B909-8059DBDB3171}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe | 
"{0770DCF6-AF8B-4FC3-9F9A-D751E78BDA3F}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe | 
"{084CE2B3-7348-4643-A112-6617948C0A1E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{11FAC405-F4FF-4774-BB46-4BAA005809AE}" = protocol=6 | dir=in | app=c:\program files\powercinema\powercinema.exe | 
"{1BBAAD9B-9E1C-48D5-A4A6-102AAEA0156A}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe | 
"{2007E066-CCE6-4C5B-B1C5-3DC4D506A0CA}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 
"{2290F4B7-BCE9-41D0-B12C-55FEA65D58EE}" = dir=in | app=c:\program files\powercinema\kernel\dms\clmsservice.exe | 
"{235AB811-65F6-4564-A428-9977D874AF03}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{23B81CA7-C3D9-4D4D-AB82-4EC0FE51F3FE}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{2FC97CCB-E9C9-4BE3-87CC-06F2EE4B9EF4}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{3752926B-A7E6-4DAE-B02B-64415665EF17}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{3EB1343C-5D2F-4E1E-8F98-E8FCBDA8BFA1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{3EF9358E-74A8-49FB-9E03-10874DD8194C}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe | 
"{45B579BA-A879-4771-8FE7-9C8912C1F286}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{4FD5B76E-A8C8-4E11-8389-197223CB44E9}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{541B4445-5206-438A-ACB9-80C128F0B4BD}" = protocol=17 | dir=in | app=c:\program files\powercinema\powercinema.exe | 
"{55414428-6732-4C13-AAE3-6164E2832F79}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe | 
"{557B8736-3BB6-483C-A928-3A2ED40B9F7F}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{5676ED70-284A-4374-AAE2-11E3994C0B6A}" = protocol=6 | dir=in | app=c:\program files\powercinema\pcmservice.exe | 
"{595C1B14-2F1D-4B58-86BD-FD4A85BD0545}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{66477BFB-D270-4B8C-9581-A59926D08C6E}" = protocol=17 | dir=in | app=c:\program files\powercinema\pcmservice.exe | 
"{6825C0C5-9022-441C-86B8-FE89E35A28B1}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe | 
"{78ED9E83-36DF-46ED-8982-7564B7A670B1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{80CBEF3C-C4D8-4B33-905D-08EC216804AA}" = dir=in | app=c:\program files\powercinema\powercinema.exe | 
"{8EB09E1E-4CC2-4D68-8DFC-58EDC9AFB7CD}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{9346B39C-20B6-418E-A9BD-AF09262FE2B2}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{95E44B3B-C4B6-4F12-926F-A3227A95B33D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{A31811AB-53AE-485B-AAB2-9D742860D7E3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{AE12DB2C-C45F-4707-8FEE-14DC0794DC30}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{B22E3C37-124E-4814-BA27-9742979CF0F2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B3CF341F-1DB3-4A0E-A88E-02791FC398CD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B6316D68-C3DE-495A-91CD-95F29268089A}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{B71C6C5F-FEBB-48DF-937C-E0BE64921F13}" = dir=in | app=c:\program files\powercinema\pcmservice.exe | 
"{C5C55218-B0B0-4F68-9121-BDEB6A491142}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{C64DA8CB-CBF7-4C2B-8837-50E86338BBF1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{CF7DDE00-457E-43DE-9686-E433B07FF251}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 
"{DE7F8A63-4612-4BA8-8504-050340831509}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{E24E57B0-F372-407F-B759-7E7D798221D4}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe | 
"{E45DE126-E6AA-422E-B110-578AD4A2ADB1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{EF66B37E-794E-4D7B-AD12-88C9FA63BB14}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F57CDAB2-1E0D-43C3-80F8-53110D711BB5}" = dir=in | app=c:\program files\powercinema\kernel\dmp\clbrowserengine.exe | 
"{F61249DB-6362-44AD-ABC2-C016A75984AE}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{FF6222F0-0357-4925-917B-AE181EB5B54B}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe | 
"TCP Query User{06517BF7-1A4F-421F-B354-ED16D9FDE8F7}C:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe | 
"TCP Query User{118EE256-F3CB-4C3B-8808-B3490E3F95AF}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{2A2A885B-9105-483C-9E0F-A19423436907}C:\users\nadine\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nadine\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{38033693-386D-4CC7-B482-18C9DB169E53}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{4E6FDABB-441C-4748-915A-811054A7AA1A}C:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
"TCP Query User{59F65AE6-B3CF-49C3-B4E4-22A047B0A8F5}C:\games\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\games\counter-strike 1.6\hl.exe | 
"TCP Query User{7DC0246C-C1BB-49F3-AF2C-40935F619334}C:\games\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\games\counter-strike 1.6\hl.exe | 
"TCP Query User{855F6D63-D1FC-42FF-A572-9AB579062A31}C:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe" = protocol=6 | dir=in | app=c:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe | 
"TCP Query User{A3CDCC38-D43A-422F-8356-BBED2B916527}C:\users\karout\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\karout\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{B3BF47D7-6B4C-4CDB-BF59-B16BAA5A6DE9}C:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru)\hl.exe" = protocol=6 | dir=in | app=c:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru)\hl.exe | 
"UDP Query User{2BB16509-AB2F-40AA-A40B-3A5F2825ABDE}C:\users\nadine\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nadine\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{608E5A17-15EC-4BB0-A04D-ADE6E3AA6B69}C:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe" = protocol=17 | dir=in | app=c:\program files\theabyss\counter-strike source [no-steam] v1.0.0.66 the abyss (cs.theabyss.ru)\hl2.exe | 
"UDP Query User{66E47E44-9B29-490F-B67B-5C4FA98ADB0B}C:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\opera.exe | 
"UDP Query User{7F6FCCDA-6545-4D94-A4CA-9277653F6D07}C:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru)\hl.exe" = protocol=17 | dir=in | app=c:\program files\cs.theabyss.ru\counter-strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru)\hl.exe | 
"UDP Query User{864170B2-9AEF-4AB2-AF8D-ABE95CB2AFE6}C:\games\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\games\counter-strike 1.6\hl.exe | 
"UDP Query User{C1F4CFFE-699D-4751-9ED8-005A7338EF95}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{E3B76813-08F2-473B-BC94-954BFF15880A}C:\users\karout\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{E6EB2DD6-6220-4983-AA61-12B51D82452B}C:\games\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\games\counter-strike 1.6\hl.exe | 
"UDP Query User{F8282610-7C6C-49FC-805B-75F11A5356EE}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{FB03CCC0-FF4F-4995-8999-ED2E6FBA237B}C:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\karout\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{04441EE4-3631-43DB-813A-9D031380C8E5}" = MarketingReg
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24EE4523-711A-4BD1-95EA-F73A8A6950D3}" = Audials TV
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = PowerCinema
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{48185814-A224-447A-81DA-71BD20580E1B}" = Norton Internet Security
"{4843B611-8FCB-4428-8C23-31D0A5EAE164}" = Norton Confidential Browser Component
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56624BBF-8925-D5F8-7662-3ABE1BA7EC28}" = Catalyst Control Center Graphics Light
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{58A8820A-CCF4-4A6E-A4B9-CECD87D3C7F2}" = ccc-Branding
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security
"{5EE48155-BD54-46E2-8D81-A57A69726A95}" = SearchTheWeb
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61E7C563-8BDA-4E44-F9A8-F21E29F0F6A8}" = Catalyst Control Center Core Implementation
"{620CAD2D-0757-43A9-AA5F-C8D48A1E4D85}_is1" = BigMacroTool 1.5
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{830D8CBD-C668-49e2-A969-C2C2106332E0}" = Norton AntiVirus
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{924901FC-88E8-B25B-C0DD-9E029A6570FC}" = Catalyst Control Center Localization German
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}" = Norton Protection Center
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A7DB362E-16DC-4E29-8A34-E74381E00B5B}" = Adobe Shockwave Player
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{ACA85783-8EEA-4f0a-B2A3-A8173F30209F}" = C4200_doccd
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B09BCBF6-87EE-4403-A336-3A9510856535}" = HP Photosmart All-In-One Software 9.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Creator 9 LE
"{B834524D-C302-F626-87D6-5E7352FBE502}" = simfy
"{B9701D86-3D63-7F49-9948-27670574B4CC}" = ccc-core-static
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BFDE4176-5DFE-4db9-AA00-8F30CB001BDA}" = c4200_Help
"{C222C293-2B1F-C94F-088E-D3F55CF732FC}" = ccc-utility
"{C39E671D-0528-4c5e-A034-8470C5BC393A}" = C4200
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" = Norton Confidential Web Protection Component
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" = Symantec Real Time Storage Protection Component
"{D8B7A682-20DA-4797-8415-B1FB14D4D32B}" = PS_AIO_Software
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E28750A2-45F2-4b63-99F7-9F81A94B1E2D}" = PS_AIO_Software_min
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E5EE9939-259F-4DE2-8023-5C49E16A4F43}" = Norton Internet Security
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F4DB525F-A986-4249-B98B-42A8066251CA}" = AV
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FAD800F2-B263-49B5-BDA6-7FF8D625D49A}" = Audials
"{FD7F242B-9AA0-40c3-941E-3A9821D19C09}" = PS_AIO_ProductContext
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AdobeReader" = Adobe Reader 8
"AOL Deinstallation" = AOL Deinstallation
"AOL_DE" = AOL 9.0 VR
"Audacity_is1" = Audacity 1.2.6
"AUDIO_REALTEK" = Realtek HD Audio V6.0.1.5322
"AutocompletePro2_is1" = AutocompletePro
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"conduitEngine" = Conduit Engine
"Counter-Strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru) v1.1.2.6 (4554)" = Counter-Strike 1.6 v1.1.2.6  (4554) (cs.theabyss.ru) v1.1.2.6 (4554)
"Counter-Strike Source [no-steam] v1.0.0.66 The Abyss (cs.theabyss.ru) v1.0.0.66" = Counter-Strike Source [no-steam] v1.0.0.66 The Abyss (cs.theabyss.ru) v1.0.0.66
"CREATOR9" = Creator 9
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"FirefoxDE" = Firefox
"Flashplayer" = Flash Player 9 Internet Explorer
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Sound Recorder_is1" = Free Sound Recorder 2010 v9.2.1
"Free Studio_is1" = Free Studio version 5.0.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"GOOGLE_EARTH" = Google Earth
"GoogleBAE" = Google BAE
"GoogleDesktop" = Google Desktop
"GoogleToolbar" = Google Toolbar
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"HPOCR" = HP OCR Software 9.0
"ImageWriter" = Packard Bell ImageWriter
"Infocentre" = Infocentre Rev. 2.0
"kikin Plugin (NO23 Edition)" = kikin Plugin (NO23 Edition) 1.11
"Kingsoft Writer" = Kingsoft Writer  (8.1.0.2948)
"LCDTest" = Packard Bell LCD Test
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Messenger Plus!" = Messenger Plus! 5
"METABOLI" = Metaboli
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.25)" = Mozilla Firefox (3.6.25)
"Music Editor Free" = Music Editor Free
"NIS2007_DE" = NIS2007
"OFFICE Ready" = OFFICE Ready
"Opera 11.60.1185" = Opera 11.60
"PhotoScape" = PhotoScape
"PHPNukeDE Toolbar" = PHPNukeDE Toolbar
"Picasa 3" = Picasa 3
"Picasa2" = Picasa2
"PowerCinema5" = Power Cinema 5
"PROHYBRIDR" = 2007 Microsoft Office system
"SearchTheWebARP" = SearchTheWeb
"SETUPMYPC_DE" = SetUp My PC
"Shockwave" = Shockwave player 10
"Simfy" = simfy
"SKYPE" = Skype 2.5.2.151
"Skype_is1" = Packard Bell - Skype 2.5
"SymSetup.{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security (Symantec Corporation)
"Synthesia" = Synthesia (remove only)
"Uninstall_is1" = Uninstall 1.0.0.1
"Updator" = Packard Bell Updator
"VIDEO_RIO" = Video ATI v8.332
"ViewpointMediaPlayer" = Viewpoint Media Player
"WinLiveSuite_Wave3" = Windows Live Essentials
"X10Hardware" = X10 Hardware(TM)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Resetting to Probing:    4 Karout-PC.local.
 Addr 192.168.0.100
 
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.0.103:5353    4 Karout-PC.local.
 Addr 192.168.0.103
 
Error - 20.03.2012 13:22:22 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Resetting to Probing:   16 Karout-PC.local.
 AAAA FE80:0000:0000:0000:D42D:39DF:93C7:6C6D
 
Error - 21.03.2012 12:52:22 | Computer Name = Karout-PC | Source = Perflib | ID = 1010
Description = 
 
Error - 21.03.2012 12:52:28 | Computer Name = Karout-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.0.103:5353    4 Karout-PC.local.
 Addr 192.168.0.103
 
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: ProbeCount 2; will deregister    4 Karout-PC.local.
 Addr 192.168.0.100
 
Error - 22.03.2012 09:56:32 | Computer Name = Karout-PC | Source = Bonjour Service | ID = 100
Description = Local Hostname Karout-PC.local already in use; will try Karout-PC-2.local
 instead
 
Error - 23.03.2012 08:39:30 | Computer Name = Karout-PC | Source = Perflib | ID = 1010
Description = 
 
Error - 23.03.2012 08:39:50 | Computer Name = Karout-PC | Source = Perflib | ID = 1008
Description = 
 
[ OSession Events ]
Error - 13.07.2011 13:19:39 | Computer Name = Karout-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3604
 seconds with 1200 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 25.03.2012 07:51:51 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
 
Error - 25.03.2012 07:51:51 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
 
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
 
Error - 25.03.2012 07:51:57 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
 
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = SRTSP | ID = 524292
Description = Error loading virus definitions.
 
Error - 25.03.2012 07:52:04 | Computer Name = Karout-PC | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.
 
 
< End of report >
         

Alt 25.03.2012, 17:21   #5
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



lade unhide:
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 25.03.2012, 17:45   #6
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



1. Habe mir unhide heruntergeladen und habe es gestartet.
Da steht gerade folgendes:
Code:
ATTFilter
Program started at 03/25/2012 06:26:53 PM
......................appdata doesn't exist! Unhide Terminated!
         
Dann kam eine Fehlermeldung namens "Unhide Error":
Code:
ATTFilter
There was a problem retrieving a necessary environment variable.
Unhide has terminated!
         

2. Habe keinen Download-Link zum ComboFix gefunden.

Alt 25.03.2012, 17:49   #7
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



im tutorial stehen 2 links, bitte lesen.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 25.03.2012, 17:56   #8
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Okay habs gefunden.
Was muss ich mit dem Unhide jetzt machen?

Kann ich eigentlich den ComboFix schon ausführen?

Alt 27.03.2012, 15:27   #9
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Sorry, gibt es aber noch ne Lösung dafür?

Alt 27.03.2012, 16:20   #10
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



na ich warte auf das combofix log.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 30.03.2012, 15:18   #11
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Heute habe ich mal Zeit das ComboFix durchzuführen:

Code:
ATTFilter
ComboFix 12-03-22.01 - SYSTEM 30.03.2012  15:58:14.1.1 - x86
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.49.1031.18.1279.717 [GMT 2:00]
ausgeführt von:: C:\Users\Karout\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

- REDUZIERTER FUNKTIONALITÄTSMODUS -


((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\AutocompletePro
C:\Program Files\AutocompletePro\AcRemoteUpdate.exe
C:\Program Files\AutocompletePro\AutocompletePro.dll
C:\Program Files\AutocompletePro\InstTracker.exe
C:\Program Files\AutocompletePro\support@predictad.com\chrome.manifest
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.js
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\options.xul
C:\Program Files\AutocompletePro\support@predictad.com\chrome\content\utils.js
C:\Program Files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
C:\Program Files\AutocompletePro\support@predictad.com\install.rdf
C:\Program Files\AutocompletePro\TaskScheduler.dll
C:\Program Files\AutocompletePro\unins000.dat
C:\Program Files\AutocompletePro\unins000.exe
C:\Windows\system32\AutoRun.inf


(((((((((((((((((((((((   Dateien erstellt von 2012-02-28 bis 2012-03-30  ))))))))))))))))))))))))))))))


2012-03-30 13:12:08 . 2012-03-30 13:12:08	--------	d-----w-	C:\Users\Karout\AppData\Roaming\Simfy
2012-03-29 15:58:39 . 2012-03-29 15:58:39	--------	d-----w-	C:\Users\Karout\AppData\Local\Mozilla
2012-03-29 15:58:05 . 2012-03-29 15:58:09	--------	d-----w-	C:\Users\Karout\AppData\Local\Mozilla Firefox
2012-03-28 18:01:25 . 2012-03-28 18:01:25	--------	d--h--w-	C:\ProgramData\CanonBJ
2012-03-28 17:14:08 . 2012-03-28 17:14:08	--------	d-----w-	C:\Users\Karout\AppData\Local\Apple
2012-03-25 12:58:40 . 2012-03-25 13:16:58	--------	d-----w-	C:\Users\Karout\AppData\Roaming\Skype
2012-03-25 12:58:19 . 2012-03-28 17:33:11	--------	d-----w-	C:\Users\Karout\AppData\Local\Adobe
2012-03-25 11:53:09 . 2012-03-25 11:53:09	--------	d-----w-	C:\Users\Karout\AppData\Local\HP
2012-03-25 11:50:55 . 2012-03-25 11:50:55	--------	d-----w-	C:\Users\Karout\AppData\Roaming\HP
2012-03-25 11:46:03 . 2012-03-25 11:46:03	--------	d-----w-	C:\Users\Karout\AppData\Local\Opera
2012-03-25 11:45:24 . 2012-03-25 11:45:24	--------	d-----w-	C:\Users\Karout\AppData\Roaming\Avira
2012-03-25 11:45:20 . 2012-03-25 11:45:20	--------	d-----w-	C:\Users\Karout\AppData\Roaming\ATI
2012-03-25 11:45:20 . 2012-03-25 11:45:20	--------	d-----w-	C:\Users\Karout\AppData\Local\ATI
2012-03-25 11:44:54 . 2012-03-25 11:44:57	--------	d-----w-	C:\ProgramData\Messenger Plus!
2012-03-25 11:44:40 . 2012-03-25 11:44:43	--------	d-----w-	C:\Users\Karout\AppData\Roaming\Apple Computer
2012-03-23 13:33:50 . 2012-03-23 13:33:50	704512	------w-	C:\Windows\system32\jpgm0109.dll
2012-03-23 13:33:50 . 2012-03-23 13:33:50	464384	----a-w-	C:\Windows\system32\ntqjxeh5.sys
2012-03-23 13:01:25 . 2012-03-14 02:15:38	6582328	------w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{888AD71F-8F0B-46B3-B72C-89B0CB86DC46}\mpengine.dll
2012-03-19 15:17:18 . 2012-03-19 15:17:23	--------	d-----w-	C:\Program Files\simfy
2012-03-14 15:19:38 . 2012-02-02 15:16:25	2044416	----a-w-	C:\Windows\system32\win32k.sys
2012-03-14 15:19:33 . 2012-02-14 15:45:30	219648	----a-w-	C:\Windows\system32\d3d10_1core.dll
2012-03-14 15:19:33 . 2012-02-13 13:44:40	1068544	----a-w-	C:\Windows\system32\DWrite.dll
2012-03-14 15:19:32 . 2012-02-14 15:45:30	160768	----a-w-	C:\Windows\system32\d3d10_1.dll
2012-03-14 15:19:32 . 2012-02-13 14:12:08	1172480	----a-w-	C:\Windows\system32\d3d10warp.dll
2012-03-14 15:19:32 . 2012-02-13 13:47:57	683008	----a-w-	C:\Windows\system32\d2d1.dll
2012-03-14 15:19:27 . 2012-01-31 10:59:56	2409784	----a-w-	C:\Program Files\Windows Mail\OESpamFilter.dat
2012-03-14 15:18:19 . 2012-01-09 15:54:08	613376	----a-w-	C:\Windows\system32\rdpencom.dll
2012-03-14 15:18:19 . 2012-01-09 13:58:29	180736	----a-w-	C:\Windows\system32\drivers\rdpwd.sys
2012-03-08 15:11:36 . 2012-03-08 15:11:36	--------	d-----w-	C:\Program Files\Kingsoft
.


((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-03-23 12:37:47 . 2011-12-26 11:02:14	221184	----a-w-	C:\Windows\system32\aptwdhlrc.dll
2012-02-23 07:18:36 . 2011-02-24 16:13:08	237072	------w-	C:\Windows\system32\MpSigStub.exe
2012-01-11 13:34:23 . 2012-01-11 13:34:23	614400	------w-	C:\Windows\system32\pngjmhgf.dll
2011-02-22 19:31:14 . 2011-02-22 19:31:17	119808	----a-w-	C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll


((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))


*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 14:02:22	3863136	----a-w-	C:\Program Files\ConduitEngine\ConduitEngine.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
2011-01-26 15:52:08	101096	----a-w-	C:\Program Files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54:02	175912	----a-w-	C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c9508125-4747-4733-b048-e4b82dc9716d}]
2010-09-12 14:02:22	3863136	----a-w-	C:\Program Files\PHPNukeDE\tbPHPN.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c9508125-4747-4733-b048-e4b82dc9716d}"= "C:\Program Files\PHPNukeDE\tbPHPN.dll" [2010-09-12 14:02:22 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "C:\Program Files\ConduitEngine\ConduitEngine.dll" [2010-09-12 14:02:22 3863136]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-01-17 14:54:02 175912]

[HKEY_CLASSES_ROOT\clsid\{c9508125-4747-4733-b048-e4b82dc9716d}]

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 09:57:52 3784704]
"InstallProcess"="c:\oem\process\process.cmd" [2007-02-01 15:25:36 16183]
"HostManager"="C:\Program Files\Common Files\AOL\1298400348\ee\AOLSoftware.exe" [2006-11-14 13:47:54 50736]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 10:40:22 232184]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-02-22 19:31:14 30192]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-24 21:08:40 107112]
"IS CfgWiz"="C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2006-10-24 07:19:18 46728]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-26 23:18:38 22696]
"PCMService"="c:\Program Files\Powercinema\PCMService.exe" [2007-02-14 19:45:48 159744]
"VX1000"="C:\Windows\vVX1000.exe" [2010-05-20 13:27:24 762736]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 13:22:55 281768]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 10:44:46 248552]
"Iminent.Notifier"="C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe" [2011-01-26 15:52:14 1863168]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 13:27:24 119152]
"PlusService"="C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-10-24 15:51:19 801792]
"NetFxUpdate_v1.1.4322"="C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 15:20:00 106496]
"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 22:25:58 59240]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 19:34:40 49152]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - COMHOST
*Deregistered* - ntqjxeh5

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
Update-Service-Installer-Service	REG_MULTI_SZ   	Update-Service-Installer-Service
Update-Service	REG_MULTI_SZ   	Update-Service
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

Inhalt des "geplante Tasks" Ordners

2012-03-30 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 15:10:00 . 2011-04-15 15:09:34]

2012-03-30 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-15 15:10:00 . 2011-04-15 15:09:34]

2012-03-30 C:\Windows\Tasks\WpsUpdateTask_Nadine.job
- C:\Program Files\Kingsoft\Kingsoft Writer\office6\wpsupdate.exe [2011-08-24 16:00:00 . 2011-08-24 16:00:00]


------- Zusätzlicher Suchlauf -------

mStart Page = hxxp://home.sweetim.com
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - 

- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll
HKLM_ActiveSetup-ccc-core-static - msiexec
AddRemove-Activation Assistant for the 2007 Microsoft Office suites - C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe
AddRemove-AutocompletePro2_is1 - C:\Program Files\AutocompletePro\unins000.exe
         

Alt 30.03.2012, 18:25   #12
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



ist das das ganze log, bitte mal als txt anhängen
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 30.03.2012, 18:33   #13
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Auf C:/ war dieses ComboFix.txt nicht drin. Habe sie als C:/ComboFix/ComboFix.txt gefunden.

-> Was mit noch eingefallen ist: Als ich ComboFix gestartet habe, hat es mir angezeigt, dass ComboFix abgelaufen ist. Man konnte es aber in "reduzierter Funktionalität" auszuführen.
Angehängte Dateien
Dateityp: txt ComboFix.txt (10,8 KB, 135x aufgerufen)

Geändert von 3Kay (30.03.2012 um 18:44 Uhr) Grund: Zusatz

Alt 31.03.2012, 19:26   #14
markusg
/// Malware-holic
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



tdss killer nutzen, log bitte posten:
http://www.trojaner-board.de/82358-t...entfernen.html
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 31.03.2012, 19:54   #15
3Kay
 
TR/Crypt.XPACK.Gen' [trojan] - Standard

TR/Crypt.XPACK.Gen' [trojan]



Code:
ATTFilter
20:50:26.0749 50888	TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
20:50:26.0921 50888	============================================================
20:50:26.0921 50888	Current date / time: 2012/03/31 20:50:26.0921
20:50:26.0921 50888	SystemInfo:
20:50:26.0921 50888	
20:50:26.0921 50888	OS Version: 6.0.6002 ServicePack: 2.0
20:50:26.0921 50888	Product type: Workstation
20:50:26.0921 50888	ComputerName: KAROUT-PC
20:50:26.0921 50888	UserName: Nadine
20:50:26.0921 50888	Windows directory: C:\Windows
20:50:26.0921 50888	System windows directory: C:\Windows
20:50:26.0921 50888	Processor architecture: Intel x86
20:50:26.0921 50888	Number of processors: 1
20:50:26.0921 50888	Page size: 0x1000
20:50:26.0921 50888	Boot type: Normal boot
20:50:26.0921 50888	============================================================
20:50:28.0452 50888	Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:50:28.0530 50888	\Device\Harddisk0\DR0:
20:50:28.0546 50888	MBR used
20:50:28.0546 50888	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1000000
20:50:28.0561 50888	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1000800, BlocksNum 0x11A18EB0
20:50:28.0593 50888	Initialize success
20:50:28.0593 50888	============================================================
20:50:30.0968 61212	============================================================
20:50:30.0968 61212	Scan started
20:50:30.0968 61212	Mode: Manual; 
20:50:30.0968 61212	============================================================
20:50:32.0233 61212	ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
20:50:32.0249 61212	ACPI - ok
20:50:32.0405 61212	adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:50:32.0499 61212	adp94xx - ok
20:50:32.0608 61212	adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:50:32.0640 61212	adpahci - ok
20:50:32.0780 61212	adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:50:32.0811 61212	adpu160m - ok
20:50:32.0936 61212	adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:50:32.0968 61212	adpu320 - ok
20:50:33.0077 61212	AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:50:33.0093 61212	AeLookupSvc - ok
20:50:33.0233 61212	AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
20:50:33.0249 61212	AFD - ok
20:50:33.0358 61212	agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:50:33.0374 61212	agp440 - ok
20:50:33.0483 61212	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:50:33.0515 61212	aic78xx - ok
20:50:33.0624 61212	ALG             (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
20:50:33.0640 61212	ALG - ok
20:50:33.0827 61212	aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
20:50:33.0858 61212	aliide - ok
20:50:33.0983 61212	amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:50:34.0015 61212	amdagp - ok
20:50:34.0155 61212	amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
20:50:34.0171 61212	amdide - ok
20:50:34.0436 61212	AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:50:34.0499 61212	AmdK7 - ok
20:50:34.0702 61212	AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
20:50:34.0718 61212	AmdK8 - ok
20:50:34.0952 61212	AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:50:34.0968 61212	AntiVirSchedulerService - ok
20:50:35.0155 61212	AntiVirService  (72d90e56563165984224493069c69ed4) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:50:35.0218 61212	AntiVirService - ok
20:50:35.0436 61212	AOL ACS         (85180cf88c5ebad73b452a43a004ca51) C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
20:50:35.0515 61212	AOL ACS - ok
20:50:35.0655 61212	Appinfo         (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
20:50:35.0686 61212	Appinfo - ok
20:50:35.0936 61212	arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:50:35.0968 61212	arc - ok
20:50:36.0077 61212	arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:50:36.0108 61212	arcsas - ok
20:50:36.0280 61212	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
20:50:36.0296 61212	AsyncMac - ok
20:50:36.0515 61212	atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
20:50:36.0515 61212	atapi - ok
20:50:36.0655 61212	Ati External Event Utility (b488fc27338b83c9fc91d684467eeb7e) C:\Windows\system32\Ati2evxx.exe
20:50:36.0686 61212	Ati External Event Utility - ok
20:50:36.0921 61212	AtiPcie         (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
20:50:36.0936 61212	AtiPcie - ok
20:50:37.0171 61212	AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:50:37.0186 61212	AudioEndpointBuilder - ok
20:50:37.0296 61212	Audiosrv        (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:50:37.0296 61212	Audiosrv - ok
20:50:37.0483 61212	Automatisches LiveUpdate - Scheduler (018fe8992fe4d70b69ae866ea0d83f0d) C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
20:50:37.0530 61212	Automatisches LiveUpdate - Scheduler - ok
20:50:37.0718 61212	avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
20:50:37.0749 61212	avgntflt - ok
20:50:37.0968 61212	avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
20:50:37.0999 61212	avipbb - ok
20:50:38.0296 61212	BBSvc           (0d1ea7509f394d8b705b239ee71f5118) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
20:50:38.0327 61212	BBSvc - ok
20:50:38.0468 61212	BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
20:50:38.0515 61212	BcmSqlStartupSvc - ok
20:50:38.0702 61212	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
20:50:38.0718 61212	Beep - ok
20:50:39.0046 61212	BFE             (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll
20:50:39.0061 61212	BFE - ok
20:50:39.0296 61212	BITS            (93952506c6d67330367f7e7934b6a02f) C:\Windows\system32\qmgr.dll
20:50:39.0327 61212	BITS - ok
20:50:39.0483 61212	blbdrive - ok
20:50:39.0655 61212	Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
20:50:39.0702 61212	Bonjour Service - ok
20:50:39.0874 61212	bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
20:50:39.0890 61212	bowser - ok
20:50:40.0015 61212	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:50:40.0046 61212	BrFiltLo - ok
20:50:40.0280 61212	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:50:40.0327 61212	BrFiltUp - ok
20:50:40.0546 61212	Browser         (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
20:50:40.0546 61212	Browser - ok
20:50:40.0671 61212	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:50:40.0702 61212	Brserid - ok
20:50:40.0890 61212	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:50:40.0936 61212	BrSerWdm - ok
20:50:41.0108 61212	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:50:41.0140 61212	BrUsbMdm - ok
20:50:41.0358 61212	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:50:41.0421 61212	BrUsbSer - ok
20:50:41.0515 61212	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:50:41.0546 61212	BTHMODEM - ok
20:50:41.0640 61212	catchme - ok
20:50:41.0811 61212	ccEvtMgr        (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:41.0843 61212	ccEvtMgr - ok
20:50:41.0905 61212	ccSetMgr        (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:41.0905 61212	ccSetMgr - ok
20:50:42.0077 61212	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
20:50:42.0093 61212	cdfs - ok
20:50:42.0233 61212	cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
20:50:42.0265 61212	cdrom - ok
20:50:42.0436 61212	CertPropSvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:50:42.0436 61212	CertPropSvc - ok
20:50:42.0561 61212	circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
20:50:42.0593 61212	circlass - ok
20:50:42.0905 61212	CLCapSvc        (cd6d23e3adf57035c30b53843f21a416) c:\Program Files\Powercinema\Kernel\TV\CLCapSvc.exe
20:50:42.0983 61212	CLCapSvc - ok
20:50:43.0140 61212	CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
20:50:43.0155 61212	CLFS - ok
20:50:43.0311 61212	clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:50:43.0358 61212	clr_optimization_v2.0.50727_32 - ok
20:50:43.0530 61212	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:50:43.0546 61212	clr_optimization_v4.0.30319_32 - ok
20:50:43.0765 61212	CLSched         (4fa0b771df428de79ce96108e5370841) c:\Program Files\Powercinema\Kernel\TV\CLSched.exe
20:50:43.0811 61212	CLSched - ok
20:50:43.0968 61212	CLTNetCnService (e7aab1a32ac2eea4c4b735b8d034c802) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
20:50:43.0968 61212	CLTNetCnService - ok
20:50:44.0108 61212	cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
20:50:44.0140 61212	cmdide - ok
20:50:44.0327 61212	comHost         (7ce352882828c12dd7632b172253a02c) C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
20:50:44.0358 61212	comHost - ok
20:50:44.0499 61212	Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
20:50:44.0546 61212	Compbatt - ok
20:50:44.0655 61212	COMSysApp - ok
20:50:44.0827 61212	crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:50:44.0858 61212	crcdisk - ok
20:50:45.0061 61212	Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:50:45.0077 61212	Crusoe - ok
20:50:45.0358 61212	CryptSvc        (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll
20:50:45.0374 61212	CryptSvc - ok
20:50:45.0640 61212	DcomLaunch      (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:50:45.0671 61212	DcomLaunch - ok
20:50:45.0811 61212	DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
20:50:45.0858 61212	DfsC - ok
20:50:46.0311 61212	DFSR            (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
20:50:46.0530 61212	DFSR - ok
20:50:46.0686 61212	Dhcp            (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
20:50:46.0702 61212	Dhcp - ok
20:50:46.0874 61212	disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
20:50:46.0936 61212	disk - ok
20:50:47.0140 61212	Dnscache        (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
20:50:47.0155 61212	Dnscache - ok
20:50:47.0327 61212	dot3svc         (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
20:50:47.0327 61212	dot3svc - ok
20:50:47.0483 61212	Dot4            (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
20:50:47.0561 61212	Dot4 - ok
20:50:47.0686 61212	Dot4Print       (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
20:50:47.0702 61212	Dot4Print - ok
20:50:48.0015 61212	dot4usb         (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
20:50:48.0046 61212	dot4usb - ok
20:50:48.0218 61212	DPS             (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
20:50:48.0218 61212	DPS - ok
20:50:48.0530 61212	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
20:50:48.0546 61212	drmkaud - ok
20:50:48.0765 61212	DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
20:50:48.0780 61212	DXGKrnl - ok
20:50:48.0874 61212	E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:50:48.0905 61212	E1G60 - ok
20:50:48.0999 61212	EapHost         (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
20:50:48.0999 61212	EapHost - ok
20:50:49.0171 61212	Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
20:50:49.0218 61212	Ecache - ok
20:50:49.0452 61212	eeCtrl          (fb069d8270853023f6e315745b5bbad4) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
20:50:49.0515 61212	eeCtrl - ok
20:50:49.0796 61212	elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:50:49.0858 61212	elxstor - ok
20:50:50.0061 61212	EMDMgmt         (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
20:50:50.0077 61212	EMDMgmt - ok
20:50:50.0452 61212	EventSystem     (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
20:50:50.0468 61212	EventSystem - ok
20:50:50.0765 61212	exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
20:50:50.0796 61212	exfat - ok
20:50:50.0936 61212	fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
20:50:50.0968 61212	fastfat - ok
20:50:51.0061 61212	fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:50:51.0077 61212	fdc - ok
20:50:51.0265 61212	fdPHost         (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
20:50:51.0280 61212	fdPHost - ok
20:50:51.0405 61212	FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:50:51.0405 61212	FDResPub - ok
20:50:51.0499 61212	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
20:50:51.0530 61212	FileInfo - ok
20:50:51.0640 61212	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
20:50:51.0655 61212	Filetrace - ok
20:50:51.0765 61212	flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:50:51.0780 61212	flpydisk - ok
20:50:51.0890 61212	FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
20:50:51.0905 61212	FltMgr - ok
20:50:52.0061 61212	FontCache       (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
20:50:52.0093 61212	FontCache - ok
20:50:52.0218 61212	FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:50:52.0233 61212	FontCache3.0.0.0 - ok
20:50:52.0343 61212	fssfltr         (491e9d9a26a745f6ae7d570849f4bd87) C:\Windows\system32\DRIVERS\fssfltr.sys
20:50:52.0343 61212	fssfltr - ok
20:50:52.0530 61212	fsssvc          (45b52394f9624237f33a8a3d73c0b221) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
20:50:52.0624 61212	fsssvc - ok
20:50:52.0733 61212	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
20:50:52.0749 61212	Fs_Rec - ok
20:50:52.0827 61212	gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:50:52.0858 61212	gagp30kx - ok
20:50:53.0015 61212	GoogleDesktopManager-051210-111108 (9f5f2f0fb0a7f5aa9f16b9a7b6dad89f) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
20:50:53.0015 61212	GoogleDesktopManager-051210-111108 - ok
20:50:53.0140 61212	gpsvc           (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
20:50:53.0155 61212	gpsvc - ok
20:50:53.0358 61212	gupdate         (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
20:50:53.0358 61212	gupdate - ok
20:50:53.0468 61212	gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
20:50:53.0468 61212	gupdatem - ok
20:50:53.0686 61212	gusvc           (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
20:50:53.0733 61212	gusvc - ok
20:50:53.0921 61212	HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:50:53.0936 61212	HDAudBus - ok
20:50:54.0124 61212	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:50:54.0140 61212	HidBth - ok
20:50:54.0405 61212	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:50:54.0468 61212	HidIr - ok
20:50:54.0733 61212	hidserv         (84067081f3318162797385e11a8f0582) C:\Windows\System32\hidserv.dll
20:50:54.0749 61212	hidserv - ok
20:50:54.0952 61212	HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
20:50:54.0968 61212	HidUsb - ok
20:50:55.0155 61212	hkmsvc          (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
20:50:55.0155 61212	hkmsvc - ok
20:50:55.0530 61212	HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:50:55.0546 61212	HpCISSs - ok
20:50:55.0765 61212	hpqcxs08        (38d6b51f04def7fb248fa56e4c47407e) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
20:50:55.0780 61212	hpqcxs08 - ok
20:50:55.0999 61212	hpqddsvc        (3ee4a63539ec04ee2d4bd293985087ab) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
20:50:55.0999 61212	hpqddsvc - ok
20:50:56.0530 61212	HTTP            (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
20:50:56.0608 61212	HTTP - ok
20:50:56.0749 61212	i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:50:56.0796 61212	i2omp - ok
20:50:56.0952 61212	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
20:50:56.0999 61212	i8042prt - ok
20:50:57.0327 61212	iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:50:57.0374 61212	iaStorV - ok
20:50:57.0530 61212	IDriverT        (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
20:50:57.0561 61212	IDriverT - ok
20:50:57.0952 61212	idsvc           (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:50:58.0108 61212	idsvc - ok
20:50:58.0218 61212	IDSvix86 - ok
20:50:58.0561 61212	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:50:58.0577 61212	iirsp - ok
20:50:58.0874 61212	IKEEXT          (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
20:50:58.0921 61212	IKEEXT - ok
20:50:59.0546 61212	IntcAzAudAddService (a47b2875680ad67b35c6150bd0203056) C:\Windows\system32\drivers\RTKVHDA.sys
20:50:59.0671 61212	IntcAzAudAddService - ok
20:51:00.0093 61212	intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
20:51:00.0108 61212	intelide - ok
20:51:00.0436 61212	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
20:51:00.0436 61212	intelppm - ok
20:51:00.0624 61212	IPBusEnum       (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
20:51:00.0640 61212	IPBusEnum - ok
20:51:00.0905 61212	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:51:00.0952 61212	IpFilterDriver - ok
20:51:01.0233 61212	iphlpsvc        (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll
20:51:01.0265 61212	iphlpsvc - ok
20:51:01.0452 61212	IpInIp - ok
20:51:01.0577 61212	IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:51:01.0593 61212	IPMIDRV - ok
20:51:01.0718 61212	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
20:51:01.0749 61212	IPNAT - ok
20:51:01.0936 61212	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
20:51:01.0983 61212	IRENUM - ok
20:51:02.0093 61212	isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:51:02.0155 61212	isapnp - ok
20:51:02.0311 61212	iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
20:51:02.0311 61212	iScsiPrt - ok
20:51:02.0749 61212	ISPwdSvc        (36474fde02f8422b8b1a52ead9894dbc) C:\Program Files\Norton Internet Security\isPwdSvc.exe
20:51:02.0765 61212	ISPwdSvc - ok
20:51:02.0858 61212	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:51:02.0874 61212	iteatapi - ok
20:51:03.0061 61212	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:51:03.0093 61212	iteraid - ok
20:51:03.0233 61212	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:51:03.0280 61212	kbdclass - ok
20:51:03.0405 61212	kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
20:51:03.0436 61212	kbdhid - ok
20:51:03.0546 61212	KeyIso          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:03.0546 61212	KeyIso - ok
20:51:03.0655 61212	KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
20:51:03.0733 61212	KSecDD - ok
20:51:03.0843 61212	KtmRm           (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
20:51:03.0858 61212	KtmRm - ok
20:51:03.0968 61212	LanmanServer    (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\System32\srvsvc.dll
20:51:03.0983 61212	LanmanServer - ok
20:51:04.0093 61212	LanmanWorkstation (534d0e286fbcdf35b5d5933f0fb03132) C:\Windows\System32\aptwdhlrc.dll
20:51:04.0108 61212	LanmanWorkstation - ok
20:51:04.0265 61212	LiveUpdate      (3c7fcbbc35e0a52ce9b12e9cc4f5b991) C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
20:51:04.0421 61212	LiveUpdate - ok
20:51:04.0546 61212	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
20:51:04.0561 61212	lltdio - ok
20:51:04.0671 61212	lltdsvc         (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
20:51:04.0702 61212	lltdsvc - ok
20:51:04.0796 61212	lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:51:04.0796 61212	lmhosts - ok
20:51:04.0936 61212	LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:51:04.0968 61212	LSI_FC - ok
20:51:05.0218 61212	LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:51:05.0265 61212	LSI_SAS - ok
20:51:05.0358 61212	LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:51:05.0374 61212	LSI_SCSI - ok
20:51:05.0530 61212	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
20:51:05.0546 61212	luafv - ok
20:51:05.0733 61212	megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:51:05.0780 61212	megasas - ok
20:51:05.0952 61212	MMCSS           (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:51:05.0952 61212	MMCSS - ok
20:51:06.0186 61212	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
20:51:06.0233 61212	Modem - ok
20:51:06.0499 61212	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
20:51:06.0499 61212	monitor - ok
20:51:06.0796 61212	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
20:51:06.0874 61212	mouclass - ok
20:51:07.0296 61212	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
20:51:07.0327 61212	mouhid - ok
20:51:07.0593 61212	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
20:51:07.0640 61212	MountMgr - ok
20:51:07.0843 61212	mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:51:07.0890 61212	mpio - ok
20:51:08.0140 61212	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
20:51:08.0202 61212	mpsdrv - ok
20:51:08.0499 61212	MpsSvc          (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll
20:51:08.0530 61212	MpsSvc - ok
20:51:08.0733 61212	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:51:08.0780 61212	Mraid35x - ok
20:51:09.0155 61212	MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
20:51:09.0186 61212	MRxDAV - ok
20:51:09.0421 61212	mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:51:09.0452 61212	mrxsmb - ok
20:51:09.0624 61212	mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:51:09.0686 61212	mrxsmb10 - ok
20:51:09.0827 61212	mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:51:09.0858 61212	mrxsmb20 - ok
20:51:10.0030 61212	msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
20:51:10.0046 61212	msahci - ok
20:51:10.0186 61212	MSCamSvc        (d98350792a7ce82e7459a7c36481beda) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
20:51:10.0233 61212	MSCamSvc - ok
20:51:10.0405 61212	msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:51:10.0436 61212	msdsm - ok
20:51:10.0546 61212	MSDTC           (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
20:51:10.0593 61212	MSDTC - ok
20:51:10.0733 61212	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
20:51:10.0749 61212	Msfs - ok
20:51:10.0905 61212	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
20:51:10.0983 61212	msisadrv - ok
20:51:11.0108 61212	MSiSCSI         (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
20:51:11.0171 61212	MSiSCSI - ok
20:51:11.0374 61212	msiserver - ok
20:51:11.0530 61212	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
20:51:11.0561 61212	MSKSSRV - ok
20:51:11.0733 61212	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
20:51:11.0733 61212	MSPCLOCK - ok
20:51:11.0952 61212	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
20:51:12.0030 61212	MSPQM - ok
20:51:12.0343 61212	MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
20:51:12.0421 61212	MsRPC - ok
20:51:12.0686 61212	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
20:51:12.0702 61212	mssmbios - ok
20:51:13.0015 61212	MSSQL$MSSMLBIZ - ok
20:51:13.0186 61212	MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
20:51:13.0218 61212	MSSQLServerADHelper - ok
20:51:13.0515 61212	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
20:51:13.0515 61212	MSTEE - ok
20:51:13.0640 61212	Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
20:51:13.0655 61212	Mup - ok
20:51:13.0827 61212	napagent        (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
20:51:13.0843 61212	napagent - ok
20:51:14.0061 61212	NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
20:51:14.0124 61212	NativeWifiP - ok
20:51:14.0343 61212	NAVENG - ok
20:51:14.0530 61212	NAVEX15 - ok
20:51:14.0780 61212	NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
20:51:14.0796 61212	NDIS - ok
20:51:15.0077 61212	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
20:51:15.0202 61212	NdisTapi - ok
20:51:15.0327 61212	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
20:51:15.0374 61212	Ndisuio - ok
20:51:15.0577 61212	NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
20:51:15.0624 61212	NdisWan - ok
20:51:15.0749 61212	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
20:51:15.0780 61212	NDProxy - ok
20:51:15.0921 61212	Net Driver HPZ12 (51c6d8bfbd4ea5b62a1ba7f4469250d3) C:\Windows\system32\HPZinw12.dll
20:51:15.0952 61212	Net Driver HPZ12 - ok
20:51:16.0108 61212	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
20:51:16.0155 61212	NetBIOS - ok
20:51:16.0577 61212	netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
20:51:16.0671 61212	netbt - ok
20:51:16.0811 61212	Netlogon        (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:16.0811 61212	Netlogon - ok
20:51:16.0999 61212	Netman          (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
20:51:17.0030 61212	Netman - ok
20:51:17.0140 61212	netprofm        (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
20:51:17.0140 61212	netprofm - ok
20:51:17.0265 61212	NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:51:17.0296 61212	NetTcpPortSharing - ok
20:51:17.0390 61212	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:51:17.0405 61212	nfrd960 - ok
20:51:17.0530 61212	NlaSvc          (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
20:51:17.0546 61212	NlaSvc - ok
20:51:17.0655 61212	Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
20:51:17.0671 61212	Npfs - ok
20:51:17.0780 61212	nsi             (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
20:51:17.0780 61212	nsi - ok
20:51:17.0890 61212	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
20:51:17.0905 61212	nsiproxy - ok
20:51:18.0077 61212	Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
20:51:18.0171 61212	Ntfs - ok
20:51:18.0374 61212	ntqjxeh5        (df37d15f5638882b823e4070b80533d3) C:\Windows\system32\ntqjxeh5.sys
20:51:18.0452 61212	ntqjxeh5 - ok
20:51:18.0530 61212	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:51:18.0546 61212	ntrigdigi - ok
20:51:18.0671 61212	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
20:51:18.0686 61212	Null - ok
20:51:18.0796 61212	nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
20:51:18.0811 61212	nvraid - ok
20:51:18.0890 61212	nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
20:51:18.0905 61212	nvstor - ok
20:51:18.0999 61212	nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:51:19.0015 61212	nv_agp - ok
20:51:19.0093 61212	NwlnkFlt - ok
20:51:19.0155 61212	NwlnkFwd - ok
20:51:19.0249 61212	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:51:19.0311 61212	odserv - ok
20:51:19.0421 61212	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
20:51:19.0421 61212	ohci1394 - ok
20:51:19.0515 61212	ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:51:19.0546 61212	ose - ok
20:51:19.0671 61212	p2pimsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:19.0702 61212	p2pimsvc - ok
20:51:19.0765 61212	p2psvc          (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:19.0780 61212	p2psvc - ok
20:51:19.0905 61212	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:51:19.0936 61212	Parport - ok
20:51:20.0390 61212	partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
20:51:20.0452 61212	partmgr - ok
20:51:20.0655 61212	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:51:20.0702 61212	Parvdm - ok
20:51:21.0061 61212	PcaSvc          (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
20:51:21.0077 61212	PcaSvc - ok
20:51:21.0468 61212	pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
20:51:21.0499 61212	pci - ok
20:51:21.0702 61212	pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
20:51:21.0749 61212	pciide - ok
20:51:21.0968 61212	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
20:51:22.0015 61212	pcmcia - ok
20:51:22.0280 61212	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:51:22.0452 61212	PEAUTH - ok
20:51:22.0733 61212	pla             (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
20:51:22.0796 61212	pla - ok
20:51:23.0061 61212	PlugPlay        (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
20:51:23.0077 61212	PlugPlay - ok
20:51:23.0202 61212	Pml Driver HPZ12 (79834aa2fbf9fe81eebb229024f6f7fc) C:\Windows\system32\HPZipm12.dll
20:51:23.0202 61212	Pml Driver HPZ12 - ok
20:51:23.0390 61212	PNRPAutoReg     (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:23.0405 61212	PNRPAutoReg - ok
20:51:23.0499 61212	PNRPsvc         (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:51:23.0499 61212	PNRPsvc - ok
20:51:23.0765 61212	PolicyAgent     (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
20:51:23.0811 61212	PolicyAgent - ok
20:51:24.0218 61212	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
20:51:24.0249 61212	PptpMiniport - ok
20:51:24.0358 61212	Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:51:24.0390 61212	Processor - ok
20:51:24.0593 61212	ProfSvc         (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
20:51:24.0593 61212	ProfSvc - ok
20:51:24.0843 61212	ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:24.0843 61212	ProtectedStorage - ok
20:51:25.0015 61212	PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
20:51:25.0030 61212	PSched - ok
20:51:25.0327 61212	PxHelp20        (f7bb4e7a7c02ab4a2672937e124e306e) C:\Windows\system32\Drivers\PxHelp20.sys
20:51:25.0405 61212	PxHelp20 - ok
20:51:25.0765 61212	ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:51:25.0905 61212	ql2300 - ok
20:51:26.0108 61212	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:51:26.0140 61212	ql40xx - ok
20:51:26.0390 61212	QWAVE           (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
20:51:26.0452 61212	QWAVE - ok
20:51:26.0577 61212	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
20:51:26.0624 61212	QWAVEdrv - ok
20:51:27.0155 61212	R300            (e52b7a5010011c29063684cac1a6bbf0) C:\Windows\system32\DRIVERS\atikmdag.sys
20:51:27.0296 61212	R300 - ok
20:51:27.0452 61212	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
20:51:27.0468 61212	RasAcd - ok
20:51:27.0561 61212	RasAuto         (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
20:51:27.0593 61212	RasAuto - ok
20:51:27.0811 61212	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:51:27.0843 61212	Rasl2tp - ok
20:51:28.0140 61212	RasMan          (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll
20:51:28.0218 61212	RasMan - ok
20:51:28.0390 61212	RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
20:51:28.0436 61212	RasPppoe - ok
20:51:28.0561 61212	RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
20:51:28.0593 61212	RasSstp - ok
20:51:28.0874 61212	rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
20:51:28.0936 61212	rdbss - ok
20:51:29.0499 61212	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:51:29.0546 61212	RDPCDD - ok
20:51:29.0952 61212	rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:51:30.0046 61212	rdpdr - ok
20:51:30.0280 61212	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
20:51:30.0311 61212	RDPENCDD - ok
20:51:30.0640 61212	RDPWD           (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
20:51:30.0702 61212	RDPWD - ok
20:51:30.0999 61212	RemoteAccess    (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
20:51:31.0046 61212	RemoteAccess - ok
20:51:31.0405 61212	RemoteRegistry  (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll
20:51:31.0436 61212	RemoteRegistry - ok
20:51:31.0686 61212	RoxMediaDB9     (9638e5820858593a12005c753b03ceae) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
20:51:31.0749 61212	RoxMediaDB9 - ok
20:51:32.0061 61212	RoxWatch9       (910fba95ee4f56449aa81315884c8efd) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
20:51:32.0093 61212	RoxWatch9 - ok
20:51:32.0265 61212	RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:51:32.0265 61212	RpcLocator - ok
20:51:32.0483 61212	RpcSs           (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:51:32.0483 61212	RpcSs - ok
20:51:32.0671 61212	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
20:51:32.0733 61212	rspndr - ok
20:51:32.0952 61212	RTL8023xp       (959ef612d2ccfdb6d9e443f8e3655013) C:\Windows\system32\DRIVERS\Rtnicxp.sys
20:51:32.0968 61212	RTL8023xp - ok
20:51:33.0155 61212	SamSs           (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:51:33.0155 61212	SamSs - ok
20:51:33.0515 61212	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:51:33.0530 61212	sbp2port - ok
20:51:33.0749 61212	SCardSvr        (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
20:51:33.0780 61212	SCardSvr - ok
20:51:33.0952 61212	Schedule        (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
20:51:33.0999 61212	Schedule - ok
20:51:34.0233 61212	SCPolicySvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:51:34.0233 61212	SCPolicySvc - ok
20:51:34.0374 61212	SDRSVC          (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
20:51:34.0405 61212	SDRSVC - ok
20:51:34.0624 61212	SeaPort         (d358e077a0a05d9b12da22d137ee8464) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
20:51:34.0624 61212	SeaPort - ok
20:51:34.0733 61212	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:51:34.0749 61212	secdrv - ok
20:51:34.0905 61212	seclogon        (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
20:51:34.0921 61212	seclogon - ok
20:51:35.0061 61212	SENS            (a9bbab5759771e523f55563d6cbe140f) C:\Windows\system32\sens.dll
20:51:35.0077 61212	SENS - ok
20:51:35.0202 61212	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
20:51:35.0358 61212	Serenum - ok
20:51:35.0593 61212	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:51:35.0624 61212	Serial - ok
20:51:35.0733 61212	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
20:51:35.0749 61212	sermouse - ok
20:51:35.0983 61212	SessionEnv      (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
20:51:36.0015 61212	SessionEnv - ok
20:51:36.0108 61212	sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:51:36.0124 61212	sffdisk - ok
20:51:36.0327 61212	sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:51:36.0343 61212	sffp_mmc - ok
20:51:36.0640 61212	sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:51:36.0655 61212	sffp_sd - ok
20:51:36.0765 61212	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:51:36.0780 61212	sfloppy - ok
20:51:36.0936 61212	SharedAccess    (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
20:51:36.0968 61212	SharedAccess - ok
20:51:37.0124 61212	ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
20:51:37.0171 61212	ShellHWDetection - ok
20:51:37.0265 61212	sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:51:37.0311 61212	sisagp - ok
20:51:37.0405 61212	SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:51:37.0421 61212	SiSRaid2 - ok
20:51:37.0546 61212	SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:51:37.0593 61212	SiSRaid4 - ok
20:51:37.0780 61212	slsvc           (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
20:51:37.0874 61212	slsvc - ok
20:51:38.0015 61212	SLUINotify      (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
20:51:38.0061 61212	SLUINotify - ok
20:51:38.0171 61212	Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
20:51:38.0202 61212	Smb - ok
20:51:38.0327 61212	SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:51:38.0343 61212	SNMPTRAP - ok
20:51:38.0546 61212	SPBBCDrv        (905782bcf15b6e5af9905b77923c7fa2) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
20:51:38.0655 61212	SPBBCDrv - ok
20:51:38.0780 61212	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
20:51:38.0811 61212	spldr - ok
20:51:38.0921 61212	Spooler         (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
20:51:38.0936 61212	Spooler - ok
20:51:39.0046 61212	SQLBrowser      (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
20:51:39.0093 61212	SQLBrowser - ok
20:51:39.0202 61212	SQLWriter       (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
20:51:39.0202 61212	SQLWriter - ok
20:51:39.0327 61212	SRTSP           (15e29eb26dd53eb6385629f4622b5519) C:\Windows\system32\Drivers\SRTSP.SYS
20:51:39.0390 61212	SRTSP - ok
20:51:39.0483 61212	SRTSPL          (fd0c0333fae09dbd1170e0d607eca5c8) C:\Windows\system32\Drivers\SRTSPL.SYS
20:51:39.0530 61212	SRTSPL - ok
20:51:39.0655 61212	SRTSPX          (7e60a4a4035be470f47c6806da57db99) C:\Windows\system32\Drivers\SRTSPX.SYS
20:51:39.0686 61212	SRTSPX - ok
20:51:39.0811 61212	srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
20:51:39.0858 61212	srv - ok
20:51:39.0983 61212	srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
20:51:39.0999 61212	srv2 - ok
20:51:40.0108 61212	srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
20:51:40.0140 61212	srvnet - ok
20:51:40.0249 61212	SSDPSRV         (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
20:51:40.0265 61212	SSDPSRV - ok
20:51:40.0343 61212	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:51:40.0374 61212	ssmdrv - ok
20:51:40.0483 61212	SstpSvc         (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
20:51:40.0499 61212	SstpSvc - ok
20:51:40.0765 61212	StillCam        (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
20:51:40.0780 61212	StillCam - ok
20:51:40.0890 61212	stisvc          (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
20:51:40.0905 61212	stisvc - ok
20:51:41.0030 61212	stllssvr        (51778fd315c9882f1cbd932743e62a72) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
20:51:41.0046 61212	stllssvr - ok
20:51:41.0171 61212	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
20:51:41.0202 61212	swenum - ok
20:51:41.0452 61212	swprv           (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
20:51:41.0483 61212	swprv - ok
20:51:41.0718 61212	Symantec Core LC (2698cd77f4d73ea7988f0bc63de8e3d6) C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
20:51:42.0077 61212	Symantec Core LC - ok
20:51:42.0296 61212	SymAppCore      (2fe779b1a07747fed8074c433c3c4604) C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
20:51:42.0311 61212	SymAppCore - ok
20:51:42.0405 61212	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:51:42.0421 61212	Symc8xx - ok
20:51:42.0593 61212	SymEvent        (9d98270b5f10a4c84e8da417c30756e1) C:\Windows\system32\Drivers\SYMEVENT.SYS
20:51:42.0624 61212	SymEvent - ok
20:51:42.0780 61212	SYMREDRV        (7f4011a719bf30e3dbd84d3a0a45c91c) C:\Windows\System32\Drivers\SYMREDRV.SYS
20:51:42.0811 61212	SYMREDRV - ok
20:51:42.0936 61212	SYMTDI          (2f03cbdb0f22278d05d5d616c993ab58) C:\Windows\System32\Drivers\SYMTDI.SYS
20:51:42.0983 61212	SYMTDI - ok
20:51:43.0171 61212	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:51:43.0218 61212	Sym_hi - ok
20:51:43.0593 61212	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:51:43.0624 61212	Sym_u3 - ok
20:51:43.0921 61212	SysMain         (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
20:51:43.0952 61212	SysMain - ok
20:51:44.0249 61212	TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:51:44.0265 61212	TabletInputService - ok
20:51:44.0452 61212	TapiSrv         (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll
20:51:44.0530 61212	TapiSrv - ok
20:51:44.0718 61212	tbhsd           (77bd6143c6dce0a1bf7b5571bed860dc) C:\Windows\system32\drivers\tbhsd.sys
20:51:44.0749 61212	tbhsd - ok
20:51:44.0890 61212	TBS             (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
20:51:44.0905 61212	TBS - ok
20:51:45.0515 61212	Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
20:51:45.0624 61212	Tcpip - ok
20:51:45.0999 61212	Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
20:51:45.0999 61212	Tcpip6 - ok
20:51:46.0436 61212	tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
20:51:46.0499 61212	tcpipreg - ok
20:51:46.0640 61212	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
20:51:46.0671 61212	TDPIPE - ok
20:51:46.0811 61212	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
20:51:46.0858 61212	TDTCP - ok
20:51:47.0311 61212	tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
20:51:47.0374 61212	tdx - ok
20:51:47.0577 61212	TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
20:51:47.0593 61212	TermDD - ok
20:51:47.0890 61212	TermService     (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll
20:51:47.0905 61212	TermService - ok
20:51:48.0061 61212	Themes          (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
20:51:48.0061 61212	Themes - ok
20:51:48.0186 61212	THREADORDER     (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:51:48.0186 61212	THREADORDER - ok
20:51:48.0311 61212	TrkWks          (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
20:51:48.0311 61212	TrkWks - ok
20:51:48.0436 61212	TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
20:51:48.0436 61212	TrustedInstaller - ok
20:51:48.0577 61212	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:51:48.0593 61212	tssecsrv - ok
20:51:48.0796 61212	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
20:51:48.0811 61212	tunmp - ok
20:51:48.0999 61212	tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
20:51:49.0015 61212	tunnel - ok
20:51:49.0171 61212	uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:51:49.0186 61212	uagp35 - ok
20:51:49.0483 61212	udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
20:51:49.0546 61212	udfs - ok
20:51:49.0780 61212	UI0Detect       (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
20:51:49.0780 61212	UI0Detect - ok
20:51:49.0983 61212	uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:51:50.0015 61212	uliagpkx - ok
20:51:50.0202 61212	uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:51:50.0265 61212	uliahci - ok
20:51:50.0452 61212	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:51:50.0468 61212	UlSata - ok
20:51:50.0593 61212	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:51:50.0640 61212	ulsata2 - ok
20:51:50.0796 61212	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
20:51:50.0890 61212	umbus - ok
20:51:50.0999 61212	Update-Service  (d6acd2c46857250fdb0d832e47bbb4d8) C:\Windows\System32\UpdSvc.dll
20:51:51.0046 61212	Update-Service - ok
20:51:51.0233 61212	upnphost        (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
20:51:51.0265 61212	upnphost - ok
20:51:51.0405 61212	usbaudio        (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
20:51:51.0436 61212	usbaudio - ok
20:51:51.0608 61212	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
20:51:51.0640 61212	usbccgp - ok
20:51:51.0749 61212	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:51:51.0780 61212	usbcir - ok
20:51:51.0890 61212	usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
20:51:51.0905 61212	usbehci - ok
20:51:51.0999 61212	usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
20:51:52.0108 61212	usbhub - ok
20:51:52.0249 61212	usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
20:51:52.0249 61212	usbohci - ok
20:51:52.0374 61212	usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
20:51:52.0405 61212	usbprint - ok
20:51:52.0546 61212	usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
20:51:52.0546 61212	usbscan - ok
20:51:52.0671 61212	USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:51:52.0733 61212	USBSTOR - ok
20:51:52.0843 61212	usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
20:51:52.0858 61212	usbuhci - ok
20:51:52.0968 61212	UxSms           (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
20:51:52.0983 61212	UxSms - ok
20:51:53.0093 61212	vds             (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
20:51:53.0108 61212	vds - ok
20:51:53.0186 61212	vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:51:53.0218 61212	vga - ok
20:51:53.0327 61212	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
20:51:53.0343 61212	VgaSave - ok
20:51:53.0421 61212	viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:51:53.0421 61212	viaagp - ok
20:51:53.0499 61212	ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:51:53.0515 61212	ViaC7 - ok
20:51:53.0624 61212	viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
20:51:53.0655 61212	viaide - ok
20:51:53.0765 61212	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
20:51:53.0765 61212	volmgr - ok
20:51:53.0890 61212	volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
20:51:53.0952 61212	volmgrx - ok
20:51:54.0046 61212	volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
20:51:54.0061 61212	volsnap - ok
20:51:54.0171 61212	vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:51:54.0186 61212	vsmraid - ok
20:51:54.0327 61212	VSS             (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
20:51:54.0358 61212	VSS - ok
20:51:54.0577 61212	VX1000          (d22c6b9c2f840d403fd387ad207a4b16) C:\Windows\system32\DRIVERS\VX1000.sys
20:51:54.0686 61212	VX1000 - ok
20:51:54.0796 61212	W32Time         (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
20:51:54.0811 61212	W32Time - ok
20:51:54.0999 61212	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:51:55.0015 61212	WacomPen - ok
20:51:55.0218 61212	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:51:55.0280 61212	Wanarp - ok
20:51:55.0343 61212	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:51:55.0343 61212	Wanarpv6 - ok
20:51:55.0561 61212	wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\Windows\system32\DRIVERS\wanatw4.sys
20:51:55.0577 61212	wanatw - ok
20:51:55.0811 61212	wcncsvc         (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
20:51:55.0858 61212	wcncsvc - ok
20:51:55.0999 61212	WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:51:56.0015 61212	WcsPlugInService - ok
20:51:56.0233 61212	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
20:51:56.0249 61212	Wd - ok
20:51:56.0421 61212	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
20:51:56.0530 61212	Wdf01000 - ok
20:51:56.0718 61212	WdiServiceHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:51:56.0733 61212	WdiServiceHost - ok
20:51:56.0780 61212	WdiSystemHost   (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:51:56.0796 61212	WdiSystemHost - ok
20:51:57.0202 61212	WebClient       (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
20:51:57.0218 61212	WebClient - ok
20:51:57.0343 61212	Wecsvc          (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
20:51:57.0405 61212	Wecsvc - ok
20:51:57.0515 61212	wercplsupport   (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
20:51:57.0530 61212	wercplsupport - ok
20:51:57.0733 61212	WerSvc          (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
20:51:57.0780 61212	WerSvc - ok
20:51:57.0952 61212	WinDefend       (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
20:51:57.0952 61212	WinDefend - ok
20:51:57.0999 61212	WinHttpAutoProxySvc - ok
20:51:58.0249 61212	Winmgmt         (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
20:51:58.0280 61212	Winmgmt - ok
20:51:58.0577 61212	WinRM           (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
20:51:58.0671 61212	WinRM - ok
20:51:58.0936 61212	Wlansvc         (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
20:51:58.0999 61212	Wlansvc - ok
20:51:59.0171 61212	WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
20:51:59.0186 61212	WmiAcpi - ok
20:51:59.0499 61212	wmiApSrv        (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
20:51:59.0499 61212	wmiApSrv - ok
20:51:59.0749 61212	WMPNetworkSvc   (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:51:59.0780 61212	WMPNetworkSvc - ok
20:51:59.0968 61212	WPCSvc          (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
20:51:59.0999 61212	WPCSvc - ok
20:52:00.0155 61212	WPDBusEnum      (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
20:52:00.0171 61212	WPDBusEnum - ok
20:52:00.0311 61212	WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
20:52:00.0311 61212	WpdUsb - ok
20:52:00.0624 61212	WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:52:00.0718 61212	WPFFontCache_v0400 - ok
20:52:00.0858 61212	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
20:52:00.0905 61212	ws2ifsl - ok
20:52:01.0186 61212	wscsvc          (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\system32\wscsvc.dll
20:52:01.0218 61212	wscsvc - ok
20:52:01.0280 61212	WSearch - ok
20:52:01.0796 61212	wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:52:01.0874 61212	wuauserv - ok
20:52:02.0249 61212	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:52:02.0249 61212	WUDFRd - ok
20:52:02.0374 61212	wudfsvc         (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
20:52:02.0374 61212	wudfsvc - ok
20:52:02.0577 61212	X10Hid          (ab2d77bf7222b007717abb61b15f9ae2) C:\Windows\system32\Drivers\x10hid.sys
20:52:02.0608 61212	X10Hid - ok
20:52:02.0827 61212	x10nets         (5a0c788c5bc5f2c993cb60940adcf95e) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
20:52:02.0874 61212	x10nets - ok
20:52:02.0936 61212	MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
20:52:03.0061 61212	\Device\Harddisk0\DR0 - ok
20:52:03.0093 61212	Boot (0x1200)   (7dfbe882cd523ccab456f03c3e364095) \Device\Harddisk0\DR0\Partition0
20:52:03.0124 61212	\Device\Harddisk0\DR0\Partition0 - ok
20:52:03.0171 61212	Boot (0x1200)   (27f1e6389c260f4e9fadef4a8dc218f8) \Device\Harddisk0\DR0\Partition1
20:52:03.0171 61212	\Device\Harddisk0\DR0\Partition1 - ok
20:52:03.0171 61212	============================================================
20:52:03.0171 61212	Scan finished
20:52:03.0171 61212	============================================================
20:52:03.0186 61436	Detected object count: 0
20:52:03.0186 61436	Actual detected object count: 0
         
Jetzt bekomme ich den ähnlichen Virus mehrmals. Obwohl ich auf "Entfernen" geklickt habe, bekomme ich den Trojaner immer. Das hat mein Avira gemeldet:
Code:
ATTFilter
In der Datei 'C:\Windows\System32\jpgm0109.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
         
Code:
ATTFilter
Die Datei 'C:\Windows\System32\jpgm0109.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan].
Durchgeführte Aktion(en):
Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
Die Datei konnte nicht gelöscht werden!
Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
Die Datei konnte nicht gelöscht werden!
         
was muss ich nun machen? Ich muss grad den Trojaner jede 2. Minute entfernen. Und so wie es aussieht lässt er sich nicht entfernen.

-> Habe den PC neugestartet und nun lässt sich der Trojaner in die Quarantäneverzeichnis verschieben:

Code:
ATTFilter
Die Datei 'C:\Windows\System32\jpgm0109.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a83e652.qua' verschoben!
         

Antwort

Themen zu TR/Crypt.XPACK.Gen' [trojan]
.dll, antivir, avira, avira antivir, bilder, code, datei, desktop, drucker, festplatte, files, klicke, nicht mehr, nichts, ordner, papierkorb, programm, programme, start, symantec, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen', trojan, unerwünschtes programm, virus, zugriff



Ähnliche Themen: TR/Crypt.XPACK.Gen' [trojan]


  1. TR/Crypt.XPACK.Gen' [trojan]
    Plagegeister aller Art und deren Bekämpfung - 29.03.2014 (14)
  2. Win 7 64BIT TR/Crypt.XPACK.Gen2' [trojan]
    Log-Analyse und Auswertung - 22.01.2014 (7)
  3. 'TR/Crypt.XPACK.Gen' [trojan]
    Log-Analyse und Auswertung - 23.01.2013 (2)
  4. AntiVir hat folgede Viren gefunden: TR/Crypt.ZPACK.Gen2' & 'TR/Crypt.XPACK.Gen5' [trojan
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (33)
  5. Trojan.0Access / Trojan.Sirefef / TR/Crypt.XPACK.Gen
    Log-Analyse und Auswertung - 19.09.2012 (9)
  6. Virus - 'TR/Crypt.XPACK.Gen' [trojan]
    Plagegeister aller Art und deren Bekämpfung - 27.05.2011 (7)
  7. 'TR/Crypt.XPACK.Gen' [trojan] gefunden
    Plagegeister aller Art und deren Bekämpfung - 04.05.2011 (1)
  8. Entfernung von 'TR/Crypt.XPACK.Gen' [trojan]
    Plagegeister aller Art und deren Bekämpfung - 10.10.2010 (11)
  9. TR/Crypt.XPACK.Gen3 backdoor/trojan
    Log-Analyse und Auswertung - 29.09.2010 (35)
  10. TR/Crypt.XPACK.Gen2' [trojan].
    Plagegeister aller Art und deren Bekämpfung - 18.05.2010 (16)
  11. was muss ich nun tun 'TR/Crypt.XPACK.Gen' [trojan]
    Log-Analyse und Auswertung - 22.04.2010 (3)
  12. TR/Crypt.XPACK.Gen, Trojan.BHO.Gen und mehr
    Plagegeister aller Art und deren Bekämpfung - 21.01.2010 (14)
  13. 'TR/Crypt.XPACK.Gen' [trojan] gefunden...
    Log-Analyse und Auswertung - 22.11.2009 (4)
  14. TR/Crypt.XPACK.Gen - Trojan 4 mal auf dem pc gefunden
    Plagegeister aller Art und deren Bekämpfung - 05.10.2009 (2)
  15. trojaner: 'TR/Crypt.XPACK.Gen' [trojan]
    Mülltonne - 10.12.2008 (2)
  16. TR/Crypt.XPACK.Gen - Trojan
    Mülltonne - 26.10.2008 (0)
  17. 'TR/Crypt.XPACK.Gen [trojan]'
    Mülltonne - 11.07.2008 (0)

Zum Thema TR/Crypt.XPACK.Gen' [trojan] - Hallo, heute hat mein Avira AntiVir einen Virus gefunden: Code: Alles auswählen Aufklappen ATTFilter In der Datei 'C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll' wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden. - TR/Crypt.XPACK.Gen' [trojan]...
Archiv
Du betrachtest: TR/Crypt.XPACK.Gen' [trojan] auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.