Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Bundespolizeitrojaner entdeckt - Logs anbei

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 02.08.2012, 15:18   #1
Hydrom
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Hallo trojaner-board Team,

heute hat es mich anscheinend erwischt. Vorhin hat der Bundestrojaner/UKASH mein System lahmgelegt. Habe dann im abgesicherten Modus Malwarebytes laufen lassen und es wurde ein Trojan.Agent.Gen unter Quarantäne gestellt. Nachdem ich mir hier ein paar Threads durchgelesen habe, lies ich OTL, Avira, MalwareBytes, CCCleaner, Temp File Cleaner,adwcleaner durchlaufen. Am meisten beunruhigt mich ja das versteckte Objekt im Avira Log, Avira empfiehlt eine Rescue CD zu erstellen und die durchlaufen zu lassen... Hier meine Logs:

Avira
Code:
ATTFilter

Avira Professional Security
Erstellungsdatum der Reportdatei: Donnerstag, 2. August 2012  13:46

Es wird nach 4050057 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Plattform      : Windows 7 Home Premium
Windowsversion : (plain)  [6.1.7600]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : CHRIS-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1466    46760 Bytes  23.05.2012 16:50:00
AVSCAN.EXE     : 12.3.0.15     466896 Bytes  24.05.2012 15:08:06
AVSCAN.DLL     : 12.3.0.15      66256 Bytes  24.05.2012 15:08:06
LUKE.DLL       : 12.3.0.15      68304 Bytes  24.05.2012 15:08:24
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  24.05.2012 15:08:47
AVREG.DLL      : 12.3.0.17     232200 Bytes  24.05.2012 15:08:47
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 15:06:28
VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 15:07:02
VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 15:07:21
VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 15:07:28
VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 15:07:34
VBASE005.VDF   : 7.11.34.116  4034048 Bytes  29.06.2012 12:55:43
VBASE006.VDF   : 7.11.34.117     2048 Bytes  29.06.2012 12:55:43
VBASE007.VDF   : 7.11.34.118     2048 Bytes  29.06.2012 12:55:43
VBASE008.VDF   : 7.11.34.119     2048 Bytes  29.06.2012 12:55:43
VBASE009.VDF   : 7.11.34.120     2048 Bytes  29.06.2012 12:55:43
VBASE010.VDF   : 7.11.34.121     2048 Bytes  29.06.2012 12:55:43
VBASE011.VDF   : 7.11.34.122     2048 Bytes  29.06.2012 12:55:43
VBASE012.VDF   : 7.11.34.123     2048 Bytes  29.06.2012 12:55:43
VBASE013.VDF   : 7.11.34.124     2048 Bytes  29.06.2012 12:55:43
VBASE014.VDF   : 7.11.38.18   2554880 Bytes  30.07.2012 15:55:25
VBASE015.VDF   : 7.11.38.70    556032 Bytes  31.07.2012 13:48:13
VBASE016.VDF   : 7.11.38.71      2048 Bytes  31.07.2012 13:48:13
VBASE017.VDF   : 7.11.38.72      2048 Bytes  31.07.2012 13:48:13
VBASE018.VDF   : 7.11.38.73      2048 Bytes  31.07.2012 13:48:13
VBASE019.VDF   : 7.11.38.74      2048 Bytes  31.07.2012 13:48:13
VBASE020.VDF   : 7.11.38.75      2048 Bytes  31.07.2012 13:48:13
VBASE021.VDF   : 7.11.38.76      2048 Bytes  31.07.2012 13:48:13
VBASE022.VDF   : 7.11.38.77      2048 Bytes  31.07.2012 13:48:13
VBASE023.VDF   : 7.11.38.78      2048 Bytes  31.07.2012 13:48:13
VBASE024.VDF   : 7.11.38.79      2048 Bytes  31.07.2012 13:48:13
VBASE025.VDF   : 7.11.38.80      2048 Bytes  31.07.2012 13:48:13
VBASE026.VDF   : 7.11.38.81      2048 Bytes  31.07.2012 13:48:13
VBASE027.VDF   : 7.11.38.82      2048 Bytes  31.07.2012 13:48:13
VBASE028.VDF   : 7.11.38.83      2048 Bytes  31.07.2012 13:48:13
VBASE029.VDF   : 7.11.38.84      2048 Bytes  31.07.2012 13:48:13
VBASE030.VDF   : 7.11.38.85      2048 Bytes  31.07.2012 13:48:13
VBASE031.VDF   : 7.11.38.140   159744 Bytes  02.08.2012 08:28:38
Engineversion  : 8.2.10.120
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 14:01:21
AESCRIPT.DLL   : 8.1.4.36      459131 Bytes  27.07.2012 08:44:48
AESCN.DLL      : 8.1.8.2       131444 Bytes  24.05.2012 15:07:45
AESBX.DLL      : 8.2.5.12      606578 Bytes  14.06.2012 12:29:20
AERDL.DLL      : 8.1.9.15      639348 Bytes  24.05.2012 15:07:44
AEPACK.DLL     : 8.3.0.18      807287 Bytes  27.07.2012 08:44:48
AEOFFICE.DLL   : 8.1.2.42      201083 Bytes  19.07.2012 12:14:42
AEHEUR.DLL     : 8.1.4.80     5075318 Bytes  27.07.2012 08:44:48
AEHELP.DLL     : 8.1.23.2      258422 Bytes  28.06.2012 11:55:24
AEGEN.DLL      : 8.1.5.34      434548 Bytes  19.07.2012 12:14:39
AEEXP.DLL      : 8.1.0.72       86389 Bytes  27.07.2012 08:44:49
AEEMU.DLL      : 8.1.3.2       393587 Bytes  10.07.2012 14:01:20
AECORE.DLL     : 8.1.27.2      201078 Bytes  10.07.2012 14:01:20
AEBB.DLL       : 8.1.1.0        53618 Bytes  24.05.2012 15:07:39
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  24.05.2012 15:05:31
AVPREF.DLL     : 12.3.0.15      51920 Bytes  24.05.2012 15:08:06
AVREP.DLL      : 12.3.0.15     179208 Bytes  24.05.2012 15:08:47
AVARKT.DLL     : 12.3.0.15     211408 Bytes  24.05.2012 15:07:56
AVEVTLOG.DLL   : 12.3.0.15     169168 Bytes  24.05.2012 15:07:58
SQLITE3.DLL    : 3.7.0.1       398288 Bytes  24.05.2012 15:08:35
AVSMTP.DLL     : 12.3.0.15      63952 Bytes  24.05.2012 15:08:07
NETNT.DLL      : 12.3.0.15      17104 Bytes  24.05.2012 15:08:29
RCIMAGE.DLL    : 12.3.0.15    4713680 Bytes  24.05.2012 15:05:32
RCTEXT.DLL     : 12.3.0.15      98512 Bytes  24.05.2012 15:05:32

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, 
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 2. August 2012  13:46

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
  [HINWEIS]   Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apntex.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTTray.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'ipoint.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApMsgFwd.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'acrotray.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'GrooveMonitor.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'ISBMgr.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apoint.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '227' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'SPMgr.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'Switcher.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'VESMgrSub.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'VzFw.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'VzCdbSvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'VCSW.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'VcmIAlzMgr.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'VESMgr.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'stacsv.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'iviRegMgr.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3145' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Program Files\WinRAR\rarnew.dat
  [WARNUNG]   Das Archiv ist unbekannt oder defekt
C:\Users\chriz\Downloads\avira_free_antivirus_de.exe
  [WARNUNG]   Die Datei ist kennwortgeschützt
C:\Users\chriz\Downloads\Forentreffen.part01.rar
  [WARNUNG]   Einige Dateien dieses Archives sind auf mehrere Teilarchive verteilt  (multiple volume)
C:\Users\chriz\Downloads\Final Fantasy VII (PC) Ultima Edition\Setup-1.bin
  [WARNUNG]   Einige Dateien dieses Archives sind auf mehrere Teilarchive verteilt  (multiple volume)


Ende des Suchlaufs: Donnerstag, 2. August 2012  16:06
Benötigte Zeit:  2:20:10 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  25958 Verzeichnisse wurden überprüft
 895695 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 895695 Dateien ohne Befall
   6024 Archive wurden durchsucht
      4 Warnungen
      1 Hinweise
 530030 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden
         

MalwareBytes
Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.02.04

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
chriz :: CHRIS-PC [Administrator]

02.08.2012 12:25:37
mbam-log-2012-08-02 (12-25-37).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 333908
Laufzeit: 1 Stunde(n), 12 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
OTL
Code:
ATTFilter
OTL logfile created on: 02.08.2012 12:55:11 - Run 6
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\chriz\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 41,16% Memory free
4,00 Gb Paging File | 2,50 Gb Available in Paging File | 62,66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 176,24 Gb Total Space | 8,95 Gb Free Space | 5,08% Space Free | Partition Type: NTFS
 
Computer Name: CHRIS-PC | User Name: chriz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\chriz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Users\chriz\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe (Oracle Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Users\chriz\Desktop\JavaRa\JavaRa.exe (The RaProducts Team: Paul McLain and Fred de Vries)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
PRC - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Windows\System32\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\Apntex.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.deu ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\adobexmp.dll ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\ccme_base.dll ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\cryptocme2.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
MOD - C:\Windows\System32\btwhidcs.dll ()
MOD - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\1031\nsextint.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (VAIO Event Service) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (VcmIAlzMgr) -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (VzFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-Mobile-Gateway) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-UCLS-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-UCLS-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (STacSV) -- C:\Windows\System32\stacsv.exe (SigmaTel, Inc.)
SRV - (VAIOMediaPlatform-UCLS-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe (Sony Corporation)
SRV - (IviRegMgr) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NSNDIS5) -- C:\Windows\system32\NSNDIS5.SYS File not found
DRV - (asxyq2lt) --  File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (EverestDriver) -- C:\Users\chriz\Desktop\Everest Ultimate\kerneld.wnt ()
DRV - (R5U870FLx86) -- C:\Windows\System32\drivers\R5U870FLx86.sys (Ricoh)
DRV - (R5U870FUx86) -- C:\Windows\System32\drivers\R5U870FUx86.sys (Ricoh)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope = {E87584EE-A620-4117-A1F3-ECEB4AF1F77B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}: "URL" = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes,DefaultScope = {E87584EE-A620-4117-A1F3-ECEB4AF1F77B}
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SNYK
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.readmore.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.18 20:19:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.11 02:49:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.18 20:19:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.11 02:49:43 | 000,000,000 | ---D | M]
 
[2010.04.19 21:42:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\chriz\AppData\Roaming\mozilla\Extensions
[2012.08.02 11:12:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\chriz\AppData\Roaming\mozilla\Firefox\Profiles\588nyvj1.default\extensions
[2012.01.08 06:16:14 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\chriz\AppData\Roaming\mozilla\Firefox\Profiles\588nyvj1.default\extensions\chineseperakun@gmail.com
[2008.10.18 19:17:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\chriz\AppData\Roaming\mozilla\Sunbird\Profiles\izky56rr.default\extensions
[2011.05.03 22:14:05 | 000,001,583 | ---- | M] () -- C:\Users\chriz\AppData\Roaming\Mozilla\Firefox\Profiles\588nyvj1.default\searchplugins\web-search.xml
[2012.03.18 01:03:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.03.24 12:43:15 | 000,049,303 | ---- | M] () (No name found) -- C:\USERS\CHRIZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\588NYVJ1.DEFAULT\EXTENSIONS\{4C7097F7-08F2-4EF2-9B9F-F95FA4CBB064}.XPI
[2012.07.18 20:19:47 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.12 06:59:59 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.06 21:39:11 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.06 21:39:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.05.06 21:39:11 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.05.06 21:39:11 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.05.06 21:39:11 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.05.06 21:39:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\chriz\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 10.4.1)
O16 - DPF: {CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 1.7.0_04)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Java Plug-in 10.4.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C053E522-E255-4D89-8C47-0394D8575728}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\VAIO Tender Green Wallpaper 1280x800.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\VAIO Tender Green Wallpaper 1280x800.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\Shell - "" = AutoRun
O33 - MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\Shell\AutoRun\command - "" = G:\baldur.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.02 12:50:08 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\chriz\Desktop\OTL.exe
[2012.08.02 12:49:17 | 000,000,000 | ---D | C] -- C:\Users\chriz\Desktop\Logs
[2012.08.02 12:38:38 | 000,000,000 | ---D | C] -- C:\Users\chriz\Desktop\JavaRa
[2012.08.02 12:23:29 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.02 10:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2012.08.02 10:31:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2012.08.02 10:31:18 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2008.08.16 01:27:02 | 019,957,488 | ---- | C] (Intel Corporation) -- C:\Users\chriz\winvista_159.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.02 12:50:08 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\chriz\Desktop\OTL.exe
[2012.08.02 12:35:46 | 000,614,881 | ---- | M] () -- C:\Users\chriz\Desktop\adwcleaner.exe
[2012.08.02 12:23:46 | 000,005,872 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 12:23:46 | 000,005,872 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 12:23:40 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.02 12:07:08 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.02 11:26:15 | 000,071,455 | ---- | M] () -- C:\Users\chriz\AppData\Roaming\nvModes.001
[2012.08.02 10:23:33 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.02 10:23:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.02 10:23:17 | 1609,375,744 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.01 17:14:52 | 000,071,455 | ---- | M] () -- C:\Users\chriz\AppData\Roaming\nvModes.dat
[2012.08.01 16:59:15 | 000,095,939 | ---- | M] () -- C:\Users\chriz\Desktop\error.png
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.02 12:35:46 | 000,614,881 | ---- | C] () -- C:\Users\chriz\Desktop\adwcleaner.exe
[2012.08.01 16:59:15 | 000,095,939 | ---- | C] () -- C:\Users\chriz\Desktop\error.png
[2011.06.30 21:34:15 | 000,151,840 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010.11.15 13:34:31 | 000,000,000 | ---- | C] () -- C:\Users\chriz\defogger_reenable
[2009.09.28 22:00:31 | 002,086,760 | ---- | C] () -- C:\Users\chriz\img021.jpg
[2009.03.03 21:18:54 | 000,003,193 | ---- | C] () -- C:\Users\chriz\avatar-4754.jpg
[2009.02.03 03:46:01 | 000,003,195 | ---- | C] () -- C:\Users\chriz\.sdedit.conf
[2009.01.26 01:33:58 | 020,660,224 | ---- | C] () -- C:\Users\chriz\AppData\Roaming\Messages.mdb
[2009.01.19 04:50:27 | 000,000,277 | ---- | C] () -- C:\Users\chriz\First.java
[2009.01.15 23:31:32 | 000,570,018 | ---- | C] () -- C:\Users\chriz\EER_2002_Techn.Merkblatt_6TT.pdf
[2008.06.16 15:50:29 | 000,071,455 | ---- | C] () -- C:\Users\chriz\AppData\Roaming\nvModes.dat
[2008.06.16 15:50:29 | 000,071,455 | ---- | C] () -- C:\Users\chriz\AppData\Roaming\nvModes.001
 
========== LOP Check ==========
 
[2012.05.23 17:51:02 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\DAEMON Tools Lite
[2011.10.05 13:11:21 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\DVDVideoSoft
[2011.10.05 13:11:12 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.01.08 17:56:28 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\ICQ
[2008.08.26 23:12:41 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\ICQ Toolbar
[2010.04.19 21:42:06 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\InterVideo
[2010.04.19 21:42:06 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\Lingoes
[2010.11.04 00:20:05 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\LolClient
[2012.05.23 16:47:46 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\LolClient2
[2011.07.27 19:45:00 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\MyPhoneExplorer
[2012.05.17 14:03:35 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\TS3Client
[2012.08.02 09:55:01 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\uTorrent
[2011.09.11 01:55:05 | 000,000,000 | ---D | M] -- C:\Users\chriz\AppData\Roaming\WordToPDF
[2012.07.26 07:19:54 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
OTL Extra
Code:
ATTFilter
OTL Extras logfile created on: 02.08.2012 12:55:11 - Run 6
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\chriz\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 41,16% Memory free
4,00 Gb Paging File | 2,50 Gb Available in Paging File | 62,66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 176,24 Gb Total Space | 8,95 Gb Free Space | 5,08% Space Free | Partition Type: NTFS
 
Computer Name: CHRIS-PC | User Name: chriz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07C241F1-906F-4837-8005-DCD6F839F24A}" = lport=6885 | protocol=6 | dir=in | name=league of legends launcher | 
"{0FCFDEB0-D3F2-4F63-9720-904A96F8E432}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{1F7FBF91-0D7D-4447-9F65-3F77BC07E39C}" = lport=6921 | protocol=6 | dir=in | name=league of legends launcher | 
"{2E59BFD8-F583-45E7-9864-FA82EC049D3E}" = lport=6929 | protocol=17 | dir=in | name=league of legends launcher | 
"{2ED03363-6C64-43C0-9224-7B7A8CC4FE74}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{2F6497E8-CC47-4F41-B371-836477B6D3E1}" = lport=6903 | protocol=6 | dir=in | name=league of legends launcher | 
"{307588EE-A6C5-4037-81A9-283F5595EF8B}" = lport=6978 | protocol=6 | dir=in | name=league of legends launcher | 
"{32AF26B4-37BD-4D47-8F38-3D353FF79439}" = lport=137 | protocol=17 | dir=in | app=system | 
"{3B77C5BB-AE62-4CF8-BB66-74D9857B5284}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{51C08432-CDE8-4E23-8CD2-872B1D8FE4B1}" = lport=6914 | protocol=17 | dir=in | name=league of legends launcher | 
"{529844F0-D4C5-418B-80D3-56F86AF54870}" = rport=137 | protocol=17 | dir=out | app=system | 
"{580BD7F6-8EDF-4DCD-A05B-8C0A40E98463}" = lport=6973 | protocol=17 | dir=in | name=league of legends launcher | 
"{5A6A05F4-AC6D-4EAC-B5AE-CE6B9C8F1C2F}" = lport=138 | protocol=17 | dir=in | app=system | 
"{5EA6AD2E-088F-4C9D-B0E5-5D50BD7F73A4}" = lport=6956 | protocol=17 | dir=in | name=league of legends launcher | 
"{607768B9-7ABD-40DC-8AF1-51FA3D228EC4}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{6513805D-C92E-4159-B501-E4D2BCA80EFA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{656A6AD9-B2D9-45E1-B91B-844BAE23AF93}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6929AE59-AE66-4B70-B551-E993D5B119AD}" = lport=6903 | protocol=17 | dir=in | name=league of legends launcher | 
"{6A3B500A-5500-43C1-B177-189EBB61111C}" = lport=6956 | protocol=6 | dir=in | name=league of legends launcher | 
"{6CAE1A81-F6B8-4A3F-AE9F-9400E4C5048D}" = lport=6917 | protocol=17 | dir=in | name=league of legends launcher | 
"{787F5D9F-F151-4D1A-AE74-96AA185B27F9}" = lport=6901 | protocol=17 | dir=in | name=league of legends launcher | 
"{7B7348FC-08F5-4B31-9DCA-FE3D3FC73AA3}" = lport=6914 | protocol=6 | dir=in | name=league of legends launcher | 
"{7EAF6786-C882-437B-9BE3-825A4AC4B0BF}" = lport=6885 | protocol=17 | dir=in | name=league of legends launcher | 
"{84F3B413-E2ED-4EA7-BA14-0878551F9F13}" = lport=6917 | protocol=6 | dir=in | name=league of legends launcher | 
"{880033E7-4B28-4753-B276-EDCA1ACB68A6}" = lport=6987 | protocol=17 | dir=in | name=league of legends launcher | 
"{882C974A-D68D-4A79-87FA-ED3586450B02}" = lport=6899 | protocol=6 | dir=in | name=league of legends launcher | 
"{8BCCCF4A-CB7A-4F89-B64C-9B7510708385}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8C78D9C5-2D5F-43EF-AC63-B0B92E336BA8}" = lport=6921 | protocol=17 | dir=in | name=league of legends launcher | 
"{91C0B9A6-A7E0-474F-8CEA-8BC19A7850E8}" = lport=6929 | protocol=6 | dir=in | name=league of legends launcher | 
"{92726E06-BEB1-4E8D-B946-71B4F7CEA1E8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{9A5C9628-FE9F-4417-9C4E-E65C486DC1BF}" = lport=139 | protocol=6 | dir=in | app=system | 
"{9B14288C-BD60-47BD-8D23-958BF720780D}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AB221638-4437-4157-8588-73231F493F11}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B15EF692-FA3C-40D6-8E83-62158759C86C}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{B15F6B6A-F61A-4473-B6E3-AE2D290D132E}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{B1F9CAC6-9664-4799-BD84-7A9EA84DFB7F}" = lport=6899 | protocol=17 | dir=in | name=league of legends launcher | 
"{B25FCB4C-6D5D-4E53-9166-08952E255D08}" = rport=138 | protocol=17 | dir=out | app=system | 
"{B85DB678-CF90-4D92-B6D9-3C120102D686}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{BB858D24-F2DA-4A9B-86D3-9BD62FE0C7EB}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{C751E4AB-6253-4D9E-9970-4351D5D7C563}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{CC52E8BD-D28B-4B11-958A-BDCBEDAD434F}" = lport=6902 | protocol=17 | dir=in | name=league of legends launcher | 
"{D4EBEB04-DD8B-4655-B576-6685A6FD83A8}" = lport=6973 | protocol=6 | dir=in | name=league of legends launcher | 
"{DD31FECD-CA34-443D-A868-F40E7506AE06}" = lport=6978 | protocol=17 | dir=in | name=league of legends launcher | 
"{DF8EEBEE-7A0E-4F23-92F2-2C5BD3422110}" = lport=6901 | protocol=6 | dir=in | name=league of legends launcher | 
"{E17C37BC-7574-4011-8708-1A9C456BBC48}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{FE4F95A0-8F35-4F9C-964C-26BA2AD3D7B9}" = lport=6902 | protocol=6 | dir=in | name=league of legends launcher | 
"{FEAE807B-1356-4A0F-88A3-48871532B650}" = lport=6987 | protocol=6 | dir=in | name=league of legends launcher | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01A5FD35-377F-43B3-8C07-1E92661CBB76}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.649\agent.exe | 
"{0463DAEF-7811-4801-A8B1-2F3FDF2C4ED6}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{1755F99A-820A-4AE4-95BE-585294944361}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | 
"{1F918227-DE3B-4C75-87C4-94C44EE309C5}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{21C70D52-A7E2-45F8-95F5-5F5A56C7198C}" = protocol=6 | dir=in | app=c:\league of legends\air\lolclient.exe | 
"{24F943A6-E911-4D37-816D-145A741527F0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{25BE620F-1F0C-4E13-92BF-C932AEFAEE6E}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{375015AD-3EC1-44B1-B095-8A798769189F}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{37720196-8068-4A6D-9CCD-72D8685C4B23}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"{3F799868-A83C-4348-BC4B-B36BDABDC505}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{40774E56-C278-426C-9AC1-89D239D30642}" = protocol=6 | dir=in | app=c:\program files\diablo iii beta\diablo iii.exe | 
"{457442C5-AAB9-4603-AA4D-1BEF065F48F1}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | 
"{507C4C78-AC64-49D0-AC0E-EF577156D626}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{51B2E955-B03D-4DC4-898B-CF65C05D0EB2}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{545CB333-673C-4885-B161-DE2D9E9DCC33}" = protocol=17 | dir=in | app=c:\league of legends\game\league of legends.exe | 
"{55579BF8-4601-4C49-ACE2-BA6D62C941DF}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{61DD59EF-16C1-4717-9B22-CD90F03D433C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{6335BD01-A912-4A80-876B-9EFCC0D8DAB0}" = protocol=6 | dir=in | app=c:\league of legends\game\league of legends.exe | 
"{6581AACF-BF6E-4E0D-997E-F3C7C4E1CE8D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{666A41B3-B379-4FE6-88EB-C19EA26E5CDE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{66916233-D3DC-4FF6-A4F7-8A0FAF70C23E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{6D555F52-DEDF-44A8-9027-FC6A69787998}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | 
"{6FE07B4C-B6E0-439F-B3A9-585EE661D99A}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | 
"{7061C6E9-6010-448B-A984-6A718B972E9A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{7637EB8E-0BA8-428E-B283-674E6A780952}" = protocol=17 | dir=in | app=c:\program files\diablo iii beta\diablo iii.exe | 
"{763E4FC8-FAE2-4C86-9274-B0168F56681E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.515\agent.exe | 
"{79B44A92-7DE1-41C7-9FE8-CA0CAEDB8F46}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{886DF598-A501-41E8-B1E6-4DCAF6942139}" = protocol=6 | dir=in | app=c:\program files\starcraft ii demo\starcraft ii.exe | 
"{8A67B9C7-2086-4E1A-9C4A-C93D9A34EC72}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{93D2BE7E-AB90-40A5-94D2-249838F07A61}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{945B0C5E-F699-4861-BBCF-0285A4B08295}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe | 
"{95E6ABE9-ED0A-4D69-9027-159E0CDB18B9}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | 
"{9613C189-3A52-4EB9-93D1-0F9A88BA5690}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{9A3DCB8D-D6CB-4AA2-9EC3-4B5A6B0B625A}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | 
"{9AEA0ABD-DB1B-40A7-8581-6589D8364138}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"{9E3E65D3-B475-4A07-AEBA-F239BCF75336}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.649\agent.exe | 
"{A4BCD3B3-5038-4F6C-8E98-EDA8507836EA}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{A76DB196-D08C-425D-8E0D-AFABF521C8B5}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{A8379D32-716E-42C8-B796-83F5C42288A3}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | 
"{AB96C472-069F-4010-BA59-0C73EEE7AF68}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{AC922372-BBD7-4977-9841-665FF5670D9C}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{AF30D51A-8495-4088-8811-B6049C4EBF6D}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{B39F633F-7E7A-4DA8-86B6-E248576E6498}" = protocol=17 | dir=in | app=c:\program files\starcraft ii demo\starcraft ii.exe | 
"{B4464B3F-F197-4927-881B-E4BF96AFDB7E}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{B6786A1A-46A5-417E-9357-FE5A88D71AC3}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"{B7CC5182-7F41-49AE-89E9-A38BE542A8BE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{B9943E0D-6884-4B6D-A4FE-4C93A3CDC9DD}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.515\agent.exe | 
"{BA3E22D7-7287-4A22-B5D2-7E267E6048D2}" = protocol=17 | dir=in | app=c:\league of legends\air\lolclient.exe | 
"{BBEED90A-C73C-4884-BB36-C3FD452C9256}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{BC0C0C16-4AB8-4BF1-955A-243FFDBB73F4}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{BDA03587-3800-4889-9944-88952DEEF993}" = protocol=17 | dir=in | app=c:\program files\myphoneexplorer\myphoneexplorer.exe | 
"{C3E4B142-7370-4281-B07D-689E948DA033}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"{C4269324-1E9A-4059-998C-5A3FDACDF724}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{C5CB4147-7938-4462-9574-F6B1281E595C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{CAD21E2B-6025-40A6-A703-C74CD3A13046}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe | 
"{CB127B24-168F-4A89-B506-A0CA85C5A815}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | 
"{CE9E0697-6EC1-47A0-86DC-5A26B1007E5A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{D1214147-8320-44A4-97B7-FF408DD6B7B6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{D66BA66B-1DEE-4896-892A-85369EA5BB99}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{D7EEDF0F-D690-42DF-BC7F-5A91C067B8CC}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{DBDCE47B-C794-4B19-B268-85B465B286D1}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{EC395FFD-64C0-47B2-B161-351FC3B65B6B}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{F8EAFDC1-34B8-4C04-9149-A2BDE2AABD57}" = protocol=6 | dir=in | app=c:\program files\myphoneexplorer\myphoneexplorer.exe | 
"TCP Query User{1512127F-40CA-4833-822B-E0AA11A630E2}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{20D4A642-2015-40E3-B6E8-CF3F63927EC5}C:\program files\activision\call of duty - world at war\codwaw.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"TCP Query User{21CAC22B-373A-4C96-BECB-25518EFBD76D}C:\riot games\league of legends\lol.launcher.exe" = protocol=6 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe | 
"TCP Query User{2B13F138-8456-48C7-9EF2-208B874E00C2}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{3356A4F7-C1AE-4793-A6F6-81854B345221}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"TCP Query User{43873C80-AC12-4FB3-A3A2-0961307DFB9F}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{59DCD455-7B3C-4E0C-82BB-6B8EC979F11D}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{6063009F-D621-4F55-8447-664F379F77F2}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{69F5DEEE-3E31-4DB3-9ED3-C123C0C18947}C:\program files\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"TCP Query User{6E23A3FA-AED9-4EC1-98FF-000713F00236}C:\users\chriz\desktop\flatout2\flatout2.exe" = protocol=6 | dir=in | app=c:\users\chriz\desktop\flatout2\flatout2.exe | 
"TCP Query User{700AD149-6DC3-4CBD-A59A-CF61C705BB1E}C:\program files\myphoneexplorer\myphoneexplorer.exe" = protocol=6 | dir=in | app=c:\program files\myphoneexplorer\myphoneexplorer.exe | 
"TCP Query User{8298B8E8-402C-4F0A-A893-E20C84774599}C:\riot games\league of legends\lol.launcher.exe" = protocol=6 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe | 
"TCP Query User{8A92BBE8-7325-4212-9585-3EF77C731D2B}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"TCP Query User{8C8B04BA-E5F4-4D13-8D51-A2C98D4698C3}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"TCP Query User{9CA252DD-FA90-4BEE-B1BF-DDDE67DDC1C0}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{9D043FF0-374A-4C2D-9778-848B16443E3B}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{A69F0C74-3AC9-411F-AD29-8B3ECA583CF4}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{B86E1132-F62A-4D29-8338-2CB727EC7664}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"TCP Query User{C8D95EDD-4017-4CE7-B2BC-2DBB55A3D55A}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{CC67D390-5BFE-4D6E-880B-51C6D72BE479}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"TCP Query User{D0C005FC-1992-41D9-B3B4-729C5899C28F}C:\programdata\battle.net\agent\agent.913\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.913\agent.exe | 
"TCP Query User{DAC229DF-1529-4B90-92CE-6378A65FAB50}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{DD816A11-8230-4F7B-A255-E76445B65FC5}C:\users\chriz\desktop\age of empires ii inkl. addon the conquerors\age2_x1\age2_x1.exe" = protocol=6 | dir=in | app=c:\users\chriz\desktop\age of empires ii inkl. addon the conquerors\age2_x1\age2_x1.exe | 
"UDP Query User{0FC39C1A-17E1-41DD-B9AC-2BB5410C8619}C:\riot games\league of legends\lol.launcher.exe" = protocol=17 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe | 
"UDP Query User{15674B55-F2DC-437A-998C-13DCB5A6EC11}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{1611DC9C-4DCD-4D25-A6AE-747A5F007BFA}C:\users\chriz\desktop\flatout2\flatout2.exe" = protocol=17 | dir=in | app=c:\users\chriz\desktop\flatout2\flatout2.exe | 
"UDP Query User{1B80AC34-2BE8-47D4-BC6C-4920333819DC}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{2F86645E-20B3-4950-8511-06E4A98B68AA}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{3D89B994-C2B3-44CC-AF7E-C5F09B9EDD32}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{493CF04A-A959-4384-B102-4E2D4619B662}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"UDP Query User{4C2A7F3A-E378-4154-8444-6DA5CFC0A615}C:\program files\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"UDP Query User{55A59975-F397-4BB4-B83E-725EB7F2EBAD}C:\program files\activision\call of duty - world at war\codwaw.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"UDP Query User{61735BD6-311E-46DE-B442-46FC836AF34E}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{70FF5B12-17C2-46BA-AB88-BC12FEA40FBF}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{79AAD8B4-AF80-48C8-BB9B-02EEFB36DA34}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{7AFC5599-A13B-4C24-A8DE-CC1556A4E120}C:\program files\myphoneexplorer\myphoneexplorer.exe" = protocol=17 | dir=in | app=c:\program files\myphoneexplorer\myphoneexplorer.exe | 
"UDP Query User{7B6C3E02-CEBD-4673-9206-5CEFA7AA022C}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{83DF692C-8B58-4856-9C58-5AE7B823B211}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"UDP Query User{8484B4AD-0DA7-4D47-911D-3599A839D809}C:\riot games\league of legends\lol.launcher.exe" = protocol=17 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe | 
"UDP Query User{89D5763A-E9C1-41C0-B383-6A8E07262C64}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"UDP Query User{90BD53E7-4AE6-4094-95DE-4B81CF91FD28}C:\users\chriz\desktop\age of empires ii inkl. addon the conquerors\age2_x1\age2_x1.exe" = protocol=17 | dir=in | app=c:\users\chriz\desktop\age of empires ii inkl. addon the conquerors\age2_x1\age2_x1.exe | 
"UDP Query User{93C440D3-9A31-4F41-8EBE-C112DF58952A}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{D6D4F43F-2318-47FC-8320-A41644078DBB}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"UDP Query User{DD50EB20-6B9C-47B8-90B4-6A5981FA9F7F}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"UDP Query User{ECAF81A3-0610-4655-94FE-63B099A7FD89}C:\programdata\battle.net\agent\agent.913\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.913\agent.exe | 
"UDP Query User{F6B7FB52-3768-4CF2-82C7-B605ECBD5FD0}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{009E7FB7-1775-4D89-8956-F5C9A1C019FC}" = DSD Playback Plug-in
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.1203
"{08B785C1-3893-4154-B53B-F5D341D0AAAA}" = Cisco Systems VPN Client 5.0.06.0110
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}" = VAIO Launcher
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BEF9285-5530-426B-A5F1-5836B95C7EB1}" = VAIO Original Screen Saver
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs
"{23825B69-36DF-4DAD-9CFD-118D11D80F16}" = VAIO Content Folder Setting
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{32A3A4F4-B792-11D6-A78A-00B0D0160110}" = Java(TM) SE Development Kit 6 Update 11
"{336DD6B4-B100-4048-B2B7-FBA7059FD959}" = Yu-Gi-Oh! Power of Chaos JOEY THE PASSION
"{3571656A-575D-4CED-809D-5547587121FF}" = Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{485C9280-B899-4D46-86F3-B3E459636EE5}" = Yu-Gi-Oh! Power of Chaos KAIBA THE REVENGE
"{48820099-ED7D-424B-890C-9A82EF00656D}" = VAIO Update 3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4EA55D20-27FB-45D7-8726-147E8A5F6C62}" = VAIO MusicBox
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{533D0A8A-D7E7-4F15-BC9E-FF2916A6BAA7}" = DSD Direct Player
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.0
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media Redistribution 6.0
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5F12E9D1-402C-4672-86D7-52E86A3A1411}" = VAIO Content Importer  VAIO Content Exporter
"{5F5DE5D5-D130-4110-A3A4-69FFB0B14BD9}" = VAIO Content Metadata XML Interface Library
"{6110F38A-5BE6-4199-AC96-D2DD6B4A3ADE}" = VAIO Content Metadata Intelligent Analyzing Manager
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360
"{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}" = VAIO Content Importer / VAIO Content Exporter
"{69351E9E-23ED-41D5-B146-EDBF83C63B66}" = VAIO Content Metadata Manager Setting
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}" = VAIO Movie Story Template Data
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.1
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{802889F8-6AF5-45A5-9764-CA5B999E50FC}" = VAIO Power Management
"{82D5BACA-3619-4D34-99DB-3A65CFB4DA33}" = DSD Direct
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8FC56444-161D-43B4-A662-F18F2E4A2A32}" = VAIO Content Metadata Manager Setting
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{92F8615C-43B7-4925-8457-B6D004E8D478}" = VAIO Content Metadata XML Interface Library
"{934A3213-1CB6-4264-84A2-EE080C017BCA}" = VAIO Tender Green Wallpaper
"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98FC7A64-774B-49B5-B046-4B4EBC053FA9}" = VAIO MusicBox Sample Music
"{998D6972-F58E-479D-9248-8F179E55AE38}" = Java DB 10.4.1.3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AB83A3C-604D-4B4F-AA25-A23A3FC39844}" = ArcSoft Magic-i Visual Effects Installer
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plugins
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{9FA8B5F5-4BDC-4CF4-9202-AA97FF79AE98}" = VAIO Media
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A63E7492-A0BC-4BB9-89A7-352965222380}" = VAIO Original Function Setting
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_932" = Adobe Acrobat 9.3.2 - CPSID_53951
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.0 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.0
"{AFBA0609-EB70-43CB-B11C-294EDADFA101}" = 
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}" = VAIO Movie Story
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home
"{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1" = Eraser 5.8.7
"{B8C3B479-1716-11D5-968A-0050BA84F5F7}" = Baldur's Gate(TM) II - Throne of Bhaal (TM)
"{C22826DB-8064-4607-9816-1B5B62358C3C}" = inSSIDer 2.0
"{C576C82C-EE87-11D6-B031-0000CB597465}" = A.F.7 Merge your files 1.3
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E4D96ABB-E0D8-4CA4-856E-A2703F5490F0}" = VAIO Content Metadata Intelligent Analyzing Manager
"{E66BB7B9-EC7B-45A6-B479-AD43A9B32AA0}" = SonicStage Mastering Studio
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD 2.6.00
"{E89D31F3-7F6C-47A3-8669-0A8DDE27B664}" = VAIO Media Registration Tool
"{EBE55E74-AF94-47BB-849B-C79F236C65F4}" = VAIO Movie Story
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" = 
"{FAA6B94E-78A7-489C-B2DB-050D9FEBFADA}" = VAIO Content Metadata Intelligent Analyzing Manager
"Adobe AIR" = Adobe AIR
"Avira AntiVir Desktop" = Avira Professional Security
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"Diablo III" = Diablo III
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"dt icon module" = 
"eBay HTML" = 
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Free YouTube Download_is1" = Free YouTube Download version 3.0.16.923
"gtfirstboot Setting Request" = 
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQ Password" = ICQ Password
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"IsoBuster_is1" = IsoBuster 2.8.5
"JCreator LE_is1" = JCreator LE 4.00
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"MiKTeX 2.7" = MiKTeX 2.7
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-15-19-01
"Picasa2" = Picasa 2
"PokerStars" = PokerStars
"Security Task Manager" = Security Task Manager 1.8d
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Skype_is1" = Skype 3.2
"SopCast" = SopCast 3.2.9
"SubtitleWorkshop" = Subtitle Workshop 2.51
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"VAIO Help and Support" = 
"VAIO MFU Module" = 
"VAIO Xblack Contents" = VAIO Xblack Contents
"VLC media player" = VLC media player 1.0.2
"Wecker 2.2" = Wecker 2.2 2.2
"WinRAR archiver" = WinRAR
"WordToPDF_is1" = WordToPDF 2.4
"XTTB00001.XTTB00001Toolbar" = ICQ Toolbar
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Advanced PDF Password Recovery" = Advanced PDF Password Recovery
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"uTorrent" = µTorrent
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 29.09.2011 21:08:46 | Computer Name = chris-PC | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
 (Fehlercode = 0x80042019)
 
Error - 29.09.2011 21:08:51 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 29.09.2011 21:08:51 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 30.09.2011 07:52:18 | Computer Name = chris-PC | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
 (Fehlercode = 0x80042019)
 
Error - 30.09.2011 07:52:21 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 30.09.2011 07:52:21 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 30.09.2011 09:59:20 | Computer Name = chris-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 30.09.2011 10:33:07 | Computer Name = chris-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 01.10.2011 10:03:41 | Computer Name = chris-PC | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
 (Fehlercode = 0x80042019)
 
Error - 01.10.2011 10:03:43 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 01.10.2011 10:03:43 | Computer Name = chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 01.10.2011 10:35:57 | Computer Name = chris-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
[ System Events ]
Error - 02.08.2012 04:00:47 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 02.08.2012 04:07:39 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
 Fehler beendet: %%-1073473535.
 
Error - 02.08.2012 04:07:39 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
 Neustart des Diensts.
 
Error - 02.08.2012 04:08:26 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows-Fehlerberichterstattungsdienst erreicht.
 
Error - 02.08.2012 04:08:38 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Search erreicht.
 
Error - 02.08.2012 04:08:38 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
Error - 02.08.2012 04:12:00 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Search erreicht.
 
Error - 02.08.2012 04:12:00 | Computer Name = chris-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
Error - 02.08.2012 04:12:00 | Computer Name = chris-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 02.08.2012 05:59:40 | Computer Name = chris-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
 
< End of report >
         
adwcleaner
Code:
ATTFilter
# AdwCleaner v1.800 - Logfile created 08/02/2012 at 13:38:27
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium  (32 bits)
# User : chriz - CHRIS-PC
# Running from : C:\Users\chriz\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\chriz\Desktop\Save
Folder Found : C:\ProgramData\Trymedia
File Found : C:\Users\chriz\AppData\Roaming\Mozilla\Firefox\Profiles\588nyvj1.default\searchplugins\web-search.xml

***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\chriz\AppData\Roaming\Mozilla\Firefox\Profiles\588nyvj1.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "Web Search...");
Found : user_pref("extensions.vshare@toolbar.update.enabled", false);
Found : user_pref("keyword.URL", "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=");

*************************

AdwCleaner[R1].txt - [1270 octets] - [02/08/2012 12:35:54]
AdwCleaner[R2].txt - [1199 octets] - [02/08/2012 13:38:27]

########## EOF - C:\AdwCleaner[R2].txt - [1327 octets] ##########
         

Alt 02.08.2012, 17:14   #2
t'john
/// Helfer-Team
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
PRC - C:\Users\chriz\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe (Oracle Corporation) 
DRV - (NSNDIS5) -- C:\Windows\system32\NSNDIS5.SYS File not found 
DRV - (asxyq2lt) -- File not found 
IE - HKLM\..\SearchScopes,DefaultScope = {E87584EE-A620-4117-A1F3-ECEB4AF1F77B} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}: "URL" = http://www.google.de/search?hl=de&q={searchTerms}&meta= 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes,DefaultScope = {E87584EE-A620-4117-A1F3-ECEB4AF1F77B} 
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\..\SearchScopes\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SNYK 
IE - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultenginename: "Web Search..." 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://www.readmore.de" 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 
FF - prefs.js..keyword.URL: "http://vshare.toolbarhome.com/search.aspx?srch=ku&q=" 
FF - prefs.js..network.proxy.http: "127.0.0.1" 
FF - prefs.js..network.proxy.http_port: 50370 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
O4 - HKLM..\Run: [] File not found 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O7 - HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found 
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\Shell - "" = AutoRun 
O33 - MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\Shell\AutoRun\command - "" = G:\baldur.exe 

[2012.08.02 11:26:15 | 000,071,455 | ---- | M] () -- C:\Users\chriz\AppData\Roaming\nvModes.001 
[2012.08.01 17:14:52 | 000,071,455 | ---- | M] () -- C:\Users\chriz\AppData\Roaming\nvModes.dat 

[2012.08.02 12:07:08 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012.08.02 10:23:33 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________

Alt 02.08.2012, 19:03   #3
Hydrom
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Hallo t'john,

danke für deine Antwort. Ich habe das Skript in OTL ausgeführt. Anbei der Log. Ich habe mittlerweile auch den Avira Rescue Scan von der selbsterstellten DVD ausgeführt. UNd dann habe ich noch TDSSKiller durchlaufen lassen und der hat wohl etwas entdeckt...

Gruß Hydrom

OTL-Log nach Neustart
Code:
ATTFilter
All processes killed
========== OTL ==========
No active process named jre-7u5-windows-i586-iftw.exe was found!
Service NSNDIS5 stopped successfully!
Service NSNDIS5 deleted successfully!
File  C:\Windows\system32\NSNDIS5.SYS File not found not found.
Error: No service named asxyq2lt was found to stop!
Service\Driver key asxyq2lt not found.
File  File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted 

successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}\ deleted 

successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set 

successfully!
Registry key HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-

472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E87584EE-A620-

4117-A1F3-ECEB4AF1F77B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E87584EE-A620-4117-A1F3-ECEB4AF1F77B}\ not found.
HKU\S-1-5-21-1255904841-3874207504-1916605801-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : 

value set successfully!
Prefs.js: "Web Search..." removed from browser.search.defaultenginename
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.readmore.de" removed from browser.startup.homepage
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=" removed from keyword.URL
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 50370 removed from network.proxy.http_port
Prefs.js: 0 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted 

successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1255904841-3874207504-1916605801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\

\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted 

successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon\ deleted successfully.
C:\Windows\System32\VESWinlogon.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\ 

deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46c25759-4d72-11df-bb30-001a801f0678}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46c25759-4d72-11df-bb30-001a801f0678}\ not 

found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46c25759-4d72-11df-bb30-001a801f0678}\ not found.
File G:\baldur.exe not found.
C:\Users\chriz\AppData\Roaming\nvModes.001 moved successfully.
C:\Users\chriz\AppData\Roaming\nvModes.dat moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\chriz\Desktop\cmd.bat deleted successfully.
C:\Users\chriz\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
 
User: All Users
 
User: chriz
->Temp folder emptied: 266754430 bytes
->Temporary Internet Files folder emptied: 102555 bytes
->Java cache emptied: 89766 bytes
->FireFox cache emptied: 54932359 bytes
->Flash cache emptied: 453 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14548523 bytes
RecycleBin emptied: 1071 bytes
 
Total Files Cleaned = 321,00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: chriz
->Flash cache emptied: 0 bytes
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.55.0 log created on 08022012_200842

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2009.07.14 03:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation) C:\Windows\System32\mctadmin.exe : 

MD5=BBA1A5B86134F496B926DDAF247DB871

Registry entries deleted on Reboot...
         
TDSSKiller Log
Code:
ATTFilter
20:25:17.0001 3096	TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
20:25:17.0813 3096	============================================================
20:25:17.0813 3096	Current date / time: 2012/08/02 20:25:17.0813
20:25:17.0813 3096	SystemInfo:
20:25:17.0813 3096	
20:25:17.0813 3096	OS Version: 6.1.7600 ServicePack: 0.0
20:25:17.0813 3096	Product type: Workstation
20:25:17.0813 3096	ComputerName: CHRIS-PC
20:25:17.0813 3096	UserName: chriz
20:25:17.0813 3096	Windows directory: C:\Windows
20:25:17.0813 3096	System windows directory: C:\Windows
20:25:17.0813 3096	Processor architecture: Intel x86
20:25:17.0813 3096	Number of processors: 2
20:25:17.0813 3096	Page size: 0x1000
20:25:17.0813 3096	Boot type: Normal boot
20:25:17.0813 3096	============================================================
20:25:18.0405 3096	Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:25:18.0405 3096	============================================================
20:25:18.0405 3096	\Device\Harddisk0\DR0:
20:25:18.0405 3096	MBR partitions:
20:25:18.0405 3096	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1422000, BlocksNum 0x1607C800
20:25:18.0405 3096	============================================================
20:25:18.0452 3096	C: <-> \Device\Harddisk0\DR0\Partition0
20:25:18.0452 3096	============================================================
20:25:18.0452 3096	Initialize success
20:25:18.0452 3096	============================================================
20:25:21.0619 3980	============================================================
20:25:21.0619 3980	Scan started
20:25:21.0619 3980	Mode: Manual; 
20:25:21.0619 3980	============================================================
20:25:23.0569 3980	1394ohci        (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
20:25:23.0585 3980	1394ohci - ok
20:25:23.0647 3980	ACPI            (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
20:25:23.0663 3980	ACPI - ok
20:25:23.0725 3980	AcpiPmi         (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
20:25:23.0725 3980	AcpiPmi - ok
20:25:23.0819 3980	adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
20:25:24.0084 3980	adp94xx - ok
20:25:24.0146 3980	adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
20:25:24.0177 3980	adpahci - ok
20:25:24.0271 3980	adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
20:25:24.0287 3980	adpu320 - ok
20:25:24.0333 3980	AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
20:25:24.0349 3980	AeLookupSvc - ok
20:25:24.0427 3980	AFD             (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
20:25:24.0458 3980	AFD - ok
20:25:24.0505 3980	agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
20:25:24.0505 3980	agp440 - ok
20:25:24.0567 3980	aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
20:25:24.0567 3980	aic78xx - ok
20:25:24.0599 3980	ALG             (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
20:25:24.0599 3980	ALG - ok
20:25:24.0645 3980	aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
20:25:24.0645 3980	aliide - ok
20:25:24.0692 3980	amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
20:25:24.0708 3980	amdagp - ok
20:25:24.0723 3980	amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
20:25:24.0739 3980	amdide - ok
20:25:24.0770 3980	AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
20:25:24.0786 3980	AmdK8 - ok
20:25:24.0817 3980	AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
20:25:24.0817 3980	AmdPPM - ok
20:25:24.0848 3980	amdsata         (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
20:25:24.0848 3980	amdsata - ok
20:25:24.0879 3980	amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
20:25:24.0895 3980	amdsbs - ok
20:25:24.0942 3980	amdxata         (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
20:25:24.0942 3980	amdxata - ok
20:25:25.0082 3980	AntiVirMailService (56beb1292dc71e49c824455ec582bfce) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
20:25:25.0129 3980	AntiVirMailService - ok
20:25:25.0176 3980	AntiVirSchedulerService (7abe4092c35e7d4596487dfa075d84e1) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:25:25.0191 3980	AntiVirSchedulerService - ok
20:25:25.0223 3980	AntiVirService  (5a37ffa608ae126c9702f5c07e07fc08) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:25:25.0223 3980	AntiVirService - ok
20:25:25.0316 3980	AntiVirWebService (5f2f39626586536ca86f402a1c947463) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
20:25:25.0347 3980	AntiVirWebService - ok
20:25:25.0410 3980	ApfiltrService  (18bff317bdb10c64a35e1ca85f1ec051) C:\Windows\system32\DRIVERS\Apfiltr.sys
20:25:25.0425 3980	ApfiltrService - ok
20:25:25.0519 3980	AppID           (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
20:25:25.0519 3980	AppID - ok
20:25:25.0581 3980	AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
20:25:25.0597 3980	AppIDSvc - ok
20:25:25.0613 3980	Appinfo         (7dead9e3f65dcb2794f2711003bbf650) C:\Windows\System32\appinfo.dll
20:25:25.0628 3980	Appinfo - ok
20:25:25.0659 3980	arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
20:25:25.0675 3980	arc - ok
20:25:25.0675 3980	arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
20:25:25.0691 3980	arcsas - ok
20:25:25.0691 3980	AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
20:25:25.0706 3980	AsyncMac - ok
20:25:25.0737 3980	atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
20:25:25.0737 3980	atapi - ok
20:25:25.0831 3980	AudioEndpointBuilder (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll
20:25:25.0847 3980	AudioEndpointBuilder - ok
20:25:25.0862 3980	Audiosrv        (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll
20:25:25.0878 3980	Audiosrv - ok
20:25:25.0925 3980	avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys
20:25:25.0940 3980	avgntflt - ok
20:25:25.0971 3980	avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys
20:25:26.0003 3980	avipbb - ok
20:25:26.0018 3980	avkmgr          (53e56450da16a1a7f0d002f511113f67) C:\Windows\system32\DRIVERS\avkmgr.sys
20:25:26.0018 3980	avkmgr - ok
20:25:26.0096 3980	AxInstSV        (dd6a431b43e34b91a767d1ce33728175) C:\Windows\System32\AxInstSV.dll
20:25:26.0112 3980	AxInstSV - ok
20:25:26.0205 3980	b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
20:25:26.0237 3980	b06bdrv - ok
20:25:26.0283 3980	b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
20:25:26.0299 3980	b57nd60x - ok
20:25:26.0346 3980	BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
20:25:26.0361 3980	BDESVC - ok
20:25:26.0377 3980	Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
20:25:26.0377 3980	Beep - ok
20:25:26.0455 3980	BFE             (85ac71c045ceb054ed48a7841aae0c11) C:\Windows\System32\bfe.dll
20:25:26.0486 3980	BFE - ok
20:25:26.0580 3980	BITS            (53f476476f55a27f580661bde09c4ec4) C:\Windows\System32\qmgr.dll
20:25:26.0611 3980	BITS - ok
20:25:26.0642 3980	blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
20:25:26.0642 3980	blbdrive - ok
20:25:26.0673 3980	bowser          (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys
20:25:26.0673 3980	bowser - ok
20:25:26.0705 3980	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:25:26.0705 3980	BrFiltLo - ok
20:25:26.0751 3980	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:25:26.0751 3980	BrFiltUp - ok
20:25:26.0814 3980	Browser         (598e1280e7ff3744f4b8329366cc5635) C:\Windows\System32\browser.dll
20:25:26.0814 3980	Browser - ok
20:25:26.0861 3980	Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
20:25:26.0876 3980	Brserid - ok
20:25:26.0892 3980	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
20:25:26.0907 3980	BrSerWdm - ok
20:25:26.0923 3980	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
20:25:26.0923 3980	BrUsbMdm - ok
20:25:26.0939 3980	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
20:25:26.0939 3980	BrUsbSer - ok
20:25:27.0001 3980	BthEnum         (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\DRIVERS\BthEnum.sys
20:25:27.0001 3980	BthEnum - ok
20:25:27.0017 3980	BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
20:25:27.0032 3980	BTHMODEM - ok
20:25:27.0048 3980	BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
20:25:27.0048 3980	BthPan - ok
20:25:27.0095 3980	BTHPORT         (4a34888e13224678dd062466afec4240) C:\Windows\system32\Drivers\BTHport.sys
20:25:27.0110 3980	BTHPORT - ok
20:25:27.0141 3980	bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
20:25:27.0157 3980	bthserv - ok
20:25:27.0173 3980	BTHUSB          (fa04c63916fa221dbb91fce153d07a55) C:\Windows\system32\Drivers\BTHUSB.sys
20:25:27.0173 3980	BTHUSB - ok
20:25:27.0235 3980	cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
20:25:27.0235 3980	cdfs - ok
20:25:27.0282 3980	cdrom           (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
20:25:27.0282 3980	cdrom - ok
20:25:27.0344 3980	CertPropSvc     (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll
20:25:27.0360 3980	CertPropSvc - ok
20:25:27.0391 3980	circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
20:25:27.0391 3980	circlass - ok
20:25:27.0422 3980	CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
20:25:27.0438 3980	CLFS - ok
20:25:27.0547 3980	clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:25:27.0563 3980	clr_optimization_v2.0.50727_32 - ok
20:25:27.0594 3980	CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
20:25:27.0594 3980	CmBatt - ok
20:25:27.0609 3980	cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
20:25:27.0625 3980	cmdide - ok
20:25:27.0672 3980	CNG             (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
20:25:27.0672 3980	CNG - ok
20:25:27.0719 3980	Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
20:25:27.0734 3980	Compbatt - ok
20:25:27.0750 3980	CompositeBus    (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
20:25:27.0765 3980	CompositeBus - ok
20:25:27.0765 3980	COMSysApp - ok
20:25:27.0781 3980	crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
20:25:27.0797 3980	crcdisk - ok
20:25:27.0859 3980	CryptSvc        (9c231178ce4fb385f4b54b0a9080b8a4) C:\Windows\system32\cryptsvc.dll
20:25:27.0859 3980	CryptSvc - ok
20:25:27.0906 3980	CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
20:25:27.0906 3980	CVirtA - ok
20:25:28.0140 3980	CVPND           (ea4300e53e5d4d1912ad04985f6264f0) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
20:25:28.0249 3980	CVPND - ok
20:25:28.0452 3980	CVPNDRVA        (34c345aaf390c12ae6e51b75198e8564) C:\Windows\system32\Drivers\CVPNDRVA.sys
20:25:28.0499 3980	CVPNDRVA - ok
20:25:28.0561 3980	DcomLaunch      (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll
20:25:28.0577 3980	DcomLaunch - ok
20:25:28.0655 3980	defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
20:25:28.0670 3980	defragsvc - ok
20:25:28.0733 3980	DfsC            (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
20:25:28.0748 3980	DfsC - ok
20:25:28.0811 3980	Dhcp            (c56495fbd770712367cad35e5de72da6) C:\Windows\system32\dhcpcore.dll
20:25:28.0826 3980	Dhcp - ok
20:25:28.0842 3980	discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
20:25:28.0857 3980	discache - ok
20:25:28.0904 3980	Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
20:25:28.0920 3980	Disk - ok
20:25:28.0935 3980	DMICall         (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys
20:25:28.0951 3980	DMICall - ok
20:25:28.0998 3980	DNE             (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
20:25:28.0998 3980	DNE - ok
20:25:29.0060 3980	Dnscache        (d0722e963d3c6145446874241401b209) C:\Windows\System32\dnsrslvr.dll
20:25:29.0060 3980	Dnscache - ok
20:25:29.0091 3980	dot3svc         (4408c85c21eea48eb0ce486baeef0502) C:\Windows\System32\dot3svc.dll
20:25:29.0123 3980	dot3svc - ok
20:25:29.0154 3980	DPS             (7fa81c6e11caa594adb52084da73a1e5) C:\Windows\system32\dps.dll
20:25:29.0154 3980	DPS - ok
20:25:29.0201 3980	drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
20:25:29.0216 3980	drmkaud - ok
20:25:29.0294 3980	DXGKrnl         (8b6c3464d7fac176500061dbfff42ad4) C:\Windows\System32\drivers\dxgkrnl.sys
20:25:29.0372 3980	DXGKrnl - ok
20:25:29.0435 3980	EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
20:25:29.0450 3980	EapHost - ok
20:25:29.0731 3980	ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
20:25:29.0856 3980	ebdrv - ok
20:25:30.0027 3980	EFS             (f42309c4191c506b71db5d1126d26318) C:\Windows\System32\lsass.exe
20:25:30.0043 3980	EFS - ok
20:25:30.0168 3980	ehRecvr         (3a74a6e33685662b125a3269b1f2114f) C:\Windows\ehome\ehRecvr.exe
20:25:30.0215 3980	ehRecvr - ok
20:25:30.0246 3980	ehSched         (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
20:25:30.0261 3980	ehSched - ok
20:25:30.0355 3980	elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
20:25:30.0386 3980	elxstor - ok
20:25:30.0402 3980	ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
20:25:30.0417 3980	ErrDev - ok
20:25:30.0495 3980	EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
20:25:30.0511 3980	EventSystem - ok
20:25:30.0698 3980	EverestDriver   (69c7c1f9b0b24f31604a68679bd07555) C:\Users\chriz\Desktop\Everest Ultimate\kerneld.wnt
20:25:30.0698 3980	EverestDriver - ok
20:25:30.0729 3980	exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
20:25:30.0745 3980	exfat - ok
20:25:30.0776 3980	fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
20:25:30.0792 3980	fastfat - ok
20:25:30.0870 3980	Fax             (f7ea23cc5e6bf2181f3f399d54f6efc1) C:\Windows\system32\fxssvc.exe
20:25:30.0885 3980	Fax - ok
20:25:30.0963 3980	fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
20:25:30.0979 3980	fdc - ok
20:25:31.0026 3980	fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
20:25:31.0041 3980	fdPHost - ok
20:25:31.0057 3980	FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
20:25:31.0057 3980	FDResPub - ok
20:25:31.0073 3980	FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
20:25:31.0088 3980	FileInfo - ok
20:25:31.0104 3980	Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
20:25:31.0104 3980	Filetrace - ok
20:25:31.0229 3980	FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
20:25:31.0275 3980	FLEXnet Licensing Service - ok
20:25:31.0307 3980	flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
20:25:31.0307 3980	flpydisk - ok
20:25:31.0338 3980	FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
20:25:31.0353 3980	FltMgr - ok
20:25:31.0416 3980	FontCache       (b6512a85815fdc3d560c3705f5bdb93d) C:\Windows\system32\FntCache.dll
20:25:31.0463 3980	FontCache - ok
20:25:31.0587 3980	FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:25:31.0603 3980	FontCache3.0.0.0 - ok
20:25:31.0650 3980	FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
20:25:31.0665 3980	FsDepends - ok
20:25:31.0681 3980	Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
20:25:31.0681 3980	Fs_Rec - ok
20:25:31.0728 3980	fvevol          (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
20:25:31.0743 3980	fvevol - ok
20:25:31.0775 3980	gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
20:25:31.0775 3980	gagp30kx - ok
20:25:31.0821 3980	GEARAspiWDM     (f877c945233039914dbe63b76f9a1065) C:\Windows\system32\Drivers\GEARAspiWDM.sys
20:25:31.0821 3980	GEARAspiWDM - ok
20:25:31.0915 3980	gpsvc           (8ba3c04702bf8f927ab36ae8313ca4ee) C:\Windows\System32\gpsvc.dll
20:25:31.0946 3980	gpsvc - ok
20:25:32.0133 3980	gupdate1c9a77f619e5ddc (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
20:25:32.0133 3980	gupdate1c9a77f619e5ddc - ok
20:25:32.0149 3980	gupdatem        (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
20:25:32.0149 3980	gupdatem - ok
20:25:32.0180 3980	gusvc           (751c1d2ca2abf4a9f5a6b8d7d45b907c) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
20:25:32.0196 3980	gusvc - ok
20:25:32.0227 3980	hamachi         (7929a161f9951d173ca9900fe7067391) C:\Windows\system32\DRIVERS\hamachi.sys
20:25:32.0227 3980	hamachi - ok
20:25:32.0274 3980	hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
20:25:32.0289 3980	hcw85cir - ok
20:25:32.0321 3980	HDAudBus        (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:25:32.0321 3980	HDAudBus - ok
20:25:32.0336 3980	HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
20:25:32.0336 3980	HidBatt - ok
20:25:32.0352 3980	HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
20:25:32.0367 3980	HidBth - ok
20:25:32.0383 3980	HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
20:25:32.0383 3980	HidIr - ok
20:25:32.0430 3980	hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll
20:25:32.0445 3980	hidserv - ok
20:25:32.0492 3980	HidUsb          (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
20:25:32.0492 3980	HidUsb - ok
20:25:32.0539 3980	hkmsvc          (741c2a45ca8407e374aaba3e330b7872) C:\Windows\system32\kmsvc.dll
20:25:32.0555 3980	hkmsvc - ok
20:25:32.0586 3980	HomeGroupListener (a768ca158bb06782a2835b907f4873c3) C:\Windows\system32\ListSvc.dll
20:25:32.0601 3980	HomeGroupListener - ok
20:25:32.0679 3980	HomeGroupProvider (fb08dec5ef43d0c66d83b8e9694e7549) C:\Windows\system32\provsvc.dll
20:25:32.0695 3980	HomeGroupProvider - ok
20:25:32.0773 3980	HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
20:25:32.0789 3980	HpSAMD - ok
20:25:32.0913 3980	HSF_DPV         (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys
20:25:32.0991 3980	HSF_DPV - ok
20:25:33.0007 3980	HSXHWAZL        (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
20:25:33.0023 3980	HSXHWAZL - ok
20:25:33.0085 3980	HTTP            (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
20:25:33.0101 3980	HTTP - ok
20:25:33.0116 3980	hwpolicy        (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
20:25:33.0116 3980	hwpolicy - ok
20:25:33.0147 3980	i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
20:25:33.0163 3980	i8042prt - ok
20:25:33.0210 3980	iaStor          (707c1692214b1c290271067197f075f6) C:\Windows\system32\DRIVERS\iaStor.sys
20:25:33.0225 3980	iaStor - ok
20:25:33.0272 3980	iaStorV         (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
20:25:33.0288 3980	iaStorV - ok
20:25:33.0428 3980	IDriverT        (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
20:25:33.0459 3980	IDriverT - ok
20:25:33.0631 3980	idsvc           (5af815eb5bc9802e5a064e2ba62bfc0c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:25:33.0725 3980	idsvc - ok
20:25:33.0881 3980	iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
20:25:33.0881 3980	iirsp - ok
20:25:33.0990 3980	IKEEXT          (fac0ee6562b121b1399d6e855583f7a5) C:\Windows\System32\ikeext.dll
20:25:34.0052 3980	IKEEXT - ok
20:25:34.0130 3980	intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
20:25:34.0130 3980	intelide - ok
20:25:34.0161 3980	intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
20:25:34.0161 3980	intelppm - ok
20:25:34.0177 3980	IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
20:25:34.0193 3980	IPBusEnum - ok
20:25:34.0208 3980	IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:25:34.0224 3980	IpFilterDriver - ok
20:25:34.0271 3980	iphlpsvc        (477397b432a256a50ee7e4339eb9ea14) C:\Windows\System32\iphlpsvc.dll
20:25:34.0286 3980	iphlpsvc - ok
20:25:34.0349 3980	IPMIDRV         (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
20:25:34.0380 3980	IPMIDRV - ok
20:25:34.0411 3980	IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
20:25:34.0411 3980	IPNAT - ok
20:25:34.0458 3980	IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
20:25:34.0458 3980	IRENUM - ok
20:25:34.0473 3980	isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
20:25:34.0473 3980	isapnp - ok
20:25:34.0505 3980	iScsiPrt        (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
20:25:34.0520 3980	iScsiPrt - ok
20:25:34.0629 3980	IviRegMgr       (213822072085b5bbad9af30ab577d817) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
20:25:34.0645 3980	IviRegMgr - ok
20:25:34.0676 3980	kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:25:34.0692 3980	kbdclass - ok
20:25:34.0723 3980	kbdhid          (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
20:25:34.0723 3980	kbdhid - ok
20:25:34.0770 3980	KeyIso          (f42309c4191c506b71db5d1126d26318) C:\Windows\system32\lsass.exe
20:25:34.0785 3980	KeyIso - ok
20:25:34.0832 3980	KSecDD          (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
20:25:34.0848 3980	KSecDD - ok
20:25:34.0895 3980	KSecPkg         (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
20:25:34.0910 3980	KSecPkg - ok
20:25:34.0957 3980	KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
20:25:34.0988 3980	KtmRm - ok
20:25:35.0066 3980	LanmanServer    (bca92cb047a4326925ecef759dbaa233) C:\Windows\system32\srvsvc.dll
20:25:35.0066 3980	LanmanServer - ok
20:25:35.0129 3980	LanmanWorkstation (b9891f885dcf1f0513a51cb58493cb1f) C:\Windows\System32\wkssvc.dll
20:25:35.0144 3980	LanmanWorkstation - ok
20:25:35.0207 3980	lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
20:25:35.0207 3980	lltdio - ok
20:25:35.0253 3980	lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
20:25:35.0269 3980	lltdsvc - ok
20:25:35.0285 3980	lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
20:25:35.0300 3980	lmhosts - ok
20:25:35.0331 3980	LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
20:25:35.0347 3980	LSI_FC - ok
20:25:35.0363 3980	LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
20:25:35.0363 3980	LSI_SAS - ok
20:25:35.0394 3980	LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:25:35.0394 3980	LSI_SAS2 - ok
20:25:35.0441 3980	LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:25:35.0456 3980	LSI_SCSI - ok
20:25:35.0472 3980	luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
20:25:35.0487 3980	luafv - ok
20:25:35.0534 3980	MBAMProtector   (6dfe7f2e8e8a337263aa5c92a215f161) C:\Windows\system32\drivers\mbam.sys
20:25:35.0534 3980	MBAMProtector - ok
20:25:35.0659 3980	MBAMService     (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
20:25:35.0675 3980	MBAMService - ok
20:25:35.0721 3980	Mcx2Svc         (e2b0887816ed336685954e3d8fdaa51d) C:\Windows\system32\Mcx2Svc.dll
20:25:35.0737 3980	Mcx2Svc - ok
20:25:35.0799 3980	mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
20:25:35.0815 3980	mdmxsdk - ok
20:25:35.0831 3980	megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
20:25:35.0831 3980	megasas - ok
20:25:35.0877 3980	MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
20:25:35.0893 3980	MegaSR - ok
20:25:36.0018 3980	Microsoft Office Groove Audit Service (fafe367d032ed82e9332b4c741a20216) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
20:25:36.0033 3980	Microsoft Office Groove Audit Service - ok
20:25:36.0096 3980	MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
20:25:36.0096 3980	MMCSS - ok
20:25:36.0111 3980	Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
20:25:36.0127 3980	Modem - ok
20:25:36.0189 3980	monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
20:25:36.0189 3980	monitor - ok
20:25:36.0221 3980	mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
20:25:36.0236 3980	mouclass - ok
20:25:36.0283 3980	mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
20:25:36.0283 3980	mouhid - ok
20:25:36.0314 3980	mountmgr        (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
20:25:36.0330 3980	mountmgr - ok
20:25:36.0455 3980	MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
20:25:36.0470 3980	MozillaMaintenance - ok
20:25:36.0517 3980	mpio            (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
20:25:36.0533 3980	mpio - ok
20:25:36.0564 3980	mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
20:25:36.0564 3980	mpsdrv - ok
20:25:36.0657 3980	MpsSvc          (5cd996cecf45cbc3e8d109c86b82d69e) C:\Windows\system32\mpssvc.dll
20:25:36.0689 3980	MpsSvc - ok
20:25:36.0720 3980	MRxDAV          (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
20:25:36.0735 3980	MRxDAV - ok
20:25:36.0798 3980	mrxsmb          (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:25:36.0813 3980	mrxsmb - ok
20:25:36.0829 3980	mrxsmb10        (5613358b4050f46f5a9832da8050d6e4) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:25:36.0845 3980	mrxsmb10 - ok
20:25:36.0860 3980	mrxsmb20        (25c9792778d80feb4c8201e62281bfdf) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:25:36.0876 3980	mrxsmb20 - ok
20:25:36.0923 3980	msahci          (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
20:25:36.0923 3980	msahci - ok
20:25:37.0063 3980	MSCSPTISRV      (8e46a7bac823dd82d4fb2a34c3df4c1d) C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
20:25:37.0079 3980	MSCSPTISRV - ok
20:25:37.0141 3980	msdsm           (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
20:25:37.0157 3980	msdsm - ok
20:25:37.0203 3980	MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
20:25:37.0219 3980	MSDTC - ok
20:25:37.0235 3980	Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
20:25:37.0235 3980	Msfs - ok
20:25:37.0250 3980	mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
20:25:37.0250 3980	mshidkmdf - ok
20:25:37.0266 3980	msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
20:25:37.0266 3980	msisadrv - ok
20:25:37.0344 3980	MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
20:25:37.0359 3980	MSiSCSI - ok
20:25:37.0375 3980	msiserver - ok
20:25:37.0391 3980	MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
20:25:37.0391 3980	MSKSSRV - ok
20:25:37.0422 3980	MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
20:25:37.0422 3980	MSPCLOCK - ok
20:25:37.0437 3980	MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
20:25:37.0437 3980	MSPQM - ok
20:25:37.0469 3980	MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
20:25:37.0484 3980	MsRPC - ok
20:25:37.0500 3980	mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
20:25:37.0500 3980	mssmbios - ok
20:25:37.0515 3980	MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
20:25:37.0531 3980	MSTEE - ok
20:25:37.0547 3980	MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
20:25:37.0547 3980	MTConfig - ok
20:25:37.0562 3980	Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
20:25:37.0562 3980	Mup - ok
20:25:37.0640 3980	napagent        (80284f1985c70c86f0b5f86da2dfe1df) C:\Windows\system32\qagentRT.dll
20:25:37.0640 3980	napagent - ok
20:25:37.0718 3980	NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
20:25:37.0734 3980	NativeWifiP - ok
20:25:37.0796 3980	NDIS            (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
20:25:37.0827 3980	NDIS - ok
20:25:37.0843 3980	NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
20:25:37.0859 3980	NdisCap - ok
20:25:37.0874 3980	NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
20:25:37.0874 3980	NdisTapi - ok
20:25:37.0905 3980	Ndisuio         (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
20:25:37.0921 3980	Ndisuio - ok
20:25:37.0937 3980	NdisWan         (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
20:25:37.0952 3980	NdisWan - ok
20:25:37.0968 3980	NDProxy         (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
20:25:37.0968 3980	NDProxy - ok
20:25:37.0999 3980	NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
20:25:38.0015 3980	NetBIOS - ok
20:25:38.0030 3980	NetBT           (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
20:25:38.0046 3980	NetBT - ok
20:25:38.0093 3980	Netlogon        (f42309c4191c506b71db5d1126d26318) C:\Windows\system32\lsass.exe
20:25:38.0093 3980	Netlogon - ok
20:25:38.0186 3980	Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
20:25:38.0202 3980	Netman - ok
20:25:38.0249 3980	netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
20:25:38.0280 3980	netprofm - ok
20:25:38.0420 3980	NetTcpPortSharing (fe2aa5a684b0dd9b1fae57b7817c198b) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:25:38.0436 3980	NetTcpPortSharing - ok
20:25:38.0888 3980	netw5v32        (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS\netw5v32.sys
20:25:39.0091 3980	netw5v32 - ok
20:25:39.0325 3980	nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
20:25:39.0325 3980	nfrd960 - ok
20:25:39.0403 3980	NlaSvc          (2226496e34bd40734946a054b1cd657f) C:\Windows\System32\nlasvc.dll
20:25:39.0419 3980	NlaSvc - ok
20:25:39.0450 3980	Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
20:25:39.0450 3980	Npfs - ok
20:25:39.0465 3980	npggsvc - ok
20:25:39.0497 3980	nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
20:25:39.0497 3980	nsi - ok
20:25:39.0512 3980	nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
20:25:39.0512 3980	nsiproxy - ok
20:25:39.0621 3980	Ntfs            (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
20:25:39.0715 3980	Ntfs - ok
20:25:39.0731 3980	Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
20:25:39.0746 3980	Null - ok
20:25:40.0417 3980	nvlddmkm        (61cc6e7237973caa4e384ce97fd7a7b9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:25:40.0729 3980	nvlddmkm - ok
20:25:40.0979 3980	nvraid          (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys
20:25:40.0994 3980	nvraid - ok
20:25:41.0057 3980	nvstor          (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys
20:25:41.0057 3980	nvstor - ok
20:25:41.0072 3980	nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
20:25:41.0088 3980	nv_agp - ok
20:25:41.0244 3980	odserv          (84de1dd996b48b05ace31ad015fa108a) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:25:41.0306 3980	odserv - ok
20:25:41.0337 3980	ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
20:25:41.0337 3980	ohci1394 - ok
20:25:41.0400 3980	ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:25:41.0415 3980	ose - ok
20:25:41.0509 3980	p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
20:25:41.0540 3980	p2pimsvc - ok
20:25:41.0587 3980	p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
20:25:41.0603 3980	p2psvc - ok
20:25:41.0696 3980	PACSPTISVR      (753a8f339f231d2b857e2ccd51a6e6ca) C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
20:25:41.0712 3980	PACSPTISVR - ok
20:25:41.0774 3980	Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
20:25:41.0774 3980	Parport - ok
20:25:41.0806 3980	partmgr         (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
20:25:41.0821 3980	partmgr - ok
20:25:41.0837 3980	Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
20:25:41.0837 3980	Parvdm - ok
20:25:41.0868 3980	PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
20:25:41.0884 3980	PcaSvc - ok
20:25:41.0899 3980	pci             (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
20:25:41.0915 3980	pci - ok
20:25:41.0930 3980	pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
20:25:41.0930 3980	pciide - ok
20:25:41.0962 3980	pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
20:25:41.0962 3980	pcmcia - ok
20:25:41.0993 3980	pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
20:25:42.0008 3980	pcw - ok
20:25:42.0055 3980	PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
20:25:42.0086 3980	PEAUTH - ok
20:25:42.0258 3980	pla             (9c1bff7910c89a1d12e57343475840cb) C:\Windows\system32\pla.dll
20:25:42.0352 3980	pla - ok
20:25:42.0554 3980	PlugPlay        (2cc2008f1296968fba162ed9f9afe328) C:\Windows\system32\umpnpmgr.dll
20:25:42.0570 3980	PlugPlay - ok
20:25:42.0570 3980	PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
20:25:42.0586 3980	PNRPAutoReg - ok
20:25:42.0617 3980	PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
20:25:42.0632 3980	PNRPsvc - ok
20:25:42.0695 3980	Point32         (896d916de06f5502d301e8c4dc442ae8) C:\Windows\system32\DRIVERS\point32.sys
20:25:42.0695 3980	Point32 - ok
20:25:42.0788 3980	PolicyAgent     (48e1b75c6dc0232fd92baae4bd344721) C:\Windows\System32\ipsecsvc.dll
20:25:42.0804 3980	PolicyAgent - ok
20:25:42.0835 3980	Power           (dbff83f709a91049621c1d35dd45c92c) C:\Windows\system32\umpo.dll
20:25:42.0851 3980	Power - ok
20:25:42.0913 3980	PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
20:25:42.0929 3980	PptpMiniport - ok
20:25:42.0944 3980	Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
20:25:42.0960 3980	Processor - ok
20:25:43.0022 3980	ProfSvc         (630cf26f0227498b7d5a92b12548960f) C:\Windows\system32\profsvc.dll
20:25:43.0022 3980	ProfSvc - ok
20:25:43.0069 3980	ProtectedStorage (f42309c4191c506b71db5d1126d26318) C:\Windows\system32\lsass.exe
20:25:43.0069 3980	ProtectedStorage - ok
20:25:43.0100 3980	Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
20:25:43.0100 3980	Psched - ok
20:25:43.0132 3980	PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\Windows\system32\Drivers\PxHelp20.sys
20:25:43.0132 3980	PxHelp20 - ok
20:25:43.0256 3980	ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
20:25:43.0334 3980	ql2300 - ok
20:25:43.0568 3980	ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
20:25:43.0584 3980	ql40xx - ok
20:25:43.0631 3980	QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
20:25:43.0646 3980	QWAVE - ok
20:25:43.0662 3980	QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
20:25:43.0662 3980	QWAVEdrv - ok
20:25:43.0724 3980	R5U870FLx86     (9ac8ac6cd00100443ea6afd0a4ade8f7) C:\Windows\system32\Drivers\R5U870FLx86.sys
20:25:43.0724 3980	R5U870FLx86 - ok
20:25:43.0740 3980	R5U870FUx86     (1ae358affffd13bf6ec7dc72dccfac12) C:\Windows\system32\Drivers\R5U870FUx86.sys
20:25:43.0756 3980	R5U870FUx86 - ok
20:25:43.0771 3980	RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
20:25:43.0771 3980	RasAcd - ok
20:25:43.0834 3980	RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
20:25:43.0849 3980	RasAgileVpn - ok
20:25:43.0865 3980	RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
20:25:43.0880 3980	RasAuto - ok
20:25:43.0896 3980	Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:25:43.0896 3980	Rasl2tp - ok
20:25:43.0927 3980	RasMan          (0ce66ec736b7fc526d78f7624c7d2a94) C:\Windows\System32\rasmans.dll
20:25:43.0943 3980	RasMan - ok
20:25:43.0958 3980	RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
20:25:43.0958 3980	RasPppoe - ok
20:25:43.0974 3980	RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
20:25:43.0990 3980	RasSstp - ok
20:25:44.0021 3980	rdbss           (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
20:25:44.0021 3980	rdbss - ok
20:25:44.0083 3980	rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
20:25:44.0083 3980	rdpbus - ok
20:25:44.0099 3980	RDPCDD          (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:25:44.0099 3980	RDPCDD - ok
20:25:44.0130 3980	RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
20:25:44.0146 3980	RDPENCDD - ok
20:25:44.0161 3980	RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
20:25:44.0161 3980	RDPREFMP - ok
20:25:44.0192 3980	RDPWD           (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
20:25:44.0192 3980	RDPWD - ok
20:25:44.0239 3980	rdyboost        (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
20:25:44.0239 3980	rdyboost - ok
20:25:44.0270 3980	regi            (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys
20:25:44.0270 3980	regi - ok
20:25:44.0333 3980	RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
20:25:44.0348 3980	RemoteAccess - ok
20:25:44.0380 3980	RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
20:25:44.0395 3980	RemoteRegistry - ok
20:25:44.0426 3980	RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys
20:25:44.0442 3980	RFCOMM - ok
20:25:44.0458 3980	RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
20:25:44.0458 3980	RpcEptMapper - ok
20:25:44.0504 3980	RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
20:25:44.0520 3980	RpcLocator - ok
20:25:44.0551 3980	RpcSs           (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll
20:25:44.0567 3980	RpcSs - ok
20:25:44.0614 3980	rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
20:25:44.0629 3980	rspndr - ok
20:25:44.0645 3980	SamSs           (f42309c4191c506b71db5d1126d26318) C:\Windows\system32\lsass.exe
20:25:44.0645 3980	SamSs - ok
20:25:44.0676 3980	sbp2port        (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
20:25:44.0692 3980	sbp2port - ok
20:25:44.0738 3980	SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
20:25:44.0754 3980	SCardSvr - ok
20:25:44.0785 3980	scfilter        (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
20:25:44.0785 3980	scfilter - ok
20:25:44.0848 3980	Schedule        (3e8b0c453e25613a1f59762a5c42aa75) C:\Windows\system32\schedsvc.dll
20:25:44.0879 3980	Schedule - ok
20:25:44.0941 3980	SCPolicySvc     (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll
20:25:44.0941 3980	SCPolicySvc - ok
20:25:44.0972 3980	SDRSVC          (5fd90abdbfaee85986802622cbb03446) C:\Windows\System32\SDRSVC.dll
20:25:44.0988 3980	SDRSVC - ok
20:25:45.0019 3980	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:25:45.0019 3980	secdrv - ok
20:25:45.0019 3980	seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
20:25:45.0019 3980	seclogon - ok
20:25:45.0035 3980	SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll
20:25:45.0050 3980	SENS - ok
20:25:45.0097 3980	SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
20:25:45.0113 3980	SensrSvc - ok
20:25:45.0128 3980	Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
20:25:45.0128 3980	Serenum - ok
20:25:45.0175 3980	Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
20:25:45.0191 3980	Serial - ok
20:25:45.0238 3980	sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
20:25:45.0238 3980	sermouse - ok
20:25:45.0316 3980	SessionEnv      (8f55ce568c543d5adf45c409d16718fc) C:\Windows\system32\sessenv.dll
20:25:45.0331 3980	SessionEnv - ok
20:25:45.0347 3980	sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
20:25:45.0362 3980	sffdisk - ok
20:25:45.0378 3980	sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
20:25:45.0394 3980	sffp_mmc - ok
20:25:45.0409 3980	sffp_sd         (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
20:25:45.0409 3980	sffp_sd - ok
20:25:45.0440 3980	sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
20:25:45.0456 3980	sfloppy - ok
20:25:45.0518 3980	SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
20:25:45.0534 3980	SharedAccess - ok
20:25:45.0581 3980	ShellHWDetection (cd2e48fa5b29ee2b3b5858056d246ef2) C:\Windows\System32\shsvcs.dll
20:25:45.0581 3980	ShellHWDetection - ok
20:25:45.0612 3980	sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
20:25:45.0612 3980	sisagp - ok
20:25:45.0628 3980	SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:25:45.0643 3980	SiSRaid2 - ok
20:25:45.0690 3980	SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
20:25:45.0690 3980	SiSRaid4 - ok
20:25:45.0737 3980	Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
20:25:45.0752 3980	Smb - ok
20:25:45.0815 3980	SNC             (db31d8989b3450569c29780e7fa98c48) C:\Windows\system32\Drivers\SonyNC.sys
20:25:45.0815 3980	SNC - ok
20:25:45.0877 3980	SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
20:25:45.0893 3980	SNMPTRAP - ok
20:25:45.0924 3980	spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
20:25:45.0924 3980	spldr - ok
20:25:45.0971 3980	Spooler         (49b6dd6ab3715b7a67965f17194e98a9) C:\Windows\System32\spoolsv.exe
20:25:45.0986 3980	Spooler - ok
20:25:46.0236 3980	sppsvc          (4c287f9069fedbd791178876ee9de536) C:\Windows\system32\sppsvc.exe
20:25:46.0330 3980	sppsvc - ok
20:25:46.0501 3980	sppuinotify     (d8e3e19eebdab49dd4a8d3062ead4ec7) C:\Windows\system32\sppuinotify.dll
20:25:46.0501 3980	sppuinotify - ok
20:25:46.0595 3980	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
20:25:46.0595 3980	Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
20:25:46.0595 3980	sptd ( LockedFile.Multi.Generic ) - warning
20:25:46.0595 3980	sptd - detected LockedFile.Multi.Generic (1)
20:25:46.0735 3980	SPTISRV         (e3e6c96b0ef4492c3c8fd0deef4e35a1) C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
20:25:46.0735 3980	SPTISRV - ok
20:25:46.0813 3980	srv             (50a83ca406c808bd35ac9141a0c7618f) C:\Windows\system32\DRIVERS\srv.sys
20:25:46.0844 3980	srv - ok
20:25:46.0922 3980	srv2            (dce7e10feaabd4cae95948b3de5340bb) C:\Windows\system32\DRIVERS\srv2.sys
20:25:46.0954 3980	srv2 - ok
20:25:46.0985 3980	srvnet          (bd1433a32792fd0dc450479094fc435a) C:\Windows\system32\DRIVERS\srvnet.sys
20:25:47.0000 3980	srvnet - ok
20:25:47.0063 3980	SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
20:25:47.0063 3980	SSDPSRV - ok
20:25:47.0094 3980	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:25:47.0110 3980	ssmdrv - ok
20:25:47.0125 3980	SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
20:25:47.0141 3980	SstpSvc - ok
20:25:47.0203 3980	STacSV          (b218068eba6f46f102b4218bdb81be0b) C:\Windows\system32\stacsv.exe
20:25:47.0219 3980	STacSV - ok
20:25:47.0250 3980	stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
20:25:47.0250 3980	stexstor - ok
20:25:47.0281 3980	STHDA           (167909a1c36aa3e8f2582962f0ccc748) C:\Windows\system32\drivers\stwrt.sys
20:25:47.0297 3980	STHDA - ok
20:25:47.0375 3980	StiSvc          (a22825e7bb7018e8af3e229a5af17221) C:\Windows\System32\wiaservc.dll
20:25:47.0437 3980	StiSvc - ok
20:25:47.0500 3980	swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
20:25:47.0500 3980	swenum - ok
20:25:47.0593 3980	swprv           (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
20:25:47.0624 3980	swprv - ok
20:25:47.0734 3980	SysMain         (04105c8da62353589c29bdaeb8d88bd8) C:\Windows\system32\sysmain.dll
20:25:47.0780 3980	SysMain - ok
20:25:47.0796 3980	TabletInputService (fcfb6c552fbc0da299799cbd50ad9fd4) C:\Windows\System32\TabSvc.dll
20:25:47.0812 3980	TabletInputService - ok
20:25:47.0843 3980	TapiSrv         (2f46b0c70a4adc8c90cf825da3b4feaf) C:\Windows\System32\tapisrv.dll
20:25:47.0843 3980	TapiSrv - ok
20:25:47.0874 3980	TBS             (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
20:25:47.0874 3980	TBS - ok
20:25:48.0030 3980	Tcpip           (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\drivers\tcpip.sys
20:25:48.0092 3980	Tcpip - ok
20:25:48.0124 3980	TCPIP6          (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\DRIVERS\tcpip.sys
20:25:48.0139 3980	TCPIP6 - ok
20:25:48.0186 3980	tcpipreg        (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
20:25:48.0202 3980	tcpipreg - ok
20:25:48.0217 3980	TDPIPE          (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
20:25:48.0217 3980	TDPIPE - ok
20:25:48.0248 3980	TDTCP           (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys
20:25:48.0248 3980	TDTCP - ok
20:25:48.0264 3980	tdx             (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
20:25:48.0280 3980	tdx - ok
20:25:48.0311 3980	TermDD          (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
20:25:48.0311 3980	TermDD - ok
20:25:48.0404 3980	TermService     (a01e50a04d7b1960b33e92b9080e6a94) C:\Windows\System32\termsrv.dll
20:25:48.0451 3980	TermService - ok
20:25:48.0467 3980	Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
20:25:48.0482 3980	Themes - ok
20:25:48.0529 3980	THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
20:25:48.0529 3980	THREADORDER - ok
20:25:48.0701 3980	ti21sony        (909cd987b54a8179c9aee874d754721a) C:\Windows\system32\drivers\ti21sony.sys
20:25:48.0763 3980	ti21sony - ok
20:25:48.0779 3980	TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
20:25:48.0779 3980	TrkWks - ok
20:25:48.0872 3980	TrustedInstaller (41a4c781d2286208d397d72099304133) C:\Windows\servicing\TrustedInstaller.exe
20:25:48.0888 3980	TrustedInstaller - ok
20:25:48.0919 3980	tssecsrv        (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:25:48.0919 3980	tssecsrv - ok
20:25:48.0966 3980	tunnel          (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
20:25:48.0982 3980	tunnel - ok
20:25:48.0997 3980	uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
20:25:49.0013 3980	uagp35 - ok
20:25:49.0044 3980	udfs            (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
20:25:49.0060 3980	udfs - ok
20:25:49.0122 3980	UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
20:25:49.0122 3980	UI0Detect - ok
20:25:49.0153 3980	uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
20:25:49.0169 3980	uliagpkx - ok
20:25:49.0200 3980	umbus           (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
20:25:49.0200 3980	umbus - ok
20:25:49.0231 3980	UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
20:25:49.0231 3980	UmPass - ok
20:25:49.0262 3980	upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
20:25:49.0278 3980	upnphost - ok
20:25:49.0340 3980	usbaudio        (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys
20:25:49.0356 3980	usbaudio - ok
20:25:49.0418 3980	usbccgp         (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
20:25:49.0434 3980	usbccgp - ok
20:25:49.0465 3980	usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
20:25:49.0481 3980	usbcir - ok
20:25:49.0512 3980	usbehci         (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
20:25:49.0512 3980	usbehci - ok
20:25:49.0559 3980	usbhub          (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
20:25:49.0574 3980	usbhub - ok
20:25:49.0590 3980	usbohci         (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
20:25:49.0606 3980	usbohci - ok
20:25:49.0637 3980	usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
20:25:49.0652 3980	usbprint - ok
20:25:49.0668 3980	USBSTOR         (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:25:49.0668 3980	USBSTOR - ok
20:25:49.0699 3980	usbuhci         (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
20:25:49.0699 3980	usbuhci - ok
20:25:49.0762 3980	usbvideo        (f642a7e4bf78cfa359cca0a3557c28d7) C:\Windows\system32\Drivers\usbvideo.sys
20:25:49.0777 3980	usbvideo - ok
20:25:49.0824 3980	UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
20:25:49.0840 3980	UxSms - ok
20:25:50.0011 3980	VAIO Entertainment TV Device Arbitration Service (afbcd738df9de3b6d71afc704e7f27fb) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
20:25:50.0042 3980	VAIO Entertainment TV Device Arbitration Service - ok
20:25:50.0167 3980	VAIO Event Service (8a9f18adad471402236ca931553bf79b) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
20:25:50.0183 3980	VAIO Event Service - ok
20:25:50.0417 3980	VAIOMediaPlatform-IntegratedServer-AppServer (0a4cd617ed1f03c8b7310fc4871173a4) C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
20:25:50.0557 3980	VAIOMediaPlatform-IntegratedServer-AppServer - ok
20:25:50.0666 3980	VAIOMediaPlatform-IntegratedServer-HTTP (56e33aaa46cba8431e72486196afb3a1) C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
20:25:50.0729 3980	VAIOMediaPlatform-IntegratedServer-HTTP - ok
20:25:50.0838 3980	VAIOMediaPlatform-IntegratedServer-UPnP (addf0e4e19bd2ff0a0b852d324fdc281) C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
20:25:50.0932 3980	VAIOMediaPlatform-IntegratedServer-UPnP - ok
20:25:51.0025 3980	VAIOMediaPlatform-UCLS-AppServer (52d4f568fe7d05ae5026b8717eeb59eb) C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
20:25:51.0072 3980	VAIOMediaPlatform-UCLS-AppServer - ok
20:25:51.0119 3980	VAIOMediaPlatform-UCLS-HTTP (56e33aaa46cba8431e72486196afb3a1) C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
20:25:51.0119 3980	VAIOMediaPlatform-UCLS-HTTP - ok
20:25:51.0228 3980	VAIOMediaPlatform-UCLS-UPnP (addf0e4e19bd2ff0a0b852d324fdc281) C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
20:25:51.0244 3980	VAIOMediaPlatform-UCLS-UPnP - ok
20:25:51.0415 3980	VaultSvc        (f42309c4191c506b71db5d1126d26318) C:\Windows\system32\lsass.exe
20:25:51.0431 3980	VaultSvc - ok
20:25:51.0540 3980	VcmIAlzMgr      (5d325b6add78a111be62a3842cf05345) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
20:25:51.0556 3980	VcmIAlzMgr - ok
20:25:51.0665 3980	VcmXmlIfHelper  (8fd247d84d168097d7bc3e4f21f3414d) C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
20:25:51.0696 3980	VcmXmlIfHelper - ok
20:25:51.0696 3980	Vcsw - ok
20:25:51.0790 3980	vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
20:25:51.0805 3980	vdrvroot - ok
20:25:51.0899 3980	vds             (8c4e7c49d3641bc9e299e466a7f8867d) C:\Windows\System32\vds.exe
20:25:51.0946 3980	vds - ok
20:25:51.0961 3980	vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
20:25:51.0961 3980	vga - ok
20:25:51.0977 3980	VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
20:25:51.0977 3980	VgaSave - ok
20:25:52.0008 3980	vhdmp           (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
20:25:52.0024 3980	vhdmp - ok
20:25:52.0055 3980	viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
20:25:52.0055 3980	viaagp - ok
20:25:52.0070 3980	ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
20:25:52.0070 3980	ViaC7 - ok
20:25:52.0086 3980	viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
20:25:52.0102 3980	viaide - ok
20:25:52.0117 3980	volmgr          (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
20:25:52.0117 3980	volmgr - ok
20:25:52.0164 3980	volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
20:25:52.0164 3980	volmgrx - ok
20:25:52.0211 3980	volsnap         (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
20:25:52.0226 3980	volsnap - ok
20:25:52.0289 3980	vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
20:25:52.0289 3980	vsmraid - ok
20:25:52.0398 3980	VSS             (7ea2bcd94d9cfaf4c556f5cc94532a6c) C:\Windows\system32\vssvc.exe
20:25:52.0445 3980	VSS - ok
20:25:52.0460 3980	vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
20:25:52.0460 3980	vwifibus - ok
20:25:52.0632 3980	VzCdbSvc        (0b3244bab1fa37cf15fa7243504391a6) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
20:25:52.0648 3980	VzCdbSvc - ok
20:25:52.0679 3980	VzFw            (938fbfa83148dadd7db0b1303dccfa00) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
20:25:52.0679 3980	VzFw - ok
20:25:52.0741 3980	W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
20:25:52.0757 3980	W32Time - ok
20:25:52.0819 3980	WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
20:25:52.0819 3980	WacomPen - ok
20:25:52.0850 3980	WANARP          (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
20:25:52.0866 3980	WANARP - ok
20:25:52.0866 3980	Wanarpv6        (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
20:25:52.0866 3980	Wanarpv6 - ok
20:25:52.0960 3980	wbengine        (7790b77fe1e5ee47dcc66247095bb4c9) C:\Windows\system32\wbengine.exe
20:25:53.0038 3980	wbengine - ok
20:25:53.0084 3980	WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
20:25:53.0100 3980	WbioSrvc - ok
20:25:53.0131 3980	wcncsvc         (d0f88aa11ee1a62bcc6d6a8a7783ca11) C:\Windows\System32\wcncsvc.dll
20:25:53.0131 3980	wcncsvc - ok
20:25:53.0162 3980	WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
20:25:53.0178 3980	WcsPlugInService - ok
20:25:53.0225 3980	Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
20:25:53.0225 3980	Wd - ok
20:25:53.0287 3980	Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
20:25:53.0334 3980	Wdf01000 - ok
20:25:53.0381 3980	WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
20:25:53.0396 3980	WdiServiceHost - ok
20:25:53.0412 3980	WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
20:25:53.0412 3980	WdiSystemHost - ok
20:25:53.0459 3980	WebClient       (d87c7d2c517f82a5ab7a73e203063d9e) C:\Windows\System32\webclnt.dll
20:25:53.0459 3980	WebClient - ok
20:25:53.0490 3980	Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
20:25:53.0490 3980	Wecsvc - ok
20:25:53.0506 3980	wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
20:25:53.0521 3980	wercplsupport - ok
20:25:53.0552 3980	WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
20:25:53.0568 3980	WerSvc - ok
20:25:53.0615 3980	WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
20:25:53.0630 3980	WfpLwf - ok
20:25:53.0662 3980	WimFltr         (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys
20:25:53.0677 3980	WimFltr - ok
20:25:53.0708 3980	WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
20:25:53.0708 3980	WIMMount - ok
20:25:53.0818 3980	winachsf        (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
20:25:53.0864 3980	winachsf - ok
20:25:54.0036 3980	WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
20:25:54.0098 3980	WinDefend - ok
20:25:54.0114 3980	WinHttpAutoProxySvc - ok
20:25:54.0332 3980	Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
20:25:54.0364 3980	Winmgmt - ok
20:25:54.0504 3980	WinRM           (c4f5d3901d1b41d602ddc196e0b95b51) C:\Windows\system32\WsmSvc.dll
20:25:54.0566 3980	WinRM - ok
20:25:54.0676 3980	Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
20:25:54.0707 3980	Wlansvc - ok
20:25:54.0800 3980	WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
20:25:54.0800 3980	WmiAcpi - ok
20:25:54.0847 3980	wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
20:25:54.0863 3980	wmiApSrv - ok
20:25:55.0066 3980	WMPNetworkSvc   (77fbd400984cf72ba0fc4b3489d65f74) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:25:55.0175 3980	WMPNetworkSvc - ok
20:25:55.0222 3980	WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
20:25:55.0237 3980	WPCSvc - ok
20:25:55.0268 3980	WPDBusEnum      (b7f658a2ebc07129538ad9ab35212637) C:\Windows\system32\wpdbusenum.dll
20:25:55.0268 3980	WPDBusEnum - ok
20:25:55.0378 3980	ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
20:25:55.0393 3980	ws2ifsl - ok
20:25:55.0409 3980	wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll
20:25:55.0424 3980	wscsvc - ok
20:25:55.0424 3980	WSearch - ok
20:25:55.0565 3980	wuauserv        (a33408cc036f9c08142b11be5e93f0a1) C:\Windows\system32\wuaueng.dll
20:25:55.0643 3980	wuauserv - ok
20:25:55.0768 3980	WudfPf          (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
20:25:55.0783 3980	WudfPf - ok
20:25:55.0830 3980	WUDFRd          (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:25:55.0830 3980	WUDFRd - ok
20:25:55.0877 3980	wudfsvc         (ddee3682fe97037c45f4d7ab467cb8b6) C:\Windows\System32\WUDFSvc.dll
20:25:55.0877 3980	wudfsvc - ok
20:25:55.0908 3980	WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
20:25:55.0924 3980	WwanSvc - ok
20:25:55.0970 3980	XAudio          (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys
20:25:55.0970 3980	XAudio - ok
20:25:56.0017 3980	XAudioService   (15a317674a08df26be65164d959e9203) C:\Windows\system32\DRIVERS\xaudio.exe
20:25:56.0033 3980	XAudioService - ok
20:25:56.0064 3980	yukonw7         (b07c5b7efdf936ff93d4f540938725be) C:\Windows\system32\DRIVERS\yk62x86.sys
20:25:56.0064 3980	yukonw7 - ok
20:25:56.0111 3980	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
20:25:56.0423 3980	\Device\Harddisk0\DR0 - ok
20:25:56.0438 3980	Boot (0x1200)   (6474a8e84c5ffe54d5fd7632a117c98a) \Device\Harddisk0\DR0\Partition0
20:25:56.0438 3980	\Device\Harddisk0\DR0\Partition0 - ok
20:25:56.0438 3980	============================================================
20:25:56.0438 3980	Scan finished
20:25:56.0438 3980	============================================================
20:25:56.0470 2356	Detected object count: 1
20:25:56.0470 2356	Actual detected object count: 1
20:26:27.0046 2356	sptd ( LockedFile.Multi.Generic ) - skipped by user
20:26:27.0046 2356	sptd ( LockedFile.Multi.Generic ) - User select action: Skip
         

Avira Rescue Scan

Code:
ATTFilter
Avira / Linux Version 1.9.152.0
Copyright (c) 2010 by Avira GmbH
All rights reserved.
engine set:         8.2.10.120
VDF Version:        7.11.38.158
Scan start time: Thu Aug  2 19:48:25 2012
configuration file: /etc/avira/scancl.conf
WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_1.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_2.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_3.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_4.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_5.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IENT_6.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_1.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_2.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_3.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_4.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_5.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda1/data/2007/08/cn_20070806000000000000000000010/0000016276.app --> 1 --> IE_6.CAB


WARNING: [The files in archive are multiple volume] /media/Devices/sda2/Users/chriz/Downloads/Forentreffen.part01.rar


WARNING: [File is encrypted] /media/Devices/sda2/Users/chriz/Downloads/avira_free_antivirus_de.exe --> AVSDKList.zip


WARNING: [File is encrypted] /media/Devices/sda2/Users/chriz/Downloads/avira_free_antivirus_de.exe --> ManualUninstallConfig.zip


WARNING: [File is encrypted] /media/Devices/sda2/Users/chriz/Downloads/avira_free_antivirus_de.exe --> ProductReleaseNotes.zip


WARNING: [File is encrypted] /media/Devices/sda2/Users/chriz/Downloads/avira_free_antivirus_de.exe --> QATestedProducts.zip


WARNING: [The files in archive are multiple volume] /media/Devices/sda2/Users/chriz/Downloads/Final Fantasy VII (PC) Ultima Edition/Setup-1.bin


WARNING: [Archive is invalid or corrupt] /media/Devices/sda2/Program Files/WinRAR/rarnew.dat


WARNING: [Unexpected end of block read] /media/Devices/sda2/Windows/Temp/Temporary Internet Files/Content.IE5/W62UEWOW/rescue_system-common-en[1].iso


Statistics :
Directories............... : 26247
Archives.................. : 3155
Files..................... : 1074281
Infected.............. : 0
Warnings.............. : 20
Suspicious............ : 0
Infections................ : 0
         
__________________

Geändert von Hydrom (02.08.2012 um 19:28 Uhr)

Alt 03.08.2012, 13:43   #4
t'john
/// Helfer-Team
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Sehr gut!


1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 04.08.2012, 11:47   #5
Hydrom
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Hallo t'john,

hier die aktuellen Logfiles. Ich habe inzwischen auch mit JavaRa mein Java geupdated.

Malwarebytes
Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.02.04

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
chriz :: CHRIS-PC [Administrator]

04.08.2012 10:57:14
mbam-log-2012-08-04 (10-57-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 332560
Laufzeit: 1 Stunde(n), 16 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
adwcleaner
Code:
ATTFilter
# AdwCleaner v1.800 - Logfile created 08/04/2012 at 12:42:33
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium  (32 bits)
# User : chriz - CHRIS-PC
# Running from : C:\Users\chriz\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\chriz\Desktop\Save
Folder Found : C:\ProgramData\Trymedia
File Found : C:\Users\chriz\AppData\Roaming\Mozilla\Firefox\Profiles\588nyvj1.default\searchplugins\web-search.xml

***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\chriz\AppData\Roaming\Mozilla\Firefox\Profiles\588nyvj1.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1270 octets] - [02/08/2012 12:35:54]
AdwCleaner[R2].txt - [1328 octets] - [02/08/2012 13:38:27]
AdwCleaner[R3].txt - [1045 octets] - [04/08/2012 12:42:33]

########## EOF - C:\AdwCleaner[R3].txt - [1173 octets] ##########
         


Alt 04.08.2012, 14:51   #6
t'john
/// Helfer-Team
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> Bundespolizeitrojaner entdeckt - Logs anbei

Alt 22.08.2012, 01:19   #7
t'john
/// Helfer-Team
 
Bundespolizeitrojaner entdeckt - Logs anbei - Standard

Bundespolizeitrojaner entdeckt - Logs anbei



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Bundespolizeitrojaner entdeckt - Logs anbei
adwcleaner, antivir, antivirus, avira, battle.net, bho, desktop, eraser, error, excel, firefox, flash player, google earth, grand theft auto, hier meine logs, home, hängen, install.exe, league of legends, logfile, mozilla, picasa, plug-in, programm, prozesse, registry, rescue cd, rundll, software, svchost.exe, system, taskhost.exe, teamspeak, trojan.agent.ge, trojaner-board, verweise, virus, vista, warnung, windows



Ähnliche Themen: Bundespolizeitrojaner entdeckt - Logs anbei


  1. Bundespolizeitrojaner
    Plagegeister aller Art und deren Bekämpfung - 03.01.2015 (13)
  2. Tagelang ohne Firewall - Logs anbei
    Log-Analyse und Auswertung - 04.09.2013 (11)
  3. Computerverhalten; verdacht auf ZBot (Logs anbei)
    Log-Analyse und Auswertung - 13.12.2012 (25)
  4. Ukash Bundespolizei Infektion - Logs anbei
    Plagegeister aller Art und deren Bekämpfung - 02.12.2012 (16)
  5. "Live Security Platinum" vollständig entfernt? Logs anbei.
    Log-Analyse und Auswertung - 03.08.2012 (33)
  6. Laptop (Vista) versendet Spam - Logs anbei
    Log-Analyse und Auswertung - 29.07.2012 (12)
  7. Bundespolizeitrojaner
    Plagegeister aller Art und deren Bekämpfung - 25.07.2012 (11)
  8. http://searchqu.com/410 als Startseite – gut oder bösartig? Logs anbei.
    Log-Analyse und Auswertung - 15.07.2012 (11)
  9. ANTIVIR meldet tr/sirefef.gc.1 und ATRAPS Gen2 - Was kann ich tun? Anbei Logs
    Log-Analyse und Auswertung - 13.06.2012 (1)
  10. BundespolizeiTrojaner
    Plagegeister aller Art und deren Bekämpfung - 13.04.2012 (7)
  11. BundespolizeiTrojaner
    Alles rund um Windows - 12.04.2012 (1)
  12. Bundespolizeitrojaner
    Log-Analyse und Auswertung - 28.03.2012 (12)
  13. Bundespolizeitrojaner
    Plagegeister aller Art und deren Bekämpfung - 10.10.2011 (7)
  14. Trojaner Katusha kann nicht gelöscht werden: Logs der Entfernungsversuche sind anbei
    Plagegeister aller Art und deren Bekämpfung - 14.06.2011 (14)
  15. Bundespolizeitrojaner die 17. ...
    Plagegeister aller Art und deren Bekämpfung - 19.04.2011 (3)
  16. Bundespolizeitrojaner
    Plagegeister aller Art und deren Bekämpfung - 18.04.2011 (19)
  17. Alle Programme starten sehr langsam - Logs anbei
    Log-Analyse und Auswertung - 19.12.2010 (6)

Zum Thema Bundespolizeitrojaner entdeckt - Logs anbei - Hallo trojaner-board Team, heute hat es mich anscheinend erwischt. Vorhin hat der Bundestrojaner/UKASH mein System lahmgelegt. Habe dann im abgesicherten Modus Malwarebytes laufen lassen und es wurde ein Trojan.Agent.Gen unter - Bundespolizeitrojaner entdeckt - Logs anbei...
Archiv
Du betrachtest: Bundespolizeitrojaner entdeckt - Logs anbei auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.