Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 04.05.2013, 00:02   #1
Dremor
 
Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Standard

Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt



Aloah,

bin gerade am verzweifeln.

Vor ca 2 Monaten habe ich mein System neu aufgestzt.
Es besteht aus:
Phenom II X4 BE @ 3,6 GHZ
Gigabyte MA790GP-UD4H
4Gig DDR2 800 Ram (2 Riegel)
Asus HD7870 DC II

In dieser Konfiguration läuft das System (ausser Graka) seit Jahren ohne Probleme und Stabil. Zuvor lief eine GTX470 drin.

Das Problem besteht nu laso darin, daß sich seit dem letzten Aufsetzen des Systems immer wieder, ohne irgendwelche Regelmässigkeiten, diverse Windows Dienste verabschieden.

Die Nachricht lautet immer : Windows muss heruntergefahren werden weil Dienst XY sich verabschiedet hat.

Habe mich natürlich im Netz schlau gemacht, auch verschiedene Hilfestellungen wie z.B. webkit/rootkit-scanner drüber laufen lassen, verschiedene Virenscanner, aber nie kam etwas bei rum.

Nun habe ich heute mein System aus lauter Frust neu aufgestzt, das Problem blieb allerdings.
Vorhin hat sich dann glaube der USB Dienst verabschiedet.

Da ich nun gar keine Ahnung mehr habe wende ich mich mal hoffnungsvoll an euch.

Hab auch mal ein OTL Scan gemacht.
Dies ist das Ergebnis :OTL Logfile:
OTL EXTRAS Logfile:
Code:
ATTFilter
OTL logfile created on: 04.05.2013 00:44:41 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,67 Gb Available Physical Memory | 66,68% Memory free
7,99 Gb Paging File | 5,88 Gb Available in Paging File | 73,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 85,59 Gb Free Space | 71,84% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 50,17 Gb Free Space | 51,38% Space Free | Partition Type: NTFS
Drive E: | 97,66 Gb Total Space | 45,90 Gb Free Space | 47,00% Space Free | Partition Type: NTFS
Drive F: | 102,77 Gb Total Space | 61,30 Gb Free Space | 59,65% Space Free | Partition Type: NTFS
 
Computer Name: VEKT-PC | User Name: Vekt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Razer\Naga\NagaTray.exe (Razer USA Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll ()
MOD - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RzSynapse) -- C:\Windows\SysNative\drivers\RzSynapse.sys (Razer USA Ltd)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
 
 
 
 
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 75 7E A8 6F 33 48 CE 01  [binary data]
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - Extension: Google Docs = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Mail = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga\NagaTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{304A4617-0092-456B-9A2E-6106B7026458}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.03 22:08:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DEFIANCE
[2013.05.03 22:08:22 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Defiance
[2013.05.03 21:48:11 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\AMD
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\ATI
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\ATI
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.05.03 21:47:04 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2013.05.03 21:47:04 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2013.05.03 21:47:04 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2013.05.03 21:47:04 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2013.05.03 21:47:04 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2013.05.03 21:47:04 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2013.05.03 21:47:03 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2013.05.03 21:47:03 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2013.05.03 21:47:03 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2013.05.03 21:47:03 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2013.05.03 21:47:03 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2013.05.03 21:47:03 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2013.05.03 21:47:03 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2013.05.03 21:47:03 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2013.05.03 21:47:03 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2013.05.03 21:47:03 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2013.05.03 21:47:03 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2013.05.03 21:47:03 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2013.05.03 21:47:03 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2013.05.03 21:47:03 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2013.05.03 21:47:03 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2013.05.03 21:47:03 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2013.05.03 21:47:03 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2013.05.03 21:47:03 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2013.05.03 21:47:02 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll
[2013.05.03 21:47:02 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll
[2013.05.03 21:47:02 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll
[2013.05.03 21:47:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2013.05.03 21:47:02 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll
[2013.05.03 21:47:02 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll
[2013.05.03 21:47:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll
[2013.05.03 21:47:02 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2013.05.03 21:47:02 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll
[2013.05.03 21:47:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll
[2013.05.03 21:47:02 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll
[2013.05.03 21:47:02 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll
[2013.05.03 21:47:01 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll
[2013.05.03 21:47:01 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll
[2013.05.03 21:47:01 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll
[2013.05.03 21:47:01 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll
[2013.05.03 21:47:01 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.05.03 21:47:01 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll
[2013.05.03 21:47:01 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll
[2013.05.03 21:47:01 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll
[2013.05.03 21:47:01 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll
[2013.05.03 21:47:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll
[2013.05.03 21:47:01 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll
[2013.05.03 21:47:01 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll
[2013.05.03 21:47:01 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll
[2013.05.03 21:47:01 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll
[2013.05.03 21:47:01 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll
[2013.05.03 21:47:01 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll
[2013.05.03 21:47:00 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll
[2013.05.03 21:47:00 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2013.05.03 21:47:00 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll
[2013.05.03 21:47:00 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll
[2013.05.03 21:47:00 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll
[2013.05.03 21:47:00 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll
[2013.05.03 21:47:00 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll
[2013.05.03 21:47:00 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll
[2013.05.03 21:47:00 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll
[2013.05.03 21:47:00 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll
[2013.05.03 21:47:00 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll
[2013.05.03 21:47:00 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll
[2013.05.03 21:46:59 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll
[2013.05.03 21:46:59 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll
[2013.05.03 21:46:59 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll
[2013.05.03 21:46:59 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll
[2013.05.03 21:46:59 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll
[2013.05.03 21:46:59 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll
[2013.05.03 21:46:59 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll
[2013.05.03 21:46:59 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll
[2013.05.03 21:46:59 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll
[2013.05.03 21:46:59 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll
[2013.05.03 21:46:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll
[2013.05.03 21:46:59 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll
[2013.05.03 21:46:59 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll
[2013.05.03 21:46:59 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll
[2013.05.03 21:46:59 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll
[2013.05.03 21:46:59 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll
[2013.05.03 21:46:59 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll
[2013.05.03 21:46:59 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll
[2013.05.03 21:46:58 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll
[2013.05.03 21:46:58 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll
[2013.05.03 21:46:58 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll
[2013.05.03 21:46:58 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll
[2013.05.03 21:46:58 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll
[2013.05.03 21:46:58 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll
[2013.05.03 21:46:58 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll
[2013.05.03 21:46:58 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll
[2013.05.03 21:46:58 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll
[2013.05.03 21:46:58 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll
[2013.05.03 21:46:57 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll
[2013.05.03 21:46:57 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll
[2013.05.03 21:46:57 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll
[2013.05.03 21:46:57 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll
[2013.05.03 21:46:57 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll
[2013.05.03 21:46:57 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll
[2013.05.03 21:46:57 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll
[2013.05.03 21:46:57 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll
[2013.05.03 21:46:57 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll
[2013.05.03 21:46:57 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll
[2013.05.03 21:46:57 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll
[2013.05.03 21:46:57 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll
[2013.05.03 21:46:57 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll
[2013.05.03 21:46:57 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll
[2013.05.03 21:46:56 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll
[2013.05.03 21:46:56 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll
[2013.05.03 21:46:56 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll
[2013.05.03 21:46:56 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll
[2013.05.03 21:46:56 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll
[2013.05.03 21:46:56 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll
[2013.05.03 21:46:56 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll
[2013.05.03 21:46:56 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll
[2013.05.03 21:46:56 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll
[2013.05.03 21:46:56 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll
[2013.05.03 21:46:56 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll
[2013.05.03 21:46:56 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll
[2013.05.03 21:46:55 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll
[2013.05.03 21:46:55 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll
[2013.05.03 21:46:55 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2013.05.03 21:46:55 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2013.05.03 21:46:55 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll
[2013.05.03 21:46:55 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll
[2013.05.03 21:46:55 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll
[2013.05.03 21:46:55 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll
[2013.05.03 21:46:55 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll
[2013.05.03 21:46:55 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll
[2013.05.03 21:46:55 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll
[2013.05.03 21:46:55 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll
[2013.05.03 21:46:55 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll
[2013.05.03 21:46:55 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll
[2013.05.03 21:46:54 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll
[2013.05.03 21:46:54 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll
[2013.05.03 21:46:54 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll
[2013.05.03 21:46:54 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll
[2013.05.03 21:46:54 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll
[2013.05.03 21:46:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll
[2013.05.03 21:46:54 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll
[2013.05.03 21:46:54 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll
[2013.05.03 21:46:54 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll
[2013.05.03 21:46:54 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll
[2013.05.03 21:46:54 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll
[2013.05.03 21:46:54 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll
[2013.05.03 21:46:53 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll
[2013.05.03 21:46:53 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll
[2013.05.03 21:46:53 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll
[2013.05.03 21:46:53 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2013.05.03 21:46:53 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll
[2013.05.03 21:46:53 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll
[2013.05.03 21:46:53 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll
[2013.05.03 21:46:53 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll
[2013.05.03 21:46:53 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll
[2013.05.03 21:46:53 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll
[2013.05.03 21:46:53 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll
[2013.05.03 21:46:53 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll
[2013.05.03 21:46:53 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll
[2013.05.03 21:46:53 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll
[2013.05.03 21:46:52 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll
[2013.05.03 21:46:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll
[2013.05.03 21:46:52 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll
[2013.05.03 21:46:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll
[2013.05.03 21:46:52 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll
[2013.05.03 21:46:52 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll
[2013.05.03 21:46:51 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll
[2013.05.03 21:46:51 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll
[2013.05.03 21:46:51 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll
[2013.05.03 21:46:51 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll
[2013.05.03 21:46:51 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.05.03 21:46:51 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll
[2013.05.03 21:46:51 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll
[2013.05.03 21:46:51 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll
[2013.05.03 21:46:51 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll
[2013.05.03 21:46:51 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll
[2013.05.03 21:46:51 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll
[2013.05.03 21:46:51 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll
[2013.05.03 21:46:50 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll
[2013.05.03 21:46:50 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll
[2013.05.03 21:46:50 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll
[2013.05.03 21:46:50 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll
[2013.05.03 21:46:50 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll
[2013.05.03 21:46:50 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll
[2013.05.03 21:45:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2013.05.03 21:45:43 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
[2013.05.03 21:45:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSI Afterburner
[2013.05.03 21:43:00 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Avira
[2013.05.03 21:41:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.05.03 21:36:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.05.03 21:36:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamSpeak 3 Client
[2013.05.03 21:35:57 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
[2013.05.03 21:35:54 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\IrfanView
[2013.05.03 21:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView
[2013.05.03 21:35:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
[2013.05.03 21:35:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer
[2013.05.03 21:34:27 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Dropbox
[2013.05.03 21:32:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.05.03 21:32:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.05.03 21:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.05.03 21:32:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2013.05.03 21:32:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.05.03 21:32:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.05.03 21:32:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.05.03 21:32:04 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.05.03 21:32:02 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.05.03 21:31:43 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Dropbox
[2013.05.03 21:31:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.05.03 21:31:30 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.05.03 21:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.05.03 21:30:50 | 000,000,000 | ---D | C] -- C:\AMD
[2013.05.03 21:27:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.05.03 21:27:37 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.03 21:27:37 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.03 21:27:37 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.03 21:27:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.05.03 21:27:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.05.03 21:27:00 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.05.03 21:23:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.05.03 21:22:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.05.03 21:22:50 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Google
[2013.05.03 21:22:46 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Deployment
[2013.05.03 21:22:46 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Apps
[2013.05.03 21:22:22 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2013.05.03 21:22:22 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2013.05.03 21:22:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Diagnostics
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Searches
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.05.03 21:20:10 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.05.03 21:20:10 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.05.03 21:20:10 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.05.03 21:20:09 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.05.03 21:20:09 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.05.03 21:20:09 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.05.03 21:20:08 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.05.03 21:20:08 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.05.03 21:20:08 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Identities
[2013.05.03 21:20:06 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Contacts
[2013.05.03 21:20:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\VirtualStore
[2013.05.03 21:20:03 | 000,000,000 | --SD | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Videos
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Saved Games
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Pictures
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Music
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Links
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Favorites
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Downloads
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Documents
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Desktop
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Vorlagen
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Verlauf
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Temporary Internet Files
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Startmenü
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\SendTo
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Recent
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Netzwerkumgebung
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Lokale Einstellungen
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Videos
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Musik
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Eigene Dateien
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Bilder
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Druckumgebung
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Cookies
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Anwendungsdaten
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Anwendungsdaten
[2013.05.03 21:20:03 | 000,000,000 | -H-D | C] -- C:\Users\Vekt\AppData
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Temp
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Microsoft
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Media Center Programs
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.05.03 21:19:54 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.05.03 20:33:33 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.05.03 20:33:24 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.04 00:27:46 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.04 00:27:46 | 000,698,688 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.04 00:27:46 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.04 00:27:46 | 000,148,828 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.04 00:27:46 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.04 00:27:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.04 00:23:20 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.04 00:23:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.04 00:23:16 | 3219,251,200 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.04 00:22:38 | 000,016,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 00:22:38 | 000,016,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.03 22:08:23 | 000,001,041 | ---- | M] () -- C:\Users\Vekt\Desktop\DEFIANCE.lnk
[2013.05.03 21:45:43 | 000,001,086 | ---- | M] () -- C:\Users\Vekt\Desktop\MSI Afterburner.lnk
[2013.05.03 21:41:24 | 001,558,224 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.03 21:40:14 | 000,001,047 | ---- | M] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.03 21:40:02 | 000,001,013 | ---- | M] () -- C:\Users\Vekt\Desktop\Dropbox.lnk
[2013.05.03 21:37:52 | 000,275,904 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.03 21:36:20 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.05.03 21:35:57 | 000,000,998 | ---- | M] () -- C:\Users\Vekt\Desktop\IrfanView.lnk
[2013.05.03 21:35:41 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.05.03 21:33:35 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.05.03 20:35:53 | 000,177,271 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.05.03 20:35:53 | 000,177,271 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.03 22:08:23 | 000,001,041 | ---- | C] () -- C:\Users\Vekt\Desktop\DEFIANCE.lnk
[2013.05.03 21:45:43 | 000,001,086 | ---- | C] () -- C:\Users\Vekt\Desktop\MSI Afterburner.lnk
[2013.05.03 21:41:24 | 001,558,224 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.03 21:36:20 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.05.03 21:35:57 | 000,000,998 | ---- | C] () -- C:\Users\Vekt\Desktop\IrfanView.lnk
[2013.05.03 21:35:41 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.05.03 21:34:28 | 000,001,013 | ---- | C] () -- C:\Users\Vekt\Desktop\Dropbox.lnk
[2013.05.03 21:33:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.05.03 21:32:19 | 000,001,047 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.03 21:22:51 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.03 21:22:51 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.03 21:20:16 | 000,001,405 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2013.05.03 21:20:14 | 000,001,439 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.05.03 20:35:36 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.05.03 20:35:34 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.05.03 20:33:24 | 3219,251,200 | -HS- | C] () -- C:\hiberfil.sys
[2013.03.29 04:13:14 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.03.29 04:13:12 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.03.29 03:38:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.03.29 03:38:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 01:18:46 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.09.28 21:45:06 | 000,247,296 | ---- | C] () -- C:\Windows\SysWow64\rtvcvfw32.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010.11.21 05:23:55 | 014,174,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.11.21 05:24:02 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.05.04 00:46:49 | 000,000,000 | ---D | M] -- C:\Users\Vekt\AppData\Roaming\Dropbox
[2013.05.03 21:35:54 | 000,000,000 | ---D | M] -- C:\Users\Vekt\AppData\Roaming\IrfanView
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

--- --- ---OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 04.05.2013 00:44:41 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,67 Gb Available Physical Memory | 66,68% Memory free
7,99 Gb Paging File | 5,88 Gb Available in Paging File | 73,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 85,59 Gb Free Space | 71,84% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 50,17 Gb Free Space | 51,38% Space Free | Partition Type: NTFS
Drive E: | 97,66 Gb Total Space | 45,90 Gb Free Space | 47,00% Space Free | Partition Type: NTFS
Drive F: | 102,77 Gb Total Space | 61,30 Gb Free Space | 59,65% Space Free | Partition Type: NTFS
 
Computer Name: VEKT-PC | User Name: Vekt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{21B2E81D-D55C-4D15-A863-3BC254ED613A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{360C46D4-1BE9-4480-B5D4-A825CD050281}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3E08830C-4B1A-40FD-A476-DF090889265F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3E403F00-1544-4932-B537-F7B9E644BF8C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{4548C37C-837D-462A-8ED9-6EC8347EAF19}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4EDF809D-7490-4012-9C2E-9FFF28F0E8FF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6F8AA8A7-A5C3-49D9-AB1A-09FB5C55D5D9}" = rport=445 | protocol=6 | dir=out | app=system | 
"{7AB59707-E5CC-428E-884A-6EE29699BDFB}" = lport=139 | protocol=6 | dir=in | app=system | 
"{80B9320D-32C0-47D7-B957-1BD8D33A956A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{815ED569-603B-4446-BC6F-D970DED33058}" = rport=139 | protocol=6 | dir=out | app=system | 
"{871CA8E1-80A7-4664-837C-38DDF6216CEB}" = lport=137 | protocol=17 | dir=in | app=system | 
"{AC85248B-0913-44C8-90BD-559CC89FDFC0}" = rport=138 | protocol=17 | dir=out | app=system | 
"{B46AEF33-6936-43CD-97FF-7CC1D15F3A68}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{C2408342-BDB8-403B-8639-7F9C24643197}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{CA1AF24A-F67D-4971-AA5A-2636AA9D8A88}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{DAD2F28A-EAFC-4831-9E91-668E169ED0CC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EB0EBB50-E34E-4176-A7B7-3969DD11526A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F5960683-416B-4428-B295-98D7793DFA39}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{F8D8A26A-B3C0-4A45-9787-327E93037F72}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F8ED36A8-99F7-4483-8919-91F2FC9436A4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FBFE2EF1-0EE1-4FCF-B548-71C53075B243}" = lport=138 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AA9B22C-7611-4E75-B141-3B663B6656AE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{39EFBFF7-C38A-488F-9074-320CC7808B6C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{4612564D-7D93-4813-927A-5334E6AA4C4E}" = protocol=6 | dir=out | app=system | 
"{4C1964D9-C20B-4AA0-BC03-BC61EFEFDE36}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{54802692-A5ED-4057-9B92-7EAF63A15A3E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{54C2E3E3-829A-42F6-8B62-28A103DAD8B9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{56AB1CDB-7E17-4D7A-9CE8-9E472E777A23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{60D0859F-D926-4A12-9B8A-4D43E6D5C87D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{67E23298-99AD-4A73-9C66-F1A310AB1F77}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{72027A1D-5C76-4FC7-80ED-FCD178D667D5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{880CF5B4-4051-4087-A6CC-5647AD5F2EC3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9C375D34-8453-4781-B002-A2362A43A782}" = protocol=17 | dir=in | app=c:\users\vekt\appdata\roaming\dropbox\bin\dropbox.exe | 
"{A29B828C-C3B1-4737-8B63-716C87A689F2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A43DDCBD-20E4-4157-A95A-548924F928F4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{B08DDCD6-3318-41BC-9A47-278368B92600}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{BAE89A95-B343-4F97-B807-18079D685FA1}" = protocol=6 | dir=in | app=c:\users\vekt\appdata\roaming\dropbox\bin\dropbox.exe | 
"{DF991CFB-2155-480D-9057-FCD99BD43E8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{EBEF5B7E-B9C9-4A4C-AE5C-D1E38D4D340E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F01E6DBA-88BB-4584-963C-FC4F79FE061B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{F2B27940-9F3C-4B76-B267-311615CD6651}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F3CF5B38-283D-4597-AE3B-979ACC1C32D2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003B37AE-21F5-5BC5-F5EB-CD60A8928696}" = AMD Accelerated Video Transcoding
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{35D00343-3BFA-46A1-C6DD-FFD770501E0B}" = AMD Drag and Drop Transcoding
"{408DD513-C71C-EF6C-1456-247DD8403E18}" = AMD Steady Video Plug-In 
"{6397820D-9FC6-774C-1EF5-CBA09049E426}" = AMD Fuel
"{653B9326-BD45-53BE-681A-A49CAAEE8A3C}" = ccc-utility64
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}" = AMD Catalyst Install Manager
"{AAFE68DD-A2D5-BDBF-E1B2-CB01DEFD6EB0}" = AMD Media Foundation Decoders
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{13464292-6666-B2DB-1B0C-A3FE14DAD1F9}" = CCC Help Dutch
"{338CD56F-1CDC-CF32-33F6-DED2DF92284E}" = CCC Help French
"{46458556-5C46-79A9-A6FF-81DF1F8B2729}" = CCC Help Hungarian
"{519D68B8-A768-4CDC-E4C9-B115D49CED93}" = CCC Help Norwegian
"{51D383BC-D988-8C1E-FAA1-BC5260A32A87}" = CCC Help Polish
"{58C7728C-D226-41B9-AA52-39CCC3ADB65F}_is1" = DEFIANCE
"{5A883D2B-D279-0D01-6E62-B810AFD8CC62}" = Catalyst Control Center InstallProxy
"{67A4760F-9804-CCF6-C319-27840ED77924}" = CCC Help Korean
"{6BE5E4A9-D88B-532D-26E6-883C32BF098A}" = CCC Help Thai
"{6E0D26C1-4265-1D02-4D19-D0A8F6A463F8}" = AMD VISION Engine Control Center
"{79B1FF35-9EA8-48ED-98D6-19ABE004BE89}" = DefianceRuntimes
"{7DD62206-7B6C-E32E-BD11-B49B3B089D16}" = CCC Help Danish
"{9739158D-EDED-D628-9865-1460B5A7FAE3}" = CCC Help Portuguese
"{9809124C-0C4C-2367-7889-1E16D8EF1AAF}" = CCC Help Chinese Standard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A6E1EE9D-01DD-82FD-BDBC-193BCEF9FD5C}" = CCC Help Greek
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB13F192-49FC-A065-F15C-746B10CC43C8}" = CCC Help Japanese
"{AE548812-D611-608D-61C6-7E40F28573A2}" = CCC Help Russian
"{BC63AEF9-1367-9F7C-5926-52E56450EDCD}" = CCC Help Spanish
"{C1E2D27F-B363-588E-8859-9EF7F4EBF418}" = CCC Help Chinese Traditional
"{D76AC809-CCC1-6198-4970-A63FA5CF7DCB}" = CCC Help Swedish
"{DA675EE2-4C04-9699-0EE2-7EF9FE7AB870}" = CCC Help German
"{E06F7C95-4D68-63D9-2231-AA5F8E186FCB}" = CCC Help English
"{E21A8F3C-1ACB-46B1-CE72-E9CF09549DED}" = Catalyst Control Center Localization All
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E2F52AC2-B925-C18F-E1AE-42FBD46ECAC7}" = CCC Help Czech
"{E649AC39-69C0-C6FE-0A54-4752DB5D1FD2}" = Catalyst Control Center Graphics Previews Common
"{E9463114-898C-7C2A-2C47-E9ABC63F5D43}" = CCC Help Finnish
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F3CC3463-C6C2-4667-BDAC-BC517A11628F}" = Razer Naga
"{FF10AC4D-3349-99DA-3E58-5197CEA1D833}" = CCC Help Italian
"{FFEC93FF-C162-C0C3-B5E7-01214B0E5F2D}" = CCC Help Turkish
"Afterburner" = MSI Afterburner 2.3.1
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"IrfanView" = IrfanView (remove only)
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 03.05.2013 16:04:54 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.05.2013 16:23:04 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 03.05.2013 16:23:15 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 03.05.2013 16:23:16 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 03.05.2013 16:23:18 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 03.05.2013 16:23:25 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 03.05.2013 18:01:34 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe_PlugPlay, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7c96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000026687
ID
 des fehlerhaften Prozesses: 0x288  Startzeit der fehlerhaften Anwendung: 0x01ce484984405501
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\RPCRT4.dll  Berichtskennung: cbe5feaa-b43f-11e2-b76a-00241d126209
 
Error - 03.05.2013 18:22:01 | Computer Name = Vekt-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Patcher.exe, Version: 2.0.0.0, Zeitstempel:
 0x517a215d  Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.1, Zeitstempel:
 0x4d5f0c22  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00001f68  ID des fehlerhaften Prozesses:
 0xa08  Startzeit der fehlerhaften Anwendung: 0x01ce484a3fec407f  Pfad der fehlerhaften
 Anwendung: C:\Users\Vekt\AppData\Local\Defiance\Patcher.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\MSVCR100.dll  Berichtskennung: dfecd7c9-b43f-11e2-b76a-00241d126209
 
Error - 03.05.2013 18:25:10 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 03.05.2013 16:05:03 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 03.05.2013 16:05:10 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 03.05.2013 16:05:18 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 03.05.2013 16:05:25 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 03.05.2013 17:59:43 | Computer Name = Vekt-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?03.?05.?2013 um 23:58:14 unerwartet heruntergefahren.
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "DCOM-Server-Prozessstart" wurde unerwartet beendet. Dies
 ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Computers.
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Plug & Play" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
 Neustart des Computers.
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Stromversorgung" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
 Neustart des Computers.
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "DCOM-Server-Prozessstart" Korrekturmaßnahmen (Neustart des Computers)
 durchzuführen, ist fehlgeschlagen. Fehler:   %%1190
 
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Plug & Play" Korrekturmaßnahmen (Neustart des Computers) durchzuführen,
 ist fehlgeschlagen. Fehler:   %%1190
 
 
< End of report >
         
--- --- ---

und hier noch ein Log von Gmer:

GMER Logfile:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-04 01:20:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 M4-CT128M4SSD2 rev.0309 119,24GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Vekt\AppData\Local\Temp\kxldypow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe[2176] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69            0000000076261465 2 bytes [26, 76]
.text   C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe[2176] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155           00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
?       C:\Windows\system32\mssprxy.dll [1648] entry point in ".rdata" section                                                         000000006c6671e6
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5     0000000076fef9a1 7 bytes {MOV EDX, 0xf64e28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5          0000000076fefbe5 7 bytes {MOV EDX, 0xf64e68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5              0000000076fefc15 7 bytes {MOV EDX, 0xf64da8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5       0000000076fefc2d 7 bytes {MOV EDX, 0xf64d28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5         0000000076fefc45 7 bytes {MOV EDX, 0xf64f28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5       0000000076fefc75 7 bytes {MOV EDX, 0xf64f68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5        0000000076fefcf5 7 bytes {MOV EDX, 0xf64ee8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5       0000000076fefd0d 7 bytes {MOV EDX, 0xf64ea8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                 0000000076fefd59 7 bytes {MOV EDX, 0xf64c68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5      0000000076fefe51 7 bytes {MOV EDX, 0xf64ca8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5               0000000076ff00a9 7 bytes {MOV EDX, 0xf64c28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5         0000000076ff10b5 7 bytes {MOV EDX, 0xf64de8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5               0000000076ff112d 7 bytes {MOV EDX, 0xf64d68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5  0000000076ff1331 7 bytes {MOV EDX, 0xf64ce8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5     0000000076fef9a1 7 bytes {MOV EDX, 0x66aa28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5          0000000076fefbe5 7 bytes {MOV EDX, 0x66aa68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5              0000000076fefc15 7 bytes {MOV EDX, 0x66a9a8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5       0000000076fefc2d 7 bytes {MOV EDX, 0x66a928; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5         0000000076fefc45 7 bytes {MOV EDX, 0x66ab28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5       0000000076fefc75 7 bytes {MOV EDX, 0x66ab68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5        0000000076fefcf5 7 bytes {MOV EDX, 0x66aae8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5       0000000076fefd0d 7 bytes {MOV EDX, 0x66aaa8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                 0000000076fefd59 7 bytes {MOV EDX, 0x66a868; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5      0000000076fefe51 7 bytes {MOV EDX, 0x66a8a8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5               0000000076ff00a9 7 bytes {MOV EDX, 0x66a828; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5         0000000076ff10b5 7 bytes {MOV EDX, 0x66a9e8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5               0000000076ff112d 7 bytes {MOV EDX, 0x66a968; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5  0000000076ff1331 7 bytes {MOV EDX, 0x66a8e8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5     0000000076fef9a1 7 bytes {MOV EDX, 0x37ba28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5          0000000076fefbe5 7 bytes {MOV EDX, 0x37ba68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5              0000000076fefc15 7 bytes {MOV EDX, 0x37b9a8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5       0000000076fefc2d 7 bytes {MOV EDX, 0x37b928; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5         0000000076fefc45 7 bytes {MOV EDX, 0x37bb28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5       0000000076fefc75 7 bytes {MOV EDX, 0x37bb68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5        0000000076fefcf5 7 bytes {MOV EDX, 0x37bae8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5       0000000076fefd0d 7 bytes {MOV EDX, 0x37baa8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                 0000000076fefd59 7 bytes {MOV EDX, 0x37b868; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5      0000000076fefe51 7 bytes {MOV EDX, 0x37b8a8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5               0000000076ff00a9 7 bytes {MOV EDX, 0x37b828; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5         0000000076ff10b5 7 bytes {MOV EDX, 0x37b9e8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5               0000000076ff112d 7 bytes {MOV EDX, 0x37b968; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5  0000000076ff1331 7 bytes {MOV EDX, 0x37b8e8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5     0000000076fef9a1 7 bytes {MOV EDX, 0x465e28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5          0000000076fefbe5 7 bytes {MOV EDX, 0x465e68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5              0000000076fefc15 7 bytes {MOV EDX, 0x465da8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5       0000000076fefc2d 7 bytes {MOV EDX, 0x465d28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5         0000000076fefc45 7 bytes {MOV EDX, 0x465f28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5       0000000076fefc75 7 bytes {MOV EDX, 0x465f68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5        0000000076fefcf5 7 bytes {MOV EDX, 0x465ee8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5       0000000076fefd0d 7 bytes {MOV EDX, 0x465ea8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                 0000000076fefd59 7 bytes {MOV EDX, 0x465c68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5      0000000076fefe51 7 bytes {MOV EDX, 0x465ca8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5               0000000076ff00a9 7 bytes {MOV EDX, 0x465c28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5         0000000076ff10b5 7 bytes {MOV EDX, 0x465de8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5               0000000076ff112d 7 bytes {MOV EDX, 0x465d68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5  0000000076ff1331 7 bytes {MOV EDX, 0x465ce8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5     0000000076fef9a1 7 bytes {MOV EDX, 0xfb0e28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5          0000000076fefbe5 7 bytes {MOV EDX, 0xfb0e68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5              0000000076fefc15 7 bytes {MOV EDX, 0xfb0da8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5       0000000076fefc2d 7 bytes {MOV EDX, 0xfb0d28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5         0000000076fefc45 7 bytes {MOV EDX, 0xfb0f28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5       0000000076fefc75 7 bytes {MOV EDX, 0xfb0f68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5        0000000076fefcf5 7 bytes {MOV EDX, 0xfb0ee8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5       0000000076fefd0d 7 bytes {MOV EDX, 0xfb0ea8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                 0000000076fefd59 7 bytes {MOV EDX, 0xfb0c68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5      0000000076fefe51 7 bytes {MOV EDX, 0xfb0ca8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5               0000000076ff00a9 7 bytes {MOV EDX, 0xfb0c28; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5         0000000076ff10b5 7 bytes {MOV EDX, 0xfb0de8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5               0000000076ff112d 7 bytes {MOV EDX, 0xfb0d68; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5  0000000076ff1331 7 bytes {MOV EDX, 0xfb0ce8; JMP RDX}
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155     00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69        0000000076261465 2 bytes [26, 76]
.text   C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155       00000000762614bb 2 bytes [26, 76]
.text   ...                                                                                                                            * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\mmc.exe [2456:2324]                                                                                        000007fee9c3472c
Thread  C:\Windows\system32\mmc.exe [2456:2040]                                                                                        000007fee9d780ec
Thread  C:\Windows\system32\mmc.exe [2456:3524]                                                                                        000007fefb2f2ab8
Thread  C:\Windows\system32\mmc.exe [2456:2508]                                                                                        000007fee9d780ec
Thread  C:\Windows\system32\mmc.exe [2456:4016]                                                                                        000007fee9d81cfc
Thread  C:\Windows\system32\mmc.exe [2456:3420]                                                                                        000007fee9d780ec
Thread  C:\Windows\system32\mmc.exe [2456:712]                                                                                         000007fee9d780ec
Thread  C:\Windows\system32\mmc.exe [2456:2148]                                                                                        000007fee9c61564
Thread  C:\Windows\system32\mmc.exe [2456:1884]                                                                                        000007fee9d780ec

---- Files - GMER 2.1 ----

File    C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005d                                                     0 bytes
File    C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000c8                                                     0 bytes

---- EOF - GMER 2.1 ----
         
--- --- ---


Hoffnungsvoll
Dremor

Geändert von Dremor (04.05.2013 um 00:21 Uhr)

Alt 06.05.2013, 10:55   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Standard

Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt





Zitat:
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Warum hast du eine Professional-Edition von Windows, brauchst du das als Heimanwender?
Oder ist das rein zufällig ein Büro-/Firmen-PC bzw. ein Uni-Rechner?


Hast du die Hardware schonmal überprüft? Es gibt da diverse Testsoftware zB Memtest86+, welches den RAM prüft.


Du solltest auch mal versuchen rauszufinden, ob das nur unter Windows so ist, oder auch mit anderen Betriebssystemen.

So kann man sehen ob sich da ein Hardwareproblem abzeichnet oder der Fehler eher in der Konfig in Windows und/oder im Dateisystem ist.

Lad dir mal sowas wie Knoppix oder Xubuntu herunter, brenn die iso Datei per Imagebrennfunktion auf eine CD und boote den Rechner davon.
Teste dann mal ausgiebig das System unter Linux und berichte ob es dort normal läuft.
__________________

__________________

Alt 06.05.2013, 17:57   #3
Dremor
 
Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Standard

Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt



So, da ich gestern nichts zu tun hatte, habe ich den Rechner nochmal neu aufgestzt.

Zum Betriebssystem, ich arbeite an einer Schule und da kommt man billiger an Software ran.
Zudem ist dies eine Systembuilderversion und war einfach billiger als die Homeversion auf dem freien Markt.

Das mit dem Hardwaredefekt kam mir auch schon in den Sinn.
Die Fehler kamen auch immer dann wenn ich "Defiance" am zocken bin. Kann natürlich Zufall sein, da ich diesen Rechner fast nur zum zocken nehme.
Surfen, Videos etc mach ich mit meinem Asus TF101.

Werde die Tests mal durchlaufen lassen und mich wieder melden.

Ach ja, was mir einfällt, ich hatte das letzte mal beim neuaufsetzten diese Minipartition auf der diese Wiederherstellungsdaten sind nicht mitgelöscht.
Könnte es sein das ich darüber den Fehler ( wenn es ein Softwareseitiger ist ) mit auf die neue Installation genommen habe ?

Gruß Dremor
__________________

Alt 06.05.2013, 20:47   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Standard

Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt



Ja, wenn man neu installation sollte man auch unbedingt die bestehende 100-MB-Startpartition löschen. Das Windows-7-Setup legt diese automatisch wieder neu an.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 06.05.2013, 22:47   #5
Dremor
 
Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Standard

Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt



Na dann hoffe ich mal, dass es daran lag.

Gruß Dremor


Antwort

Themen zu Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt
antivir, autorun, avg, avira, bho, desktop, diverse, explorer, explorer.exe, firefox, format, google, install.exe, logfile, microsoft, mmc.exe, neu, ntdll.dll, opera, plug-in, programme, realtek, registry, software, system, system neu, teamspeak, usb, windows, winlogon



Ähnliche Themen: Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt


  1. Tägliche "Erkennung interaktiver Dienste" und "automatische Abmeldung" bei web.de
    Log-Analyse und Auswertung - 12.02.2015 (41)
  2. "tcbhn hat ein Problem festgestellt und muß beendet werden"
    Plagegeister aller Art und deren Bekämpfung - 01.08.2013 (16)
  3. XP-Rechner nach "System care antivirus" Befall neu aufgesetzt
    Log-Analyse und Auswertung - 29.04.2013 (9)
  4. Problem: "remoteprozeduraufruf wurde unerwartet beendet"
    Plagegeister aller Art und deren Bekämpfung - 21.03.2012 (11)
  5. Internet Explorer öffnet russische Seiten und Windows dienste werden immer beendet
    Log-Analyse und Auswertung - 08.01.2011 (37)
  6. Bei diversen Programmen "... hat ein Problem festgestellt und muss beendet werden"
    Plagegeister aller Art und deren Bekämpfung - 23.11.2009 (21)
  7. "hat ein Probl. festgestellt u. muss beendet werden" JUSCHED, NERO, WS FTP, etc.
    Log-Analyse und Auswertung - 21.09.2009 (15)
  8. Computer langsam, beim Runterfahren Meldung: "Control" müsse erst beendet werden
    Plagegeister aller Art und deren Bekämpfung - 05.04.2009 (0)
  9. Logfile auswerten + Fehlerbehebung: "icq hat Problem festgestellt, beendet werden"
    Log-Analyse und Auswertung - 18.07.2008 (0)
  10. "explorer.exe hat ein Problem festgestellt und muss beendet werden". Bitte um Hilfe
    Plagegeister aller Art und deren Bekämpfung - 20.03.2008 (2)
  11. "Programm muss beendet werden"+Unendlich viele Spybot Meldungen!
    Log-Analyse und Auswertung - 02.03.2008 (2)
  12. "Windows muss beendet werden" nach Programminstallierung
    Alles rund um Windows - 27.02.2007 (6)
  13. "xxx hat ein Problem festgestellt und muss beendet werden"
    Log-Analyse und Auswertung - 25.09.2006 (6)
  14. "Das Programm hat einen Fehler festgestellt und muss beendet werden..."
    Log-Analyse und Auswertung - 07.02.2006 (7)
  15. NT-Autorität\System RPC unerwartet beendet
    Log-Analyse und Auswertung - 15.09.2005 (7)
  16. "ICQLite hat ein Problem festgestellt und muss beendet werden."
    Log-Analyse und Auswertung - 08.07.2005 (1)
  17. "IE hat ein Problem festgestellt u. muss beendet werden"
    Alles rund um Windows - 29.12.2004 (1)

Zum Thema Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt - Aloah, bin gerade am verzweifeln. Vor ca 2 Monaten habe ich mein System neu aufgestzt. Es besteht aus: Phenom II X4 BE @ 3,6 GHZ Gigabyte MA790GP-UD4H 4Gig DDR2 800 - Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt...
Archiv
Du betrachtest: Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.