| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Coin-miner zieht alle ressourcen! Processor 100%Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
15.06.2013, 14:29
| #1 |
 |  Coin-miner zieht alle ressourcen! Processor 100% Hallo, ich fürchte ich habe mir einen Virus eingefangen. Seit einer Stunde läuft mein Prozessor mit 100% - der Task Manager zeigt dass ein Programm "Coin-miner (32-bit)" die ganze Last verursacht. Ich bitte um Hilfe, hoffe ich hab das mit den log files richtig gemacht. Gruss mamic HTML-Code: OTL Extras logfile created on: 15.06.2013 14:43:15 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = G:\Desktop 64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16599) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,91 Gb Total Physical Memory | 5,75 Gb Available Physical Memory | 72,69% Memory free 9,10 Gb Paging File | 6,93 Gb Available in Paging File | 76,13% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86) Drive C: | 74,43 Gb Total Space | 20,50 Gb Free Space | 27,54% Space Free | Partition Type: NTFS Drive E: | 379,63 Gb Total Space | 11,30 Gb Free Space | 2,98% Space Free | Partition Type: NTFS Drive G: | 75,19 Gb Total Space | 16,79 Gb Free Space | 22,32% Space Free | Partition Type: NTFS Drive H: | 9,77 Gb Total Space | 0,80 Gb Free Space | 8,17% Space Free | Partition Type: NTFS Computer Name: YPS | User Name: Santa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) .url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation) Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation) Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. [color=#E56717]========== Security Center Settings ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00AA2EAD-5274-4D92-9EDD-D49C8061DE85}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{0A53D4A1-9579-4BC2-B94A-A70C9A0E055A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{19FBCE80-5F45-4E38-A25A-7E4FCBC90F1A}" = lport=138 | protocol=17 | dir=in | app=system | "{244C4895-4C76-475A-8613-6FFEC6114CCE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{34544656-2DAE-49C1-BAC3-54D53767C889}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{3A426161-B67B-4454-B706-29AE10C1B108}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{4560CD55-5749-404E-A939-5EBC735E61C4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{52DB5E37-0527-4BB7-A20C-7C7CC57B9A0A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{5A9ECE9F-4BF2-42D0-9D9A-B9D4F80D60C4}" = rport=139 | protocol=6 | dir=out | app=system | "{782D33FC-6480-4395-8780-8ADA2333039B}" = lport=445 | protocol=6 | dir=in | app=system | "{7A8B0523-3C55-4896-A3C8-C0FBF339F5DB}" = lport=139 | protocol=6 | dir=in | app=system | "{7E6793FA-A50C-4EF9-BB7E-4E1F38E284AB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{85F92CF4-C2D8-47DB-9EF0-71E7CD5FA6E5}" = rport=138 | protocol=17 | dir=out | app=system | "{9F208396-A77A-44E3-9C6B-1F0BB54FF12A}" = lport=137 | protocol=17 | dir=in | app=system | "{A0388511-25AA-4D35-9F80-F78ABC20CE71}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{AC00F4B2-03A0-4162-B5E9-1359D94AECD7}" = rport=445 | protocol=6 | dir=out | app=system | "{B1E4266C-F3A2-4A76-BE67-7E2D01642C09}" = rport=137 | protocol=17 | dir=out | app=system | "{BF853237-B7F5-4A2C-B93D-7F4303032217}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{C2EE18AE-FC12-4122-BDC8-177E36D27502}" = lport=10243 | protocol=6 | dir=in | app=system | "{D6A2F78B-C065-48AE-8912-1DFD00F0A5C9}" = lport=2869 | protocol=6 | dir=in | app=system | "{E72414E9-7784-4A30-B89F-05F5C33783BB}" = rport=10243 | protocol=6 | dir=out | app=system | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{027DB729-8992-4FE4-9DD8-58A7AC6BE651}" = dir=in | name=hp printer control | "{0C05591A-9238-4A1D-AED6-9A1AFBB11496}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{0CF432F0-4FFE-4F0B-B651-E3465D500302}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{0D9D7EF4-DB63-4175-8FF6-D2616FEB69DA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{12A6FBCF-1CCD-48FE-9C56-019F98C1FAA0}" = dir=out | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} | "{14777555-956F-47D7-993A-D472AF732C33}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{1EB804B3-94AD-47AF-9CB0-3764F1ABA454}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{20859E39-FAE7-4EB7-98AC-89F754271DD8}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | "{21DF9161-2A80-4156-A1EB-2A58D562BE36}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{2236FC6B-DC1B-4981-9A96-525EA9CEE2A7}" = dir=out | name=markpad | "{22971F3B-30F1-4838-8AC7-924A0FDA7B24}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{28BD4296-755B-412D-BAD9-1DC7904E9B2B}" = protocol=6 | dir=in | app=c:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe | "{2BC61803-8966-4177-ADC2-9F35D6EB708D}" = dir=out | name=@{microsoft.bingsports_1.8.0.51_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} | "{3538CDF3-BDFF-42CB-AF64-E67605FEAAB1}" = dir=out | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} | "{3A49E9EB-7A1D-42CF-A343-20D7AF2BED14}" = dir=out | name=@{microsoft.zunemusic_1.1.144.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} | "{469D8B87-0048-4685-B3A8-303ADE675E51}" = dir=in | name=@{microsoft.reader_6.2.9200.20523_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} | "{4970466E-478E-4B4B-85B5-5B9869855E68}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{4BB6A9DB-485B-4DAA-B0EB-17269824B4A4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{4C7F2F77-C433-4E3E-8EFB-887820E110E3}" = dir=out | name=microsoft mahjong | "{4C8F411F-8215-46E9-86A7-89059315C2E2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{4E70F3BA-40A1-4E8E-8772-3CFFCF96055C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{4F024861-4F05-4982-BE65-1207B7809425}" = dir=out | name=zattoo live tv | "{515BF6C9-03CD-41E6-A5CF-097384F10FE7}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | "{5187ACB3-FF8A-4F15-A69F-CDE17E6571E2}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{546A0FEA-EC1D-4819-B3D5-D03A52577106}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{58C20550-7352-46F3-95C2-A49536858BEE}" = protocol=6 | dir=out | app=system | "{5C307656-20D2-40C2-AD79-4A4A156DCFE0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{61353486-E23E-48B7-9299-F2C382431FFA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{62E92688-C722-49D4-9F83-543CBC6C2E6F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{68746105-F548-4015-994E-19B030550E14}" = dir=in | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} | "{68DE01C1-BC82-488A-88C7-85A9C56BF944}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{712E3597-2DE4-4FFC-909A-27301688F5C4}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{71E9C46B-8A1F-4A02-9EE7-6953B2EB06DF}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} | "{77989DFD-C88A-468A-BB31-2DC0DF9A3C2C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{791D45AE-0DCC-4087-840E-5760D900E96D}" = protocol=17 | dir=in | app=c:\program files (x86)\google\google talk\googletalk.exe | "{7F279CB9-8C3B-4A34-90DA-1ABB175A6EED}" = dir=out | name=@{microsoft.reader_6.2.9200.20523_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} | "{80089ADB-FE50-428D-9C83-5718E7C56EB8}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | "{8C0B3F93-04A7-4922-9390-028664EF281F}" = dir=out | name=hp printer control | "{8D2B8401-5AA2-4DC6-B1FD-950FA6CD51F8}" = dir=out | name=wortsuche | "{904BE012-DA54-43C3-A0A2-9599278432CA}" = dir=in | name=qool | "{921A3E3E-C41C-4F81-B016-955468619A84}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{923C623D-633C-4DF3-91CA-16C15DED16E2}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{92B500F6-C137-4544-BD52-D90D2EF9B44A}" = dir=out | name=google search | "{94C0ED25-AD1F-4955-BCD3-2D1577EAD9FA}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{97B41FB1-87FA-4AB6-BEC4-9E9EF314BA7B}" = dir=out | name=@{microsoft.bingfinance_1.7.0.38_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} | "{9AF7E8C5-E9BF-4768-90BC-1DC3E7087153}" = dir=out | name=@{microsoft.zunevideo_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} | "{9B6CEEBC-48EE-41D3-B2D5-BC81BE29155A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{9C2DD098-75D2-4308-B95A-1B27C0EAE1CF}" = dir=out | name=@{microsoft.bingtravel_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} | "{A31FE256-F40C-4ACA-8CE4-02B48A42C51A}" = dir=out | name=@{microsoft.bingnews_1.7.0.38_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} | "{A47A4837-7445-4066-B16A-4CBCAF74C088}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | "{AA71A175-43CE-40CE-BE0C-CCDDAEF43AAA}" = dir=out | name=@{microsoft.bingmaps_1.5.1.240_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} | "{AEE19888-B76D-4E27-AA48-557420B7DDFC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{B7B674D5-BA0D-482B-82D7-0DEC5756C9A3}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{B8A76143-4973-4EE3-92CF-11D0A89F09DB}" = dir=out | name=qool | "{BC3A60DD-BC1C-4FAB-8474-F91001C870D1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{C3E6E7A3-EA2B-482B-A2D1-3AD58E668163}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{C4E4853F-3746-4426-A321-92B08BF40EED}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{C628FA0B-2246-4278-A55B-F5BFF54667CD}" = protocol=6 | dir=in | app=c:\program files (x86)\google\google talk\googletalk.exe | "{CEB3457F-7E41-405F-96CE-EBE76C6FC8D1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{D1C8F549-2F3B-4D32-8E9B-E6B9F6380A8E}" = dir=out | name=@{microsoft.xboxlivegames_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} | "{D411DE5A-CA04-42A1-B098-BF95E9D2EFCB}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{D49C1D8E-BEE3-4083-8FD3-7A82DBA9F43B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{D6798907-2749-47D7-B694-77731C3EAAB3}" = dir=out | name=bubblebreaker | "{D9887D69-EEB0-4970-8EB3-54AB3A6ADE97}" = dir=out | name=tv-programm | "{DB21E116-0A65-4759-8076-810ECCAF57FD}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | "{E62DB4B0-B75A-4A59-951B-DC6A88A05CDC}" = dir=out | name=@{microsoft.bingweather_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} | "{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | "{E9428011-4376-4A69-B7FD-0BCC6C63906B}" = dir=in | app=c:\program files\intel corporation\intel widi\widiapp.exe | "{EA738C74-D371-4CC9-BAEC-14BF865DD34F}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{EC4939F6-495F-413F-9F4B-7B7831E7330D}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} | "{ED8578FE-9501-417C-A54D-E75A1AF5D38B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{F9498454-EC8F-4A37-90DD-9E5B6A861F67}" = protocol=17 | dir=in | app=c:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe | "{FEEC421E-B699-4007-BA33-939589DE98D3}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | "{FF2802A5-FBC9-4D57-A8A6-7AC6180BAAD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{FF2AD749-CCB8-4CCD-83B6-DD79B59D25E2}" = dir=in | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} | "TCP Query User{4DB8D40E-2A9D-4DAF-808E-AE1BA667A6EB}C:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe | "TCP Query User{C1FDC4A8-882D-417F-BB9A-4558F902A2AC}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | "UDP Query User{27A6ECDF-C27B-47E7-8E62-37F87BC64E1B}C:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\santa\appdata\roaming\dropbox\bin\dropbox.exe | "UDP Query User{2835BC31-F622-448F-B293-E7E7B03376E8}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{088AD1DB-D1D7-469A-AE6C-1EBD766ACB5A}" = Newshosting "{1593C708-5535-47A4-8C0F-F8D4BE2B4560}" = Intel® PROSet/Wireless WiFi-Software "{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition) "{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit) "{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support "{2FE46568-5754-43AE-A289-0A8A7E5BCEAE}" = calibre 64bit "{49A09C2C-FFF4-478E-B397-5E0979F67F5D}" = Lenovo Patch Utility 64 bit "{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6097158B-0184-4140-BEC3-7885794D2571}" = Intel(R) WiDi "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes "{7B324AC3-57C3-4701-B023-F54D78546BFA}_is1" = Windows Service-Center 2013 "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}" = Classic Shell "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{9B3F0A88-790D-3AD9-9F96-B19CF2746452}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 "{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}" = Lenovo Bluetooth with Enhanced Data Rate Software "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones "{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 "BatteryBar" = BatteryBar (remove only) "CCleaner" = CCleaner "CNXT_AUDIO_HDA" = Conexant HD Audio "KeyLemon" = KeyLemon "OnScreenDisplay" = Anzeige am Bildschirm "Power Management Driver" = Lenovo Power Management Driver "ProInst" = Intel PROSet Wireless "SynTPDeinstKey" = ThinkPad UltraNav Driver "TeraCopy_is1" = TeraCopy 2.27 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{1845470B-EB14-4ABC-835B-E36C693DC07D}" = Skype™ 6.3 "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only) "{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21 "{38EE230F-F631-451F-8800-E29F5E5C9E7D}" = iTunes Library Updater "{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth "{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA5009F6-E65C-4DBD-92B8-988F0ADD1E99}" = SlimDrivers "{B78203BF-CF9C-4163-B6C3-B70A27A646EE}" = 8GadgetPack "{DD2FEA6F-5AC2-46B2-0001-C2A0C077FD2C}" = Simply Good Pictures 2 "{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag "{E8F27ADF-B1ED-41AF-A7EF-D5E71778480C}" = Lenovo Patch Utility "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{FE041B02-234C-4AAA-9511-80DF6482A458}" = RICOH_Media_Driver_v2.22.18.01 "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17 "ArchiCrypt Live 6_is1" = ArchiCrypt Live Version 6.9.2.10088 "doubleTwist" = doubleTwist "ffdshow_is1" = ffdshow [rev 2527] [2008-12-19] "Foxit Reader_is1" = Foxit Reader "FreeFileSync" = FreeFileSync 5.12 "Freemake Video Converter_is1" = Freemake Video Converter Version 4.0.1 "Glary Utilities_is1" = Glary Utilities 2.56.0.1822 "Google Chrome" = Google Chrome "HandBrake" = HandBrake 0.9.9.1 "ImgBurn" = ImgBurn "IrfanView" = IrfanView (remove only) "ISO Workshop_is1" = ISO Workshop 4.2 "KeePassPasswordSafe2_is1" = KeePass Password Safe 2.22 "Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "Network Meter_is1" = Network Meter version 9.1 "Notepad++" = Notepad++ "PdaNet_is1" = PdaNet+ for Android 4.12 "Picasa 3" = Picasa 3 "Q-Dir" = Q-Dir "Revo Uninstaller" = Revo Uninstaller 1.94 "Secunia PSI" = Secunia PSI (3.0.0.6001) "TeamViewer 8" = TeamViewer 8 "TrueCrypt" = TrueCrypt "UseNeXT by Tangysoft_is1" = UseNeXT by Tangysoft "uTorrent" = µTorrent "VirtualCloneDrive" = VirtualCloneDrive "VLC media player" = VLC media player 2.0.6 "Yahoo! Messenger" = Yahoo! Messenger [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Dropbox" = Dropbox "MusicManager" = Music Manager [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 13.06.2013 16:37:15 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_7_700_224.exe, Version: 11.7.700.224, Zeitstempel: 0x51a67447 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x6ea42366 ID des fehlerhaften Prozesses: 0x1f8c Startzeit der fehlerhaften Anwendung: 0x01ce6875c9b2723c Pfad der fehlerhaften Anwendung: C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 07fc5b60-d469-11e2-beb4-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 13.06.2013 16:37:22 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_7_700_224.exe, Version: 11.7.700.224, Zeitstempel: 0x51a67447 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x00d149b0 ID des fehlerhaften Prozesses: 0x1884 Startzeit der fehlerhaften Anwendung: 0x01ce6875ce919903 Pfad der fehlerhaften Anwendung: C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 0c4a10cf-d469-11e2-beb4-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 13.06.2013 16:37:23 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_7_700_224.exe, Version: 11.7.700.224, Zeitstempel: 0x51a67447 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x6ea42366 ID des fehlerhaften Prozesses: 0x1884 Startzeit der fehlerhaften Anwendung: 0x01ce6875ce919903 Pfad der fehlerhaften Anwendung: C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 0cd6bd5f-d469-11e2-beb4-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 13.06.2013 17:04:13 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: CxAudMsg64.exe, Version: 1.6.0.0, Zeitstempel: 0x4fd1c0c1 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77 Ausnahmecode: 0xc0000374 Fehleroffset: 0x00000000000ebd59 ID des fehlerhaften Prozesses: 0x754 Startzeit der fehlerhaften Anwendung: 0x01ce68480457b5be Pfad der fehlerhaften Anwendung: C:\WINDOWS\system32\CxAudMsg64.exe Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: cc2db026-d46c-11e2-beb4-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 14.06.2013 15:19:25 | Computer Name = YpS | Source = Microsoft-Windows-LocationProvider | ID = 2006 Description = There was an error with the Windows Location Provider database Error - 15.06.2013 01:51:58 | Computer Name = YpS | Source = VSS | ID = 8194 Description = Error - 15.06.2013 06:48:17 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000032 ID des fehlerhaften Prozesses: 0x28b4 Startzeit der fehlerhaften Anwendung: 0x01ce69b5cda18bea Pfad der fehlerhaften Anwendung: C:\Users\Santa\AppData\Local\Google\Update\GoogleUpdate.exe Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: 15eccb3d-d5a9-11e2-beb5-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 15.06.2013 07:48:30 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000002f ID des fehlerhaften Prozesses: 0x3838 Startzeit der fehlerhaften Anwendung: 0x01ce69be2f66f29e Pfad der fehlerhaften Anwendung: C:\Users\Santa\AppData\Local\Google\Update\GoogleUpdate.exe Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: 7f2c509e-d5b1-11e2-beb5-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 15.06.2013 08:47:38 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: GPhotos.scr, Version: 3.9.136.20, Zeitstempel: 0x515ae6ae Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000048 ID des fehlerhaften Prozesses: 0x3220 Startzeit der fehlerhaften Anwendung: 0x01ce69c676d7072f Pfad der fehlerhaften Anwendung: C:\WINDOWS\SysWOW64\GPhotos.scr Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: c1be7245-d5b9-11e2-beb5-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error - 15.06.2013 08:48:25 | Computer Name = YpS | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000002f ID des fehlerhaften Prozesses: 0x1e6c Startzeit der fehlerhaften Anwendung: 0x01ce69c6912b3725 Pfad der fehlerhaften Anwendung: C:\Users\Santa\AppData\Local\Google\Update\GoogleUpdate.exe Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: ddc9ec21-d5b9-11e2-beb5-cc52afe0f613 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: [ System Events ] Error - 09.06.2013 03:17:38 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 09.06.2013 04:16:01 | Computer Name = YpS | Source = Service Control Manager | ID = 7034 Description = Dienst "Conexant Audio Message Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error - 09.06.2013 06:44:16 | Computer Name = YpS | Source = DCOM | ID = 10010 Description = Error - 09.06.2013 06:45:01 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 10.06.2013 12:41:09 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 11.06.2013 13:08:08 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 12.06.2013 14:13:45 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 13.06.2013 11:10:15 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 13.06.2013 17:04:13 | Computer Name = YpS | Source = Service Control Manager | ID = 7034 Description = Dienst "Conexant Audio Message Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error - 14.06.2013 15:19:08 | Computer Name = YpS | Source = Service Control Manager | ID = 7000 Description = Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 < End of report > HTML-Code: OTL logfile created on: 15.06.2013 14:43:15 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = G:\Desktop 64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16599) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,91 Gb Total Physical Memory | 5,75 Gb Available Physical Memory | 72,69% Memory free 9,10 Gb Paging File | 6,93 Gb Available in Paging File | 76,13% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86) Drive C: | 74,43 Gb Total Space | 20,50 Gb Free Space | 27,54% Space Free | Partition Type: NTFS Drive E: | 379,63 Gb Total Space | 11,30 Gb Free Space | 2,98% Space Free | Partition Type: NTFS Drive G: | 75,19 Gb Total Space | 16,79 Gb Free Space | 22,32% Space Free | Partition Type: NTFS Drive H: | 9,77 Gb Total Space | 0,80 Gb Free Space | 8,17% Space Free | Partition Type: NTFS Computer Name: YPS | User Name: Santa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013.06.15 14:32:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- G:\Desktop\OTL.exe PRC - [2013.06.15 12:16:53 | 000,055,296 | ---- | M] (Ufasoft) -- C:\Users\Santa\AppData\Roaming\WindowsLogonS\shell.exe PRC - [2013.06.15 12:16:53 | 000,055,296 | ---- | M] (Ufasoft) -- C:\Users\Santa\AppData\Roaming\WindowsLogonS\macromedia.exe PRC - [2013.06.07 14:39:25 | 004,150,112 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe PRC - [2013.05.30 01:33:20 | 000,101,888 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe PRC - [2013.04.12 23:27:48 | 000,068,608 | ---- | M] (IvoSoft) -- C:\Programme\Classic Shell\ClassicShellService.exe PRC - [2012.11.26 16:09:22 | 001,225,312 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe PRC - [2012.08.24 19:33:26 | 000,127,072 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\micmute.exe PRC - [2012.07.26 05:32:50 | 000,385,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\WerFault.exe PRC - [2012.07.26 05:20:44 | 000,349,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cmd.exe PRC - [2011.11.10 10:59:36 | 002,594,584 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.11.10 10:59:34 | 000,325,912 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2011.09.01 16:23:44 | 000,447,104 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\SysWOW64\SASrv.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012.11.28 15:13:52 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.11.28 15:13:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2012.05.25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2013.04.09 06:48:42 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder) SRV:[b]64bit:[/b] - [2013.03.02 04:45:07 | 000,171,008 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker) SRV:[b]64bit:[/b] - [2013.03.02 04:45:05 | 000,180,224 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker) SRV:[b]64bit:[/b] - [2013.02.02 10:21:45 | 000,467,456 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm) SRV:[b]64bit:[/b] - [2013.01.10 01:23:16 | 001,964,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc) SRV:[b]64bit:[/b] - [2013.01.10 01:22:35 | 000,438,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM) SRV:[b]64bit:[/b] - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:[b]64bit:[/b] - [2012.11.06 06:36:55 | 002,675,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify) SRV:[b]64bit:[/b] - [2012.09.20 11:10:47 | 002,367,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService) SRV:[b]64bit:[/b] - [2012.09.20 08:31:18 | 000,116,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc) SRV:[b]64bit:[/b] - [2012.09.20 08:30:41 | 000,179,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure) SRV:[b]64bit:[/b] - [2012.07.26 05:07:47 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc) SRV:[b]64bit:[/b] - [2012.07.26 05:07:42 | 000,263,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc) SRV:[b]64bit:[/b] - [2012.07.26 05:07:40 | 000,283,648 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc) SRV:[b]64bit:[/b] - [2012.07.26 05:07:25 | 000,012,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc) SRV:[b]64bit:[/b] - [2012.07.26 05:06:34 | 000,743,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon) SRV:[b]64bit:[/b] - [2012.07.26 05:06:33 | 000,161,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc) SRV:[b]64bit:[/b] - [2012.07.26 05:06:33 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup) SRV:[b]64bit:[/b] - [2012.07.26 05:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso) SRV:[b]64bit:[/b] - [2012.07.26 05:05:34 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\efssvc.dll -- (EFS) SRV:[b]64bit:[/b] - [2012.07.26 05:05:28 | 000,207,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc) SRV:[b]64bit:[/b] - [2012.07.26 05:05:24 | 000,342,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService) SRV:[b]64bit:[/b] - [2012.07.26 05:05:12 | 000,331,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\BthHFSrv.dll -- (BthHFSrv) SRV:[b]64bit:[/b] - [2012.07.26 05:05:08 | 000,122,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AUInstallAgent.dll -- (AllUserInstallAgent) SRV:[b]64bit:[/b] - [2012.07.26 05:05:04 | 000,187,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange) SRV:[b]64bit:[/b] - [2012.07.26 02:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat) SRV:[b]64bit:[/b] - [2012.06.08 18:07:16 | 000,201,376 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 002,227,992 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Windows\SysNative\BtwRSupportService.exe -- (BcmBtRSupport) SRV - [2013.06.11 20:09:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.06.07 14:39:25 | 004,150,112 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8) SRV - [2013.05.30 16:34:34 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.30 01:33:20 | 000,101,888 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver) SRV - [2013.04.12 23:27:48 | 000,068,608 | ---- | M] (IvoSoft) [Auto | Running] -- C:\Programme\Classic Shell\ClassicShellService.exe -- (ClassicShellService) SRV - [2012.12.18 13:30:54 | 000,127,120 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD) SRV - [2012.12.14 03:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012.11.26 16:09:22 | 001,225,312 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent) SRV - [2012.11.26 16:09:20 | 000,659,040 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent) SRV - [2012.11.15 15:51:42 | 000,959,256 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\Lenovo\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2012.11.06 06:36:55 | 002,675,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll -- (PrintNotify) SRV - [2012.09.24 17:03:12 | 001,153,840 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\ZeroConfigService.exe -- (ZeroConfigService) SRV - [2012.09.24 17:02:54 | 000,272,176 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV - [2012.09.24 17:02:42 | 000,617,776 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2012.09.24 17:02:16 | 000,149,296 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2012.08.24 19:33:26 | 000,127,072 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV - [2012.07.26 05:20:04 | 000,018,432 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc) SRV - [2011.11.10 10:59:36 | 002,594,584 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.11.10 10:59:34 | 000,325,912 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2011.09.01 16:23:44 | 000,447,104 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\SASrv.exe -- (SAService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2013.04.24 01:23:00 | 000,460,528 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2013.04.12 17:20:43 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\truecrypt.sys -- (truecrypt) DRV:[b]64bit:[/b] - [2013.04.09 07:27:43 | 000,284,424 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\spaceport.sys -- (spaceport) DRV:[b]64bit:[/b] - [2013.03.11 02:49:12 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\VClone.sys -- (VClone) DRV:[b]64bit:[/b] - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:[b]64bit:[/b] - [2013.03.02 12:57:48 | 000,337,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\USBXHCI.SYS -- (USBXHCI) DRV:[b]64bit:[/b] - [2013.03.02 12:57:46 | 000,077,544 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\storahci.sys -- (storahci) DRV:[b]64bit:[/b] - [2013.03.02 12:45:20 | 000,148,712 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\tpm.sys -- (TPM) DRV:[b]64bit:[/b] - [2013.03.02 12:45:19 | 000,194,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdbus.sys -- (sdbus) DRV:[b]64bit:[/b] - [2013.03.02 12:39:38 | 000,069,864 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\pdc.sys -- (pdc) DRV:[b]64bit:[/b] - [2013.02.14 01:51:32 | 000,109,016 | ---- | M] (Softwareentwicklung Remus - ArchiCrypt - ) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ACLE1764.sys -- (ACLE6Live) DRV:[b]64bit:[/b] - [2013.02.06 08:42:08 | 000,102,936 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\ssudbus.sys -- (dg_ssudbus) DRV:[b]64bit:[/b] - [2013.02.02 13:19:44 | 000,446,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\USBHUB3.SYS -- (USBHUB3) DRV:[b]64bit:[/b] - [2013.02.02 09:25:23 | 000,037,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys -- (BthAvrcpTg) DRV:[b]64bit:[/b] - [2013.02.02 09:24:50 | 000,117,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthA2DP.sys -- (BthA2DP) DRV:[b]64bit:[/b] - [2013.02.02 09:24:42 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthHfAud.sys -- (BthHFAud) DRV:[b]64bit:[/b] - [2013.01.29 03:57:05 | 000,035,232 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\WdBoot.sys -- (WdBoot) DRV:[b]64bit:[/b] - [2013.01.29 01:08:22 | 000,230,904 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\Drivers\WdFilter.sys -- (WdFilter) DRV:[b]64bit:[/b] - [2013.01.10 03:53:32 | 000,028,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpiowin32.sys -- (msgpiowin32) DRV:[b]64bit:[/b] - [2012.12.14 03:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64) DRV:[b]64bit:[/b] - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:[b]64bit:[/b] - [2012.11.27 05:55:44 | 000,029,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthhfHid.sys -- (bthhfhid) DRV:[b]64bit:[/b] - [2012.11.20 06:54:31 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hidi2c.sys -- (hidi2c) DRV:[b]64bit:[/b] - [2012.11.06 05:55:44 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\fxppm.sys -- (FxPPM) DRV:[b]64bit:[/b] - [2012.10.18 00:19:22 | 000,044,344 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Smb_driver_Intel.sys -- (SmbDrvI) DRV:[b]64bit:[/b] - [2012.10.12 10:08:01 | 000,027,880 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:[b]64bit:[/b] - [2012.10.11 09:25:48 | 000,056,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdstor.sys -- (sdstor) DRV:[b]64bit:[/b] - [2012.10.11 09:13:49 | 000,058,088 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\Drivers\dam.sys -- (dam) DRV:[b]64bit:[/b] - [2012.10.09 19:48:50 | 000,035,296 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\intelaud.sys -- (intaud_WaveExtensible) DRV:[b]64bit:[/b] - [2012.10.09 19:48:50 | 000,025,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\iwdbus.sys -- (iwdbus) DRV:[b]64bit:[/b] - [2012.10.09 19:48:48 | 000,188,896 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\xHCIPort.sys -- (XHCIPort) DRV:[b]64bit:[/b] - [2012.10.09 19:48:48 | 000,047,072 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\usb3Hub.sys -- (usb3Hub) DRV:[b]64bit:[/b] - [2012.09.20 09:55:33 | 000,212,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\UCX01000.SYS -- (UCX01000) DRV:[b]64bit:[/b] - [2012.09.20 09:55:30 | 000,120,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpioclx.sys -- (GPIOClx0101) DRV:[b]64bit:[/b] - [2012.09.20 09:55:27 | 003,265,256 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2012.09.20 09:55:24 | 000,533,224 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:[b]64bit:[/b] - [2012.07.26 07:26:46 | 000,025,328 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\WINDOWS\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2012.07.26 07:26:45 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\condrv.sys -- (condrv) DRV:[b]64bit:[/b] - [2012.07.26 07:00:58 | 000,322,800 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS -- (VSTXRAID) DRV:[b]64bit:[/b] - [2012.07.26 07:00:58 | 000,106,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\VerifierExt.sys -- (VerifierExt) DRV:[b]64bit:[/b] - [2012.07.26 07:00:58 | 000,097,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\uaspstor.sys -- (UASPStor) DRV:[b]64bit:[/b] - [2012.07.26 07:00:57 | 000,077,040 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\acpiex.sys -- (acpiex) DRV:[b]64bit:[/b] - [2012.07.26 07:00:55 | 000,064,240 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\mvumis.sys -- (mvumis) DRV:[b]64bit:[/b] - [2012.07.26 07:00:55 | 000,030,960 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2012.07.26 07:00:52 | 000,092,400 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2012.07.26 07:00:52 | 000,081,136 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sss.sys -- (LSI_SSS) DRV:[b]64bit:[/b] - [2012.07.26 07:00:52 | 000,064,752 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2012.07.26 07:00:51 | 000,113,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv) DRV:[b]64bit:[/b] - [2012.07.26 07:00:51 | 000,081,136 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\EhStorClass.sys -- (EhStorClass) DRV:[b]64bit:[/b] - [2012.07.26 07:00:49 | 000,258,288 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2012.07.26 07:00:49 | 000,106,736 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\3ware.sys -- (3ware) DRV:[b]64bit:[/b] - [2012.07.26 07:00:49 | 000,076,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2012.07.26 07:00:48 | 000,026,352 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2012.07.26 06:57:54 | 000,361,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\clfs.sys -- (CLFS) DRV:[b]64bit:[/b] - [2012.07.26 06:54:34 | 000,096,496 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\wfplwfs.sys -- (WFPLWFS) DRV:[b]64bit:[/b] - [2012.07.26 06:53:16 | 000,067,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpci.sys -- (vpci) DRV:[b]64bit:[/b] - [2012.07.26 05:17:38 | 000,036,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\terminpt.sys -- (terminpt) DRV:[b]64bit:[/b] - [2012.07.26 04:30:00 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbser.sys -- (usbser) DRV:[b]64bit:[/b] - [2012.07.26 04:29:47 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WSDPrint.sys -- (WSDPrintDevice) DRV:[b]64bit:[/b] - [2012.07.26 04:29:14 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mshidumdf.sys -- (mshidumdf) DRV:[b]64bit:[/b] - [2012.07.26 04:29:08 | 000,048,640 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicDisplay.sys -- (BasicDisplay) DRV:[b]64bit:[/b] - [2012.07.26 04:29:03 | 000,024,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\HyperVideo.sys -- (HyperVideo) DRV:[b]64bit:[/b] - [2012.07.26 04:28:52 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicRender.sys -- (BasicRender) DRV:[b]64bit:[/b] - [2012.07.26 04:27:58 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmgencounter.sys -- (gencounter) DRV:[b]64bit:[/b] - [2012.07.26 04:27:41 | 000,018,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kdnic.sys -- (kdnic) DRV:[b]64bit:[/b] - [2012.07.26 04:27:37 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpitime.sys -- (acpitime) DRV:[b]64bit:[/b] - [2012.07.26 04:27:33 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\npsvctrig.sys -- (npsvctrig) DRV:[b]64bit:[/b] - [2012.07.26 04:27:29 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys -- (WpdUpFltr) DRV:[b]64bit:[/b] - [2012.07.26 04:27:16 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpipagr.sys -- (acpipagr) DRV:[b]64bit:[/b] - [2012.07.26 04:27:01 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hyperkbd.sys -- (hyperkbd) DRV:[b]64bit:[/b] - [2012.07.26 04:26:46 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SerCx.sys -- (SerCx) DRV:[b]64bit:[/b] - [2012.07.26 04:26:43 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SpbCx.sys -- (SpbCx) DRV:[b]64bit:[/b] - [2012.07.26 04:26:34 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2012.07.26 04:26:13 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\bthhfenum.sys -- (BthHFEnum) DRV:[b]64bit:[/b] - [2012.07.26 04:25:57 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\dmvsc.sys -- (dmvsc) DRV:[b]64bit:[/b] - [2012.07.26 04:25:56 | 000,057,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2012.07.26 04:25:26 | 000,203,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\Vid.sys -- (Vid) DRV:[b]64bit:[/b] - [2012.07.26 04:25:22 | 000,067,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\storvsp.sys -- (storvsp) DRV:[b]64bit:[/b] - [2012.07.26 04:25:13 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\wpcfltr.sys -- (wpcfltr) DRV:[b]64bit:[/b] - [2012.07.26 04:25:12 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmbusr.sys -- (vmbusr) DRV:[b]64bit:[/b] - [2012.07.26 04:25:12 | 000,066,048 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpcivsp.sys -- (vpcivsp) DRV:[b]64bit:[/b] - [2012.07.26 04:25:01 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys -- (NdisImPlatform) DRV:[b]64bit:[/b] - [2012.07.26 04:23:53 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mslldp.sys -- (MsLldp) DRV:[b]64bit:[/b] - [2012.07.26 04:23:42 | 000,097,792 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\Ndu.sys -- (Ndu) DRV:[b]64bit:[/b] - [2012.07.04 14:39:00 | 000,105,472 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\risdxc64.sys -- (risdxc) DRV:[b]64bit:[/b] - [2012.06.22 06:59:50 | 001,586,848 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:[b]64bit:[/b] - [2012.06.02 16:31:56 | 000,589,824 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Rt630x64.sys -- (RTL8168) DRV:[b]64bit:[/b] - [2012.06.02 16:31:50 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NETwNs64.sys -- (NETwNs64) DRV:[b]64bit:[/b] - [2011.11.25 01:25:52 | 000,015,360 | ---- | M] (June Fabrics Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\pneteth.sys -- (pneteth) DRV:[b]64bit:[/b] - [2011.09.22 10:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2011.07.27 20:48:14 | 000,014,952 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\iPodDrv.sys -- (iPodDrv) DRV:[b]64bit:[/b] - [2010.09.01 10:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\psi_mf.sys -- (PSI) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,226,680 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btwavdt.sys -- (btwavdt) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,186,136 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btwaudio.sys -- (btwaudio) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,169,240 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\bcbtums.sys -- (bcbtums) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,161,144 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btwampfl.sys -- (btwampfl) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,040,248 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btwl2cap.sys -- (btwl2cap) DRV:[b]64bit:[/b] - [2000.01.01 02:00:00 | 000,020,856 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btwrchid.sys -- (btwrchid) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 18 7D 4C C7 E0 62 CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.openintab: true FF - prefs.js..browser.search.selectedEngine: "Web Search" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "hxxp://web.de/|hxxp://www.google.com/ig?hl=de|https://ksab.kroschu.com/webaccess/index.php|hxxp://www.gizmodo.de/|hxxp://www.focus.de/|hxxp://www.myliveshopping.de/" FF - prefs.js..extensions.enabledAddons: %7BD4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389%7D:0.9.10 FF - prefs.js..extensions.enabledAddons: translator%40zoli.bod:2.1.0.3 FF - prefs.js..extensions.enabledAddons: musicplayer%40firemediaplayer.com:2.2 FF - prefs.js..extensions.enabledAddons: isreaditlater%40ideashower.com:3.0.1 FF - prefs.js..extensions.enabledAddons: amznUWL2%40amazon.com:1.10 FF - prefs.js..extensions.enabledAddons: SkipScreen%40SkipScreen:0.7.0 FF - prefs.js..extensions.enabledAddons: %7Bdc572301-7619-498c-a57d-39143191b318%7D:0.4.1.0 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.15 FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:18.8 FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.9 FF - prefs.js..extensions.enabledAddons: %7B677a8f98-fd64-40b0-a883-b8c95d0cbf17%7D:0.4 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKCU\Software\MozillaPlugins\@doubletwist.com/NPPodcast: C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll (doubleTwist Corporation) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Santa\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Santa\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{59d42255-7f9c-49e5-8e68-a5fd16d06d76}: C:\Program Files\KeyLemon\extension\{59d42255-7f9c-49e5-8e68-a5fd16d06d76} FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.03 21:18:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\Extensions [2013.06.08 21:21:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\Firefox\Profiles\5zat8v2p.default\extensions [2013.05.30 16:55:07 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\Santa\AppData\Roaming\mozilla\Firefox\Profiles\5zat8v2p.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2013.05.30 16:55:07 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Santa\AppData\Roaming\mozilla\Firefox\Profiles\5zat8v2p.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2013.05.30 16:55:07 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Santa\AppData\Roaming\mozilla\Firefox\Profiles\5zat8v2p.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.02.03 21:53:47 | 000,243,287 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\amznUWL2@amazon.com.xpi [2013.05.30 16:55:07 | 000,363,920 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\client@anonymox.net.xpi [2013.02.03 21:53:47 | 000,223,719 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\isreaditlater@ideashower.com.xpi [2013.02.03 21:53:47 | 000,237,521 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\musicplayer@firemediaplayer.com.xpi [2013.02.03 21:53:47 | 000,071,037 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\SkipScreen@SkipScreen.xpi [2013.02.03 21:53:47 | 000,060,290 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\translator@zoli.bod.xpi [2013.06.08 21:21:34 | 000,020,949 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2013.05.30 16:10:49 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.02.03 21:53:47 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2013.04.20 22:00:58 | 000,765,412 | ---- | M] () (No name found) -- C:\Users\Santa\AppData\Roaming\mozilla\firefox\profiles\5zat8v2p.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2013.05.30 16:34:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.30 16:34:36 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll CHR - plugin: doubletwist Plugin 1, 3, 0, 0 (Enabled) = C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\WINDOWS\SysWOW64\npDeployJava1.dll CHR - Extension: Google Docs = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YOUZEEK Free Music = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjcgpdkighmjfjlplcighhgamlhkimce\2.0.1_0\ CHR - Extension: YouTube = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google-Suche = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Google Play Music = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg\5.1_0\ CHR - Extension: Google Mail = C:\Users\Santa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2012.07.26 07:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft) O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2:[b]64bit:[/b] - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Programme\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft) O2 - BHO: (PodcastBHO Class) - {65134FDF-F8A5-4B3D-91D9-CDF273CFD578} - C:\Program Files (x86)\Common Files\doubleTwist\IEPodcastPlugin.dll (doubleTwist Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Programme\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft) O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft) O4:[b]64bit:[/b] - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe (Conexant Systems, Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [ForteConfig] C:\Programme\CONEXANT\ForteConfig\fmapp.exe () O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [KeyLemon LemonScreen] C:\Program Files\KeyLemon\KLLockEngine.exe (KeyLemon) O4:[b]64bit:[/b] - HKLM..\Run: [KeyLemon Updater] C:\Programme\KeyLemon\KLUpdater.exe (KeyLemon) O4:[b]64bit:[/b] - HKLM..\Run: [LenovoOptMouseUpdate] C:\Programme\Lenovo\HOTKEY\extapsup.exe (Lenovo Group Limited) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SACpl.exe (Conexant Systems, Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Dominik Reichl) O4 - HKCU..\Run: [Adobe Flash Updater] C:\ProgramData\svsupdates0\xsytzecrn.exe (Microsoft Corporation) O4 - HKCU..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google) O4 - HKCU..\Run: [MusicManager] C:\Users\Santa\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.) O4 - HKCU..\Run: [NPowerTray] G:\Downloads\NPowerTray.exe () O4 - HKCU..\Run: [ShowBatteryBar] C:\Program Files\BatteryBar\ShowBatteryBar.exe () O4 - HKCU..\RunOnce: [Adobe Flash Updater] C:\ProgramData\svsupdates0\xsytzecrn.exe (Microsoft Corporation) O4 - Startup: C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Santa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk = C:\Users\Santa\AppData\Roaming\WindowsLogonS\usft_ext.exe.vbs () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 1 O8:[b]64bit:[/b] - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 File not found O8:[b]64bit:[/b] - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Programme\Classic Shell\ClassicIE9_32.exe (IvoSoft) O9 - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Programme\Classic Shell\ClassicIE9_32.exe (IvoSoft) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A283C47B-98AD-4D34-9552-DCD9CEC0DDA1}: DhcpNameServer = 192.168.178.1 O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap11 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:[b]64bit:[/b] - Protocol\Filter\text/xml - No CLSID value found O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:[b]64bit:[/b] - HKLM IFEO\mbam.exe: Debugger - mefjb_.exe File not found O27:[b]64bit:[/b] - HKLM IFEO\mbamgui.exe: Debugger - gxwfo_.exe File not found O27:[b]64bit:[/b] - HKLM IFEO\MSASCui.exe: Debugger - moyml_.exe File not found O27:[b]64bit:[/b] - HKLM IFEO\MsMpEng.exe: Debugger - ftdim_.exe File not found O27:[b]64bit:[/b] - HKLM IFEO\msseces.exe: Debugger - xsljq_.exe File not found O27 - HKLM IFEO\mbam.exe: Debugger - mefjb_.exe File not found O27 - HKLM IFEO\mbamgui.exe: Debugger - gxwfo_.exe File not found O27 - HKLM IFEO\MSASCui.exe: Debugger - moyml_.exe File not found O27 - HKLM IFEO\MsMpEng.exe: Debugger - ftdim_.exe File not found O27 - HKLM IFEO\msseces.exe: Debugger - xsljq_.exe File not found O30 - LSA: Security Packages - (livessp) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013.06.15 14:39:40 | 000,602,112 | ---- | C] (OldTimer Tools) -- G:\Desktop\OTL.exe [2013.06.15 12:16:52 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\WindowsLogonS [2013.06.15 11:46:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\svsupdates0 [2013.06.13 18:32:38 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\Newshosting [2013.06.13 18:32:38 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\CrashRpt [2013.06.13 18:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon [2013.06.13 18:32:32 | 000,000,000 | ---D | C] -- C:\Program Files\Newshosting [2013.06.13 18:32:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Newshosting [2013.06.13 18:32:27 | 000,000,000 | ---D | C] -- C:\Users\Santa\Downloads [2013.06.13 18:30:24 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Newshosting [2013.06.09 12:54:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes Library Updater [2013.06.09 12:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTLU [2013.06.09 12:28:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2013.06.09 12:28:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2013.06.09 12:28:21 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013.06.09 12:28:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2013.06.09 12:28:21 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 [2013.06.09 09:44:04 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Manager [2013.06.09 09:40:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2013.06.08 22:36:28 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth [2013.06.08 22:35:16 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\Broadcom [2013.06.08 22:19:32 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\SysWow64\CSVer.dll [2013.06.08 22:19:23 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\pcwServiceCenter [2013.06.08 22:16:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimDrivers [2013.06.08 22:16:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SlimDrivers [2013.06.08 22:16:04 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers [2013.06.08 22:12:34 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\SlimWare Utilities Inc [2013.06.08 21:02:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2013.06.08 21:01:45 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Talk [2013.06.08 21:01:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Talk [2013.06.08 20:59:05 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\Secunia PSI [2013.06.08 20:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia [2013.06.08 19:54:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics [2013.06.08 19:54:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Auslogics [2013.06.08 19:48:33 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Auslogics [2013.06.08 19:47:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC-WELT-ServiceCenter [2013.06.08 19:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\PC-WELT-ServiceCenter [2013.06.08 18:32:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\appmgmt [2013.06.08 16:46:00 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\Engelmann_Media [2013.06.08 16:40:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Licenses [2013.06.08 16:34:05 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\SuperEasy Software [2013.06.08 16:31:13 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Engelmann Media [2013.06.08 16:31:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\HDX4 [2013.06.08 16:31:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Engelmann Media [2013.06.08 16:31:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Engelmann Media [2013.06.08 16:27:57 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Q-Dir [2013.06.08 16:27:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Q-Dir [2013.06.08 16:27:57 | 000,000,000 | ---D | C] -- G:\Documents\Favorites_Q_Dir [2013.06.08 16:27:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Q-Dir [2013.06.06 22:52:08 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\GlarySoft [2013.06.06 22:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities [2013.06.06 22:50:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Glary Utilities [2013.06.05 23:50:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell [2013.06.04 20:02:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes [2013.06.04 20:02:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elaborate Bytes [2013.06.04 19:22:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Bluray Decrypter [2013.06.04 19:07:29 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake [2013.06.04 19:07:28 | 000,000,000 | ---D | C] -- C:\Program Files\Handbrake [2013.06.04 13:51:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations [2013.06.04 13:51:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Lenovo [2013.06.04 13:51:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Lenovo [2013.06.04 13:51:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Lenovo [2013.06.03 17:30:43 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\VMLite Workstation [2013.06.03 17:30:42 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VMLite Workstation [2013.06.03 17:10:08 | 000,000,000 | ---D | C] -- C:\Users\Santa\VMLites [2013.06.02 12:38:54 | 000,000,000 | ---D | C] -- C:\Users\Santa\.android [2013.05.31 22:26:58 | 000,015,360 | ---- | C] (June Fabrics Technology Inc.) -- C:\WINDOWS\SysNative\drivers\pneteth.sys [2013.05.31 22:26:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PdaNet for Android [2013.05.31 22:26:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PdaNet for Android [2013.05.31 22:25:12 | 000,000,000 | ---D | C] -- G:\Desktop\motochopper [2013.05.31 14:19:48 | 000,000,000 | ---D | C] -- C:\ZOPO [2013.05.31 12:29:01 | 000,000,000 | ---D | C] -- C:\ProgramData\SP_FT_Logs [2013.05.30 20:59:08 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Local\FreemakeVideoConverter [2013.05.30 20:25:26 | 000,000,000 | ---D | C] -- G:\Documents\Freemake [2013.05.30 20:25:26 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake [2013.05.30 20:25:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake [2013.05.30 20:25:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake [2013.05.30 20:25:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake [2013.05.30 19:37:41 | 000,000,000 | ---D | C] -- C:\Users\Santa\AppData\Roaming\HandBrake [2013.05.30 19:37:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake [2013.05.30 16:57:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader [2013.05.30 16:57:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software [2013.05.30 16:34:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\WINDOWS\SysWow64\ElbyCDIO.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013.06.15 14:44:14 | 000,001,116 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2013.06.15 14:41:56 | 000,000,418 | ---- | M] () -- C:\WINDOWS\tasks\SlimDrivers Startup.job [2013.06.15 14:37:45 | 000,377,856 | ---- | M] () -- G:\Desktop\gmer_2.1.19163.exe [2013.06.15 14:32:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- G:\Desktop\OTL.exe [2013.06.15 14:32:03 | 000,050,477 | ---- | M] () -- G:\Desktop\Defogger.exe [2013.06.15 14:09:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.06.15 14:00:00 | 000,015,547 | ---- | M] () -- C:\Users\Santa\Network_Meter_Data.js [2013.06.15 13:48:39 | 000,000,916 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1236658316-3132239065-196456727-1000UA.job [2013.06.15 12:16:57 | 000,001,088 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk [2013.06.15 09:48:00 | 000,000,864 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1236658316-3132239065-196456727-1000Core.job [2013.06.15 09:44:00 | 000,001,112 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2013.06.14 21:27:29 | 001,745,416 | ---- | M] () -- C:\WINDOWS\SysNative\PerfStringBackup.INI [2013.06.14 21:27:29 | 000,753,134 | ---- | M] () -- C:\WINDOWS\SysNative\perfh007.dat [2013.06.14 21:27:29 | 000,710,244 | ---- | M] () -- C:\WINDOWS\SysNative\perfh009.dat [2013.06.14 21:27:29 | 000,155,826 | ---- | M] () -- C:\WINDOWS\SysNative\perfc007.dat [2013.06.14 21:27:29 | 000,132,614 | ---- | M] () -- C:\WINDOWS\SysNative\perfc009.dat [2013.06.14 21:20:39 | 000,067,584 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.06.14 21:19:00 | 000,000,334 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2013.06.14 21:18:38 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys [2013.06.14 21:18:38 | 2502,512,639 | -HS- | M] () -- C:\hiberfil.sys [2013.06.14 00:40:10 | 000,000,026 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\Network Meter_Usage.ini [2013.06.13 22:23:58 | 000,000,658 | ---- | M] () -- G:\Documents\Breaking Point (German) (2009) AC3 BDRip.nzb [2013.06.10 18:43:27 | 000,000,853 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\Drives Meter_Settings.ini [2013.06.09 12:58:20 | 000,000,748 | ---- | M] () -- G:\Documents\2013-06-09.itlu [2013.06.08 22:34:42 | 000,000,876 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013.06.08 22:20:10 | 000,000,334 | ---- | M] () -- C:\WINDOWS\tasks\SuperEasyDriverUpdater_UPDATES.job [2013.06.08 22:16:04 | 000,002,467 | ---- | M] () -- C:\Users\Public\Desktop\SlimDrivers.lnk [2013.06.08 20:59:01 | 000,001,109 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2013.06.08 20:56:39 | 000,053,248 | ---- | M] () -- C:\WINDOWS\SysWow64\zlib.dll [2013.06.08 20:56:39 | 000,000,749 | ---- | M] () -- C:\Users\Public\Desktop\dMaintenanceConfig.zip [2013.06.08 20:49:03 | 000,024,576 | ---- | M] () -- C:\WINDOWS\SysNative\FoolishEventLogMsgHelper.dll [2013.06.08 19:47:38 | 000,000,946 | ---- | M] () -- C:\Users\Public\Desktop\PC-WELT-ServiceCenter.lnk [2013.06.08 16:28:09 | 000,010,458 | ---- | M] () -- C:\WINDOWS\Q-Dir.ini [2013.06.08 16:27:57 | 000,001,832 | ---- | M] () -- C:\Users\Public\Desktop\Q-Dir.lnk [2013.06.05 23:44:36 | 000,000,562 | ---- | M] () -- G:\Documents\Menu Settings.xml [2013.06.04 20:05:22 | 000,000,021 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\ISOWorkshop.ini [2013.06.04 19:51:10 | 000,036,446 | ---- | M] () -- G:\Documents\cc_20130604_195103.reg [2013.06.04 19:13:43 | 000,001,198 | ---- | M] () -- C:\Users\Public\Desktop\ISO Workshop.lnk [2013.06.01 09:27:30 | 000,001,048 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.06.01 09:27:24 | 000,000,930 | ---- | M] () -- G:\Desktop\Dropbox.lnk [2013.05.30 17:19:36 | 000,001,080 | ---- | M] () -- C:\Users\Santa\AppData\Roaming\Network Meter_Settings.ini [2013.05.30 17:17:46 | 000,310,216 | ---- | M] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT [2013.05.24 15:21:55 | 000,000,572 | R--- | M] () -- C:\WINDOWS\SysWow64\revolution.2012.118.720p-dimension.nfo [2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\SysWow64\ElbyCDIO.dll [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013.06.15 14:37:40 | 000,377,856 | ---- | C] () -- G:\Desktop\gmer_2.1.19163.exe [2013.06.15 14:31:48 | 000,050,477 | ---- | C] () -- G:\Desktop\Defogger.exe [2013.06.15 12:16:57 | 000,001,088 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk [2013.06.15 00:21:50 | 000,000,572 | R--- | C] () -- C:\WINDOWS\SysWow64\revolution.2012.118.720p-dimension.nfo [2013.06.13 22:23:58 | 000,000,658 | ---- | C] () -- G:\Documents\Breaking Point (German) (2009) AC3 BDRip.nzb [2013.06.09 12:58:19 | 000,000,748 | ---- | C] () -- G:\Documents\2013-06-09.itlu [2013.06.09 09:43:45 | 000,000,916 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1236658316-3132239065-196456727-1000UA.job [2013.06.09 09:43:45 | 000,000,864 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1236658316-3132239065-196456727-1000Core.job [2013.06.09 09:39:34 | 000,001,116 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2013.06.09 09:39:34 | 000,001,112 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2013.06.08 22:34:26 | 000,000,876 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013.06.08 22:16:04 | 000,002,467 | ---- | C] () -- C:\Users\Public\Desktop\SlimDrivers.lnk [2013.06.08 22:12:36 | 000,000,418 | ---- | C] () -- C:\WINDOWS\tasks\SlimDrivers Startup.job [2013.06.08 20:59:01 | 000,001,109 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2013.06.08 20:59:01 | 000,001,072 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk [2013.06.08 20:56:39 | 000,053,248 | ---- | C] () -- C:\WINDOWS\SysWow64\zlib.dll [2013.06.08 20:56:39 | 000,000,749 | ---- | C] () -- C:\Users\Public\Desktop\dMaintenanceConfig.zip [2013.06.08 20:49:03 | 000,024,576 | ---- | C] () -- C:\WINDOWS\SysNative\FoolishEventLogMsgHelper.dll [2013.06.08 19:47:38 | 000,000,946 | ---- | C] () -- C:\Users\Public\Desktop\PC-WELT-ServiceCenter.lnk [2013.06.08 16:34:10 | 000,000,334 | ---- | C] () -- C:\WINDOWS\tasks\SuperEasyDriverUpdater_UPDATES.job [2013.06.08 16:27:57 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\Q-Dir.lnk [2013.06.08 16:27:46 | 000,010,458 | ---- | C] () -- C:\WINDOWS\Q-Dir.ini [2013.06.06 22:50:51 | 000,000,334 | ---- | C] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2013.06.05 23:44:36 | 000,000,562 | ---- | C] () -- G:\Documents\Menu Settings.xml [2013.06.04 19:51:06 | 000,036,446 | ---- | C] () -- G:\Documents\cc_20130604_195103.reg [2013.06.03 17:30:42 | 000,002,241 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (Secure).lnk [2013.05.30 17:17:43 | 000,310,216 | ---- | C] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT [2013.05.30 16:03:37 | 000,387,688 | ---- | C] () -- C:\WINDOWS\SysNative\ApnDatabase.xml [2013.03.31 19:55:28 | 000,006,656 | ---- | C] () -- C:\Users\Santa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.03.31 01:13:10 | 000,000,026 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Network Meter_Usage.ini [2013.03.30 17:26:19 | 000,000,368 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Digital Clock_Settings.ini [2013.03.30 17:23:06 | 000,015,547 | ---- | C] () -- C:\Users\Santa\Network_Meter_Data.js [2013.02.10 13:29:17 | 000,057,344 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_vfw.dll [2013.02.09 16:08:35 | 000,000,021 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\ISOWorkshop.ini [2013.02.06 00:00:00 | 000,004,853 | ---- | C] () -- C:\ProgramData\Network_Meter_Data.csv [2013.02.05 23:11:22 | 000,001,080 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Network Meter_Settings.ini [2013.02.05 00:41:56 | 000,000,576 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\All CPU MeterV3_Settings.ini [2013.02.05 00:26:52 | 000,000,853 | ---- | C] () -- C:\Users\Santa\AppData\Roaming\Drives Meter_Settings.ini [2013.02.05 00:14:24 | 000,727,029 | ---- | C] () -- C:\WINDOWS\unins000.exe [2013.02.05 00:14:24 | 000,044,083 | ---- | C] () -- C:\WINDOWS\unins000.dat [2013.02.04 22:33:22 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2013.02.03 21:00:48 | 000,083,968 | ---- | C] () -- C:\WINDOWS\SysWow64\OEMLicense.dll [2013.02.03 20:59:12 | 000,010,597 | ---- | C] () -- C:\Users\Santa\AppData\Local\Application.xml [2013.01.30 20:34:47 | 000,000,000 | ---- | C] () -- C:\Users\Santa\defogger_reenable [2012.12.14 03:42:30 | 000,963,452 | ---- | C] () -- C:\WINDOWS\SysWow64\igcodeckrng600.bin [2012.12.14 03:42:30 | 000,064,512 | ---- | C] () -- C:\WINDOWS\SysWow64\igdde32.dll [2012.12.14 03:42:28 | 000,272,928 | ---- | C] () -- C:\WINDOWS\SysWow64\igvpkrng600.bin [2012.10.29 16:44:56 | 000,315,392 | ---- | C] () -- C:\WINDOWS\SysWow64\EMRegSys.dll [2012.07.26 10:13:10 | 000,215,943 | ---- | C] () -- C:\WINDOWS\SysWow64\dssec.dat [2012.07.26 10:13:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\SysWow64\NOISE.DAT [2012.07.26 09:21:26 | 000,067,584 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2012.07.26 03:17:42 | 000,043,520 | ---- | C] () -- C:\WINDOWS\SysWow64\BWContextHandler.dll [2012.07.25 22:37:29 | 000,043,131 | ---- | C] () -- C:\WINDOWS\mib.bin [2012.07.25 22:28:31 | 000,364,544 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll [2012.06.02 16:31:19 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat [color=#E56717]========== ZeroAccess Check ==========[/color] [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.03.06 08:31:28 | 019,758,592 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.03.06 07:03:37 | 017,561,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012.07.26 05:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2012.07.26 05:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012.07.26 05:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2013.02.14 01:57:59 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\ACLive5 [2013.02.10 12:14:02 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Amazon [2013.06.08 19:48:33 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Auslogics [2013.06.06 22:55:51 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\BatteryBar [2013.02.16 22:43:12 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\calibre [2013.02.03 22:23:15 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Canneverbe Limited [2013.06.14 21:20:05 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Dropbox [2013.06.08 16:31:13 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Engelmann Media [2013.02.06 22:38:22 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\EurekaLog [2013.05.30 16:57:23 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Foxit Software [2013.02.12 18:36:41 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\FreeFileSync [2013.06.06 23:09:05 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\GlarySoft [2013.04.12 17:20:24 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Greenshot [2013.06.01 12:38:56 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\HandBrake [2013.02.06 21:02:49 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\IrfanView [2013.05.30 17:24:12 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\JAM Software [2013.06.13 22:09:57 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\KeePass [2013.06.13 18:30:24 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Newshosting [2013.06.02 12:36:20 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Notepad++ [2013.02.03 22:17:34 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\pdfforge [2013.06.08 16:28:09 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\Q-Dir [2013.06.08 16:34:05 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\SuperEasy Software [2013.06.04 16:20:36 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\TeamViewer [2013.02.03 22:44:28 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\TeraCopy [2013.06.13 22:24:06 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\UseNeXT [2013.06.04 19:49:39 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\uTorrent [2013.06.15 12:16:53 | 000,000,000 | ---D | M] -- C:\Users\Santa\AppData\Roaming\WindowsLogonS [color=#E56717]========== Purity Check ==========[/color] < End of report > |
| Themen zu Coin-miner zieht alle ressourcen! Processor 100% |
| 7-zip, android/exploit.lotoor.an, application/pdf:, askbar, autorun, bonjour, coin-miner, converter, flash player, homepage, iexplore.exe, install.exe, ntdll.dll, plug-in, programm, prozessor 100%, revo uninstaller, secunia psi, software, svchost.exe, usenext, vbs/coinminer.o, win 8, win32/injector.autoit.mb, windows, windows xp |
Baum-Darstellung