Trojaner-Board - Panda findet Hupigon.AZG und Trj/CI.A in diversen Dateien

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Panda findet Hupigon.AZG und Trj/CI.A in diversen Dateien (https://www.trojaner-board.de/124466-panda-findet-hupigon-azg-trj-ci-a-diversen-dateien.html)

Panda findet Hupigon.AZG und Trj/CI.A in diversen Dateien

Mit Panda Anti Virus gefunden:
http://s14.directupload.net/images/120921/yxbn3cnl.jpg

Ausserdem war vor einigen Tagen das Security Center von Windows plötzlich deaktiviert und ließ sich nur über die Eingabeaufforderung (per Anleitung aus dem Netz) wieder aktivieren.
Es behauptet seitdem es wäre kein Antivirus Programm installiert.

Bin dann eben nach euren Vorgaben vorgegangen.
OTL.exe erzeugt leider nur eine OTL.txt und keineExtra.txt...

Ungwöhnliche Phänomene kann ich ansonsten weniger beobachten, ausser vielleicht, dass das System manchmal etwas lahmt und Firefox sich andauernd aufhängt (was aber augenscheinlich durch das deaktivieren diverser Addons erledigt hat).

Freue mich über jede Antwort. :dankeschoen:

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hallo und vielen Dank schonmal für die Antwort.

Nachdem eset jetzt nach 24 stunden endlich durch ist hier die logs:

Code:

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org
 

Database version: v2012.09.22.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

c :: C-PC [administrator]
 

23.09.2012 02:10:16

mbam-log-2012-09-23 (02-10-16).txt
 

Scan type: Full scan (C:\|E:\|F:\|J:\|K:\|L:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 931681

Time elapsed: 2 hour(s), 43 minute(s), 27 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 2

C:\Users\c\AppData\Roaming\Thinstall\WORD 2007\300000005700002h\WINWORD.EXE (Trojan.Agent.H) -> Quarantined and deleted successfully.

J:\System Volume Information\_restore{A7866240-BD72-4EF5-849F-FDD6557C70DB}\RP8\A0007501.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
 

(end)

Code:

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\49c51529-7006f3fd        a variant of Java/Exploit.CVE-2012-1723.AP trojan

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\2e8778fc-14dedc5a        multiple threats

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\143b51c7-102aee50        a variant of Java/TrojanDownloader.OpenStream.NCC trojan

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\46f3b109-3ef493c8        multiple threats

F:\CVPiano.zip        Win32/PrcView application

F:\Firefox DLs\GingerBreak-v1.20.apk        multiple threats

F:\Firefox DLs\SoftonicDownloader_fuer_nvidia-gpu-temp.exe        a variant of Win32/SoftonicDownloader.D application

F:\Firefox DLs\CVPiano\CVPiano-GVI-Modeled_Setup.exe        Win32/PrcView application

Code:

F:\CVPiano.zip        Win32/PrcView application

F:\Firefox DLs\GingerBreak-v1.20.apk        multiple threats

F:\Firefox DLs\CVPiano\CVPiano-GVI-Modeled_Setup.exe
 

C:\Users\c\AppData\Roaming\Thinstall\WORD 2007\300000005700002h\WINWORD.EXE (Trojan.Agent.H)

Was ist das und aus welcher Quelle?

CV-Piano ist ein kostenloses VST-Plugin (hxxp://www.vst4free.com/free_vst.php?id=382)
Gingerbreak ist eine Software zum rooten für Android Handys (Nie benutzt und wo es her ist kann ich leider nichtmehr nachvollziehen).
Word/Microsoft Office hab ich garnicht installiert...keine Ahnung ehrlich gesagt.
Ich benutze Normalerweise Libre Office.

Edit: Ich erinnere mich gerade, dass ein Kommilitone mal Zeitweise Word bei mir installiert hatte, da es Kompatibilitätsprobleme zwischen Libre Office und Word gab...sollte aber garnicht mehr drauf sein.

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.003 - Logfile created 09/24/2012 at 20:46:44

# Updated 23/09/2012 by Xplode

# Operating system : Windows 7 Enterprise Service Pack 1 (64 bits)

# User : c - C-PC

# Boot Mode : Normal

# Running from : F:\Firefox DLs\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\ProgramData\Trymedia
 

***** [Registry] *****
 

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKCU\Software\Softonic

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C99FDC39-A1AE-4B24-8D71-E5274F8D7C54}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Found : HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Internet Explorer\SearchScopes\{C99FDC39-A1AE-4B24-8D71-E5274F8D7C54}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v15.0 (de)
 

-\\ Google Chrome v [Unable to get version]
 

-\\ Chromium v [Unable to get version]
 

-\\ Opera v12.2.1578.0
 

*************************
 

AdwCleaner[R1].txt - [1937 octets] - [24/09/2012 20:46:44]
 

########## EOF - C:\AdwCleaner[R1].txt - [1997 octets] ##########

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.003 - Logfile created 09/25/2012 at 13:12:36

# Updated 23/09/2012 by Xplode

# Operating system : Windows 7 Enterprise Service Pack 1 (64 bits)

# User : c - C-PC

# Boot Mode : Normal

# Running from : F:\Firefox DLs\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\ProgramData\Trymedia
 

***** [Registry] *****
 

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C99FDC39-A1AE-4B24-8D71-E5274F8D7C54}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

Restored : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
 

-\\ Mozilla Firefox v15.0 (de)
 

-\\ Google Chrome v [Unable to get version]
 

-\\ Chromium v [Unable to get version]
 

-\\ Opera v12.2.1578.0
 

*************************
 

AdwCleaner[R1].txt - [2058 octets] - [24/09/2012 20:46:44]

AdwCleaner[R2].txt - [2118 octets] - [25/09/2012 13:12:06]

AdwCleaner[S2].txt - [2051 octets] - [25/09/2012 13:12:36]
 

########## EOF - C:\AdwCleaner[S2].txt - [2111 octets] ##########

Edit: Ergänzend fällt mir noch ein, dass in letzter Zeit die Datei conhost.exe des öfteren in mehreren Instanzen lief (2). Momentan allerdings nicht.

Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Zitat:

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?

Firefox läuft immernoch sehr träge und langsam.

Diese Meldung besteht nachwievor:

http://s1.directupload.net/images/120925/cezi75ro.jpg

Edit: Ich sollte dazu sagen, dass ich ein recht schnelles sytem (QuadCore, 4GB Ram) habe, die Performance ist aber wirklich nicht gut. Alles wirkt etwas zu träge und das einfache öffenen von Ordnern z.B. dauert manchmal einfach zu lang und Programme brauchen oft sehr lang zum starten und lähmen andere Programme zeitweise noch mehr. Das ging alles mal wie geschmiert...

Zitat:

2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ich benutze das Startmenü so gut wie nie.

Hier eine Auflistung aller leeren Ordner welche ich gefunden habe mit Herkunft/Verbleib:

AVG 2011 (deinstalliert)
Biet-O-Matic (nicht sicher)
Cooliris (deinstalliert)
Game Maker 8 (nicht sicher, wahrscheinlich auf ausgebauter Festplatte installiert)
Kingisle Entertainment (nicht sicher)
M-Audio Fast -> Track Pro (deinstalliert)
Virtual Dj (deinstalliert)

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 25.09.2012 20:55:03 - Run 7

OTL by OldTimer - Version 3.2.68.0     Folder = C:\Users\c\Desktop

64bit- Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 73,82% Memory free

8,00 Gb Paging File | 6,32 Gb Available in Paging File | 79,06% Paging File free

Paging file location(s): f:\pagefile.sys 0 0 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 48,83 Gb Total Space | 6,12 Gb Free Space | 12,53% Space Free | Partition Type: NTFS

Drive D: | 2794,51 Gb Total Space | 1335,59 Gb Free Space | 47,79% Space Free | Partition Type: NTFS

Drive E: | 48,83 Gb Total Space | 2,31 Gb Free Space | 4,74% Space Free | Partition Type: NTFS

Drive F: | 490,70 Gb Total Space | 65,44 Gb Free Space | 13,34% Space Free | Partition Type: NTFS

Drive J: | 118,70 Gb Total Space | 16,38 Gb Free Space | 13,80% Space Free | Partition Type: NTFS

Drive K: | 156,25 Gb Total Space | 0,05 Gb Free Space | 0,03% Space Free | Partition Type: NTFS

Drive L: | 97,66 Gb Total Space | 65,70 Gb Free Space | 67,28% Space Free | Partition Type: NTFS

 

Computer Name: C-PC | User Name: c | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\c\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()

PRC - C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe (Panda Security)

PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe (Apple Inc.)

PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)

PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - E:\Tobit Radio.fx\Server\rfx-server.exe ()

PRC - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)

PRC - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe (Panda Security, S.L.)

PRC - C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe (KORG Inc.)

PRC - C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\zlib.dll ()

MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\CrashRpt.dll ()

MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\DockShellHook.dll ()

MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\Docklets\Clock\Clock.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)

SRV:64bit: - (NIHardwareService) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH)

SRV:64bit: - (SandraAgentSrv) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe (SiSoftware)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (Desura Install Service) -- C:\Program Files (x86)\Common Files\Desura\desura_service.exe (Desura Pty Ltd)

SRV - (Hamachi2Svc) -- F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)

SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)

SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (Radio.fx) -- E:\Tobit Radio.fx\Server\rfx-server.exe ()

SRV - (NanoServiceMain) -- C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe (Panda Security, S.L.)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (nTuneService) -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)

DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)

DRV:64bit: - (PSINAflt) -- C:\Windows\SysNative\drivers\PSINAflt.sys (Panda Security, S.L.)

DRV:64bit: - (PSINProt) -- C:\Windows\SysNative\drivers\PSINProt.sys (Panda Security, S.L.)

DRV:64bit: - (PSINKNC) -- C:\Windows\SysNative\drivers\PSINKNC.sys (Panda Security, S.L.)

DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)

DRV:64bit: - (tapoas) -- C:\Windows\SysNative\drivers\tapoas.sys (The OpenVPN Project)

DRV:64bit: - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV:64bit: - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV:64bit: - (gbxavs) -- C:\Windows\SysNative\drivers\gbxavs.sys (Native Instruments GmbH)

DRV:64bit: - (gbxusb_svc) -- C:\Windows\SysNative\drivers\gbxusb.sys (Native Instruments GmbH)

DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)

DRV:64bit: - (PSINProc) -- C:\Windows\SysNative\drivers\PSINProc.sys (Panda Security, S.L.)

DRV:64bit: - (PSINFile) -- C:\Windows\SysNative\drivers\PSINFile.sys (Panda Security, S.L.)

DRV:64bit: - (KORGUMDS) -- C:\Windows\SysNative\drivers\KORGUM64.SYS (KORG INC.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (ANDModem) -- C:\Windows\SysNative\drivers\lgandmodem64.sys (LG Electronics Inc.)

DRV:64bit: - (AndDiag) -- C:\Windows\SysNative\drivers\lganddiag64.sys (LG Electronics Inc.)

DRV:64bit: - (AndGps) -- C:\Windows\SysNative\drivers\lgandgps64.sys (LG Electronics Inc.)

DRV:64bit: - (Andbus) -- C:\Windows\SysNative\drivers\lgandbus64.sys (LG Electronics Inc.)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)

DRV:64bit: - (HDJMidi) -- C:\Windows\SysNative\drivers\HDJMidi.sys (© Guillemot R&D, 2010. All rights reserved.)

DRV:64bit: - (Bulk) -- C:\Windows\SysNative\drivers\HDJBulk.sys (© Guillemot R&D, 2010. All rights reserved.)

DRV:64bit: - (HDJAsioK) -- C:\Windows\SysNative\drivers\HDJAsioK.sys (© Guillemot R&D, 2010. All rights reserved.)

DRV:64bit: - (bcd3000) -- C:\Windows\SysNative\drivers\bcd3000_x64.sys (Behringer)

DRV:64bit: - (bcd3000wdm) -- C:\Windows\SysNative\drivers\bcd3000wdm_x64.sys (Behringer)

DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)

DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)

DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)

DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)

DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)

DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)

DRV:64bit: - (ctaud2k) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)

DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)

DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)

DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)

DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)

DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)

DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)

DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)

DRV:64bit: - (XONE_2D) -- C:\Windows\SysNative\drivers\XONE_2D.sys (Allen & Heath)

DRV:64bit: - (XONE_2D_WDM) -- C:\Windows\SysNative\drivers\XONE_2DW.sys (Allen & Heath)

DRV:64bit: - (XONE_2DM) -- C:\Windows\SysNative\drivers\XONE_2dm.sys (Ploytec GmbH)

DRV:64bit: - (Tpkd) -- C:\Windows\SysNative\drivers\Tpkd.sys (PACE Anti-Piracy, Inc.)

DRV:64bit: - (MAUSBFASTTRACKPRO) -- C:\Windows\SysNative\drivers\MAudioFastTrackPro.sys (Avid Technology, Inc.)

DRV:64bit: - (AtcL001) -- C:\Windows\SysNative\drivers\l160x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (gbxavs_x64) -- C:\Windows\SysNative\drivers\gbxavs_x64.sys (Native Instruments GmbH)

DRV:64bit: - (gbxusb_x64) -- C:\Windows\SysNative\drivers\gbxusb_x64.sys (Native Instruments GmbH)

DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)

DRV:64bit: - (SANDRA) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\sandra.sys (SiSoftware)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (KMWDFILTER) -- C:\Windows\SysNative\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider)

DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)

DRV:64bit: - (NvnUsbAudio) -- C:\Windows\SysNative\drivers\nvnusbaudio.sys (Novation DMS Ltd.)

DRV:64bit: - (athrusb) -- C:\Windows\SysNative\drivers\athrxusb.sys (Atheros Communications, Inc.)

DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.)

DRV:64bit: - (athrusb6) -- C:\Windows\SysNative\drivers\G220Vista64.sys (Atheros Communications, Inc.)

DRV:64bit: - (SynasUSB) -- C:\Windows\SysNative\drivers\synUSB64.sys (SIA Syncrosoft)

DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (NVR0Dev) -- C:\Windows\nvoclk64.sys (NVidia Corp.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 DD CF 99 E0 A2 CB 01  [binary data]

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\..\SearchScopes\{A1B19448-A883-494D-863B-F203823F0CE9}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MYC-ST&o=102869&src=kw&q={searchTerms}&locale=&apn_ptnrs=5J&apn_dtid=YYYYYYYYDE&apn_uid=06d54a5e-60f0-459a-8d03-5d06a71cd673&apn_sauid=B502D06C-2DFF-4141-8ECC-DE8F4B1A3EE4

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:home"

FF - prefs.js..extensions.enabledAddons: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.16

FF - prefs.js..extensions.enabledAddons: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120515

FF - prefs.js..extensions.enabledAddons: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:4.13

FF - prefs.js..extensions.enabledAddons: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: john@velvetcache.org:1.3.3

FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81

FF - prefs.js..extensions.enabledItems: {d33c2f7c-b1e6-4d46-ab0e-be1f6d05c904}:2.0.2

FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323

FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.5

FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.5

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: elemhidehelper@adblockplus.org:1.1.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209

FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 8118

FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"

FF - prefs.js..network.proxy.socks: "127.0.0.1"

FF - prefs.js..network.proxy.socks_port: 9050

FF - prefs.js..network.proxy.socks_remote_dns: true

FF - prefs.js..network.proxy.ssl: "127.0.0.1"

FF - prefs.js..network.proxy.ssl_port: 8118

FF - prefs.js..network.proxy.type: 4

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: d:\Program Files (x86)\VideoLAN\VLC\npvlc.dll File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\c\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\c\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 03:25:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.24 20:07:13 | 000,000,000 | ---D | M]

 

[2010.10.12 20:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Extensions

[2010.10.12 20:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.08.30 14:14:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions

[2012.06.21 19:08:43 | 000,000,000 | ---D | M] (WOT) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.08.30 04:32:16 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.07.01 17:15:23 | 000,000,000 | ---D | M] ("FacebookBlocker") -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\facebookBlocker@webgraph.com

[2012.06.21 22:04:35 | 000,246,802 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\lazarus@interclue.com.xpi

[2012.06.21 22:00:44 | 000,196,944 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\UIEnhancer@girishsharma.xpi

[2012.06.21 19:08:43 | 000,439,720 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi

[2012.08.30 03:05:48 | 000,505,801 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi

[2012.06.21 19:08:43 | 000,525,301 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

[2012.06.21 22:04:35 | 000,377,145 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi

[2012.06.21 19:08:43 | 000,634,964 | ---- | M] () (No name found) -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2012.01.13 01:18:55 | 000,000,933 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\11-suche.xml

[2011.06.22 19:38:47 | 000,002,400 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\askcom.xml

[2012.01.13 01:18:55 | 000,002,419 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\englische-ergebnisse.xml

[2010.10.12 21:00:24 | 000,002,314 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\forestle-de.xml

[2011.04.30 04:21:57 | 000,002,317 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\geizhalsat.xml

[2012.01.13 01:18:55 | 000,010,525 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\gmx-suche.xml

[2011.10.23 17:14:43 | 000,002,101 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\googlede.xml

[2012.01.13 01:18:55 | 000,002,457 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\lastminute.xml

[2010.10.12 21:01:16 | 000,001,590 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\scroogle-ssl-german-search.xml

[2010.10.12 21:01:10 | 000,001,549 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\scroogle-ssl-search.xml

[2012.01.13 01:18:55 | 000,005,508 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\webde-suche.xml

[2011.04.02 16:07:22 | 000,001,997 | ---- | M] () -- C:\Users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\searchplugins\wolframalpha.xml

[2012.08.30 03:25:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.08.25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010.10.13 15:09:16 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll

[2012.08.25 04:49:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.25 04:49:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.08.25 04:49:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.08.25 04:49:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.08.25 04:49:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.08.25 04:49:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

 

O1 HOSTS File: ([2011.11.17 07:01:33 | 000,011,312 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Panda Security Toolbar) - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll ()

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Panda Security Toolbar) - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll ()

O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)

O4 - HKLM..\Run: [KORG USB-MIDI Driver] C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe (KORG Inc.)

O4 - HKLM..\Run: [Panda Security URL Filtering] C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe (Panda Security)

O4 - HKLM..\Run: [PSUNMain] C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001..\Run: [F.lux] C:\Users\c\Local Settings\Apps\F.lux\flux.exe ()

O4 - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001..\Run: [NVIDIA nTune] C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA)

O4 - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001..\Run: [Rainlendar2] f:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()

O4 - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()

O4 - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001..\Run: [Spotify Web Helper] C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Computer - Shortcut.lnk =  File not found

O4 - Startup: C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\c\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O8 - Extra context menu item: Free YouTube Download - C:\Users\c\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)

O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)

O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Reg Error: Key error.)

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{091BC6DB-D53F-439F-8CDB-CBC2EBFF26E2}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{091BC6DB-D53F-439F-8CDB-CBC2EBFF26E2}: NameServer = 8.8.4.4,192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4D21D8DB-30CC-4909-AA06-DA99EEEEB5A5}: DhcpNameServer = 80.67.0.2 91.213.246.2

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AF222216-8DDC-46F0-8013-747DAA101F74}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF90E457-A960-479F-B576-DDADA01BC4FF}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF90E457-A960-479F-B576-DDADA01BC4FF}: NameServer = 213.73.89.124,78.47.115.195

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (c:\windows\syswow64\userinit.exe) - c:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Biet-O-Matic.lnk -  - File not found

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Evernote Clipper.lnk - C:\Windows\Installer\{F761359C-9CED-45AE-9A51-9D6605CD55C4}\Evernote.ico - ()

MsConfig:64bit - StartUpFolder: C:^Users^c^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - C:\Users\c\AppData\Roaming\Dropbox\bin\Dropbox.exe - (Dropbox, Inc.)

MsConfig:64bit - StartUpFolder: C:^Users^c^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe - (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

MsConfig:64bit - StartUpFolder: C:^Users^c^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^openvpn-gui-1.0.3.exe - Shortcut.lnk - C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe - ()

MsConfig:64bit - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: AvgUninstallURL - hkey= - key= - C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)

MsConfig:64bit - StartUpReg: B2C_AGENT - hkey= - key= - C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics)

MsConfig:64bit - StartUpReg: CTxfiHlp - hkey= - key= - C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)

MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

MsConfig:64bit - StartUpReg: FileHippo.com - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: HD Tune Pro - hkey= - key= - C:\Program Files (x86)\HD Tune Pro\HDTunePro.exe (EFD Software)

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - E:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: LemurDaemon - hkey= - key= - C:\Program Files (x86)\Liine\Lemur Daemon.exe (Liine)

MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

MsConfig:64bit - StartUpReg: LWS - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: Nikon Message Center 2 - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

MsConfig:64bit - StartUpReg: Steam - hkey= - key= - F:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

MsConfig:64bit - StartUpReg: SUPERAntiSpyware - hkey= - key= - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)

MsConfig:64bit - State: "services" - Reg Error: Key error.

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: hitmanpro35 - Reg Error: Value error.

SafeBootNet:64bit: hitmanpro35.sys - Reg Error: Value error.

SafeBootNet:64bit: HitmanPro35Crusader - Reg Error: Value error.

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: Hamachi2Svc - F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)

SafeBootNet: HelpSvc - Service

SafeBootNet: hitmanpro35 - Reg Error: Value error.

SafeBootNet: hitmanpro35.sys - Reg Error: Value error.

SafeBootNet: HitmanPro35Crusader - Reg Error: Value error.

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {A69C3B07-FE6C-1674-622D-51BC9648A422} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: midi - KORGUM64.DRV (KORG INC.)

Drivers32:64bit: midi3 - KORGUM64.DRV (KORG INC.)

Drivers32:64bit: midi5 - KORGUM64.DRV (KORG INC.)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)

Drivers32: midi - C:\Windows\SysWow64\KORGUM64.DRV (KORG INC.)

Drivers32: midi3 - C:\Windows\SysWow64\KORGUM64.DRV (KORG INC.)

Drivers32: midi5 - C:\Windows\SysWow64\KORGUM64.DRV (KORG INC.)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\SysWOW64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()

Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.09.25 02:16:59 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D9BC4C8F-B86F-45C8-A961-B9FF0910DE40}

[2012.09.25 02:15:08 | 000,000,000 | -H-D | C] -- C:\ProgramData\{30FA7941-4170-4C83-A9A8-FDF01C431704}

[2012.09.25 02:14:12 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 02:05:07 | 181,871,384 | ---- | C] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Maschine 1.8.1 Setup PC.exe

[2012.09.24 19:46:39 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Local\Sidhe

[2012.09.24 01:55:52 | 000,000,000 | ---D | C] -- C:\Users\c\Desktop\logs

[2012.09.23 05:38:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.09.21 18:19:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\c\Desktop\OTL.exe

[2012.09.21 17:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security

[2012.09.19 16:54:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7F3144B7-67AA-4DD7-BC11-CBA9A40B430D}

[2012.09.19 16:51:23 | 022,335,264 | ---- | C] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Maschine Controller Setup PC.exe

[2012.09.19 16:43:58 | 018,191,320 | ---- | C] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Controller Editor 1.5.1 Setup PC.exe

[2012.09.19 16:43:21 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\ImgBurn

[2012.09.19 16:26:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn

[2012.09.19 16:26:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ImgBurn

[2012.09.19 16:12:10 | 000,000,000 | ---D | C] -- C:\ProgramData\{20EFD19B-675C-417B-A498-B0161D72FF88}

[2012.09.19 16:10:20 | 000,000,000 | ---D | C] -- C:\ProgramData\{B5F0C192-874D-49A8-88D7-8431E3714756}

[2012.09.19 02:43:07 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\MinMaxGames

[2012.09.18 01:40:48 | 000,000,000 | -H-D | C] -- C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}

[2012.09.17 19:14:55 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Local\bau_jump_n_run_alpha3.1

[2012.09.17 19:14:13 | 000,000,000 | ---D | C] -- C:\Users\c\Documents\bau_jump_n_run_alpha3.1

[2012.09.16 14:04:00 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Local\bau_jump_n_run

[2012.09.16 14:03:54 | 000,000,000 | ---D | C] -- C:\Users\c\Desktop\bau_jump_n_run

[2012.09.13 01:39:41 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Local\IsolatedStorage

[2012.09.13 01:39:31 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlatformanceTempleDeath

[2012.09.13 01:38:42 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Local\Deployment

[2012.09.11 21:07:52 | 000,000,000 | ---D | C] -- C:\Users\c\Documents\IAmAlive

[2012.09.08 16:45:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler

[2012.09.08 16:45:06 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler

[2012.09.08 16:36:47 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\Auslogics

[2012.09.08 13:20:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MIDI-OX

[2012.09.08 13:20:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MIDIOX

[2012.09.08 06:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey

[2012.09.08 06:07:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AutoHotkey

[2012.09.08 01:59:31 | 000,000,000 | ---D | C] -- C:\Users\c\Documents\BotaniculaSaves

[2012.09.04 23:36:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012.09.04 23:12:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Project Zomboid

[2012.09.04 00:06:30 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\Squids

[2012.09.03 13:06:30 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\collection

[2012.09.03 06:13:26 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\HD Tune Pro

[2012.09.03 06:13:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro

[2012.09.03 06:13:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HD Tune Pro

[2012.09.02 15:22:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.08.30 04:42:39 | 000,000,000 | ---D | C] -- C:\Users\c\dwhelper

[2012.08.29 01:32:30 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Ghost Master

[2012.08.26 22:45:24 | 000,000,000 | ---D | C] -- C:\Users\c\Desktop\Keyboard Locker

[2012.08.26 21:19:50 | 000,000,000 | ---D | C] -- C:\Users\c\AppData\Roaming\JAM Software

[2012.08.26 21:19:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize Free

[2012.08.26 21:19:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JAM Software

[2011.05.15 15:56:41 | 004,411,392 | ---- | C] (Gabest) -- C:\Program Files (x86)\mplayerc.exe

[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.09.25 20:44:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\c\Desktop\OTL.exe

[2012.09.25 19:03:23 | 003,035,120 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.09.25 19:03:23 | 000,704,678 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.09.25 19:03:23 | 000,666,610 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat

[2012.09.25 19:03:23 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.09.25 19:03:23 | 000,479,744 | ---- | M] () -- C:\Windows\SysNative\perfh00B.dat

[2012.09.25 19:03:23 | 000,152,204 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.09.25 19:03:23 | 000,144,574 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat

[2012.09.25 19:03:23 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.09.25 19:03:23 | 000,104,746 | ---- | M] () -- C:\Windows\SysNative\perfc00B.dat

[2012.09.25 17:53:01 | 000,012,956 | ---- | M] () -- C:\Users\c\Desktop\scr.jpg

[2012.09.25 17:53:01 | 000,010,783 | ---- | M] () -- C:\Users\c\.recently-used.xbel

[2012.09.25 17:52:33 | 000,034,726 | ---- | M] () -- C:\Users\c\Desktop\scr.xcf

[2012.09.25 14:01:46 | 000,438,499 | ---- | M] () -- C:\Users\c\Desktop\google.gif

[2012.09.25 13:33:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.09.25 02:58:40 | 000,000,000 | ---- | M] () -- C:\Users\c\Desktop\NO_HOST_CHECK=NO

[2012.09.25 02:54:40 | 000,009,504 | ---- | M] () -- C:\Users\c\Desktop\Lightwave.evm

[2012.09.25 02:16:53 | 000,000,837 | ---- | M] () -- C:\Users\Public\Desktop\Maschine.lnk

[2012.09.25 02:15:06 | 000,001,102 | ---- | M] () -- C:\Users\Public\Desktop\Controller Editor.lnk

[2012.09.25 02:14:10 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Service Center.lnk

[2012.09.25 02:05:09 | 181,871,384 | ---- | M] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Maschine 1.8.1 Setup PC.exe

[2012.09.22 00:57:21 | 000,334,502 | ---- | M] () -- C:\Users\c\Desktop\coolecollage.png

[2012.09.22 00:52:33 | 000,035,800 | ---- | M] () -- C:\Users\c\Desktop\560477_438518639508734_180992803_n.jpg

[2012.09.22 00:51:18 | 000,018,293 | ---- | M] () -- C:\Users\c\Desktop\382a0be59.4559549,1.jpg

[2012.09.22 00:50:44 | 000,008,799 | ---- | M] () -- C:\Users\c\Desktop\1fddef44a.8705087,1.jpg

[2012.09.21 19:18:54 | 000,026,393 | ---- | M] () -- C:\Users\c\Desktop\vir.jpg

[2012.09.21 18:14:21 | 000,000,020 | ---- | M] () -- C:\Users\c\defogger_reenable

[2012.09.21 17:48:37 | 000,001,294 | ---- | M] () -- C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk

[2012.09.21 17:40:28 | 000,008,532 | ---- | M] () -- C:\Users\c\Documents\cc_20120921_174024.reg

[2012.09.20 23:22:16 | 020,623,360 | ---- | M] () -- C:\Users\c\Desktop\Maschine_170_Manuals_all.zip.incomplete

[2012.09.20 23:22:05 | 017,766,856 | ---- | M] () -- C:\Users\c\Desktop\Controller_Editor_151_PC.zip.incomplete

[2012.09.20 23:19:43 | 003,445,384 | ---- | M] () -- C:\Users\c\Desktop\ControllerEditorManual_German.pdf

[2012.09.20 23:19:38 | 003,619,086 | ---- | M] () -- C:\Users\c\Desktop\Maschine_Hardware_Control_Reference_English.pdf

[2012.09.20 21:38:41 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.09.20 03:50:29 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.09.20 03:50:29 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.09.19 18:49:51 | 000,080,750 | ---- | M] () -- C:\Users\c\Desktop\basodijfaodkfj.png

[2012.09.19 16:51:23 | 022,335,264 | ---- | M] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Maschine Controller Setup PC.exe

[2012.09.19 16:43:58 | 018,191,320 | ---- | M] (Native Instruments                                                                                                                                                                                                                                                                                          ) -- C:\Users\c\Desktop\Controller Editor 1.5.1 Setup PC.exe

[2012.09.19 16:26:34 | 000,001,877 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk

[2012.09.18 01:40:46 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\Massive.lnk

[2012.09.17 19:12:53 | 002,666,376 | ---- | M] () -- C:\Users\c\Documents\bau_jump_n_run_alpha3.1.zip

[2012.09.16 14:03:27 | 002,755,913 | ---- | M] () -- C:\Users\c\Documents\trololol.zip

[2012.09.16 13:58:05 | 002,824,619 | ---- | M] () -- C:\Users\c\Documents\install_geburtstagsgeschenk_alpha.exe

[2012.09.15 13:46:12 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.09.15 13:46:12 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.09.13 01:39:31 | 000,000,456 | ---- | M] () -- C:\Users\c\Desktop\PlatformanceTempleDeath.appref-ms

[2012.09.12 23:14:28 | 001,727,208 | ---- | M] () -- C:\Users\c\Documents\persepolis analyse.odt

[2012.09.09 14:49:18 | 000,304,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.09.08 16:41:17 | 000,004,404 | ---- | M] () -- C:\Users\c\Documents\cc_20120908_164115.reg

[2012.09.08 13:20:23 | 000,002,575 | ---- | M] () -- C:\Users\Public\Desktop\MIDI-OX.lnk

[2012.09.08 06:08:46 | 000,005,106 | ---- | M] () -- C:\Users\c\Documents\AutoHotkey.ahk

[2012.09.08 00:29:38 | 000,067,883 | ---- | M] () -- C:\Users\c\Desktop\Amazon.de - Rücksendezentrum.pdf

[2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.09.04 23:12:14 | 000,000,889 | ---- | M] () -- C:\Users\Public\Desktop\Project Zomboid.lnk

[2012.09.03 06:13:19 | 000,001,045 | ---- | M] () -- C:\Users\c\Desktop\HD Tune Pro.lnk

[2012.08.30 03:19:56 | 000,006,662 | ---- | M] () -- C:\Users\c\Documents\cc_20120830_031952.reg

[2012.08.26 20:58:24 | 000,032,192 | ---- | M] () -- C:\Users\c\Documents\cc_20120826_205818.reg

[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.09.25 17:53:01 | 000,010,783 | ---- | C] () -- C:\Users\c\.recently-used.xbel

[2012.09.25 17:53:00 | 000,012,956 | ---- | C] () -- C:\Users\c\Desktop\scr.jpg

[2012.09.25 17:52:33 | 000,034,726 | ---- | C] () -- C:\Users\c\Desktop\scr.xcf

[2012.09.25 14:01:46 | 000,438,499 | ---- | C] () -- C:\Users\c\Desktop\google.gif

[2012.09.25 02:58:40 | 000,000,000 | ---- | C] () -- C:\Users\c\Desktop\NO_HOST_CHECK=NO

[2012.09.25 02:54:40 | 000,009,504 | ---- | C] () -- C:\Users\c\Desktop\Lightwave.evm

[2012.09.25 02:16:53 | 000,000,837 | ---- | C] () -- C:\Users\Public\Desktop\Maschine.lnk

[2012.09.25 02:15:06 | 000,001,102 | ---- | C] () -- C:\Users\Public\Desktop\Controller Editor.lnk

[2012.09.25 02:14:10 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Service Center.lnk

[2012.09.22 00:58:41 | 000,334,502 | ---- | C] () -- C:\Users\c\Desktop\coolecollage.png

[2012.09.22 00:52:33 | 000,035,800 | ---- | C] () -- C:\Users\c\Desktop\560477_438518639508734_180992803_n.jpg

[2012.09.22 00:51:18 | 000,018,293 | ---- | C] () -- C:\Users\c\Desktop\382a0be59.4559549,1.jpg

[2012.09.22 00:50:44 | 000,008,799 | ---- | C] () -- C:\Users\c\Desktop\1fddef44a.8705087,1.jpg

[2012.09.21 19:18:54 | 000,026,393 | ---- | C] () -- C:\Users\c\Desktop\vir.jpg

[2012.09.21 18:14:20 | 000,000,020 | ---- | C] () -- C:\Users\c\defogger_reenable

[2012.09.21 17:48:37 | 000,001,294 | ---- | C] () -- C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk

[2012.09.21 17:40:26 | 000,008,532 | ---- | C] () -- C:\Users\c\Documents\cc_20120921_174024.reg

[2012.09.21 00:37:53 | 007,152,305 | ---- | C] () -- C:\Users\c\Desktop\Maschine Reference Manual German.pdf

[2012.09.20 21:29:44 | 020,623,360 | ---- | C] () -- C:\Users\c\Desktop\Maschine_170_Manuals_all.zip.incomplete

[2012.09.20 21:29:44 | 003,619,086 | ---- | C] () -- C:\Users\c\Desktop\Maschine_Hardware_Control_Reference_English.pdf

[2012.09.20 21:29:44 | 003,445,384 | ---- | C] () -- C:\Users\c\Desktop\ControllerEditorManual_German.pdf

[2012.09.20 21:29:43 | 017,766,856 | ---- | C] () -- C:\Users\c\Desktop\Controller_Editor_151_PC.zip.incomplete

[2012.09.19 18:49:49 | 000,080,750 | ---- | C] () -- C:\Users\c\Desktop\basodijfaodkfj.png

[2012.09.19 16:26:34 | 000,001,889 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk

[2012.09.19 16:26:34 | 000,001,877 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk

[2012.09.18 01:40:46 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\Massive.lnk

[2012.09.17 19:11:54 | 002,666,376 | ---- | C] () -- C:\Users\c\Documents\bau_jump_n_run_alpha3.1.zip

[2012.09.16 14:02:51 | 002,755,913 | ---- | C] () -- C:\Users\c\Documents\trololol.zip

[2012.09.16 13:57:27 | 002,824,619 | ---- | C] () -- C:\Users\c\Documents\install_geburtstagsgeschenk_alpha.exe

[2012.09.13 01:39:31 | 000,000,456 | ---- | C] () -- C:\Users\c\Desktop\PlatformanceTempleDeath.appref-ms

[2012.09.08 16:41:16 | 000,004,404 | ---- | C] () -- C:\Users\c\Documents\cc_20120908_164115.reg

[2012.09.08 13:20:23 | 000,002,575 | ---- | C] () -- C:\Users\Public\Desktop\MIDI-OX.lnk

[2012.09.08 06:08:03 | 000,005,106 | ---- | C] () -- C:\Users\c\Documents\AutoHotkey.ahk

[2012.09.04 23:30:41 | 001,727,208 | ---- | C] () -- C:\Users\c\Documents\persepolis analyse.odt

[2012.09.04 23:12:14 | 000,000,889 | ---- | C] () -- C:\Users\Public\Desktop\Project Zomboid.lnk

[2012.09.03 06:13:19 | 000,001,045 | ---- | C] () -- C:\Users\c\Desktop\HD Tune Pro.lnk

[2012.08.30 03:25:32 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.08.30 03:25:31 | 000,001,154 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.08.30 03:19:55 | 000,006,662 | ---- | C] () -- C:\Users\c\Documents\cc_20120830_031952.reg

[2012.08.26 20:58:19 | 000,032,192 | ---- | C] () -- C:\Users\c\Documents\cc_20120826_205818.reg

[2012.08.01 12:26:54 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll

[2012.06.18 17:41:23 | 000,000,268 | RH-- | C] () -- C:\ProgramData\User Loops

[2012.06.18 17:41:23 | 000,000,268 | RH-- | C] () -- C:\ProgramData\URLs

[2012.06.18 17:41:23 | 000,000,268 | RH-- | C] () -- C:\Users\c\AppData\Roaming\Tribal Masks

[2012.06.18 17:41:23 | 000,000,268 | RH-- | C] () -- C:\Users\c\AppData\Roaming\Tremolo

[2012.06.18 17:41:23 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT

[2012.06.18 17:41:23 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT

[2012.06.18 17:41:23 | 000,000,012 | RH-- | C] () -- C:\ProgramData\filter

[2012.06.18 17:41:23 | 000,000,012 | RH-- | C] () -- C:\ProgramData\deskjet

[2012.06.18 17:41:22 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Tuner

[2012.06.18 17:41:22 | 000,000,268 | RH-- | C] () -- C:\Users\c\AppData\Roaming\Treble Reduction

[2012.06.18 17:41:22 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT

[2012.06.18 17:41:22 | 000,000,012 | RH-- | C] () -- C:\ProgramData\business-inkjet

[2012.05.09 23:26:52 | 000,000,406 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2012.04.01 14:59:15 | 000,000,600 | ---- | C] () -- C:\Users\c\AppData\Roaming\winscp.rnd

[2012.02.29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll

[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll

[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe

[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2011.09.26 14:28:56 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.09.15 01:12:45 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll

[2011.09.15 01:12:45 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini

[2011.09.05 21:16:01 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2011.08.15 12:44:15 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat

[2011.06.16 21:52:15 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat

[2011.05.16 21:52:39 | 000,499,246 | ---- | C] () -- C:\Windows\SysWow64\sqlite3.dll

[2011.01.26 20:52:30 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL

[2011.01.26 20:52:30 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL

[2011.01.26 20:51:37 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL

[2010.11.04 20:18:28 | 013,893,632 | ---- | C] () -- C:\ProgramData\sandra.mda

[2010.10.27 05:23:39 | 000,007,604 | ---- | C] () -- C:\Users\c\AppData\Local\resmon.resmoncfg

[2010.10.16 17:12:48 | 000,001,019 | ---- | C] () -- C:\Windows\disney.ini

[2010.10.14 02:13:28 | 000,000,000 | -H-- | C] () -- C:\Users\c\AppData\Roaming\.53685440DD4DB4CF.sys

[2010.10.13 18:38:33 | 002,977,324 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2010.10.13 18:31:45 | 000,052,836 | ---- | C] () -- C:\Windows\SysWow64\zlib1.dll

[2010.10.13 18:31:43 | 000,394,752 | ---- | C] () -- C:\Windows\SysWow64\cygwinb19.dll

[2010.10.13 18:31:43 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\libpng13.dll

[2010.10.13 18:31:42 | 001,199,179 | ---- | C] () -- C:\Windows\unins001.exe

[2010.10.13 18:31:42 | 000,030,762 | ---- | C] () -- C:\Windows\unins001.dat

[2010.10.13 18:29:30 | 001,199,175 | ---- | C] () -- C:\Windows\unins000.exe

[2010.10.13 18:29:30 | 000,014,761 | ---- | C] () -- C:\Windows\unins000.dat

[2010.10.12 20:06:41 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.07.01 19:09:29 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\.minecraft

[2011.07.25 02:18:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Ableton

[2011.10.20 02:34:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Amazon

[2012.08.23 23:04:29 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\AudioConverter

[2012.09.08 16:36:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Auslogics

[2011.11.05 21:17:53 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\avidemux

[2012.05.07 14:17:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Bioshock

[2012.08.02 22:37:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Bioshock2

[2012.04.06 23:16:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\bizarre creations

[2010.10.14 00:40:19 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Blue Cat Audio

[2011.04.02 21:12:11 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\BOM

[2011.12.25 04:56:21 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Broken Rules

[2010.12.23 21:07:26 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Canneverbe Limited

[2012.08.09 23:37:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Carbon

[2012.09.03 13:06:30 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\collection

[2011.11.26 03:36:18 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Crayon Physics Deluxe

[2010.11.27 05:11:14 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Cycling '74

[2012.09.21 17:39:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DAEMON Tools Lite

[2010.10.16 17:29:36 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Disney Interactive Studios

[2012.09.25 13:16:35 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Dropbox

[2011.12.15 03:45:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DVDVideoSoft

[2011.12.15 03:45:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.05.16 21:55:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\FabFilter

[2011.10.22 21:58:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\FileZilla

[2012.03.27 00:49:37 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Firefly Studios

[2012.09.24 04:44:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\foobar2000

[2010.10.13 15:10:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Foxit Software

[2011.10.04 22:06:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\GameMaker

[2012.09.25 17:53:01 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\gtk-2.0

[2012.09.04 17:06:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\HD Tune Pro

[2012.09.19 16:55:46 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ImgBurn

[2011.05.16 21:56:57 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\iZotope

[2012.08.26 21:19:50 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\JAM Software

[2010.12.21 23:29:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Korg

[2011.11.06 13:21:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Leadertech

[2011.05.10 01:25:38 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\LibreOffice

[2010.10.15 19:38:08 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\LolClient

[2012.05.11 19:48:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ManyCam

[2012.09.19 02:43:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\MinMaxGames

[2011.11.05 21:19:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\mkvtoolnix

[2012.01.06 19:14:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Mumble

[2012.02.02 01:51:41 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nicalis

[2011.12.21 04:17:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nifflas

[2012.06.18 20:38:48 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nikon

[2011.05.16 01:35:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Octoshape

[2011.07.21 01:27:54 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Opera

[2012.06.30 18:34:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Orbit

[2011.12.02 04:51:53 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\PACE Anti-Piracy

[2011.12.10 07:21:13 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Panda Security

[2012.03.21 16:42:38 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\pdfforge

[2011.12.29 22:29:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Polynomial

[2012.06.29 17:59:25 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ProgSense

[2011.04.25 18:25:12 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\punktminecraft

[2011.09.15 23:13:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\punktminecraft2

[2011.09.12 17:03:37 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\REAPER

[2012.06.27 04:10:44 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\redsn0w

[2012.02.21 20:11:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\RotMG.Production

[2011.07.06 22:40:46 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Screaming Bee

[2012.09.25 20:44:17 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Spotify

[2012.09.04 00:06:31 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Squids

[2011.05.10 01:30:15 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Stardock

[2011.09.12 19:25:26 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Synthesia

[2011.12.03 02:39:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\TeamViewer

[2010.10.15 21:27:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\The Path

[2012.02.09 13:27:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Thinstall

[2010.10.12 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Thunderbird

[2012.08.01 12:27:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Tobit

[2012.04.15 13:38:17 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Trine2

[2011.07.18 19:41:00 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

[2012.05.01 04:45:59 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\VertexDispenser

[2011.08.27 03:54:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\WindSolutions

[2010.10.14 00:40:45 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Yellow Tools

[2012.07.01 23:46:28 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ZombieDriver

[2011.06.09 18:12:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{ca6389c2-28d2-40ef-ab3d-2221e06e372f}

[2011.06.09 18:12:10 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{cc5077cc-858c-4ac2-b258-d8f4b86979d3}

[2011.06.09 18:11:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{f71f39b3-d083-4fae-9b9e-dfeba90cb0e5}

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.07.01 19:09:29 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\.minecraft

[2011.07.25 02:18:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Ableton

[2012.07.11 16:22:54 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Adobe

[2011.10.20 02:34:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Amazon

[2012.07.12 01:43:19 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Apple Computer

[2012.08.23 23:04:29 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\AudioConverter

[2012.09.08 16:36:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Auslogics

[2011.11.05 21:17:53 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\avidemux

[2012.05.07 14:17:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Bioshock

[2012.08.02 22:37:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Bioshock2

[2012.04.06 23:16:47 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\bizarre creations

[2010.10.14 00:40:19 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Blue Cat Audio

[2011.04.02 21:12:11 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\BOM

[2011.12.25 04:56:21 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Broken Rules

[2010.12.23 21:07:26 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Canneverbe Limited

[2012.08.09 23:37:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Carbon

[2012.09.03 13:06:30 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\collection

[2011.11.26 03:36:18 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Crayon Physics Deluxe

[2011.01.26 21:32:41 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Creative

[2010.11.27 05:11:14 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Cycling '74

[2012.09.21 17:39:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DAEMON Tools Lite

[2010.10.16 17:29:36 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Disney Interactive Studios

[2012.09.25 13:16:35 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Dropbox

[2010.12.24 05:48:18 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DVD Flick

[2012.08.11 22:22:57 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\dvdcss

[2011.12.15 03:45:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DVDVideoSoft

[2011.12.15 03:45:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.05.16 21:55:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\FabFilter

[2011.10.22 21:58:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\FileZilla

[2012.03.27 00:49:37 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Firefly Studios

[2012.09.24 04:44:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\foobar2000

[2010.10.13 15:10:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Foxit Software

[2011.10.04 22:06:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\GameMaker

[2012.09.25 17:53:01 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\gtk-2.0

[2012.09.04 17:06:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\HD Tune Pro

[2010.03.12 03:21:17 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Identities

[2012.09.19 16:55:46 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ImgBurn

[2010.10.16 17:12:44 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\InstallShield

[2011.05.16 21:56:57 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\iZotope

[2012.08.26 21:19:50 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\JAM Software

[2010.12.21 23:29:51 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Korg

[2011.11.06 13:21:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Leadertech

[2011.05.10 01:25:38 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\LibreOffice

[2010.10.15 19:38:08 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\LolClient

[2010.10.12 18:55:05 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Macromedia

[2010.11.05 00:36:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Malwarebytes

[2012.05.11 19:48:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ManyCam

[2009.07.14 09:23:33 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Media Center Programs

[2012.09.24 03:27:36 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Media Player Classic

[2012.06.12 13:05:16 | 000,000,000 | --SD | M] -- C:\Users\c\AppData\Roaming\Microsoft

[2012.09.19 02:43:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\MinMaxGames

[2011.11.05 21:19:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\mkvtoolnix

[2011.05.16 01:35:41 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Mozilla

[2012.01.06 19:14:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Mumble

[2012.02.02 01:51:41 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nicalis

[2011.12.21 04:17:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nifflas

[2012.06.18 20:38:48 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Nikon

[2011.09.11 02:02:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\NVIDIA

[2011.05.16 01:35:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Octoshape

[2011.07.21 01:27:54 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Opera

[2012.06.30 18:34:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Orbit

[2011.12.02 04:51:53 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\PACE Anti-Piracy

[2011.12.10 07:21:13 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Panda Security

[2012.03.21 16:42:38 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\pdfforge

[2011.12.29 22:29:39 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Polynomial

[2012.06.29 17:59:25 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ProgSense

[2011.04.25 18:25:12 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\punktminecraft

[2011.09.15 23:13:16 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\punktminecraft2

[2011.09.12 17:03:37 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\REAPER

[2012.06.27 04:10:44 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\redsn0w

[2012.02.21 20:11:34 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\RotMG.Production

[2011.07.06 22:40:46 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Screaming Bee

[2010.10.22 00:31:25 | 000,000,000 | RH-D | M] -- C:\Users\c\AppData\Roaming\SecuROM

[2012.09.25 20:51:19 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Skype

[2011.07.04 22:27:35 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\skypePM

[2012.09.25 20:44:17 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Spotify

[2012.09.04 00:06:31 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Squids

[2011.05.10 01:30:15 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Stardock

[2011.12.10 07:30:49 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\SUPERAntiSpyware.com

[2011.09.12 19:25:26 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Synthesia

[2011.12.03 02:39:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\TeamViewer

[2010.10.15 21:27:09 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\The Path

[2012.02.09 13:27:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Thinstall

[2010.10.12 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Thunderbird

[2012.08.01 12:27:07 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Tobit

[2010.11.10 02:39:50 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\tor

[2010.12.08 01:05:48 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Toribash

[2012.04.15 13:38:17 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Trine2

[2011.07.18 19:41:00 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

[2012.05.01 04:45:59 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\VertexDispenser

[2010.11.10 02:39:50 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Vidalia

[2012.09.25 19:05:08 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\vlc

[2011.08.27 03:54:32 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\WindSolutions

[2010.10.13 20:55:55 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\WinRAR

[2010.10.14 00:40:45 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\Yellow Tools

[2012.07.01 23:46:28 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\ZombieDriver

[2011.06.09 18:12:23 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{ca6389c2-28d2-40ef-ab3d-2221e06e372f}

[2011.06.09 18:12:10 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{cc5077cc-858c-4ac2-b258-d8f4b86979d3}

[2011.06.09 18:11:58 | 000,000,000 | ---D | M] -- C:\Users\c\AppData\Roaming\{f71f39b3-d083-4fae-9b9e-dfeba90cb0e5}

 
 < %APPDATA%\*.exe /s >

[2010.12.22 12:57:08 | 000,011,264 | ---- | M] (Fibonacci Software) -- C:\Users\c\AppData\Roaming\{cc5077cc-858c-4ac2-b258-d8f4b86979d3}\bump.exe

[2010.12.20 06:33:57 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Users\c\AppData\Roaming\{cc5077cc-858c-4ac2-b258-d8f4b86979d3}\winver.exe

[2008.03.12 18:27:16 | 000,296,960 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\aften_x86\aften.exe

[2008.03.12 18:28:28 | 000,305,152 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\aften_x86_SSE\aften.exe

[2008.03.12 18:29:38 | 000,273,408 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\aften_x86_SSE2\aften.exe

[2008.03.12 18:30:50 | 000,273,920 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\aften_x86_SSE3\aften.exe

[2008.03.12 18:22:44 | 000,145,408 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\libaftendll_x86\aften.exe

[2008.03.12 18:23:50 | 000,146,944 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\libaftendll_x86_SSE\aften.exe

[2008.03.12 18:24:56 | 000,147,456 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\libaftendll_x86_SSE2\aften.exe

[2008.03.12 18:26:02 | 000,147,456 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\libaftendll_x86_SSE3\aften.exe

[2008.03.12 18:21:30 | 000,141,824 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\wavfilter_x86\wavfilter.exe

[2008.03.12 18:21:32 | 000,113,664 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\wavinfo_x86\wavinfo.exe

[2008.03.12 18:21:34 | 000,156,160 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Aften\wavrms_x86\wavrms.exe

[2005.09.08 22:10:18 | 000,061,440 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\BeSweet\BeSweet.exe

[2006.02.11 13:59:00 | 000,290,816 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\DelayCut\delaycut.exe

[2009.03.29 08:46:50 | 000,303,510 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\eac3to\Clown_BD_v0.41b.exe

[2009.03.29 12:00:14 | 001,871,872 | ---- | M] (madshi.net) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\eac3to\eac3to.exe

[2009.03.29 13:37:10 | 000,084,480 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\eac3to\HdBrStreamExtractor.exe

[2008.11.02 22:14:34 | 000,572,103 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\eac3to\yr_eac3to_more_gui.exe

[2004.02.05 10:16:44 | 000,131,072 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\FAAD\faad.exe

[2008.07.11 14:53:40 | 002,834,432 | ---- | M] (hxxp://mediainfo.sourceforge.net) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MediaInfo\MediaInfo.exe

[2008.07.14 20:43:36 | 000,122,423 | ---- | M] (0.7.7.4) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MediaInfo\uninst.exe

[2009.03.24 15:28:38 | 001,822,208 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MKVtoolnix\mkvextract.exe

[2009.03.24 15:28:38 | 001,049,600 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MKVtoolnix\mkvinfo.exe

[2009.03.24 15:28:38 | 004,199,424 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MKVtoolnix\mkvmerge.exe

[2009.03.24 15:28:38 | 002,204,160 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MKVtoolnix\mmg.exe

[2009.05.02 22:14:24 | 000,053,862 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\MKVtoolnix\uninst.exe

[2007.08.06 09:44:30 | 000,425,984 | ---- | M] (Nero AG) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\NeroAAC\win32\neroAacDec.exe

[2007.08.06 09:44:26 | 001,081,344 | ---- | M] (Nero AG) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\NeroAAC\win32\neroAacEnc.exe

[2007.08.06 10:06:16 | 001,744,896 | ---- | M] (Nero AG) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\NeroAAC\win32\neroAacEnc_SSE.exe

[2007.08.06 09:44:52 | 000,373,248 | ---- | M] (Nero AG) -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\NeroAAC\win32\neroAacTag.exe

[2004.07.18 18:44:18 | 000,073,728 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\Normalize\normalize.exe

[2008.03.16 13:43:30 | 000,319,488 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\OGG\oggdec.exe

[2005.06.28 01:01:04 | 000,061,440 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\SSRC\ssrc.exe

[2005.06.28 01:01:04 | 000,062,976 | ---- | M] () -- C:\Users\c\AppData\Roaming\AudioConverter\Tools\SSRC\ssrc_hp.exe

[2012.08.09 23:37:35 | 004,293,120 | ---- | M] () -- C:\Users\c\AppData\Roaming\Carbon\AirMech\AirMech.exe

[2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\c\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Users\c\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe

[2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\c\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2011.10.04 22:00:32 | 000,115,016 | ---- | M] (YoYo Games Ltd.) -- C:\Users\c\AppData\Roaming\GameMaker\GameMaker.exe

[2011.10.04 22:00:33 | 005,647,688 | ---- | M] (YoYo Games Ltd) -- C:\Users\c\AppData\Roaming\GameMaker\Game_Maker.exe

[2011.10.11 21:25:25 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\c\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2011.11.06 13:21:09 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\c\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

[2010.11.05 00:27:13 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\c\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

[2012.06.18 17:42:48 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\c\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

[2009.01.08 15:44:06 | 000,070,936 | ---- | M] (Octoshape ApS) -- C:\Users\c\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe

[2011.01.27 15:38:19 | 000,003,584 | ---- | M] (Octoshape ApS) -- C:\Users\c\AppData\Roaming\Octoshape\Octoshape Streaming Services\toucher-1101262-0-toucher.exe

[2012.08.20 19:37:34 | 005,576,408 | ---- | M] (Spotify Ltd) -- C:\Users\c\AppData\Roaming\Spotify\spotify.exe

[2012.08.20 19:37:34 | 000,114,904 | ---- | M] () -- C:\Users\c\AppData\Roaming\Spotify\SpotifyLauncher.exe

[2012.08.20 19:37:34 | 001,193,176 | ---- | M] () -- C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

[2011.08.27 03:54:25 | 007,278,792 | ---- | M] (WindSolutions) -- C:\Users\c\AppData\Roaming\WindSolutions\CopyTransControlCenter\Applications\CopyTrans.exe

[2011.08.27 00:18:18 | 003,461,672 | ---- | M] (WindSolutions) -- C:\Users\c\AppData\Roaming\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe

[2011.08.27 00:20:18 | 007,665,928 | ---- | M] (WindSolutions) -- C:\Users\c\AppData\Roaming\WindSolutions\CopyTransControlCenter\Applications\CopyTransManager.exe

[2011.08.27 03:52:22 | 005,993,936 | ---- | M] (WindSolutions) -- C:\Users\c\AppData\Roaming\WindSolutions\CopyTransControlCenter\Applications\CopyTransTuneSwift.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2012.05.29 18:39:54 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=2C353B6CE0C8D03225CAA2AF33B68D79 -- C:\Windows\SysNative\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\ProgramData\Microsoft\Windows\RAI\32\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Users\All Users\Microsoft\Windows\RAI\32\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2012.05.29 18:39:54 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=861C4346F9281DC0380DE72C8D55D6BE -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\ProgramData\Microsoft\Windows\RAI\64\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Users\All Users\Microsoft\Windows\RAI\64\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\ProgramData\Microsoft\Windows\RAI\64\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\ProgramData\Microsoft\Windows\RAI\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Users\All Users\Microsoft\Windows\RAI\64\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Users\All Users\Microsoft\Windows\RAI\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Code:

64bit- Enterprise Edition Service Pack 1 (Version = 6.1.7601)

Warum eine Enterprise Edition von Win7? Woher hast du die?

Ich habe den Rechner einem Bekannten abgekauft und meine Platten zusätzlich eingebaut.
Windows war darauf vorinstalliert.
Besitze aber eine original Lizenz und habe mir darum nicht groß Gedanken gemacht.

Du hast das Windows von deinem Bekannten einfach so gelassen wie es war? :wtf:

Es war auf jeden Fall neu aufgesetzt und unberührt, also keine Daten von ihm drauf (soweit ich das beurteilen kann).
Ich denke nicht, dass er mir da bewusst schadhafte Software untergejubelt hat.

Was hab ich denn nun für ein Problem ?
Ich bin ja wirklich dankbar für die Hilfe, aber diese ganzen Auswertungen sagen mir recht wenig und ich weiß nicht so wirklich wie ich mich jetzt weiter verhalten soll bzw. was ich mir da genau eingefangen habe.

Zitat:

Es war auf jeden Fall neu aufgesetzt und unberührt, also keine Daten von ihm drauf (soweit ich das beurteilen kann).
Ich denke nicht, dass er mir da bewusst schadhafte Software untergejubelt hat.

Da muss ich aber noch genauer nachhaken, aus welcher Quelle hat er dieses Windows denn?

Er wird da wohl seine Firmenlizenz verwendet haben...
Ich kann das leider nicht genau beantworten, da ich wie gesagt das System so vorgefunden habe.

Er hat seine Firmenlizenz auf einem Privat-Rechner? :wtf:

Wie bereits gesagt: Ich weiß es nicht. Das Thema ist eh bald hinfällig, da ich das System neu aufsetzen werde. Bis dahin wüsste ich zumindest gern, ob ich (angenommen mit Windows wäre alles ok) nun noch etwas tun kann/muss oder ob der Rechner sauber ist. Kann es z.B. sein, dass selbst wenn ich windows neu installiere noch Schädlingen vorhanden sind und das ganze von vorne beginnt ? Kann ich momentan unbesorgt online banking nutzen ? Würde mich wirklich freuen wenn wir hier weiter kommen könnten.

PS: Ich kenne die Regeln hier und ich denke zu wissen worauf du hinaus willst. Ich kann guten gewissen behaupten zu keinem Zeitpunkt bewusst potentiell schadhafte oder illegale Software etc. installiert/verwendet zu haben. :nixda:

Warum willst du denn hier bereinigen wenn du den Rechner eh bald neu installieren willst?
Und Onlinebanking würde ich mit einer verseuchten Kiste tunlichst sein lassen - wenn es unbedingt gemacht werden muss, dann mach es in unter einem Live-System wie Bankix

Ich habe das heute beschlossen, da ich absolut verunsichert bin ob das noch was gibt.
Ich möchte dennoch vorher alles bereinigen, da ich im Moment wenig Zeit habe und der Rechner noch ein paar Tage/Wochen so bleiben wird.
Weiterhin habe ich ja gesagt, dass ich nicht möchte, dass das System nach der neuinstallation neu infitziert wird und wer weiß was auf den zahlreichen partitionen los ist. Ich werde lediglich c: formatieren.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - user.js - File not found

IE - HKU\S-1-5-21-2460917813-4204335397-3809129294-1001\..\SearchScopes\{A1B19448-A883-494D-863B-F203823F0CE9}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=MYC-ST&o=102869&src=kw&q={searchTerms}&locale=&apn_ptnrs=5J&apn_dtid=YYYYYYYYDE&apn_uid=06d54a5e-60f0-459a-8d03-5d06a71cd673&apn_sauid=B502D06C-2DFF-4141-8ECC-DE8F4B1A3EE4

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 8118

FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"

FF - prefs.js..network.proxy.socks: "127.0.0.1"

FF - prefs.js..network.proxy.socks_port: 9050

FF - prefs.js..network.proxy.socks_remote_dns: true

FF - prefs.js..network.proxy.ssl: "127.0.0.1"

FF - prefs.js..network.proxy.ssl_port: 8118

FF - prefs.js..network.proxy.type: 4

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Computer - Shortcut.lnk =  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O32 - HKLM CDRom: AutoRun - 1

:Files

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache

F:\Firefox DLs\SoftonicDownloader_fuer_nvidia-gpu-temp.exe

C:\Users\c\AppData\Roaming\{*

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Vielen Dank.
Wärst du so nett kurz zu erläutern was da los war und wie sich sowas in Zukunft vermeiden lässt ?

Fragen werden später beantwortet wenn wir mit der Bereinigung durch sind! Mach bitte den OTL-Fix und poste das Log!

Code:

All processes killed

========== OTL ==========

Registry key HKEY_USERS\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\Microsoft\Internet Explorer\SearchScopes\{A1B19448-A883-494D-863B-F203823F0CE9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1B19448-A883-494D-863B-F203823F0CE9}\ not found.

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Ask.com" removed from browser.search.defaultenginename

Prefs.js: "Ask.com" removed from browser.search.order.1

Prefs.js: "127.0.0.1" removed from network.proxy.http

Prefs.js: 8118 removed from network.proxy.http_port

Prefs.js: "127.0.0.1" removed from network.proxy.no_proxies_on

Prefs.js: "127.0.0.1" removed from network.proxy.socks

Prefs.js: 9050 removed from network.proxy.socks_port

Prefs.js: true removed from network.proxy.socks_remote_dns

Prefs.js: "127.0.0.1" removed from network.proxy.ssl

Prefs.js: 8118 removed from network.proxy.ssl_port

Prefs.js: 4 removed from network.proxy.type

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Computer - Shortcut.lnk moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.

File Protocol\Handler\skype4com - No CLSID value found not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

========== FILES ==========

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\f2cc42f-12cff6eb-n folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\c\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.

F:\Firefox DLs\SoftonicDownloader_fuer_nvidia-gpu-temp.exe moved successfully.

C:\Users\c\AppData\Roaming\{ca6389c2-28d2-40ef-ab3d-2221e06e372f} folder moved successfully.

C:\Users\c\AppData\Roaming\{cc5077cc-858c-4ac2-b258-d8f4b86979d3} folder moved successfully.

C:\Users\c\AppData\Roaming\{f71f39b3-d083-4fae-9b9e-dfeba90cb0e5} folder moved successfully.
 < ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\c\Desktop\cmd.bat deleted successfully.

C:\Users\c\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: c

->Temp folder emptied: 35939200 bytes

->Temporary Internet Files folder emptied: 15061880 bytes

->FireFox cache emptied: 826712887 bytes

->Apple Safari cache emptied: 0 bytes

->Opera cache emptied: 8394283 bytes

->Flash cache emptied: 69194 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56468 bytes

 

User: UpdatusUser.c-PC

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 557056 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 113018 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 155938 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes

%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes

RecycleBin emptied: 248479046 bytes

 

Total Files Cleaned = 1.083,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.68.0 log created on 09272012_223053
 

Files\Folders moved on Reboot...

C:\Users\c\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Die Meldung: "find an antivirus program online" ist noch da.

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Code:

13:17:59.0293 3104  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24

13:17:59.0467 3104  ============================================================

13:17:59.0467 3104  Current date / time: 2012/09/29 13:17:59.0467

13:17:59.0467 3104  SystemInfo:

13:17:59.0467 3104  

13:17:59.0467 3104  OS Version: 6.1.7601 ServicePack: 1.0

13:17:59.0467 3104  Product type: Workstation

13:17:59.0467 3104  ComputerName: C-PC

13:17:59.0467 3104  UserName: c

13:17:59.0467 3104  Windows directory: C:\Windows

13:17:59.0467 3104  System windows directory: C:\Windows

13:17:59.0467 3104  Running under WOW64

13:17:59.0467 3104  Processor architecture: Intel x64

13:17:59.0467 3104  Number of processors: 4

13:17:59.0467 3104  Page size: 0x1000

13:17:59.0467 3104  Boot type: Normal boot

13:17:59.0467 3104  ============================================================

13:18:00.0280 3104  Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:18:00.0297 3104  Drive \Device\Harddisk1\DR1 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:18:00.0303 3104  ============================================================

13:18:00.0303 3104  \Device\Harddisk0\DR0:

13:18:00.0303 3104  MBR partitions:

13:18:00.0303 3104  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x61A7000

13:18:00.0308 3104  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x7148262, BlocksNum 0x61A7966

13:18:00.0308 3104  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0xD2EFBC8, BlocksNum 0x3D5672F9

13:18:00.0308 3104  \Device\Harddisk1\DR1:

13:18:00.0308 3104  MBR partitions:

13:18:00.0308 3104  ============================================================

13:18:00.0321 3104  C: <-> \Device\Harddisk0\DR0\Partition1

13:18:00.0352 3104  E: <-> \Device\Harddisk0\DR0\Partition2

13:18:00.0378 3104  F: <-> \Device\Harddisk0\DR0\Partition3

13:18:00.0379 3104  ============================================================

13:18:00.0379 3104  Initialize success

13:18:00.0379 3104  ============================================================

13:26:34.0802 6124  ============================================================

13:26:34.0802 6124  Scan started

13:26:34.0802 6124  Mode: Manual; SigCheck; TDLFS; 

13:26:34.0802 6124  ============================================================

13:26:35.0289 6124  ================ Scan system memory ========================

13:26:35.0289 6124  System memory - ok

13:26:35.0290 6124  ================ Scan services =============================

13:26:35.0356 6124  [ 581D88B25C4D4121824FED2CA38E562F ] !SASCORE        C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

13:26:35.0405 6124  !SASCORE - ok

13:26:35.0532 6124  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys

13:26:35.0561 6124  1394ohci - ok

13:26:35.0587 6124  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

13:26:35.0603 6124  ACPI - ok

13:26:35.0633 6124  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

13:26:35.0658 6124  AcpiPmi - ok

13:26:35.0681 6124  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

13:26:35.0702 6124  adp94xx - ok

13:26:35.0723 6124  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

13:26:35.0740 6124  adpahci - ok

13:26:35.0749 6124  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

13:26:35.0764 6124  adpu320 - ok

13:26:35.0787 6124  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

13:26:35.0844 6124  AeLookupSvc - ok

13:26:35.0889 6124  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

13:26:35.0928 6124  AFD - ok

13:26:35.0948 6124  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

13:26:35.0960 6124  agp440 - ok

13:26:35.0971 6124  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

13:26:35.0993 6124  ALG - ok

13:26:36.0010 6124  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

13:26:36.0022 6124  aliide - ok

13:26:36.0034 6124  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

13:26:36.0046 6124  amdide - ok

13:26:36.0054 6124  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

13:26:36.0082 6124  AmdK8 - ok

13:26:36.0089 6124  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

13:26:36.0103 6124  AmdPPM - ok

13:26:36.0151 6124  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

13:26:36.0169 6124  amdsata - ok

13:26:36.0186 6124  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

13:26:36.0208 6124  amdsbs - ok

13:26:36.0223 6124  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

13:26:36.0239 6124  amdxata - ok

13:26:36.0275 6124  [ 48CD7E6520D47D62EAB0E6CE3EC30C65 ] Andbus          C:\Windows\system32\DRIVERS\lgandbus64.sys

13:26:36.0312 6124  Andbus - ok

13:26:36.0330 6124  [ 08CBACC00D15DCDBBAAE1A7C8F231C61 ] AndDiag         C:\Windows\system32\DRIVERS\lganddiag64.sys

13:26:36.0344 6124  AndDiag - ok

13:26:36.0353 6124  [ CEA9A4CD6B3A83428CE8501240833668 ] AndGps          C:\Windows\system32\DRIVERS\lgandgps64.sys

13:26:36.0371 6124  AndGps - ok

13:26:36.0399 6124  [ E2B5663E547FA5E756B253EFA8EC8286 ] ANDModem        C:\Windows\system32\DRIVERS\lgandmodem64.sys

13:26:36.0432 6124  ANDModem - ok

13:26:36.0461 6124  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

13:26:36.0525 6124  AppID - ok

13:26:36.0542 6124  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

13:26:36.0589 6124  AppIDSvc - ok

13:26:36.0622 6124  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\Windows\System32\appinfo.dll

13:26:36.0667 6124  Appinfo - ok

13:26:36.0737 6124  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

13:26:36.0752 6124  Apple Mobile Device - ok

13:26:36.0770 6124  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt         C:\Windows\System32\appmgmts.dll

13:26:36.0793 6124  AppMgmt - ok

13:26:36.0815 6124  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys

13:26:36.0829 6124  arc - ok

13:26:36.0844 6124  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

13:26:36.0857 6124  arcsas - ok

13:26:36.0946 6124  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

13:26:36.0971 6124  aspnet_state - ok

13:26:36.0986 6124  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

13:26:37.0042 6124  AsyncMac - ok

13:26:37.0066 6124  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

13:26:37.0077 6124  atapi - ok

13:26:37.0118 6124  [ 940E5B876251E04FFFE058AD71FE0F1C ] AtcL001         C:\Windows\system32\DRIVERS\l160x64.sys

13:26:37.0144 6124  AtcL001 - ok

13:26:37.0194 6124  [ 788914C42AD8318F1DD7A565EAFFB049 ] athrusb         C:\Windows\system32\DRIVERS\athrxusb.sys

13:26:37.0227 6124  athrusb - ok

13:26:37.0288 6124  [ BF8CE7FFCC0C2FFFFC9F59B9A8C4DC5C ] athrusb6        C:\Windows\system32\DRIVERS\G220Vista64.sys

13:26:37.0315 6124  athrusb6 - ok

13:26:37.0356 6124  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

13:26:37.0403 6124  AudioEndpointBuilder - ok

13:26:37.0414 6124  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

13:26:37.0452 6124  AudioSrv - ok

13:26:37.0488 6124  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

13:26:37.0515 6124  AxInstSV - ok

13:26:37.0549 6124  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

13:26:37.0568 6124  b06bdrv - ok

13:26:37.0595 6124  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

13:26:37.0620 6124  b57nd60a - ok

13:26:37.0657 6124  [ 145B2FCF11FDDA5C1D3C3DEC36402A0F ] bcd3000         C:\Windows\system32\DRIVERS\bcd3000_x64.sys

13:26:37.0675 6124  bcd3000 - ok

13:26:37.0698 6124  [ 3CE93283525FA3B9792FAFC1F06CDEC3 ] bcd3000wdm      C:\Windows\system32\DRIVERS\bcd3000wdm_x64.sys

13:26:37.0707 6124  bcd3000wdm - ok

13:26:37.0721 6124  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

13:26:37.0745 6124  BDESVC - ok

13:26:37.0768 6124  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

13:26:37.0809 6124  Beep - ok

13:26:37.0863 6124  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

13:26:37.0915 6124  BFE - ok

13:26:37.0939 6124  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

13:26:37.0988 6124  BITS - ok

13:26:38.0007 6124  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

13:26:38.0028 6124  blbdrive - ok

13:26:38.0096 6124  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

13:26:38.0113 6124  Bonjour Service - ok

13:26:38.0169 6124  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

13:26:38.0182 6124  bowser - ok

13:26:38.0196 6124  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

13:26:38.0212 6124  BrFiltLo - ok

13:26:38.0223 6124  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

13:26:38.0239 6124  BrFiltUp - ok

13:26:38.0260 6124  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

13:26:38.0274 6124  Browser - ok

13:26:38.0293 6124  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

13:26:38.0323 6124  Brserid - ok

13:26:38.0335 6124  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

13:26:38.0356 6124  BrSerWdm - ok

13:26:38.0371 6124  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

13:26:38.0393 6124  BrUsbMdm - ok

13:26:38.0404 6124  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

13:26:38.0418 6124  BrUsbSer - ok

13:26:38.0434 6124  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

13:26:38.0460 6124  BTHMODEM - ok

13:26:38.0480 6124  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

13:26:38.0525 6124  bthserv - ok

13:26:38.0558 6124  [ AA3D1C7F0EE2B5FAFBE8FD88B409F61F ] Bulk            C:\Windows\system32\Drivers\HDJBulk.sys

13:26:38.0575 6124  Bulk ( UnsignedFile.Multi.Generic ) - warning

13:26:38.0575 6124  Bulk - detected UnsignedFile.Multi.Generic (1)

13:26:38.0596 6124  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

13:26:38.0645 6124  cdfs - ok

13:26:38.0683 6124  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

13:26:38.0709 6124  cdrom - ok

13:26:38.0739 6124  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

13:26:38.0778 6124  CertPropSvc - ok

13:26:38.0792 6124  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

13:26:38.0807 6124  circlass - ok

13:26:38.0827 6124  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

13:26:38.0846 6124  CLFS - ok

13:26:38.0890 6124  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:26:38.0900 6124  clr_optimization_v2.0.50727_32 - ok

13:26:38.0926 6124  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

13:26:38.0937 6124  clr_optimization_v2.0.50727_64 - ok

13:26:39.0005 6124  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:26:39.0016 6124  clr_optimization_v4.0.30319_32 - ok

13:26:39.0038 6124  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

13:26:39.0076 6124  clr_optimization_v4.0.30319_64 - ok

13:26:39.0088 6124  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

13:26:39.0113 6124  CmBatt - ok

13:26:39.0134 6124  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

13:26:39.0146 6124  cmdide - ok

13:26:39.0180 6124  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\Windows\system32\Drivers\cng.sys

13:26:39.0205 6124  CNG - ok

13:26:39.0220 6124  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

13:26:39.0231 6124  Compbatt - ok

13:26:39.0254 6124  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

13:26:39.0269 6124  CompositeBus - ok

13:26:39.0279 6124  COMSysApp - ok

13:26:39.0290 6124  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

13:26:39.0302 6124  crcdisk - ok

13:26:39.0338 6124  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll

13:26:39.0360 6124  CryptSvc - ok

13:26:39.0388 6124  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC             C:\Windows\system32\drivers\csc.sys

13:26:39.0426 6124  CSC - ok

13:26:39.0456 6124  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll

13:26:39.0489 6124  CscService - ok

13:26:39.0524 6124  [ 229E3B8F266ABDAFD54E4A372B9D5DDC ] CT20XUT         C:\Windows\system32\drivers\CT20XUT.SYS

13:26:39.0537 6124  CT20XUT - ok

13:26:39.0565 6124  [ 229E3B8F266ABDAFD54E4A372B9D5DDC ] CT20XUT.SYS     C:\Windows\System32\drivers\CT20XUT.SYS

13:26:39.0575 6124  CT20XUT.SYS - ok

13:26:39.0607 6124  [ EB3843A91A10150C9E05607CBCB44090 ] ctac32k         C:\Windows\system32\drivers\ctac32k.sys

13:26:39.0627 6124  ctac32k - ok

13:26:39.0647 6124  [ BC06EFB59A2316537765462DFE40F764 ] ctaud2k         C:\Windows\system32\drivers\ctaud2k.sys

13:26:39.0668 6124  ctaud2k - ok

13:26:39.0700 6124  [ 63B2B6CE9D3EF182981FB64BD5433DA4 ] CTEXFIFX        C:\Windows\system32\drivers\CTEXFIFX.SYS

13:26:39.0734 6124  CTEXFIFX - ok

13:26:39.0766 6124  [ 63B2B6CE9D3EF182981FB64BD5433DA4 ] CTEXFIFX.SYS    C:\Windows\System32\drivers\CTEXFIFX.SYS

13:26:39.0793 6124  CTEXFIFX.SYS - ok

13:26:39.0805 6124  [ 6D115CC80873B85FD80DDA1C41F75A2C ] CTHWIUT         C:\Windows\system32\drivers\CTHWIUT.SYS

13:26:39.0816 6124  CTHWIUT - ok

13:26:39.0820 6124  [ 6D115CC80873B85FD80DDA1C41F75A2C ] CTHWIUT.SYS     C:\Windows\System32\drivers\CTHWIUT.SYS

13:26:39.0829 6124  CTHWIUT.SYS - ok

13:26:39.0842 6124  [ EBC9548EF5838CB5AA8F18B3AC28AF12 ] ctprxy2k        C:\Windows\system32\drivers\ctprxy2k.sys

13:26:39.0851 6124  ctprxy2k - ok

13:26:39.0864 6124  [ 459BEE1682121842285C162E2D98D81A ] ctsfm2k         C:\Windows\system32\drivers\ctsfm2k.sys

13:26:39.0877 6124  ctsfm2k - ok

13:26:39.0918 6124  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

13:26:39.0969 6124  DcomLaunch - ok

13:26:40.0014 6124  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

13:26:40.0067 6124  defragsvc - ok

13:26:40.0111 6124  [ 2B9A817DC1BDAD9CE5495099B6A7136A ] Desura Install Service C:\Program Files (x86)\Common Files\Desura\desura_service.exe

13:26:40.0122 6124  Desura Install Service - ok

13:26:40.0146 6124  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

13:26:40.0186 6124  DfsC - ok

13:26:40.0233 6124  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

13:26:40.0275 6124  Dhcp - ok

13:26:40.0291 6124  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

13:26:40.0331 6124  discache - ok

13:26:40.0359 6124  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys

13:26:40.0370 6124  Disk - ok

13:26:40.0389 6124  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

13:26:40.0403 6124  Dnscache - ok

13:26:40.0426 6124  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

13:26:40.0468 6124  dot3svc - ok

13:26:40.0492 6124  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

13:26:40.0541 6124  DPS - ok

13:26:40.0566 6124  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

13:26:40.0581 6124  drmkaud - ok

13:26:40.0643 6124  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

13:26:40.0674 6124  DXGKrnl - ok

13:26:40.0704 6124  [ EDC6E9C057C9D7F83EEA22B4CEF5DCAD ] E1G60           C:\Windows\system32\DRIVERS\E1G6032E.sys

13:26:40.0719 6124  E1G60 - ok

13:26:40.0738 6124  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

13:26:40.0779 6124  EapHost - ok

13:26:40.0848 6124  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

13:26:40.0932 6124  ebdrv - ok

13:26:40.0954 6124  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

13:26:40.0976 6124  EFS - ok

13:26:41.0011 6124  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

13:26:41.0045 6124  ehRecvr - ok

13:26:41.0065 6124  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

13:26:41.0087 6124  ehSched - ok

13:26:41.0118 6124  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

13:26:41.0139 6124  elxstor - ok

13:26:41.0148 6124  [ C26133B6165928FBD156C6FE570F9ED2 ] emupia          C:\Windows\system32\drivers\emupia2k.sys

13:26:41.0158 6124  emupia - ok

13:26:41.0178 6124  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

13:26:41.0199 6124  ErrDev - ok

13:26:41.0225 6124  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

13:26:41.0262 6124  EventSystem - ok

13:26:41.0277 6124  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

13:26:41.0324 6124  exfat - ok

13:26:41.0343 6124  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

13:26:41.0379 6124  fastfat - ok

13:26:41.0420 6124  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

13:26:41.0455 6124  Fax - ok

13:26:41.0465 6124  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

13:26:41.0499 6124  fdc - ok

13:26:41.0509 6124  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

13:26:41.0553 6124  fdPHost - ok

13:26:41.0566 6124  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

13:26:41.0609 6124  FDResPub - ok

13:26:41.0619 6124  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

13:26:41.0631 6124  FileInfo - ok

13:26:41.0646 6124  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

13:26:41.0680 6124  Filetrace - ok

13:26:41.0685 6124  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

13:26:41.0698 6124  flpydisk - ok

13:26:41.0719 6124  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

13:26:41.0735 6124  FltMgr - ok

13:26:41.0776 6124  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache       C:\Windows\system32\FntCache.dll

13:26:41.0799 6124  FontCache - ok

13:26:41.0839 6124  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

13:26:41.0853 6124  FontCache3.0.0.0 - ok

13:26:41.0870 6124  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

13:26:41.0882 6124  FsDepends - ok

13:26:41.0907 6124  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

13:26:41.0918 6124  Fs_Rec - ok

13:26:41.0953 6124  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

13:26:41.0971 6124  fvevol - ok

13:26:41.0983 6124  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

13:26:41.0996 6124  gagp30kx - ok

13:26:42.0034 6124  [ A05CA8FECCD58256FD0B964DEBD8858F ] gbxavs          C:\Windows\system32\Drivers\gbxavs.sys

13:26:42.0048 6124  gbxavs - ok

13:26:42.0075 6124  [ 9562E036C2BC1ECF5399E07C2A6832AE ] gbxavs_x64      C:\Windows\system32\Drivers\gbxavs_x64.sys

13:26:42.0083 6124  gbxavs_x64 - ok

13:26:42.0104 6124  [ D7A02665FDC5D48E779C166466FA0849 ] gbxusb_svc      C:\Windows\system32\Drivers\gbxusb.sys

13:26:42.0112 6124  gbxusb_svc - ok

13:26:42.0137 6124  [ C5F1BC6397BF3AC3026F9863620E5003 ] gbxusb_x64      C:\Windows\system32\Drivers\gbxusb_x64.sys

13:26:42.0150 6124  gbxusb_x64 - ok

13:26:42.0184 6124  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

13:26:42.0193 6124  GEARAspiWDM - ok

13:26:42.0225 6124  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

13:26:42.0274 6124  gpsvc - ok

13:26:42.0334 6124  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

13:26:42.0344 6124  gupdate - ok

13:26:42.0366 6124  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

13:26:42.0376 6124  gupdatem - ok

13:26:42.0419 6124  [ A3F010D5DBFB589A3B3288C05C2EA3F9 ] ha20x2k         C:\Windows\system32\drivers\ha20x2k.sys

13:26:42.0461 6124  ha20x2k - ok

13:26:42.0490 6124  [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi         C:\Windows\system32\DRIVERS\hamachi.sys

13:26:42.0499 6124  hamachi - ok

13:26:42.0615 6124  [ F10C3F2E002100BF8B797DCF283FEA7D ] Hamachi2Svc     F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

13:26:42.0673 6124  Hamachi2Svc - ok

13:26:42.0707 6124  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

13:26:42.0729 6124  hcw85cir - ok

13:26:42.0777 6124  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

13:26:42.0807 6124  HdAudAddService - ok

13:26:42.0835 6124  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys

13:26:42.0862 6124  HDAudBus - ok

13:26:42.0912 6124  [ A90FF190094C89ADC057B975B0079135 ] HDJAsioK        C:\Windows\system32\Drivers\HDJAsioK.sys

13:26:42.0926 6124  HDJAsioK ( UnsignedFile.Multi.Generic ) - warning

13:26:42.0926 6124  HDJAsioK - detected UnsignedFile.Multi.Generic (1)

13:26:42.0958 6124  [ 76808AABA9BB015E116E8796ABAC0C49 ] HDJMidi         C:\Windows\system32\DRIVERS\HDJMidi.sys

13:26:42.0976 6124  HDJMidi ( UnsignedFile.Multi.Generic ) - warning

13:26:42.0976 6124  HDJMidi - detected UnsignedFile.Multi.Generic (1)

13:26:42.0992 6124  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

13:26:43.0012 6124  HidBatt - ok

13:26:43.0029 6124  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

13:26:43.0058 6124  HidBth - ok

13:26:43.0069 6124  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

13:26:43.0094 6124  HidIr - ok

13:26:43.0112 6124  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

13:26:43.0147 6124  hidserv - ok

13:26:43.0190 6124  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

13:26:43.0209 6124  HidUsb - ok

13:26:43.0231 6124  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

13:26:43.0279 6124  hkmsvc - ok

13:26:43.0306 6124  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

13:26:43.0334 6124  HomeGroupListener - ok

13:26:43.0355 6124  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

13:26:43.0382 6124  HomeGroupProvider - ok

13:26:43.0415 6124  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

13:26:43.0427 6124  HpSAMD - ok

13:26:43.0471 6124  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

13:26:43.0526 6124  HTTP - ok

13:26:43.0548 6124  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

13:26:43.0559 6124  hwpolicy - ok

13:26:43.0599 6124  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys

13:26:43.0613 6124  i8042prt - ok

13:26:43.0640 6124  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

13:26:43.0660 6124  iaStorV - ok

13:26:43.0714 6124  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

13:26:43.0729 6124  IDriverT ( UnsignedFile.Multi.Generic ) - warning

13:26:43.0729 6124  IDriverT - detected UnsignedFile.Multi.Generic (1)

13:26:43.0758 6124  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

13:26:43.0783 6124  idsvc - ok

13:26:43.0800 6124  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

13:26:43.0813 6124  iirsp - ok

13:26:43.0835 6124  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

13:26:43.0887 6124  IKEEXT - ok

13:26:43.0966 6124  [ E8017F1662D9142F45CEAB694D013C00 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

13:26:44.0045 6124  IntcAzAudAddService - ok

13:26:44.0064 6124  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

13:26:44.0076 6124  intelide - ok

13:26:44.0097 6124  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

13:26:44.0116 6124  intelppm - ok

13:26:44.0135 6124  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

13:26:44.0182 6124  IPBusEnum - ok

13:26:44.0197 6124  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

13:26:44.0237 6124  IpFilterDriver - ok

13:26:44.0270 6124  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

13:26:44.0308 6124  iphlpsvc - ok

13:26:44.0326 6124  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

13:26:44.0351 6124  IPMIDRV - ok

13:26:44.0375 6124  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

13:26:44.0423 6124  IPNAT - ok

13:26:44.0488 6124  [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe

13:26:44.0514 6124  iPod Service - ok

13:26:44.0533 6124  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

13:26:44.0559 6124  IRENUM - ok

13:26:44.0583 6124  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

13:26:44.0595 6124  isapnp - ok

13:26:44.0626 6124  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

13:26:44.0642 6124  iScsiPrt - ok

13:26:44.0657 6124  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

13:26:44.0668 6124  kbdclass - ok

13:26:44.0690 6124  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

13:26:44.0712 6124  kbdhid - ok

13:26:44.0721 6124  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

13:26:44.0733 6124  KeyIso - ok

13:26:44.0764 6124  [ 07071C1E3CD8F0F9114AAC8B072CA1E5 ] KMWDFILTER      C:\Windows\system32\DRIVERS\KMWDFILTER.sys

13:26:44.0773 6124  KMWDFILTER - ok

13:26:44.0806 6124  [ B3F33EAD5E5AD0704C4AE8D9CB2D4A2E ] KORGUMDS        C:\Windows\system32\Drivers\KORGUM64.SYS

13:26:44.0816 6124  KORGUMDS - ok

13:26:44.0834 6124  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

13:26:44.0846 6124  KSecDD - ok

13:26:44.0873 6124  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

13:26:44.0887 6124  KSecPkg - ok

13:26:44.0896 6124  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

13:26:44.0936 6124  ksthunk - ok

13:26:44.0966 6124  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

13:26:45.0012 6124  KtmRm - ok

13:26:45.0043 6124  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

13:26:45.0092 6124  LanmanServer - ok

13:26:45.0114 6124  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

13:26:45.0158 6124  LanmanWorkstation - ok

13:26:45.0182 6124  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

13:26:45.0225 6124  lltdio - ok

13:26:45.0245 6124  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

13:26:45.0291 6124  lltdsvc - ok

13:26:45.0301 6124  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

13:26:45.0337 6124  lmhosts - ok

13:26:45.0359 6124  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

13:26:45.0372 6124  LSI_FC - ok

13:26:45.0387 6124  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

13:26:45.0400 6124  LSI_SAS - ok

13:26:45.0415 6124  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

13:26:45.0428 6124  LSI_SAS2 - ok

13:26:45.0439 6124  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

13:26:45.0453 6124  LSI_SCSI - ok

13:26:45.0458 6124  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

13:26:45.0506 6124  luafv - ok

13:26:45.0546 6124  [ 0C85B2B6FB74B36A251792D45E0EF860 ] LVRS64          C:\Windows\system32\DRIVERS\lvrs64.sys

13:26:45.0560 6124  LVRS64 - ok

13:26:45.0656 6124  [ FF3A488924B0032B1A9CA6948C1FA9E8 ] LVUVC64         C:\Windows\system32\DRIVERS\lvuvc64.sys

13:26:45.0735 6124  LVUVC64 - ok

13:26:45.0778 6124  [ D33E2B74CF8B3A652BF0A9FBD068E87A ] ManyCam         C:\Windows\system32\DRIVERS\ManyCam_x64.sys

13:26:45.0800 6124  ManyCam - ok

13:26:45.0850 6124  [ 8238E8824E68AB867205BCD664F76655 ] MAUSBFASTTRACKPRO C:\Windows\system32\DRIVERS\MAudioFastTrackPro.sys

13:26:45.0862 6124  MAUSBFASTTRACKPRO - ok

13:26:45.0888 6124  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

13:26:45.0914 6124  Mcx2Svc - ok

13:26:45.0924 6124  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

13:26:45.0937 6124  megasas - ok

13:26:45.0954 6124  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

13:26:45.0971 6124  MegaSR - ok

13:26:45.0993 6124  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

13:26:46.0043 6124  MMCSS - ok

13:26:46.0061 6124  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

13:26:46.0095 6124  Modem - ok

13:26:46.0116 6124  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

13:26:46.0142 6124  monitor - ok

13:26:46.0156 6124  motmodem - ok

13:26:46.0178 6124  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

13:26:46.0189 6124  mouclass - ok

13:26:46.0205 6124  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

13:26:46.0225 6124  mouhid - ok

13:26:46.0242 6124  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

13:26:46.0254 6124  mountmgr - ok

13:26:46.0318 6124  [ E8D79312373F254DC13F3965BDB3D521 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

13:26:46.0329 6124  MozillaMaintenance - ok

13:26:46.0339 6124  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

13:26:46.0353 6124  mpio - ok

13:26:46.0362 6124  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

13:26:46.0396 6124  mpsdrv - ok

13:26:46.0443 6124  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

13:26:46.0484 6124  MpsSvc - ok

13:26:46.0514 6124  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

13:26:46.0544 6124  MRxDAV - ok

13:26:46.0563 6124  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

13:26:46.0582 6124  mrxsmb - ok

13:26:46.0606 6124  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

13:26:46.0631 6124  mrxsmb10 - ok

13:26:46.0649 6124  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

13:26:46.0676 6124  mrxsmb20 - ok

13:26:46.0694 6124  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

13:26:46.0706 6124  msahci - ok

13:26:46.0731 6124  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

13:26:46.0745 6124  msdsm - ok

13:26:46.0755 6124  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

13:26:46.0779 6124  MSDTC - ok

13:26:46.0801 6124  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

13:26:46.0836 6124  Msfs - ok

13:26:46.0845 6124  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

13:26:46.0879 6124  mshidkmdf - ok

13:26:46.0895 6124  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

13:26:46.0906 6124  msisadrv - ok

13:26:46.0931 6124  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

13:26:46.0981 6124  MSiSCSI - ok

13:26:46.0986 6124  msiserver - ok

13:26:47.0003 6124  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

13:26:47.0037 6124  MSKSSRV - ok

13:26:47.0056 6124  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

13:26:47.0090 6124  MSPCLOCK - ok

13:26:47.0101 6124  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

13:26:47.0143 6124  MSPQM - ok

13:26:47.0172 6124  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

13:26:47.0189 6124  MsRPC - ok

13:26:47.0200 6124  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

13:26:47.0211 6124  mssmbios - ok

13:26:47.0219 6124  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

13:26:47.0264 6124  MSTEE - ok

13:26:47.0274 6124  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

13:26:47.0298 6124  MTConfig - ok

13:26:47.0343 6124  [ 03B7145C889603537E9FFEABB1AD1089 ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys

13:26:47.0365 6124  MTsensor - ok

13:26:47.0383 6124  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

13:26:47.0400 6124  Mup - ok

13:26:47.0452 6124  [ A830E59F98827943686E90BF79FC96FA ] NanoServiceMain C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe

13:26:47.0466 6124  NanoServiceMain - ok

13:26:47.0499 6124  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

13:26:47.0561 6124  napagent - ok

13:26:47.0587 6124  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

13:26:47.0614 6124  NativeWifiP - ok

13:26:47.0662 6124  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

13:26:47.0691 6124  NDIS - ok

13:26:47.0713 6124  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

13:26:47.0754 6124  NdisCap - ok

13:26:47.0770 6124  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

13:26:47.0815 6124  NdisTapi - ok

13:26:47.0834 6124  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

13:26:47.0876 6124  Ndisuio - ok

13:26:47.0901 6124  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

13:26:47.0946 6124  NdisWan - ok

13:26:47.0957 6124  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

13:26:48.0002 6124  NDProxy - ok

13:26:48.0016 6124  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

13:26:48.0063 6124  NetBIOS - ok

13:26:48.0090 6124  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

13:26:48.0146 6124  NetBT - ok

13:26:48.0163 6124  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

13:26:48.0175 6124  Netlogon - ok

13:26:48.0214 6124  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

13:26:48.0263 6124  Netman - ok

13:26:48.0305 6124  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:26:48.0347 6124  NetMsmqActivator - ok

13:26:48.0351 6124  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:26:48.0361 6124  NetPipeActivator - ok

13:26:48.0375 6124  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

13:26:48.0416 6124  netprofm - ok

13:26:48.0421 6124  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:26:48.0431 6124  NetTcpActivator - ok

13:26:48.0435 6124  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:26:48.0444 6124  NetTcpPortSharing - ok

13:26:48.0461 6124  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

13:26:48.0473 6124  nfrd960 - ok

13:26:48.0638 6124  [ 93F304DEB07095BCF33BD1C17C2DB2A7 ] NIHardwareService C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

13:26:48.0796 6124  NIHardwareService - ok

13:26:48.0824 6124  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll

13:26:48.0871 6124  NlaSvc - ok

13:26:48.0889 6124  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

13:26:48.0932 6124  Npfs - ok

13:26:48.0949 6124  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

13:26:48.0984 6124  nsi - ok

13:26:48.0996 6124  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

13:26:49.0030 6124  nsiproxy - ok

13:26:49.0071 6124  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

13:26:49.0117 6124  Ntfs - ok

13:26:49.0154 6124  nTuneService - ok

13:26:49.0163 6124  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

13:26:49.0197 6124  Null - ok

13:26:49.0456 6124  [ BA0B4889C40380A01ECDF84C227A89C9 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys

13:26:49.0665 6124  nvlddmkm - ok

13:26:49.0686 6124  [ 19E532E5348EC5B3CFCFE2A9F3B3643D ] NvnUsbAudio     C:\Windows\system32\DRIVERS\nvnusbaudio.sys

13:26:49.0704 6124  NvnUsbAudio - ok

13:26:49.0731 6124  [ 241A095631570A9CEF4F126C87605C60 ] NVR0Dev         C:\Windows\nvoclk64.sys

13:26:49.0740 6124  NVR0Dev - ok

13:26:49.0771 6124  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

13:26:49.0785 6124  nvraid - ok

13:26:49.0812 6124  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

13:26:49.0826 6124  nvstor - ok

13:26:49.0877 6124  [ 06633CF95BEA62164C3BFCA24BCE6B11 ] nvsvc           C:\Windows\system32\nvvsvc.exe

13:26:49.0899 6124  nvsvc - ok

13:26:49.0932 6124  [ 53B629CE436B110C5689C2F6439E567B ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

13:26:49.0965 6124  nvUpdatusService - ok

13:26:49.0993 6124  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

13:26:50.0007 6124  nv_agp - ok

13:26:50.0032 6124  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

13:26:50.0046 6124  ohci1394 - ok

13:26:50.0060 6124  [ 0E2DE427EBE106E7E5B52869D5C99F68 ] ossrv           C:\Windows\system32\drivers\ctoss2k.sys

13:26:50.0072 6124  ossrv - ok

13:26:50.0091 6124  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

13:26:50.0114 6124  p2pimsvc - ok

13:26:50.0132 6124  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

13:26:50.0157 6124  p2psvc - ok

13:26:50.0189 6124  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

13:26:50.0203 6124  Parport - ok

13:26:50.0231 6124  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

13:26:50.0243 6124  partmgr - ok

13:26:50.0252 6124  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

13:26:50.0278 6124  PcaSvc - ok

13:26:50.0298 6124  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

13:26:50.0312 6124  pci - ok

13:26:50.0319 6124  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

13:26:50.0330 6124  pciide - ok

13:26:50.0344 6124  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

13:26:50.0360 6124  pcmcia - ok

13:26:50.0369 6124  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

13:26:50.0381 6124  pcw - ok

13:26:50.0398 6124  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

13:26:50.0451 6124  PEAUTH - ok

13:26:50.0480 6124  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll

13:26:50.0519 6124  PeerDistSvc - ok

13:26:50.0575 6124  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

13:26:50.0603 6124  PerfHost - ok

13:26:50.0650 6124  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

13:26:50.0717 6124  pla - ok

13:26:50.0755 6124  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

13:26:50.0783 6124  PlugPlay - ok

13:26:50.0799 6124  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

13:26:50.0819 6124  PNRPAutoReg - ok

13:26:50.0833 6124  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

13:26:50.0849 6124  PNRPsvc - ok

13:26:50.0869 6124  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

13:26:50.0910 6124  PolicyAgent - ok

13:26:50.0956 6124  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

13:26:51.0014 6124  Power - ok

13:26:51.0049 6124  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

13:26:51.0088 6124  PptpMiniport - ok

13:26:51.0102 6124  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys

13:26:51.0124 6124  Processor - ok

13:26:51.0149 6124  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

13:26:51.0176 6124  ProfSvc - ok

13:26:51.0188 6124  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

13:26:51.0200 6124  ProtectedStorage - ok

13:26:51.0228 6124  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

13:26:51.0270 6124  Psched - ok

13:26:51.0309 6124  [ BF6B640239BE2C28A6BB43ADC658FB7F ] PSINAflt        C:\Windows\system32\DRIVERS\PSINAflt.sys

13:26:51.0319 6124  PSINAflt - ok

13:26:51.0362 6124  [ 2377F49C39725ED0021D75136FB0F746 ] PSINFile        C:\Windows\system32\DRIVERS\PSINFile.sys

13:26:51.0371 6124  PSINFile - ok

13:26:51.0385 6124  [ A90F546B4F49122115768BC94BC81C04 ] PSINKNC         C:\Windows\system32\DRIVERS\psinknc.sys

13:26:51.0395 6124  PSINKNC - ok

13:26:51.0414 6124  [ F8D7465CDD2A4ECAE761BA8A0577D151 ] PSINProc        C:\Windows\system32\DRIVERS\PSINProc.sys

13:26:51.0423 6124  PSINProc - ok

13:26:51.0439 6124  [ 076254556B4B03ADE385619FF33E2F6B ] PSINProt        C:\Windows\system32\DRIVERS\PSINProt.sys

13:26:51.0448 6124  PSINProt - ok

13:26:51.0489 6124  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

13:26:51.0533 6124  ql2300 - ok

13:26:51.0546 6124  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

13:26:51.0560 6124  ql40xx - ok

13:26:51.0582 6124  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

13:26:51.0602 6124  QWAVE - ok

13:26:51.0609 6124  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

13:26:51.0632 6124  QWAVEdrv - ok

13:26:51.0758 6124  [ 138F7963118EC710C348819C08F72230 ] Radio.fx        E:\Tobit Radio.fx\Server\rfx-server.exe

13:26:51.0866 6124  Radio.fx - ok

13:26:51.0882 6124  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

13:26:51.0924 6124  RasAcd - ok

13:26:51.0950 6124  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

13:26:51.0989 6124  RasAgileVpn - ok

13:26:52.0008 6124  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

13:26:52.0053 6124  RasAuto - ok

13:26:52.0081 6124  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

13:26:52.0125 6124  Rasl2tp - ok

13:26:52.0157 6124  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

13:26:52.0196 6124  RasMan - ok

13:26:52.0214 6124  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

13:26:52.0261 6124  RasPppoe - ok

13:26:52.0282 6124  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

13:26:52.0325 6124  RasSstp - ok

13:26:52.0347 6124  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

13:26:52.0391 6124  rdbss - ok

13:26:52.0402 6124  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

13:26:52.0429 6124  rdpbus - ok

13:26:52.0443 6124  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

13:26:52.0483 6124  RDPCDD - ok

13:26:52.0507 6124  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

13:26:52.0533 6124  RDPDR - ok

13:26:52.0549 6124  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

13:26:52.0583 6124  RDPENCDD - ok

13:26:52.0591 6124  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

13:26:52.0631 6124  RDPREFMP - ok

13:26:52.0687 6124  [ 70CBA1A0C98600A2AA1863479B35CB90 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

13:26:52.0719 6124  RdpVideoMiniport - ok

13:26:52.0747 6124  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

13:26:52.0771 6124  RDPWD - ok

13:26:52.0798 6124  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

13:26:52.0813 6124  rdyboost - ok

13:26:52.0839 6124  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

13:26:52.0882 6124  RemoteAccess - ok

13:26:52.0910 6124  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

13:26:52.0953 6124  RemoteRegistry - ok

13:26:52.0966 6124  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

13:26:53.0013 6124  RpcEptMapper - ok

13:26:53.0033 6124  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

13:26:53.0054 6124  RpcLocator - ok

13:26:53.0084 6124  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

13:26:53.0122 6124  RpcSs - ok

13:26:53.0130 6124  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

13:26:53.0171 6124  rspndr - ok

13:26:53.0211 6124  [ 16D4E350420BAA7E63E16E3FC033E1F5 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys

13:26:53.0227 6124  RTL8167 - ok

13:26:53.0248 6124  [ E60C0A09F997826C7627B244195AB581 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys

13:26:53.0275 6124  s3cap - ok

13:26:53.0287 6124  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

13:26:53.0302 6124  SamSs - ok

13:26:53.0358 6124  [ 5EFBBFCC6ADAC121C8E2FE76641ED329 ] SANDRA          C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys

13:26:53.0371 6124  SANDRA - ok

13:26:53.0387 6124  [ D307353C423C75D4A7EF5B25B43684DA ] SandraAgentSrv  C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe

13:26:53.0408 6124  SandraAgentSrv ( UnsignedFile.Multi.Generic ) - warning

13:26:53.0408 6124  SandraAgentSrv - detected UnsignedFile.Multi.Generic (1)

13:26:53.0459 6124  [ 3289766038DB2CB14D07DC84392138D5 ] SASDIFSV        C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

13:26:53.0471 6124  SASDIFSV - ok

13:26:53.0498 6124  [ 58A38E75F3316A83C23DF6173D41F2B5 ] SASKUTIL        C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

13:26:53.0508 6124  SASKUTIL - ok

13:26:53.0530 6124  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

13:26:53.0549 6124  sbp2port - ok

13:26:53.0579 6124  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

13:26:53.0638 6124  SCardSvr - ok

13:26:53.0660 6124  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

13:26:53.0694 6124  scfilter - ok

13:26:53.0732 6124  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

13:26:53.0789 6124  Schedule - ok

13:26:53.0814 6124  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

13:26:53.0847 6124  SCPolicySvc - ok

13:26:53.0870 6124  [ 8B56BDCE6A303DDE63D63440D1CF9AD1 ] ScreamBAudioSvc C:\Windows\system32\drivers\ScreamingBAudio64.sys

13:26:53.0879 6124  ScreamBAudioSvc - ok

13:26:53.0902 6124  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

13:26:53.0922 6124  SDRSVC - ok

13:26:53.0949 6124  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

13:26:53.0991 6124  secdrv - ok

13:26:54.0016 6124  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

13:26:54.0051 6124  seclogon - ok

13:26:54.0065 6124  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

13:26:54.0103 6124  SENS - ok

13:26:54.0112 6124  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

13:26:54.0134 6124  SensrSvc - ok

13:26:54.0150 6124  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

13:26:54.0176 6124  Serenum - ok

13:26:54.0189 6124  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

13:26:54.0208 6124  Serial - ok

13:26:54.0229 6124  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

13:26:54.0242 6124  sermouse - ok

13:26:54.0270 6124  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

13:26:54.0305 6124  SessionEnv - ok

13:26:54.0327 6124  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

13:26:54.0349 6124  sffdisk - ok

13:26:54.0358 6124  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

13:26:54.0371 6124  sffp_mmc - ok

13:26:54.0387 6124  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

13:26:54.0408 6124  sffp_sd - ok

13:26:54.0431 6124  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

13:26:54.0444 6124  sfloppy - ok

13:26:54.0475 6124  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

13:26:54.0514 6124  SharedAccess - ok

13:26:54.0539 6124  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

13:26:54.0586 6124  ShellHWDetection - ok

13:26:54.0600 6124  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

13:26:54.0612 6124  SiSRaid2 - ok

13:26:54.0620 6124  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

13:26:54.0633 6124  SiSRaid4 - ok

13:26:54.0691 6124  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

13:26:54.0702 6124  SkypeUpdate - ok

13:26:54.0723 6124  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

13:26:54.0763 6124  Smb - ok

13:26:54.0795 6124  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

13:26:54.0810 6124  SNMPTRAP - ok

13:26:54.0820 6124  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

13:26:54.0830 6124  spldr - ok

13:26:54.0861 6124  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

13:26:54.0882 6124  Spooler - ok

13:26:54.0955 6124  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

13:26:55.0034 6124  sppsvc - ok

13:26:55.0048 6124  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

13:26:55.0085 6124  sppuinotify - ok

13:26:55.0122 6124  [ 602884696850C86434530790B110E8EB ] sptd            C:\Windows\System32\Drivers\sptd.sys

13:26:55.0146 6124  sptd - ok

13:26:55.0169 6124  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

13:26:55.0200 6124  srv - ok

13:26:55.0227 6124  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

13:26:55.0253 6124  srv2 - ok

13:26:55.0267 6124  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

13:26:55.0290 6124  srvnet - ok

13:26:55.0311 6124  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

13:26:55.0359 6124  SSDPSRV - ok

13:26:55.0373 6124  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

13:26:55.0409 6124  SstpSvc - ok

13:26:55.0445 6124  Steam Client Service - ok

13:26:55.0465 6124  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

13:26:55.0477 6124  stexstor - ok

13:26:55.0517 6124  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

13:26:55.0557 6124  stisvc - ok

13:26:55.0581 6124  [ 7785DC213270D2FC066538DAF94087E7 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys

13:26:55.0592 6124  storflt - ok

13:26:55.0603 6124  [ C40841817EF57D491F22EB103DA587CC ] StorSvc         C:\Windows\system32\storsvc.dll

13:26:55.0627 6124  StorSvc - ok

13:26:55.0636 6124  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc         C:\Windows\system32\drivers\storvsc.sys

13:26:55.0648 6124  storvsc - ok

13:26:55.0673 6124  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

13:26:55.0683 6124  swenum - ok

13:26:55.0707 6124  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

13:26:55.0757 6124  swprv - ok

13:26:55.0786 6124  [ 512231BA47975F3F1A67B11F271BB49D ] SynasUSB        C:\Windows\system32\drivers\SynUSB64.sys

13:26:55.0796 6124  SynasUSB - ok

13:26:55.0800 6124  Synth3dVsc - ok

13:26:55.0842 6124  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

13:26:55.0888 6124  SysMain - ok

13:26:55.0917 6124  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

13:26:55.0943 6124  TabletInputService - ok

13:26:55.0977 6124  [ 024ADC7F69D1776D72CC5D031B41CE4F ] tap0901         C:\Windows\system32\DRIVERS\tap0901.sys

13:26:55.0992 6124  tap0901 - ok

13:26:56.0034 6124  [ F33FDC72298DF4BF9813A55D21F4EB31 ] taphss          C:\Windows\system32\DRIVERS\taphss.sys

13:26:56.0044 6124  taphss - ok

13:26:56.0072 6124  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

13:26:56.0123 6124  TapiSrv - ok

13:26:56.0167 6124  [ 927D0CDB3F96EFC1E98FB1A2C9FB67AD ] tapoas          C:\Windows\system32\DRIVERS\tapoas.sys

13:26:56.0189 6124  tapoas - ok

13:26:56.0203 6124  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

13:26:56.0238 6124  TBS - ok

13:26:56.0289 6124  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

13:26:56.0349 6124  Tcpip - ok

13:26:56.0378 6124  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

13:26:56.0415 6124  TCPIP6 - ok

13:26:56.0443 6124  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

13:26:56.0484 6124  tcpipreg - ok

13:26:56.0502 6124  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

13:26:56.0527 6124  TDPIPE - ok

13:26:56.0543 6124  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

13:26:56.0562 6124  TDTCP - ok

13:26:56.0581 6124  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

13:26:56.0623 6124  tdx - ok

13:26:56.0711 6124  [ DE09282B3ABEF632917EBEDC4DCDFB56 ] TeamViewer7     C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

13:26:56.0762 6124  TeamViewer7 - ok

13:26:56.0787 6124  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

13:26:56.0798 6124  TermDD - ok

13:26:56.0828 6124  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

13:26:56.0878 6124  TermService - ok

13:26:56.0895 6124  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

13:26:56.0917 6124  Themes - ok

13:26:56.0934 6124  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

13:26:56.0969 6124  THREADORDER - ok

13:26:57.0028 6124  [ C676B0F52F2B6483AFB88F79CABB011E ] Tpkd            C:\Windows\system32\drivers\Tpkd.sys

13:26:57.0038 6124  Tpkd - ok

13:26:57.0050 6124  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

13:26:57.0099 6124  TrkWks - ok

13:26:57.0145 6124  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

13:26:57.0184 6124  TrustedInstaller - ok

13:26:57.0213 6124  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

13:26:57.0255 6124  tssecsrv - ok

13:26:57.0274 6124  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

13:26:57.0296 6124  TsUsbFlt - ok

13:26:57.0299 6124  tsusbhub - ok

13:26:57.0333 6124  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

13:26:57.0375 6124  tunnel - ok

13:26:57.0399 6124  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

13:26:57.0412 6124  uagp35 - ok

13:26:57.0440 6124  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

13:26:57.0478 6124  udfs - ok

13:26:57.0494 6124  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

13:26:57.0509 6124  UI0Detect - ok

13:26:57.0518 6124  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

13:26:57.0530 6124  uliagpkx - ok

13:26:57.0567 6124  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\drivers\umbus.sys

13:26:57.0587 6124  umbus - ok

13:26:57.0602 6124  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

13:26:57.0625 6124  UmPass - ok

13:26:57.0650 6124  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll

13:26:57.0675 6124  UmRdpService - ok

13:26:57.0740 6124  [ 67A95B9D129ED5399E7965CD09CF30E7 ] UMVPFSrv        C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

13:26:57.0763 6124  UMVPFSrv - ok

13:26:57.0789 6124  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

13:26:57.0830 6124  upnphost - ok

13:26:57.0855 6124  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys

13:26:57.0866 6124  USBAAPL64 - ok

13:26:57.0895 6124  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

13:26:57.0922 6124  usbaudio - ok

13:26:57.0949 6124  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

13:26:57.0971 6124  usbccgp - ok

13:26:58.0005 6124  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

13:26:58.0031 6124  usbcir - ok

13:26:58.0051 6124  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

13:26:58.0074 6124  usbehci - ok

13:26:58.0090 6124  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

13:26:58.0116 6124  usbhub - ok

13:26:58.0130 6124  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

13:26:58.0143 6124  usbohci - ok

13:26:58.0173 6124  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

13:26:58.0188 6124  usbprint - ok

13:26:58.0211 6124  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

13:26:58.0230 6124  USBSTOR - ok

13:26:58.0242 6124  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

13:26:58.0264 6124  usbuhci - ok

13:26:58.0295 6124  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys

13:26:58.0320 6124  usbvideo - ok

13:26:58.0343 6124  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

13:26:58.0388 6124  UxSms - ok

13:26:58.0404 6124  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

13:26:58.0417 6124  VaultSvc - ok

13:26:58.0435 6124  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

13:26:58.0446 6124  vdrvroot - ok

13:26:58.0474 6124  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

13:26:58.0526 6124  vds - ok

13:26:58.0552 6124  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

13:26:58.0568 6124  vga - ok

13:26:58.0577 6124  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

13:26:58.0620 6124  VgaSave - ok

13:26:58.0623 6124  VGPU - ok

13:26:58.0667 6124  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

13:26:58.0689 6124  vhdmp - ok

13:26:58.0712 6124  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

13:26:58.0725 6124  viaide - ok

13:26:58.0749 6124  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus           C:\Windows\system32\drivers\vmbus.sys

13:26:58.0764 6124  vmbus - ok

13:26:58.0776 6124  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys

13:26:58.0796 6124  VMBusHID - ok

13:26:58.0813 6124  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

13:26:58.0825 6124  volmgr - ok

13:26:58.0854 6124  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

13:26:58.0871 6124  volmgrx - ok

13:26:58.0886 6124  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

13:26:58.0903 6124  volsnap - ok

13:26:58.0920 6124  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

13:26:58.0935 6124  vsmraid - ok

13:26:58.0984 6124  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

13:26:59.0052 6124  VSS - ok

13:26:59.0073 6124  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys

13:26:59.0089 6124  vwifibus - ok

13:26:59.0115 6124  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

13:26:59.0168 6124  W32Time - ok

13:26:59.0180 6124  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

13:26:59.0194 6124  WacomPen - ok

13:26:59.0215 6124  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

13:26:59.0249 6124  WANARP - ok

13:26:59.0260 6124  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

13:26:59.0293 6124  Wanarpv6 - ok

13:26:59.0349 6124  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe

13:26:59.0386 6124  WatAdminSvc - ok

13:26:59.0431 6124  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

13:26:59.0478 6124  wbengine - ok

13:26:59.0491 6124  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

13:26:59.0520 6124  WbioSrvc - ok

13:26:59.0549 6124  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

13:26:59.0584 6124  wcncsvc - ok

13:26:59.0600 6124  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

13:26:59.0621 6124  WcsPlugInService - ok

13:26:59.0637 6124  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys

13:26:59.0649 6124  Wd - ok

13:26:59.0674 6124  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

13:26:59.0699 6124  Wdf01000 - ok

13:26:59.0711 6124  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

13:26:59.0737 6124  WdiServiceHost - ok

13:26:59.0741 6124  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

13:26:59.0761 6124  WdiSystemHost - ok

13:26:59.0780 6124  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

13:26:59.0804 6124  WebClient - ok

13:26:59.0818 6124  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

13:26:59.0869 6124  Wecsvc - ok

13:26:59.0885 6124  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

13:26:59.0934 6124  wercplsupport - ok

13:26:59.0951 6124  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

13:26:59.0990 6124  WerSvc - ok

13:27:00.0011 6124  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

13:27:00.0055 6124  WfpLwf - ok

13:27:00.0066 6124  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

13:27:00.0079 6124  WIMMount - ok

13:27:00.0098 6124  WinDefend - ok

13:27:00.0111 6124  WinHttpAutoProxySvc - ok

13:27:00.0154 6124  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

13:27:00.0197 6124  Winmgmt - ok

13:27:00.0244 6124  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

13:27:00.0328 6124  WinRM - ok

13:27:00.0361 6124  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

13:27:00.0390 6124  WinUsb - ok

13:27:00.0422 6124  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

13:27:00.0462 6124  Wlansvc - ok

13:27:00.0567 6124  [ 98F138897EF4246381D197CB81846D62 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

13:27:00.0638 6124  wlidsvc - ok

13:27:00.0660 6124  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

13:27:00.0672 6124  WmiAcpi - ok

13:27:00.0691 6124  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

13:27:00.0721 6124  wmiApSrv - ok

13:27:00.0742 6124  WMPNetworkSvc - ok

13:27:00.0764 6124  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

13:27:00.0779 6124  WPCSvc - ok

13:27:00.0800 6124  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

13:27:00.0816 6124  WPDBusEnum - ok

13:27:00.0837 6124  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

13:27:00.0871 6124  ws2ifsl - ok

13:27:00.0879 6124  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

13:27:00.0910 6124  wscsvc - ok

13:27:00.0914 6124  WSearch - ok

13:27:00.0977 6124  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

13:27:01.0023 6124  wuauserv - ok

13:27:01.0039 6124  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

13:27:01.0074 6124  WudfPf - ok

13:27:01.0110 6124  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

13:27:01.0187 6124  WUDFRd - ok

13:27:01.0227 6124  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

13:27:01.0261 6124  wudfsvc - ok

13:27:01.0277 6124  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll

13:27:01.0307 6124  WwanSvc - ok

13:27:01.0346 6124  X6va006 - ok

13:27:01.0383 6124  [ 7DD7A0AF2D8BAF809B47D67900945A54 ] XONE_2D         C:\Windows\system32\Drivers\XONE_2D.sys

13:27:01.0398 6124  XONE_2D - ok

13:27:01.0413 6124  [ F71826073DEB4DB39647E87E277B70C7 ] XONE_2DM        C:\Windows\system32\drivers\XONE_2dm.sys

13:27:01.0421 6124  XONE_2DM - ok

13:27:01.0436 6124  [ 93A90E2608A7D5A355895276BC3A0A75 ] XONE_2D_WDM     C:\Windows\system32\drivers\XONE_2DW.sys

13:27:01.0444 6124  XONE_2D_WDM - ok

13:27:01.0479 6124  [ 2EE48CFCE7CA8E0DB4C44C7476C0943B ] xusb21          C:\Windows\system32\DRIVERS\xusb21.sys

13:27:01.0496 6124  xusb21 - ok

13:27:01.0530 6124  ================ Scan global ===============================

13:27:01.0542 6124  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

13:27:01.0568 6124  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

13:27:01.0577 6124  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

13:27:01.0596 6124  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

13:27:01.0620 6124  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

13:27:01.0624 6124  [Global] - ok

13:27:01.0625 6124  ================ Scan MBR ==================================

13:27:01.0635 6124  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0

13:27:01.0888 6124  \Device\Harddisk0\DR0 - ok

13:27:01.0892 6124  [ 84EC7EA34AF44C83E152105B37E7E6A7 ] \Device\Harddisk1\DR1

13:27:02.0306 6124  \Device\Harddisk1\DR1 - ok

13:27:02.0307 6124  ================ Scan VBR ==================================

13:27:02.0310 6124  [ 9E348423B2DF916FFCCE28267955C864 ] \Device\Harddisk0\DR0\Partition1

13:27:02.0312 6124  \Device\Harddisk0\DR0\Partition1 - ok

13:27:02.0322 6124  [ 1CC340021B83B45ACE95EC66D8E202CC ] \Device\Harddisk0\DR0\Partition2

13:27:02.0324 6124  \Device\Harddisk0\DR0\Partition2 - ok

13:27:02.0333 6124  [ 488963E587232C85132CFF0889734E1E ] \Device\Harddisk0\DR0\Partition3

13:27:02.0335 6124  \Device\Harddisk0\DR0\Partition3 - ok

13:27:02.0336 6124  ============================================================

13:27:02.0336 6124  Scan finished

13:27:02.0336 6124  ============================================================

13:27:02.0348 5164  Detected object count: 5

13:27:02.0348 5164  Actual detected object count: 5

13:29:27.0210 5164  Bulk ( UnsignedFile.Multi.Generic ) - skipped by user

13:29:27.0210 5164  Bulk ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:29:27.0212 5164  HDJAsioK ( UnsignedFile.Multi.Generic ) - skipped by user

13:29:27.0212 5164  HDJAsioK ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:29:27.0214 5164  HDJMidi ( UnsignedFile.Multi.Generic ) - skipped by user

13:29:27.0214 5164  HDJMidi ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:29:27.0216 5164  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

13:29:27.0216 5164  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:29:27.0218 5164  SandraAgentSrv ( UnsignedFile.Multi.Generic ) - skipped by user

13:29:27.0218 5164  SandraAgentSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-10-02.02 - c 03.10.2012  14:46:30.1.4 - x64

Microsoft Windows 7 Enterprise   6.1.7601.1.1252.49.1033.18.4095.2513 [GMT 2:00]

ausgeführt von:: c:\users\c\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\xp-AntiSpy

c:\program files (x86)\xp-AntiSpy\Uninstall.exe

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.chm

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.exe

c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.url

c:\programdata\xml19.tmp

c:\programdata\xml96.tmp

c:\programdata\xmlF889.tmp

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

F:\install.exe

K:\install.exe

.

c:\windows\SysWow64\drivers\ntfs.sys . . . ist infiziert!!

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-09-03 bis 2012-10-03  ))))))))))))))))))))))))))))))

.

.

2012-10-02 19:27 . 2012-08-30 07:27        9308616        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DA51F9FC-7F90-46FB-8663-CDC15B140C7B}\mpengine.dll

2012-10-02 19:27 . 2012-08-21 21:01        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe

2012-09-25 00:16 . 2012-09-25 00:17        --------        dc-h--w-        c:\programdata\{D9BC4C8F-B86F-45C8-A961-B9FF0910DE40}

2012-09-25 00:15 . 2012-09-25 00:15        --------        dc-h--w-        c:\programdata\{30FA7941-4170-4C83-A9A8-FDF01C431704}

2012-09-25 00:14 . 2012-09-25 00:14        --------        dc-h--w-        c:\programdata\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

2012-09-24 17:46 . 2012-09-24 17:46        --------        d-----w-        c:\users\c\AppData\Local\Sidhe

2012-09-23 03:38 . 2012-09-23 03:38        --------        d-----w-        c:\program files (x86)\ESET

2012-09-19 14:54 . 2012-09-19 14:54        --------        dc-h--w-        c:\programdata\{7F3144B7-67AA-4DD7-BC11-CBA9A40B430D}

2012-09-19 14:43 . 2012-09-19 14:55        --------        d-----w-        c:\users\c\AppData\Roaming\ImgBurn

2012-09-19 14:26 . 2012-09-19 14:26        --------        d-----w-        c:\program files (x86)\ImgBurn

2012-09-19 14:12 . 2012-09-19 14:12        --------        dc----w-        c:\programdata\{20EFD19B-675C-417B-A498-B0161D72FF88}

2012-09-19 14:10 . 2012-09-19 14:10        --------        dc----w-        c:\programdata\{B5F0C192-874D-49A8-88D7-8431E3714756}

2012-09-19 12:39 . 2012-08-22 18:12        950128        ----a-w-        c:\windows\system32\drivers\ndis.sys

2012-09-19 12:39 . 2012-07-04 20:26        41472        ----a-w-        c:\windows\system32\drivers\RNDISMP.sys

2012-09-19 12:39 . 2012-08-02 17:58        574464        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-09-19 12:39 . 2012-08-02 16:57        490496        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2012-09-19 00:43 . 2012-09-19 00:43        --------        d-----w-        c:\users\c\AppData\Roaming\MinMaxGames

2012-09-17 23:40 . 2012-09-17 23:40        --------        dc-h--w-        c:\programdata\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}

2012-09-16 12:04 . 2012-09-16 12:05        --------        d-----w-        c:\users\c\AppData\Local\bau_jump_n_run

2012-09-16 09:46 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-09-16 09:46 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys

2012-09-16 09:46 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2012-09-12 23:39 . 2012-09-12 23:39        --------        d-----w-        c:\users\c\AppData\Local\IsolatedStorage

2012-09-12 23:38 . 2012-09-12 23:39        --------        d-----w-        c:\users\c\AppData\Local\Deployment

2012-09-09 11:18 . 2012-02-11 06:43        751104        ----a-w-        c:\windows\system32\win32spl.dll

2012-09-09 11:18 . 2012-02-11 06:36        559104        ----a-w-        c:\windows\system32\spoolsv.exe

2012-09-09 11:18 . 2012-02-11 06:36        67072        ----a-w-        c:\windows\splwow64.exe

2012-09-09 11:18 . 2012-02-11 05:43        492032        ----a-w-        c:\windows\SysWow64\win32spl.dll

2012-09-09 11:18 . 2012-05-05 08:36        503808        ----a-w-        c:\windows\system32\srcore.dll

2012-09-09 11:18 . 2012-05-05 07:46        43008        ----a-w-        c:\windows\SysWow64\srclient.dll

2012-09-08 14:45 . 2012-09-08 14:45        --------        d-----w-        c:\program files\Defraggler

2012-09-08 14:36 . 2012-09-08 14:36        --------        d-----w-        c:\users\c\AppData\Roaming\Auslogics

2012-09-08 11:20 . 2012-09-08 11:20        --------        d-----w-        c:\program files (x86)\MIDIOX

2012-09-08 04:07 . 2012-09-08 04:07        --------        d-----w-        c:\program files (x86)\AutoHotkey

2012-09-03 22:06 . 2012-09-03 22:06        --------        d-----w-        c:\users\c\AppData\Roaming\Squids

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-16 09:47 . 2010-05-12 01:59        64462936        ----a-w-        c:\windows\system32\MRT.exe

2012-09-07 15:04 . 2010-11-04 22:35        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-09-02 13:21 . 2012-09-02 13:21        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-09-02 13:21 . 2012-03-12 00:47        821736        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-09-02 13:21 . 2010-10-13 03:53        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-08-30 22:12 . 2012-08-30 22:12        73416        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-30 22:12 . 2012-08-30 22:12        696520        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-18 18:15 . 2012-08-14 18:11        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-08 23:52 . 2012-07-08 23:53        372736        ----a-w-        c:\windows\system32\NVUNINST.EXE

2010-02-14 13:35 . 2011-05-15 13:56        4411392        ----a-w-        c:\program files (x86)\mplayerc.exe

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[-] 2012-05-29 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll

.

[-] 2012-05-29 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll

[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]

2011-06-24 17:37        86696        ----a-w-        c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2011-06-24 86696]

.

[HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]

"Rainlendar2"="f:\program files (x86)\Rainlendar2\Rainlendar2.exe" [2010-07-11 2199040]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]

"F.lux"="c:\users\c\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]

"Spotify Web Helper"="c:\users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-08-20 1193176]

"NVIDIA nTune"="c:\program files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 98304]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2011-04-28 439616]

"Panda Security URL Filtering"="c:\programdata\Panda Security URL Filtering\Panda_URL_Filtering.exe" [2012-03-19 217256]

"KORG USB-MIDI Driver"="c:\program files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe" [2011-03-30 393616]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDockFree\ObjectDock.exe [2010-10-6 3768176]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"midi5"=KORGUM64.DRV

"midi"=KORGUM64.DRV

"midi3"=KORGUM64.DRV

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 136176]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [2010-12-07 19456]

R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [2010-12-07 27648]

R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [2010-12-07 27136]

R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [2010-12-07 34304]

R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrxusb.sys [2008-07-29 1075712]

R3 athrusb6;ZyXEL Wireless LAN USB device driver 6 Series;c:\windows\system32\DRIVERS\G220Vista64.sys [2007-05-16 1039360]

R3 bcd3000;bcd3000;c:\windows\system32\DRIVERS\bcd3000_x64.sys [2010-08-05 54888]

R3 bcd3000wdm;bcd3000wdm;c:\windows\system32\DRIVERS\bcd3000wdm_x64.sys [2010-08-05 32872]

R3 Bulk;HDJBulk;c:\windows\system32\Drivers\HDJBulk.sys [2010-09-30 185344]

R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2010-05-05 202840]

R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2010-05-05 202840]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]

R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]

R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2010-05-05 94808]

R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2010-05-05 94808]

R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-09-03 131912]

R3 gbxavs_x64;gbxavs_x64;c:\windows\system32\Drivers\gbxavs_x64.sys [2009-10-08 45136]

R3 gbxusb_x64;gbxusb_x64;c:\windows\system32\Drivers\gbxusb_x64.sys [2009-10-08 300624]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 136176]

R3 HDJAsioK;HDJAsioK;c:\windows\system32\Drivers\HDJAsioK.sys [2010-09-30 253440]

R3 HDJMidi;Hercules DJ Console Rmx MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys [2010-09-30 222208]

R3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\Drivers\KORGUM64.SYS [2011-03-30 33656]

R3 MAUSBFASTTRACKPRO;Service for M-Audio FastTrack Pro;c:\windows\system32\DRIVERS\MAudioFastTrackPro.sys [2009-11-09 187912]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-25 114144]

R3 NvnUsbAudio;Novation USB Audio Driver;c:\windows\system32\DRIVERS\nvnusbaudio.sys [2008-12-12 45056]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-03-21 452200]

R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe [2009-08-10 93848]

R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynUSB64.sys [2006-11-16 31248]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [2011-08-19 30720]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-06 1255736]

R3 X6va006;X6va006;c:\users\c\AppData\Local\Temp\0069E1E.tmp [x]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-12 834544]

S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2011-11-23 149768]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-09-19 140672]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;f:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]

S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2011-04-28 140608]

S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2012-09-05 6364024]

S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2012-01-05 161032]

S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2011-04-28 114760]

S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2011-04-28 121928]

S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2011-11-30 128264]

S2 Radio.fx;Radio.fx Server;e:\tobit radio.fx\Server\rfx-server.exe [2011-11-18 3673944]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-11-29 2916736]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys [2009-10-13 61440]

S3 gbxavs;Maschine Midi;c:\windows\system32\Drivers\gbxavs.sys [2011-07-07 357968]

S3 gbxusb_svc;Maschine Controller;c:\windows\system32\Drivers\gbxusb.sys [2011-07-07 68688]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]

S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]

S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2010-07-01 38992]

S3 XONE_2D;usb-audio.de driver for Allen & Heath XONE:2D;c:\windows\system32\Drivers\XONE_2D.sys [2010-04-22 398400]

S3 XONE_2D_WDM;XONE:2D WDM Audio;c:\windows\system32\drivers\XONE_2DW.sys [2010-04-22 50240]

S3 XONE_2DM;XONE:2D WDM Midi Device;c:\windows\system32\drivers\XONE_2dm.sys [2010-04-22 31296]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-09-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 01:36]

.

2012-09-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 01:36]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\c\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\Drivers32]

"midi"=KORGUM64.DRV

"midi3"=KORGUM64.DRV

"midi5"=KORGUM64.DRV

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204

IE: Free YouTube Download - c:\users\c\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

TCP: Interfaces\{091BC6DB-D53F-439F-8CDB-CBC2EBFF26E2}: NameServer = 8.8.4.4,192.168.178.1

TCP: Interfaces\{EF90E457-A960-479F-B576-DDADA01BC4FF}: NameServer = 213.73.89.124,78.47.115.195

DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

FF - ProfilePath - c:\users\c\AppData\Roaming\Mozilla\Firefox\Profiles\8oq4rs7e.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Avidemux 2.5 - d:\program files (x86)\Avidemux 2.5\uninstall.exe

AddRemove-Camel Audio Alchemy - d:\program files\REAPER (x64)\Plugins\VST\Alchemy\AlchemyUninstall.exe

AddRemove-CVPiano-Modeled - d:\progra~2\REAPER~1\Plugins\VST\CVPIAN~1\Install\UNWISE.EXE

AddRemove-Instrument-Tuner - d:\progra~3\INSTRU~1\UNWISE.EXE

AddRemove-Live 8.2.2 - d:\progra~3\Ableton\LIVE82~1.2\Install\UNWISE.EXE

AddRemove-Native Instruments Maschine Controller Driver - c:\programdata\{3C6B30C3-46C9-4FD1-AAC3-6011E43BF0D1}\Maschine Controller Driver Setup.exe

AddRemove-Native Instruments Reaktor 3 Demo - d:\progra~3\NATIVE~1\REAKTO~1.0DE\UNWISE.EXE

AddRemove-Native Instruments SoundSchool Analog - d:\progra~3\NATIVE~1\SOUNDS~1\UNWISE.EXE

AddRemove-REAPER - d:\program files (x86)\REAPER\Uninstall.exe

AddRemove-Synthesia - d:\program files (x86)\Synthesia\uninstall.exe

AddRemove-xp-AntiSpy - c:\program files (x86)\xp-AntiSpy\Uninstall.exe

AddRemove-{2AAC4085-DCBF-417B-AEBD-182197839240} - c:\programdata\{4E1B117F-A681-406A-88B5-AF868CF9CB04}\Traktor Setup PC.exe

AddRemove-{62F13B4D-FD48-4317-8E55-06DB7B397F49}_is1 - d:\program files\REAPER (x64)\Plugins\VST\unins000.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va006]

"ImagePath"="\??\c:\users\c\AppData\Local\Temp\0069E1E.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2460917813-4204335397-3809129294-1001\Software\SecuROM\License information*]

"datasecu"=hex:fc,0e,17,0d,e2,06,0c,8e,9d,5f,47,ad,b8,da,fd,5f,1a,60,00,93,81,

   03,50,42,a8,5a,e0,39,7e,83,bc,22,5f,bd,54,dc,9d,0a,04,13,f1,4a,0b,31,f1,e2,\

"rkeysecu"=hex:91,bd,0c,95,c8,38,7e,d9,6f,2b,2b,7d,c4,af,5d,f5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-10-03  15:03:35

ComboFix-quarantined-files.txt  2012-10-03 13:03

.

Vor Suchlauf: 7.046.197.248 bytes free

Nach Suchlauf: 6.872.891.392 bytes free

.

- - End Of File - - E7E7AE88091510C39603B965405EA8D4

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Code:

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<title>Report of OSAM: Autorun Manager v5.0.11926.0</title>

<style type="text/css">

body

{

    margin                    : 10px 10px 10px 20px;

    color                     : #000000;

    background-color          : #fffbf0;

    font                      : 10pt Tahoma, Verdana, Arial, Helvetica, sans-serif;

    scrollbar-3dlight-color   : #fffbf0;

    scrollbar-arrow-color     : #000000;

    scrollbar-darkshadow-color: #000000;

    scrollbar-face-color      : #fffbf0;

    scrollbar-highlight-color : #000000;

    scrollbar-shadow-color    : #fffbf0;

    scrollbar-track-color     : #fffbf0;

}

a:link

{

    color: #e15616;

}

a:visited 

{

    color: #e15616;

}

a:hover

{

    color: #e4743f;

}

a:active

{

    color: #e4743f;

}

.header1

{

    font-size  : 115%;

    font-weight: bold;

    margin-left: 0px;

}

table

{

    border-collapse: collapse;

    border         : 1px solid #000000;

    cellpadding    : 0;

    cellspacing    : 0;

    width          : 90%;

}

td,th

{

    font-size     : 12px;

    color         : #000000;

    background    : #fffbf0;

    border        : 1px solid #000000;

    text-align    : left;

    vertical-align: top;

    padding       : 2px 4px 2px 4px;

}

.cap

{

    font-weight: bold;

    font-size  : 10pt;

    padding    : 2px 4px 2px 4px;

    border     : 1px solid #000000;

}

.group

{

    font-weight: bold;

    font-size  : 10pt;

    padding    : 2px 4px 2px 4px;

    text-align : center;

}

.reg

{

    font-weight: bold;

    font-size  : 10pt;

    border     : 0px none;

    padding    : 2px 4px 2px 4px;

}

.notfound

{

    background-color: #B3DDFF;

}

.blocked

{

    background-color: #FF96EB;

}

.nodetails

{

    background-color: #FFFF75;

}

.trusted

{

    background-color: #C8FFC8;

}

.rootkit

{

    background-color: #FF8696;

}

td.rs { text-align: center; vertical-align: center; font-family: courier; }

td.rs.rm { background: #F90424; title: "Malware"; }

td.rs.ri { background: #F90424; title: "Infected"; color: #21F411; }

td.rs.rw { background: #F90424; title: "Unwanted"; }

td.rs.rs { background: #F90424; title: "Suspicious"; }

td.rs.rt { background: #21F411; title: "Trusted"; }

td.rs.rc { background: #21F411; title: "Checked"; }

td.rs.ry { background: #21F411; title: "Up-to-You"; }

td.rs.rr { background: #F6EB13; title: "Riskware"; }

td.rs.ru { background: #D4D0C8; title: "Unknown"; }

td.rs.rn { background: #FFFFFF; title: "Not checked"; }

</style>

</head>

<body>

<p><span class="header1">Report of OSAM: Autorun Manager v5.0.11926.0</span><br>

<a href="hxxp://www.online-solutions.ru/en/" target="_blank">hxxp://www.online-solutions.ru/en/</a><br>

Saved at 21:27:24 on 05.10.2012</p>

<b>OS</b>: Windows 7 Enterprise Edition Service Pack 1 (Build 7601), 64-bit<br>

<b>Default Browser</b>: Mozilla Corporation Firefox 15.0<br>

<br><b>Scanner Settings</b><br>

<input type="checkbox" disabled checked>Rootkits detection (hidden registry)<br>

<input type="checkbox" disabled checked>Rootkits detection (hidden files)<br>

<input type="checkbox" disabled checked>Retrieve files information<br>

<input type="checkbox" disabled checked>Check Microsoft signatures<br>

<br><b>Filters</b><br>

<input type="checkbox" disabled>Trusted entries<br>

<input type="checkbox" disabled>Empty entries<br>

<input type="checkbox" disabled checked>Hidden registry entries (rootkit activity)<br>

<input type="checkbox" disabled checked>Exclusively opened files<br>

<input type="checkbox" disabled checked>Not found files<br>

<input type="checkbox" disabled checked>Files without detailed information<br>

<input type="checkbox" disabled checked>Existing files<br>

<input type="checkbox" disabled>Non-startable services<br>

<input type="checkbox" disabled>Non-startable drivers<br>

<input type="checkbox" disabled checked>Active entries<br>

<input type="checkbox" disabled checked>Disabled entries<br>

<br>

<table border="1" cellpadding="0" cellspacing="0">

<tr>

<th class="cap" width="20">&nbsp;</th>

<th class="cap">Risk</th>

<th class="cap">Name</th>

<th class="cap">Publisher</th>

<th class="cap">Full Path</th>

<th class="cap">Status</th>

</tr>

<tr>

<td class="group" colspan="6">Common</td>

</tr>

<tr>

<td class="reg" colspan="6">%SystemRoot%\Tasks</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"GoogleUpdateTaskMachineCore.job"</td>

<td>"Google Inc."</td>

<td>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"GoogleUpdateTaskMachineUA.job"</td>

<td>"Google Inc."</td>

<td>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Control Panel Objects</td>

</tr>

<tr>

<td class="reg" colspan="6">%SystemRoot%\system32</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"nvcpl.cpl"</td>

<td>"NVIDIA Corporation"</td>

<td>C:\Windows\system32\nvcpl.cpl</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSUNCpl.cpl"</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\system32\PSUNCpl.cpl</td>

<td>File exists</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"QuickTime"</td>

<td>"Apple Inc."</td>

<td>C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Drivers</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"@%SystemRoot%\system32\drivers\tsusbhub.sys,-1" (tsusbhub)</td>

<td class="notfound"></td>

<td class="notfound">C:\Windows\System32\drivers\tsusbhub.sys</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"bcd3000" (bcd3000)</td>

<td>"Behringer"</td>

<td>C:\Windows\System32\DRIVERS\bcd3000_x64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"bcd3000wdm" (bcd3000wdm)</td>

<td>"Behringer"</td>

<td>C:\Windows\System32\DRIVERS\bcd3000wdm_x64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"catchme" (catchme)</td>

<td class="notfound"></td>

<td class="notfound">C:\ComboFix\catchme.sys</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"gbxavs_x64" (gbxavs_x64)</td>

<td>"Native Instruments GmbH"</td>

<td>C:\Windows\System32\Drivers\gbxavs_x64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"gbxusb_x64" (gbxusb_x64)</td>

<td>"Native Instruments GmbH"</td>

<td>C:\Windows\System32\Drivers\gbxusb_x64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rr">||||||</td>

<td>"Hamachi Network Interface" (hamachi)</td>

<td>"LogMeIn, Inc."</td>

<td>C:\Windows\System32\DRIVERS\hamachi.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"HDJAsioK" (HDJAsioK)</td>

<td>"© Guillemot R&D, 2010. All rights reserved."</td>

<td>C:\Windows\System32\Drivers\HDJAsioK.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"HDJBulk" (Bulk)</td>

<td>"© Guillemot R&D, 2010. All rights reserved."</td>

<td>C:\Windows\System32\Drivers\HDJBulk.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Hercules DJ Console Rmx MIDI" (HDJMidi)</td>

<td>"© Guillemot R&D, 2010. All rights reserved."</td>

<td>C:\Windows\System32\DRIVERS\HDJMidi.sys</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"Motorola USB CDC ACM Driver" (motmodem)</td>

<td class="notfound"></td>

<td class="notfound">C:\Windows\System32\DRIVERS\motmodem.sys</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"NVR0Dev" (NVR0Dev)</td>

<td>"NVidia Corp."</td>

<td>C:\Windows\nvoclk64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSINAflt" (PSINAflt)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\System32\DRIVERS\PSINAflt.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSINFile" (PSINFile)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\System32\DRIVERS\PSINFile.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSINKNC" (PSINKNC)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\System32\DRIVERS\psinknc.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSINProc" (PSINProc)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\System32\DRIVERS\PSINProc.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"PSINProt" (PSINProt)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Windows\System32\DRIVERS\PSINProt.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"SANDRA" (SANDRA)</td>

<td>"SiSoftware"</td>

<td>C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"SASDIFSV" (SASDIFSV)</td>

<td>"SUPERAdBlocker.com and SUPERAntiSpyware.com"</td>

<td>C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"SASKUTIL" (SASKUTIL)</td>

<td>"SUPERAdBlocker.com and SUPERAntiSpyware.com"</td>

<td>C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Service for M-Audio FastTrack Pro" (MAUSBFASTTRACKPRO)</td>

<td>"Avid Technology, Inc."</td>

<td>C:\Windows\System32\DRIVERS\MAudioFastTrackPro.sys</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"SynasUSB" (SynasUSB)</td>

<td>"SIA Syncrosoft"</td>

<td>C:\Windows\System32\drivers\SynUSB64.sys</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"Synth3dVsc" (Synth3dVsc)</td>

<td class="notfound"></td>

<td class="notfound">C:\Windows\System32\drivers\synth3dvsc.sys</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Tpkd" (Tpkd)</td>

<td>"PACE Anti-Piracy, Inc."</td>

<td>C:\Windows\system32\drivers\Tpkd.sys</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"VGPU" (VGPU)</td>

<td class="notfound"></td>

<td class="notfound">C:\Windows\System32\drivers\rdvgkmd.sys</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"X6va006" (X6va006)</td>

<td class="notfound"></td>

<td class="notfound">C:\Users\c\AppData\Local\Temp\0069E1E.tmp</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td class="group" colspan="6">Explorer</td>

</tr>

<tr>

<td class="reg" colspan="6">HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Classes\Folder\shellex\ColumnHandlers</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{AE424E85-F6DF-4910-A6A9-438797986431} "LibreOffice Property Handler"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\propertyhdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer"</td>

<td>"The Document Foundation"</td>

<td>C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="group" colspan="6">Internet Explorer</td>

</tr>

<tr>

<td class="reg" colspan="6">HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">ITBar7Height "ITBar7Height"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound"><binary data> "ITBar7Layout"</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>{D4B68B83-8710-488B-A692-D74B50BA558E} "Creative Software AutoUpdate Support Package 2"<br>hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab</td>

<td>"Creative Technology Ltd"</td>

<td>C:\Windows\DOWNLO~1\CTPIDPDE.ocx</td>

<td>File exists</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{E705A591-DA3C-4228-B0D5-A356DBA42FBF} "{E705A591-DA3C-4228-B0D5-A356DBA42FBF}"<br>hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">{F6ACF75C-C32C-447B-9BEF-46B766368D29} "{F6ACF75C-C32C-447B-9BEF-46B766368D29}"<br>hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab</td>

<td class="notfound"></td>

<td class="notfound"></td>

<td class="notfound">File not found | COM-object registry key not found</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"@C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101"</td>

<td class="notfound"></td>

<td class="notfound">res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} "Panda Security Toolbar"</td>

<td></td>

<td>C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper"</td>

<td>"Oracle Corporation"</td>

<td>C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper"</td>

<td>"Oracle Corporation"</td>

<td>C:\Program Files (x86)\Java\jre7\bin\ssv.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} "Panda Security Toolbar"</td>

<td></td>

<td>C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper"</td>

<td>"Microsoft Corporation"</td>

<td>C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Known DLLs</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"user32"</td>

<td>"Microsoft Corporation"</td>

<td>C:\Windows\system32\user32.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">LSA Providers</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Control\Lsa</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Security Packages"</td>

<td>"Microsoft Corporation"</td>

<td>C:\Windows\system32\livessp.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Logon</td>

</tr>

<tr>

<td class="reg" colspan="6">%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"desktop.ini"</td>

<td></td>

<td>C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Stardock ObjectDock.lnk"</td>

<td>"Stardock"</td>

<td>C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe</td>

<td>Shortcut exists | File exists</td>

</tr>

<tr>

<td class="reg" colspan="6">%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"desktop.ini"</td>

<td></td>

<td>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</td>

<td>File exists</td>

</tr>

<tr>

<td class="reg" colspan="6">HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</td>

</tr>

<tr>

<td class="nodetails"><input type="checkbox" disabled checked></td>

<td class="rs rc">||&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="nodetails">"F.lux"</td>

<td class="nodetails"></td>

<td class="nodetails">"C:\Users\c\Local Settings\Apps\F.lux\flux.exe" /noshow</td>

<td class="nodetails">File found, but it contains no detailed information</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"NVIDIA nTune"</td>

<td>"NVIDIA"</td>

<td>"C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Rainlendar2"</td>

<td></td>

<td>f:\Program Files (x86)\Rainlendar2\Rainlendar2.exe</td>

<td>File exists</td>

</tr>

<tr>

<td class="nodetails"><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td class="nodetails">"RocketDock"</td>

<td class="nodetails"></td>

<td class="nodetails">"C:\Program Files (x86)\RocketDock\RocketDock.exe"</td>

<td class="nodetails">File found, but it contains no detailed information</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"Skype"</td>

<td>"Skype Technologies S.A."</td>

<td>"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun</td>

<td>File exists</td>

</tr>

<tr>

<td class="nodetails"><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="nodetails">"Spotify Web Helper"</td>

<td class="nodetails"></td>

<td class="nodetails">"C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"</td>

<td class="nodetails">File found, but it contains no detailed information</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\Software\Microsoft\Windows\CurrentVersion\Run</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"KORG USB-MIDI Driver"</td>

<td>"KORG Inc."</td>

<td>C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe /s</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Panda Security URL Filtering"</td>

<td>"Panda Security"</td>

<td>"C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe"</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"PSUNMain"</td>

<td>"Panda Security, S.L."</td>

<td>"C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"QuickTime Task"</td>

<td>"Apple Inc."</td>

<td>"C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"SunJavaUpdateSched"</td>

<td>"Sun Microsystems, Inc."</td>

<td>"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Print Monitors</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"pdfcmon"</td>

<td>"pdfforge GbR"</td>

<td>C:\Windows\system32\pdfcmon.dll</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Services</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend)</td>

<td class="notfound"></td>

<td class="notfound">C:\Program Files (x86)\Windows Defender\mpsvc.dll</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td class="notfound"><input type="checkbox" disabled checked></td>

<td class="rs rn">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td class="notfound">"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc)</td>

<td class="notfound"></td>

<td class="notfound">"C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"</td>

<td class="notfound">File not found</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Apple Mobile Device" (Apple Mobile Device)</td>

<td>"Apple Inc."</td>

<td>C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"ASP.NET State Service" (aspnet_state)</td>

<td>"Microsoft Corporation"</td>

<td>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Desura Install Service" (Desura Install Service)</td>

<td>"Desura Pty Ltd"</td>

<td>C:\Program Files (x86)\Common Files\Desura\desura_service.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Dienst "Bonjour"" (Bonjour Service)</td>

<td>"Apple Inc."</td>

<td>C:\Program Files\Bonjour\mDNSResponder.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"Google Update Service (gupdate)" (gupdate)</td>

<td>"Google Inc."</td>

<td>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"Google Update-Dienst (gupdatem)" (gupdatem)</td>

<td>"Google Inc."</td>

<td>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ry">||||&nbsp;&nbsp;</td>

<td>"InstallDriver Table Manager" (IDriverT)</td>

<td>"Macrovision Corporation"</td>

<td>C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"iPod-Dienst" (iPod Service)</td>

<td>"Apple Inc."</td>

<td>C:\Program Files\iPod\bin\iPodService.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"LogMeIn Hamachi Tunneling Engine" (Hamachi2Svc)</td>

<td>"LogMeIn Inc."</td>

<td>F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64)</td>

<td>"Microsoft Corporation"</td>

<td>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32)</td>

<td>"Microsoft Corporation"</td>

<td>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Mozilla Maintenance Service" (MozillaMaintenance)</td>

<td>"Mozilla Foundation"</td>

<td>C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"NIHardwareService" (NIHardwareService)</td>

<td>"Native Instruments GmbH"</td>

<td>C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"nTune Service" (nTuneService)</td>

<td>"NVIDIA"</td>

<td>C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"NVIDIA Display Driver Service" (nvsvc)</td>

<td>"NVIDIA Corporation"</td>

<td>C:\Windows\system32\nvvsvc.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"NVIDIA Update Service Daemon" (nvUpdatusService)</td>

<td>"NVIDIA Corporation"</td>

<td>C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Panda Cloud Antivirus Service" (NanoServiceMain)</td>

<td>"Panda Security, S.L."</td>

<td>C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Radio.fx Server" (Radio.fx)</td>

<td></td>

<td>E:\Tobit Radio.fx\Server\rfx-server.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"SAS Core Service" (!SASCORE)</td>

<td>"SUPERAntiSpyware.com"</td>

<td>C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"SiSoftware Deployment Agent Service" (SandraAgentSrv)</td>

<td>"SiSoftware"</td>

<td>C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Skype Updater" (SkypeUpdate)</td>

<td>"Skype Technologies"</td>

<td>C:\Program Files (x86)\Skype\Updater\Updater.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs ru">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>

<td>"Steam Client Service" (Steam Client Service)</td>

<td>"Valve Corporation"</td>

<td>C:\Program Files (x86)\Common Files\Steam\SteamService.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rr">||||||</td>

<td>"TeamViewer 7" (TeamViewer7)</td>

<td>"TeamViewer GmbH"</td>

<td>C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"Windows Live ID Sign-in Assistant" (wlidsvc)</td>

<td>"Microsoft Corporation"</td>

<td>C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE</td>

<td>File exists</td>

</tr>

<tr>

<td class="group" colspan="6">Winsock Providers</td>

</tr>

<tr>

<td class="reg" colspan="6">HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"mdnsNSP"</td>

<td>"Apple Inc."</td>

<td>C:\Program Files (x86)\Bonjour\mdnsNSP.dll</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"WindowsLive Local NSP"</td>

<td>"Microsoft Corporation"</td>

<td>C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL</td>

<td>File exists</td>

</tr>

<tr>

<td><input type="checkbox" disabled checked></td>

<td class="rs rt">||||||</td>

<td>"WindowsLive NSP"</td>

<td>"Microsoft Corporation"</td>

<td>C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL</td>

<td>File exists</td>

</tr>

</table>

<p>If You have questions or want to get some help, You can visit <a href="hxxp://forum.online-solutions.ru" target="_blank">hxxp://forum.online-solutions.ru</a></p>

</body></html>

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-10-05 21:29:09

-----------------------------

21:29:09.027    OS Version: Windows x64 6.1.7601 Service Pack 1

21:29:09.027    Number of processors: 4 586 0xF0B

21:29:09.029    ComputerName: C-PC  UserName: c

21:29:09.352    Initialize success

21:30:14.788    AVAST engine defs: 12100501

21:30:47.414    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2

21:30:47.417    Disk 0 Vendor: WDC_WD6401AALS-00L3B2 01.03B01 Size: 610480MB BusType: 3

21:30:47.419    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP4T0L0-5

21:30:47.422    Disk 1 Vendor: SAMSUNG_HD401LJ ZZ100-15 Size: 381554MB BusType: 3

21:30:47.431    Disk 0 MBR read successfully

21:30:47.433    Disk 0 MBR scan

21:30:47.438    Disk 0 Windows XP default MBR code

21:30:47.442    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        49998 MB offset 2048

21:30:47.448    Disk 0 Partition - 00     05     Extended              8001 MB offset 102398310

21:30:47.459    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        49999 MB offset 118784610

21:30:47.470    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       502478 MB offset 221182920

21:30:47.484    Disk 0 Partition 4 00     82   Linux swap              8001 MB offset 102398373

21:30:47.508    Disk 0 scanning C:\Windows\system32\drivers

21:30:57.700    Service scanning

21:31:15.902    Modules scanning

21:31:15.910    Disk 0 trace - called modules:

21:31:15.930    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 

21:31:15.936    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a30060]

21:31:15.943    3 CLASSPNP.SYS[fffff8800145143f] -> nt!IofCallDriver -> [0xfffffa80047c4e40]

21:31:15.950    5 ACPI.sys[fffff88000f697a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa80047d4060]

21:31:16.499    AVAST engine scan C:\Windows

21:31:18.992    AVAST engine scan C:\Windows\system32

21:34:14.919    AVAST engine scan C:\Windows\system32\drivers

21:34:32.212    AVAST engine scan C:\Users\c

21:43:51.788    AVAST engine scan C:\ProgramData

21:49:52.524    Scan finished successfully

21:54:02.124    Disk 0 MBR has been saved successfully to "C:\Users\c\Desktop\MBR.dat"

21:54:02.130    The log file has been saved successfully to "C:\Users\c\Desktop\aswMBR.txt"

Warum postest du das OSAM Log nicht in dem Format, dass ich lt. Anleitung haben wollte?

Zitat:

Zitat von cosinus (Beitrag 932402)

Warum postest du das OSAM Log nicht in dem Format, dass ich lt. Anleitung haben wollte?

Sorry, hatte da wohl was missverstanden.
So besser ?

Und warum jetzt im Anhang? :confused:

Die Logs bitte nur in den Anhang (gezippt) legen, wenn sie zu groß sind um direkt gepostet zu werden!
Ansonsten bitte alles nach Möglichkeit hier in CODE-Tags posten. Das ist einfacher übersichtlicher und man spart sich ne Menge Rumklickerei

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Ok jetzt habe ich den Fehler erkannt.

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:00:48 on 07.10.2012
 

OS: Windows 7 Enterprise Edition Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 15.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

"PSUNCpl.cpl" - "Panda Security, S.L." - C:\Windows\system32\PSUNCpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%SystemRoot%\system32\drivers\tsusbhub.sys,-1" (tsusbhub) - ? - C:\Windows\System32\drivers\tsusbhub.sys  (File not found)

"bcd3000" (bcd3000) - "Behringer" - C:\Windows\System32\DRIVERS\bcd3000_x64.sys

"bcd3000wdm" (bcd3000wdm) - "Behringer" - C:\Windows\System32\DRIVERS\bcd3000wdm_x64.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"gbxavs_x64" (gbxavs_x64) - "Native Instruments GmbH" - C:\Windows\System32\Drivers\gbxavs_x64.sys

"gbxusb_x64" (gbxusb_x64) - "Native Instruments GmbH" - C:\Windows\System32\Drivers\gbxusb_x64.sys

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys

"HDJAsioK" (HDJAsioK) - "© Guillemot R&D, 2010. All rights reserved." - C:\Windows\System32\Drivers\HDJAsioK.sys

"HDJBulk" (Bulk) - "© Guillemot R&D, 2010. All rights reserved." - C:\Windows\System32\Drivers\HDJBulk.sys

"Hercules DJ Console Rmx MIDI" (HDJMidi) - "© Guillemot R&D, 2010. All rights reserved." - C:\Windows\System32\DRIVERS\HDJMidi.sys

"Motorola USB CDC ACM Driver" (motmodem) - ? - C:\Windows\System32\DRIVERS\motmodem.sys  (File not found)

"NVR0Dev" (NVR0Dev) - "NVidia Corp." - C:\Windows\nvoclk64.sys

"PSINAflt" (PSINAflt) - "Panda Security, S.L." - C:\Windows\System32\DRIVERS\PSINAflt.sys

"PSINFile" (PSINFile) - "Panda Security, S.L." - C:\Windows\System32\DRIVERS\PSINFile.sys

"PSINKNC" (PSINKNC) - "Panda Security, S.L." - C:\Windows\System32\DRIVERS\psinknc.sys

"PSINProc" (PSINProc) - "Panda Security, S.L." - C:\Windows\System32\DRIVERS\PSINProc.sys

"PSINProt" (PSINProt) - "Panda Security, S.L." - C:\Windows\System32\DRIVERS\PSINProt.sys

"SANDRA" (SANDRA) - "SiSoftware" - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

"Service for M-Audio FastTrack Pro" (MAUSBFASTTRACKPRO) - "Avid Technology, Inc." - C:\Windows\System32\DRIVERS\MAudioFastTrackPro.sys

"SynasUSB" (SynasUSB) - "SIA Syncrosoft" - C:\Windows\System32\drivers\SynUSB64.sys

"Synth3dVsc" (Synth3dVsc) - ? - C:\Windows\System32\drivers\synth3dvsc.sys  (File not found)

"Tpkd" (Tpkd) - "PACE Anti-Piracy, Inc." - C:\Windows\system32\drivers\Tpkd.sys

"VGPU" (VGPU) - ? - C:\Windows\System32\drivers\rdvgkmd.sys  (File not found)

"X6va006" (X6va006) - ? - C:\Users\c\AppData\Local\Temp\0069E1E.tmp  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "ms-help" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\NAMEEXT.DLL

{AE424E85-F6DF-4910-A6A9-438797986431} "LibreOffice Property Handler" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\propertyhdl.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Microsoft Outlook Custom Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - C:\Program Files (x86)\LibreOffice 3\Basis\program\shlxthdl\shlxthdl.dll

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{D4B68B83-8710-488B-A692-D74B50BA558E} "Creative Software AutoUpdate Support Package 2" - "Creative Technology Ltd" - C:\Windows\DOWNLO~1\CTPIDPDE.ocx / hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

{E705A591-DA3C-4228-B0D5-A356DBA42FBF} "{E705A591-DA3C-4228-B0D5-A356DBA42FBF}" - ? -   (File not found | COM-object registry key not found) / hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

{F6ACF75C-C32C-447B-9BEF-46B766368D29} "{F6ACF75C-C32C-447B-9BEF-46B766368D29}" - ? -   (File not found | COM-object registry key not found) / hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101" - ? - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} "Panda Security Toolbar" - ? - C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} "Panda Security Toolbar" - ? - C:\Program Files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Known DLLs]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----

"user32" - "Microsoft Corporation" - C:\Windows\system32\user32.dll
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Stardock ObjectDock.lnk" - "Stardock" - C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

"F.lux" - ? - "C:\Users\c\Local Settings\Apps\F.lux\flux.exe" /noshow  (File found, but it contains no detailed information)

"NVIDIA nTune" - "NVIDIA" - "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

"Rainlendar2" - ? - f:\Program Files (x86)\Rainlendar2\Rainlendar2.exe

"RocketDock" - ? - "C:\Program Files (x86)\RocketDock\RocketDock.exe"  (File found, but it contains no detailed information)

"Skype" - "Skype Technologies S.A." - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

"Spotify Web Helper" - ? - "C:\Users\c\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"  (File found, but it contains no detailed information)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"KORG USB-MIDI Driver" - "KORG Inc." - C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe /s

"Panda Security URL Filtering" - "Panda Security" - "C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe"

"PSUNMain" - "Panda Security, S.L." - "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar

"QuickTime Task" - "Apple Inc." - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"pdfcmon" - "pdfforge GbR" - C:\Windows\system32\pdfcmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"Desura Install Service" (Desura Install Service) - "Desura Pty Ltd" - C:\Program Files (x86)\Common Files\Desura\desura_service.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LogMeIn Hamachi Tunneling Engine" (Hamachi2Svc) - "LogMeIn Inc." - F:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - F:\Program Files\Microsoft Office\Office14\GROOVE.EXE

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"NIHardwareService" (NIHardwareService) - "Native Instruments GmbH" - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

"nTune Service" (nTuneService) - "NVIDIA" - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

"Office 64 Source Engine" (ose64) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"Panda Cloud Antivirus Service" (NanoServiceMain) - "Panda Security, S.L." - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe

"Radio.fx Server" (Radio.fx) - ? - E:\Tobit Radio.fx\Server\rfx-server.exe

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

"SiSoftware Deployment Agent Service" (SandraAgentSrv) - "SiSoftware" - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe

"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

"TeamViewer 7" (TeamViewer7) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 10/09/2012 at 08:34 PM
 

Application Version : 5.6.1010
 

Core Rules Database Version : 9367

Trace Rules Database Version: 7179
 

Scan type       : Complete Scan

Total Scan Time : 02:08:13
 

Operating System Information

Windows 7 Enterprise 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 649

Memory threats detected   : 0

Registry items scanned    : 74519

Registry threats detected : 0

File items scanned        : 156153

File threats detected     : 114
 

Adware.Tracking Cookie

        C:\Users\c\AppData\Roaming\Microsoft\Windows\Cookies\ZW5MMBK5.txt [ /serving-sys.com ]

        C:\Users\c\AppData\Roaming\Microsoft\Windows\Cookies\TW1IHJ7V.txt [ /bs.serving-sys.com ]

        C:\USERS\C\Cookies\TW1IHJ7V.txt [ Cookie:c@bs.serving-sys.com/ ]

        .estat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        tracking.sim-technik.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .liveperson.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        server.iad.liveperson.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .liveperson.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .cbsdigitalmedia.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        fr.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        fr.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .microsoftsto.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        stats.o2more.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        stats.o2more.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .paypal.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6afkyupczcbq.stats.esomniture.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .partnersearchmetrics.sbx1.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        wstat.wibiya.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .bwincom.122.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        tracking.mobile.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        int.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        int.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        in.getclicky.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.cyonix.to [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.cyonix.to [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .tracking.3gnet.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .www.traffictrack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .kaspersky.122.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .cyonix.to [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .cyonix.to [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .cyonix.to [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        application.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .stats.paypal.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .tracker.vinsight.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        application.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .cmp.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .mediatack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .mediatack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .mediatack.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]
 

Adware.SoftonicDownloader

        C:\_OTL\MOVEDFILES\09272012_223053\F_FIREFOX DLS\SOFTONICDOWNLOADER_FUER_NVIDIA-GPU-TEMP.EXE

Code:

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org
 

Database version: v2012.10.08.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

c :: C-PC [administrator]
 

09.10.2012 01:03:06

mbam-log-2012-10-09 (01-03-06).txt
 

Scan type: Full scan (C:\|E:\|F:\|G:\|J:\|K:\|L:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 1049362

Time elapsed: 2 hour(s), 46 minute(s), 25 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

(end)

Code:

UAC On - Limited User

Wie hast du sasw gestartet? Einfach per Doppelklick? Oder so wie es in der Anleitung steht?

Zitat:

Zitat von cosinus (Beitrag 324870)

Teil 2: Programm ausführen
Das Programm wurde nun installiert, eine Verknüpfung auf dem Desktop sollte erstellt worden sein. Nachdem du es gestartet hast, wird es sich erstmalig beim Updateserver nach neuen Schädlingssignaturen umsehen und Updates installieren. Diesen Vorgang NICHT abbrechen!

Benutzer mit Windows Vista und Windows 7 starten das Tool bitte wieder per Rechtsklick => als Administrator ausführen!

Mit rechtsklick als Admin kommt die gleiche Meldung...ich probiere es nochmal.

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 10/10/2012 at 08:13 PM
 

Application Version : 5.6.1010
 

Core Rules Database Version : 9375

Trace Rules Database Version: 7187
 

Scan type       : Complete Scan

Total Scan Time : 02:33:49
 

Operating System Information

Windows 7 Enterprise 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 629

Memory threats detected   : 0

Registry items scanned    : 74551

Registry threats detected : 0

File items scanned        : 152287

File threats detected     : 30
 

Adware.Tracking Cookie

        media.mtvnservices.com [ C:\USERS\C\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\LTZC8J6A ]

        secure-us.imrworldwide.com [ C:\USERS\C\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\LTZC8J6A ]

        .mtvn.112.2o7.net [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .account.mojang.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .account.mojang.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .account.mojang.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        uk.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        uk.sitestat.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        application.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        application.etracker.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .questionpro.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .questionpro.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .surveys.questionpro.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .surveys.questionpro.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

        .surveys.questionpro.com [ C:\USERS\C\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8OQ4RS7E.DEFAULT\COOKIES.SQLITE ]

Hmja, das ist ein Bug von SASW aber halb so wild ;)

Sieht ok aus, da wurden nur Cookies gefunden, die können alle weg.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Also ich habe das ganze jetzt mal ein paar Tage beobachtet.
Es scheint alles soweit ganz gut zu laufen.
Lediglich firefox reagiert manchmal (gestern zb.) noch extrem verzögert auf jeglich Eingaben. Allerdings jetzt nichtmehr dauerhaft.
Ein Neustart ist dann allerdings nötig um das zu beheben..
Die Windowsmeldung ich möge ein Antivirenprogrmm finden besteht auch nachwievor.
Ansonsten scheint alles gut zu sein.

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Dann bedanke ich mich recht herzlich für die sehr Umfangreiche Hilfe und hoffe das war es erstmal ;)

Toll, dass es euch gibt.

Vielen Dank.