Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr (https://www.trojaner-board.de/127307-antivir-echtzeit-scanner-meldete-trojaner-findet-nichts-mehr.html)

Dirtbag 20.11.2012 21:31
AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr
 
Heute vormittag flackerte eine Meldung des AntiVir-Echtzeit-Scanners auf, dass er in meinem Steam-Verzeichnis in einer *.dll von Bloodbowl einen Trojaner gefunden habe.

Der direkt im Anschluss durchgeführte Scan (Admin-Berechtigung) des gesamten Steam-Verzeichnis ergab nichts. Kein Fund. AntiVir arbeitet grundsätzlich ohne Einschränkung der Rekursionstiefe und mit Erkennungsstufe "hoch".

Um sicher zu gehen, habe ich anschließend einen vollständigen Systemscan mit Malwarebytes Anti-Malware sowie einen Rootkit-Scan und danach noch einen vollständigen System-Scan mit AntiVir durchführen lassen, immer mit Administrator-Berechtigung.
Abschließend noch einen OTL-Scan.

Betriebssystem ist Win7, 64bit. Laufwerk "N" ist mit Truecrypt verschlüsselt.

Vielleicht ist es nur ein Fehlalarm, aber ich wäre mir gerne sicher, dass das System sauber ist.

Deshalb nachfolgend noch die Scan-Logs.

Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Thomas :: BEHEMOTH [Administrator]

20.11.2012 12:41:45
mbam-log-2012-11-20 (12-41-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 570014
Laufzeit: 1 Stunde(n), 54 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Thomas\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Downloads\coretemp_1236.exe (PUP.BundleOffers.IIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 20. November 2012  14:43

Es wird nach 4534557 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Thomas
Computername  : BEHEMOTH

Versionsinformationen:
BUILD.DAT      : 12.1.9.1236    40872 Bytes  11.10.2012 15:29:00
AVSCAN.EXE    : 12.3.0.48    468256 Bytes  14.11.2012 22:57:07
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  02.05.2012 00:02:50
LUKE.DLL      : 12.3.0.15      68304 Bytes  01.05.2012 23:31:47
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  01.05.2012 22:13:36
AVREG.DLL      : 12.3.0.17    232200 Bytes  21.05.2012 15:57:51
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 23:22:12
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 23:31:36
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 09:58:50
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 10:43:53
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 19:40:34
VBASE006.VDF  : 7.11.41.250  4902400 Bytes  06.09.2012 21:53:44
VBASE007.VDF  : 7.11.45.207  2363904 Bytes  11.10.2012 21:06:52
VBASE008.VDF  : 7.11.45.208    2048 Bytes  11.10.2012 21:06:52
VBASE009.VDF  : 7.11.45.209    2048 Bytes  11.10.2012 21:06:52
VBASE010.VDF  : 7.11.45.210    2048 Bytes  11.10.2012 21:06:52
VBASE011.VDF  : 7.11.45.211    2048 Bytes  11.10.2012 21:06:52
VBASE012.VDF  : 7.11.45.212    2048 Bytes  11.10.2012 21:06:52
VBASE013.VDF  : 7.11.45.213    2048 Bytes  11.10.2012 21:06:52
VBASE014.VDF  : 7.11.46.65    220160 Bytes  16.10.2012 07:35:23
VBASE015.VDF  : 7.11.46.153  173568 Bytes  18.10.2012 08:02:49
VBASE016.VDF  : 7.11.46.223  162304 Bytes  19.10.2012 09:53:20
VBASE017.VDF  : 7.11.47.35    126464 Bytes  22.10.2012 10:51:38
VBASE018.VDF  : 7.11.47.95    175616 Bytes  24.10.2012 10:51:39
VBASE019.VDF  : 7.11.47.177  164352 Bytes  26.10.2012 12:48:50
VBASE020.VDF  : 7.11.47.229  143360 Bytes  28.10.2012 22:27:18
VBASE021.VDF  : 7.11.48.47    138240 Bytes  30.10.2012 07:43:29
VBASE022.VDF  : 7.11.48.135  122880 Bytes  01.11.2012 07:43:29
VBASE023.VDF  : 7.11.48.209  142848 Bytes  05.11.2012 15:45:12
VBASE024.VDF  : 7.11.48.243  119296 Bytes  05.11.2012 15:44:54
VBASE025.VDF  : 7.11.49.47    136704 Bytes  07.11.2012 15:44:54
VBASE026.VDF  : 7.11.49.135  194560 Bytes  09.11.2012 15:44:57
VBASE027.VDF  : 7.11.49.209  188416 Bytes  12.11.2012 22:03:52
VBASE028.VDF  : 7.11.50.27    212992 Bytes  14.11.2012 22:57:06
VBASE029.VDF  : 7.11.50.105  200704 Bytes  18.11.2012 11:11:54
VBASE030.VDF  : 7.11.50.164  340992 Bytes  20.11.2012 13:41:26
VBASE031.VDF  : 7.11.50.168    15872 Bytes  20.11.2012 13:41:54
Engineversion  : 8.2.10.202
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 20:55:19
AESCRIPT.DLL  : 8.1.4.66      463227 Bytes  12.11.2012 22:03:54
AESCN.DLL      : 8.1.9.4      131445 Bytes  15.11.2012 22:57:06
AESBX.DLL      : 8.2.5.12      606578 Bytes  20.06.2012 06:47:25
AERDL.DLL      : 8.2.0.74      643445 Bytes  07.11.2012 15:44:58
AEPACK.DLL    : 8.3.0.40      815479 Bytes  12.11.2012 22:03:54
AEOFFICE.DLL  : 8.1.2.50      201084 Bytes  05.11.2012 15:45:15
AEHEUR.DLL    : 8.1.4.138    5542265 Bytes  15.11.2012 22:57:06
AEHELP.DLL    : 8.1.25.2      258423 Bytes  11.10.2012 21:06:44
AEGEN.DLL      : 8.1.6.10      438646 Bytes  15.11.2012 22:57:04
AEEXP.DLL      : 8.2.0.10      119158 Bytes  05.11.2012 15:45:15
AEEMU.DLL      : 8.1.3.2      393587 Bytes  10.07.2012 20:55:18
AECORE.DLL    : 8.1.29.2      201079 Bytes  07.11.2012 15:44:54
AEBB.DLL      : 8.1.1.4        53619 Bytes  05.11.2012 15:45:12
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  01.05.2012 22:59:21
AVPREF.DLL    : 12.3.0.32      50720 Bytes  14.11.2012 22:57:07
AVREP.DLL      : 12.3.0.15    179208 Bytes  01.05.2012 22:13:35
AVARKT.DLL    : 12.3.0.33    209696 Bytes  14.11.2012 22:57:07
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  01.05.2012 22:28:49
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  16.04.2012 21:11:02
AVSMTP.DLL    : 12.3.0.32      63480 Bytes  08.08.2012 19:29:26
NETNT.DLL      : 12.3.0.15      17104 Bytes  01.05.2012 23:33:29
RCIMAGE.DLL    : 12.3.0.31    4444408 Bytes  08.08.2012 19:29:17
RCTEXT.DLL    : 12.3.0.32      98848 Bytes  14.11.2012 22:57:06

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: aus
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +JOKE,

Beginn des Suchlaufs: Dienstag, 20. November 2012  14:43

Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Fuel Caste Constructor ProcTime
  [HINWEIS]  Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Platform Caste Constructor ProcTime
  [HINWEIS]  Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Platform Caste Constructor ProcTime
Versteckter Treiber
  [HINWEIS]  Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerofa.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'razertra.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerhid.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Windows\Sysnative\drivers\sptd.sys
  [WARNUNG]  Die Datei konnte nicht geöffnet werden!
Die Registry wurde durchsucht ( '3452' Dateien ).



Ende des Suchlaufs: Dienstag, 20. November 2012  14:53
Benötigte Zeit: 09:12 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
  4334 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      1 Dateien konnten nicht durchsucht werden
  4333 Dateien ohne Befall
    15 Archive wurden durchsucht
      1 Warnungen
      3 Hinweise
 1150516 Objekte wurden beim Rootkitscan durchsucht
      4 Versteckte Objekte wurden gefunden
Code:


Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 20. November 2012  14:54

Es wird nach 4534557 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Thomas
Computername  : BEHEMOTH

Versionsinformationen:
BUILD.DAT      : 12.1.9.1236    40872 Bytes  11.10.2012 15:29:00
AVSCAN.EXE    : 12.3.0.48    468256 Bytes  14.11.2012 22:57:07
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  02.05.2012 00:02:50
LUKE.DLL      : 12.3.0.15      68304 Bytes  01.05.2012 23:31:47
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  01.05.2012 22:13:36
AVREG.DLL      : 12.3.0.17    232200 Bytes  21.05.2012 15:57:51
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 23:22:12
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 23:31:36
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 09:58:50
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 10:43:53
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 19:40:34
VBASE006.VDF  : 7.11.41.250  4902400 Bytes  06.09.2012 21:53:44
VBASE007.VDF  : 7.11.45.207  2363904 Bytes  11.10.2012 21:06:52
VBASE008.VDF  : 7.11.45.208    2048 Bytes  11.10.2012 21:06:52
VBASE009.VDF  : 7.11.45.209    2048 Bytes  11.10.2012 21:06:52
VBASE010.VDF  : 7.11.45.210    2048 Bytes  11.10.2012 21:06:52
VBASE011.VDF  : 7.11.45.211    2048 Bytes  11.10.2012 21:06:52
VBASE012.VDF  : 7.11.45.212    2048 Bytes  11.10.2012 21:06:52
VBASE013.VDF  : 7.11.45.213    2048 Bytes  11.10.2012 21:06:52
VBASE014.VDF  : 7.11.46.65    220160 Bytes  16.10.2012 07:35:23
VBASE015.VDF  : 7.11.46.153  173568 Bytes  18.10.2012 08:02:49
VBASE016.VDF  : 7.11.46.223  162304 Bytes  19.10.2012 09:53:20
VBASE017.VDF  : 7.11.47.35    126464 Bytes  22.10.2012 10:51:38
VBASE018.VDF  : 7.11.47.95    175616 Bytes  24.10.2012 10:51:39
VBASE019.VDF  : 7.11.47.177  164352 Bytes  26.10.2012 12:48:50
VBASE020.VDF  : 7.11.47.229  143360 Bytes  28.10.2012 22:27:18
VBASE021.VDF  : 7.11.48.47    138240 Bytes  30.10.2012 07:43:29
VBASE022.VDF  : 7.11.48.135  122880 Bytes  01.11.2012 07:43:29
VBASE023.VDF  : 7.11.48.209  142848 Bytes  05.11.2012 15:45:12
VBASE024.VDF  : 7.11.48.243  119296 Bytes  05.11.2012 15:44:54
VBASE025.VDF  : 7.11.49.47    136704 Bytes  07.11.2012 15:44:54
VBASE026.VDF  : 7.11.49.135  194560 Bytes  09.11.2012 15:44:57
VBASE027.VDF  : 7.11.49.209  188416 Bytes  12.11.2012 22:03:52
VBASE028.VDF  : 7.11.50.27    212992 Bytes  14.11.2012 22:57:06
VBASE029.VDF  : 7.11.50.105  200704 Bytes  18.11.2012 11:11:54
VBASE030.VDF  : 7.11.50.164  340992 Bytes  20.11.2012 13:41:26
VBASE031.VDF  : 7.11.50.168    15872 Bytes  20.11.2012 13:41:54
Engineversion  : 8.2.10.202
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 20:55:19
AESCRIPT.DLL  : 8.1.4.66      463227 Bytes  12.11.2012 22:03:54
AESCN.DLL      : 8.1.9.4      131445 Bytes  15.11.2012 22:57:06
AESBX.DLL      : 8.2.5.12      606578 Bytes  20.06.2012 06:47:25
AERDL.DLL      : 8.2.0.74      643445 Bytes  07.11.2012 15:44:58
AEPACK.DLL    : 8.3.0.40      815479 Bytes  12.11.2012 22:03:54
AEOFFICE.DLL  : 8.1.2.50      201084 Bytes  05.11.2012 15:45:15
AEHEUR.DLL    : 8.1.4.138    5542265 Bytes  15.11.2012 22:57:06
AEHELP.DLL    : 8.1.25.2      258423 Bytes  11.10.2012 21:06:44
AEGEN.DLL      : 8.1.6.10      438646 Bytes  15.11.2012 22:57:04
AEEXP.DLL      : 8.2.0.10      119158 Bytes  05.11.2012 15:45:15
AEEMU.DLL      : 8.1.3.2      393587 Bytes  10.07.2012 20:55:18
AECORE.DLL    : 8.1.29.2      201079 Bytes  07.11.2012 15:44:54
AEBB.DLL      : 8.1.1.4        53619 Bytes  05.11.2012 15:45:12
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  01.05.2012 22:59:21
AVPREF.DLL    : 12.3.0.32      50720 Bytes  14.11.2012 22:57:07
AVREP.DLL      : 12.3.0.15    179208 Bytes  01.05.2012 22:13:35
AVARKT.DLL    : 12.3.0.33    209696 Bytes  14.11.2012 22:57:07
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  01.05.2012 22:28:49
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  16.04.2012 21:11:02
AVSMTP.DLL    : 12.3.0.32      63480 Bytes  08.08.2012 19:29:26
NETNT.DLL      : 12.3.0.15      17104 Bytes  01.05.2012 23:33:29
RCIMAGE.DLL    : 12.3.0.31    4444408 Bytes  08.08.2012 19:29:17
RCTEXT.DLL    : 12.3.0.32      98848 Bytes  14.11.2012 22:57:06

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: D:\Programme\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, K:, N:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +JOKE,

Beginn des Suchlaufs: Dienstag, 20. November 2012  14:54

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD5
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'K:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'N:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
  [HINWEIS]  Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerofa.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'razertra.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerhid.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Windows\Sysnative\drivers\sptd.sys
  [WARNUNG]  Die Datei konnte nicht geöffnet werden!
Die Registry wurde durchsucht ( '3452' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Windows>
Beginne mit der Suche in 'D:\' <Multimedia>
Beginne mit der Suche in 'K:\' <Extern>
K:\Images Programme\Adobe CS4\Adobe CS4 Premium.7z.001
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
Beginne mit der Suche in 'N:\'
Der zu durchsuchende Pfad N:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.


Ende des Suchlaufs: Dienstag, 20. November 2012  18:51
Benötigte Zeit:  3:57:29 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  48422 Verzeichnisse wurden überprüft
 2304815 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      1 Dateien konnten nicht durchsucht werden
 2304814 Dateien ohne Befall
  32023 Archive wurden durchsucht
      2 Warnungen
      1 Hinweise
 895499 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden
Code:
OTL logfile created on: 20.11.2012 21:06:52 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = D:\Downloads\Antimalware
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 1.89 Gb Available Physical Memory | 47.25% Memory free
8.00 Gb Paging File | 5.84 Gb Available in Paging File | 72.99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 99.90 Gb Total Space | 60.48 Gb Free Space | 60.53% Space Free | Partition Type: NTFS
Drive D: | 272.61 Gb Total Space | 26.58 Gb Free Space | 9.75% Space Free | Partition Type: NTFS
Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 891.51 Gb Total Space | 181.59 Gb Free Space | 20.37% Space Free | Partition Type: NTFS
 
Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.20 21:04:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Downloads\Antimalware\OTL.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- D:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe
PRC - [2012.08.08 20:29:23 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.02 08:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd) -- D:\Programme\DAEMON Tools Lite\DTLite.exe
PRC - [2009.10.09 19:11:38 | 000,226,816 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe
PRC - [2009.03.05 15:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- D:\Programme\Spybot\TeaTimer.exe
PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Programme\Spybot\SDWinSec.exe
PRC - [2007.02.14 10:11:18 | 000,163,840 | ---- | M] (Razer Inc.) -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerofa.exe
PRC - [2007.02.07 15:00:02 | 000,131,072 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.10.09 19:11:38 | 000,226,816 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe
MOD - [2007.02.07 15:00:02 | 000,131,072 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2012.09.28 02:38:16 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.10.25 06:41:39 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.10.10 07:02:51 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- D:\Programme\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.04 14:15:25 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012.05.21 22:41:01 | 000,025,832 | ---- | M] (BioWare) [Auto | Running] -- D:\Spiele\Steam\SteamApps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
SRV - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.21 02:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.08.18 11:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.08.10 15:01:06 | 000,206,880 | ---- | M] () [Auto | Running] -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009.08.10 15:01:04 | 000,626,208 | ---- | M] () [Auto | Running] -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Programme\Spybot\SDWinSec.exe -- (SBSDWSCService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.09.28 03:21:20 | 010,697,216 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.09.28 02:12:52 | 000,460,288 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.06.24 10:20:54 | 000,303,616 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2012.06.24 10:20:54 | 000,035,328 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2012.05.21 16:44:28 | 000,526,392 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2012.05.14 07:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.05.02 14:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 09:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.24 23:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.04.20 02:07:48 | 001,930,240 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.01.15 00:19:10 | 001,101,600 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009.11.11 14:47:18 | 000,348,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.08.21 00:52:10 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2005.11.07 13:33:12 | 000,021,120 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Razerlow.sys -- (Razerlow)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1C A8 96 AF 82 A8 CD 01  [binary data]
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: firefox@ghostery.com:2.8.3
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: D:\Programme\Java\64bit\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Programme\Java\32bit\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins
 
[2012.05.21 19:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Extensions
[2012.10.24 17:16:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions
[2012.09.20 09:47:35 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions\firefox@ghostery.com
[2012.07.24 23:43:18 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\ot4iz9jl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 
O1 HOSTS File: ([2012.07.13 13:00:07 | 000,443,522 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15233 more lines...
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\64bit\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\64bit\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\32bit\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\32bit\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NVRaidService] C:\Programme\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Diamondback] D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [DAEMON Tools Lite] D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [Steam] D:\Spiele\Steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Thomas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..Trusted Domains: blank ([]about in Computer)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D798FFB-EC8F-413C-BC0C-E9CA871D27A4}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D45DA220-C9FD-4A87-88B3-1EB6143DA571}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.10.23 07:14:18 | 000,000,107 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\RunGame.exe -- [2004.10.23 07:14:18 | 000,192,512 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp
[2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\Program Files\Core Temp
[2012.11.18 16:55:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPU-Z
[2012.11.15 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\4A Games
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\ATI
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\ATI
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.11.15 16:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2012.11.15 16:00:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2012.11.15 16:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2012.11.15 16:00:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.11.15 15:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2012.11.15 15:58:53 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.11.15 15:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.11.15 15:57:33 | 000,000,000 | ---D | C] -- C:\AMD
[2012.11.15 14:41:32 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\4a games
[2012.11.12 12:33:34 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Diagnostics
[2012.11.08 16:40:07 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Electronic Arts
[2012.11.08 16:39:58 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electronic Arts
[2012.11.08 16:39:20 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electrontic Arts
[2012.11.06 19:50:18 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.11.01 10:51:50 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\NFS Underground 2
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.20 20:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.20 14:46:51 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.20 14:46:51 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.20 14:38:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.20 14:38:42 | 3220,074,496 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.20 12:27:42 | 000,000,741 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.18 18:09:15 | 440,077,062 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.11.18 17:45:46 | 000,000,672 | ---- | M] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk
[2012.11.18 17:45:45 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.11.18 16:59:32 | 000,001,387 | ---- | M] () -- C:\Users\Thomas\Desktop\Core Temp.lnk
[2012.11.15 16:11:50 | 000,001,017 | ---- | M] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk
[2012.11.15 16:07:53 | 000,000,208 | ---- | M] () -- C:\Users\Thomas\Desktop\Metro 2033.url
[2012.11.15 16:02:18 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2012.11.15 15:30:08 | 002,274,000 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.15 15:24:39 | 001,663,204 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.15 15:24:39 | 000,707,300 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.15 15:24:39 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.15 15:24:39 | 000,152,892 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.15 15:24:39 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.08 00:32:40 | 000,000,218 | ---- | M] () -- C:\Users\Thomas\.recently-used.xbel
[2012.11.01 10:50:09 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.18 17:45:46 | 000,000,672 | ---- | C] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk
[2012.11.18 17:45:45 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.11.18 16:59:32 | 000,001,387 | ---- | C] () -- C:\Users\Thomas\Desktop\Core Temp.lnk
[2012.11.15 16:11:50 | 000,001,017 | ---- | C] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk
[2012.11.15 16:07:53 | 000,000,208 | ---- | C] () -- C:\Users\Thomas\Desktop\Metro 2033.url
[2012.11.15 16:02:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.11.15 15:22:59 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 15:15:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.08 00:32:40 | 000,000,218 | ---- | C] () -- C:\Users\Thomas\.recently-used.xbel
[2012.11.06 19:50:12 | 440,077,062 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.11.01 10:50:09 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk
[2012.10.21 00:16:44 | 000,001,148 | ---- | C] () -- C:\Users\Thomas\AppData\Roaming\EasyToolz.ini
[2012.09.28 02:29:54 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.09.28 02:29:54 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.09.10 08:32:05 | 001,618,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.09.28 16:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.08.03 09:04:24 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.minecraft
[2012.07.11 19:00:56 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.Nitrous
[2012.11.20 13:42:03 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.purple
[2012.08.23 14:19:19 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\DAEMON Tools Lite
[2012.11.20 14:39:29 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Dropbox
[2012.11.19 00:31:04 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\gtk-2.0
[2012.08.31 06:59:48 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\ICQ
[2012.09.14 19:55:01 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\ImgBurn
[2012.10.21 01:17:45 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Kalypso Media
[2012.05.21 16:43:10 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Opera
[2012.07.10 09:51:16 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\pdfforge
[2012.09.12 15:21:33 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\runic games
[2012.08.31 09:03:26 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Trillian
[2012.09.25 23:44:08 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\wargaming.net
[2012.10.18 10:25:09 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\WOT Statistics
 
========== Purity Check ==========
 
 

< End of report >

cosinus 21.11.2012 19:41
Hallo und :hallo:

Zitat:
K:\Images Programme\Adobe CS4\Adobe CS4 Premium.7z.001
Was bitte soll das sein? Vertreibt Adobe neuerdings CS4 im 7z Format auf mehrere Volumes verteilt?

Dirtbag 21.11.2012 19:43
Das ist das Image von Photoshop, was ich von der Uni so erhalten habe, aufgeteilt in mehrere Container, inklusive Key für die Nutzung zuhause. Den werde ich hier aber nicht zur Kontrolle reinschreiben. ;)
Ich dachte mir schon, dass das Fragen aufwerfen würde, konnte den Post aber nicht mehr editieren.

Mittlerweile bin ich fertig mit dem Studium, nutze Photoshop privat auch nicht, das Image ist aber nach wie vor noch existent.

cosinus 21.11.2012 21:10
Zitat:
aufgeteilt in mehrere Container, inklusive Key für die Nutzung zuhause
Rein zufällig machen das auch illegale Portale wie die boerse das so :pfeiff:

Dirtbag 21.11.2012 21:39
Das ist mir bewusst.
Ich habe es von einem CIP-Pool-Betreuer bekommen, genutzt habe ich es nicht. Mir reichte immer der Vorgänger. Wo er es her hat, weiß ich nicht, habe nie gefragt. Ich wusste ja, dass dieses Image noch irgendwo auf meinem PC rumfliegt - hätte ich es als illegal eingestuft, hätte ich vermutlich meine Log-Files vorher gründlich durchgelesen und dann editiert. So sah ich keine Notwendigkeit dazu und hab sie direkt hochgeladen.

Wie dem auch sei:
Aufgrund der zugegebenermaßen zweifelhaften Datei fällt mein Post wohl unter die Kategorie "ohne Diskussion Einstellung der Hilfe". Denn schreiben und erzählen kann ich hier viel. Mein Fehler, akzeptiere ich, verstehe ich.
Und um ähnliche Vorkommnisse in Zukunft zu vermeiden, ist das Image jetzt außerdem gelöscht.


Nichtsdestotrotz würde ich mich freuen, zumindest ein kurzes Statement zu bekommen, ob mein System nun sauber oder nicht sauber ist. Das reicht mir schon. Wenn nicht sauber, setze ich einfach das System neu auf.

Danke. :)

cosinus 22.11.2012 12:16
Ich drück ausnahmsweise nochmal ein Auge zu, schließlich kannst du es ja wirklich "offiziell" von der Uni bekommen haben ;)

Zitat:
Und um ähnliche Vorkommnisse in Zukunft zu vermeiden, ist das Image jetzt außerdem gelöscht.
Noch besser :daumenhoc


Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Dirtbag 22.11.2012 13:36
Danke! :)

Und hier sind die gewünschten Logs.

aswMBR Scan-Log:
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-22 13:16:52
-----------------------------
13:16:52.989    OS Version: Windows x64 6.1.7601 Service Pack 1
13:16:52.989    Number of processors: 4 586 0xF0B
13:16:52.989    ComputerName: BEHEMOTH  UserName: Thomas
13:16:53.332    Initialize success
13:16:58.761    AVAST engine defs: 12112200
13:17:08.994    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000063
13:17:08.994    Disk 0 Vendor: WDC_WD40 01.0 Size: 381554MB BusType: 3
13:17:09.010    Disk 0 MBR read successfully
13:17:09.010    Disk 0 MBR scan
13:17:09.010    Disk 0 Windows 7 default MBR code
13:17:09.026    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
13:17:09.041    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      102300 MB offset 206848
13:17:09.057    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      279152 MB offset 209717248
13:17:09.072    Disk 0 scanning C:\Windows\system32\drivers
13:17:18.198    Service scanning
13:17:33.814    Modules scanning
13:17:33.814    Disk 0 trace - called modules:
13:17:33.830    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80048e92c0]<<sptd.sys storport.sys hal.dll nvstor64.sys
13:17:33.830    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c36060]
13:17:33.845    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8003ff5d30]
13:17:33.845    5 ACPI.sys[fffff88000eef7a1] -> nt!IofCallDriver -> \Device\00000063[0xfffffa8003ff49c0]
13:17:33.845    \Driver\nvstor64[0xfffffa80049de9e0] -> IRP_MJ_CREATE -> 0xfffffa80048e92c0
13:17:34.235    AVAST engine scan C:\Windows
13:17:35.514    AVAST engine scan C:\Windows\system32
13:20:07.708    AVAST engine scan C:\Windows\system32\drivers
13:20:16.007    AVAST engine scan C:\Users\Thomas
13:22:41.446    AVAST engine scan C:\ProgramData
13:23:06.827    Scan finished successfully
13:23:34.595    Disk 0 MBR has been saved successfully to "D:\Dokumente\Scan-Logs\MBR.dat"
13:23:34.595    The log file has been saved successfully to "D:\Dokumente\Scan-Logs\aswMBR_scanlog_22112012.txt"

TDSSKiller Scan-Log:
Code:
13:26:00.0726 3952  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
13:26:00.0742 3952  ============================================================
13:26:00.0742 3952  Current date / time: 2012/11/22 13:26:00.0742
13:26:00.0742 3952  SystemInfo:
13:26:00.0742 3952 
13:26:00.0742 3952  OS Version: 6.1.7601 ServicePack: 1.0
13:26:00.0742 3952  Product type: Workstation
13:26:00.0742 3952  ComputerName: BEHEMOTH
13:26:00.0742 3952  UserName: Thomas
13:26:00.0742 3952  Windows directory: C:\Windows
13:26:00.0742 3952  System windows directory: C:\Windows
13:26:00.0742 3952  Running under WOW64
13:26:00.0742 3952  Processor architecture: Intel x64
13:26:00.0742 3952  Number of processors: 4
13:26:00.0742 3952  Page size: 0x1000
13:26:00.0742 3952  Boot type: Normal boot
13:26:00.0742 3952  ============================================================
13:26:01.0506 3952  Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xC9E1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
13:26:01.0537 3952  Drive \Device\Harddisk5\DR5 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
13:26:01.0537 3952  ============================================================
13:26:01.0537 3952  \Device\Harddisk0\DR0:
13:26:01.0553 3952  MBR partitions:
13:26:01.0553 3952  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:26:01.0553 3952  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC7CE000
13:26:01.0553 3952  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0xC800800, BlocksNum 0x22138000
13:26:01.0553 3952  \Device\Harddisk5\DR5:
13:26:01.0553 3952  MBR partitions:
13:26:01.0553 3952  \Device\Harddisk5\DR5\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x6F7057F8
13:26:01.0553 3952  \Device\Harddisk5\DR5\Partition2: MBR, Type 0x7, StartLBA 0x6F706000, BlocksNum 0x4FFF800
13:26:01.0553 3952  ============================================================
13:26:01.0584 3952  C: <-> \Device\Harddisk0\DR0\Partition2
13:26:01.0600 3952  D: <-> \Device\Harddisk0\DR0\Partition3
13:26:01.0600 3952  K: <-> \Device\Harddisk5\DR5\Partition1
13:26:01.0600 3952  ============================================================
13:26:01.0600 3952  Initialize success
13:26:01.0600 3952  ============================================================
13:26:28.0260 2924  ============================================================
13:26:28.0260 2924  Scan started
13:26:28.0260 2924  Mode: Manual; SigCheck; TDLFS;
13:26:28.0260 2924  ============================================================
13:26:28.0900 2924  ================ Scan system memory ========================
13:26:28.0900 2924  System memory - ok
13:26:28.0900 2924  ================ Scan services =============================
13:26:29.0040 2924  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
13:26:29.0118 2924  1394ohci - ok
13:26:29.0181 2924  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
13:26:29.0196 2924  ACPI - ok
13:26:29.0227 2924  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
13:26:29.0290 2924  AcpiPmi - ok
13:26:29.0399 2924  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:26:29.0399 2924  AdobeARMservice - ok
13:26:29.0508 2924  [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
13:26:29.0508 2924  AdobeFlashPlayerUpdateSvc - ok
13:26:29.0555 2924  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
13:26:29.0571 2924  adp94xx - ok
13:26:29.0602 2924  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
13:26:29.0617 2924  adpahci - ok
13:26:29.0617 2924  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
13:26:29.0633 2924  adpu320 - ok
13:26:29.0649 2924  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
13:26:29.0773 2924  AeLookupSvc - ok
13:26:29.0820 2924  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
13:26:29.0867 2924  AFD - ok
13:26:29.0898 2924  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
13:26:29.0914 2924  agp440 - ok
13:26:29.0929 2924  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
13:26:29.0992 2924  ALG - ok
13:26:29.0992 2924  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
13:26:30.0007 2924  aliide - ok
13:26:30.0039 2924  [ 4C1E3649C89C7D542CD18ECC5210099D ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
13:26:30.0117 2924  AMD External Events Utility - ok
13:26:30.0132 2924  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
13:26:30.0148 2924  amdide - ok
13:26:30.0148 2924  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
13:26:30.0195 2924  AmdK8 - ok
13:26:30.0475 2924  [ A3C0A15B39F979E8F3EABA901D72ECD7 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
13:26:30.0787 2924  amdkmdag - ok
13:26:30.0850 2924  [ 20F3CD38B107C1BD747C0EA37D450165 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
13:26:30.0881 2924  amdkmdap - ok
13:26:30.0897 2924  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
13:26:30.0928 2924  AmdPPM - ok
13:26:30.0943 2924  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
13:26:30.0959 2924  amdsata - ok
13:26:30.0990 2924  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
13:26:30.0990 2924  amdsbs - ok
13:26:31.0006 2924  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
13:26:31.0021 2924  amdxata - ok
13:26:31.0068 2924  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService D:\Programme\Avira\AntiVir Desktop\sched.exe
13:26:31.0099 2924  AntiVirSchedulerService - ok
13:26:31.0115 2924  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  D:\Programme\Avira\AntiVir Desktop\avguard.exe
13:26:31.0131 2924  AntiVirService - ok
13:26:31.0162 2924  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
13:26:31.0333 2924  AppID - ok
13:26:31.0349 2924  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
13:26:31.0380 2924  AppIDSvc - ok
13:26:31.0411 2924  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
13:26:31.0458 2924  Appinfo - ok
13:26:31.0489 2924  [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:26:31.0489 2924  Apple Mobile Device - ok
13:26:31.0536 2924  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt        C:\Windows\System32\appmgmts.dll
13:26:31.0599 2924  AppMgmt - ok
13:26:31.0614 2924  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
13:26:31.0630 2924  arc - ok
13:26:31.0645 2924  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
13:26:31.0645 2924  arcsas - ok
13:26:31.0723 2924  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
13:26:31.0786 2924  aspnet_state - ok
13:26:31.0801 2924  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
13:26:31.0848 2924  AsyncMac - ok
13:26:31.0879 2924  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
13:26:31.0879 2924  atapi - ok
13:26:31.0973 2924  [ EA0AF9B866DF07E8FE6C2342585788B0 ] athur          C:\Windows\system32\DRIVERS\athurx.sys
13:26:32.0067 2924  athur - ok
13:26:32.0129 2924  [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
13:26:32.0160 2924  AtiHDAudioService - ok
13:26:32.0207 2924  [ 4AEF9EC86818375495FB78CA58DF4E18 ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys
13:26:32.0223 2924  atksgt ( UnsignedFile.Multi.Generic ) - warning
13:26:32.0223 2924  atksgt - detected UnsignedFile.Multi.Generic (1)
13:26:32.0285 2924  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
13:26:32.0363 2924  AudioEndpointBuilder - ok
13:26:32.0394 2924  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
13:26:32.0425 2924  AudioSrv - ok
13:26:32.0457 2924  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
13:26:32.0472 2924  avgntflt - ok
13:26:32.0472 2924  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
13:26:32.0488 2924  avipbb - ok
13:26:32.0503 2924  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
13:26:32.0519 2924  avkmgr - ok
13:26:32.0550 2924  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
13:26:32.0613 2924  AxInstSV - ok
13:26:32.0659 2924  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
13:26:32.0691 2924  b06bdrv - ok
13:26:32.0722 2924  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
13:26:32.0753 2924  b57nd60a - ok
13:26:32.0784 2924  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
13:26:32.0800 2924  BDESVC - ok
13:26:32.0815 2924  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
13:26:32.0847 2924  Beep - ok
13:26:32.0925 2924  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
13:26:32.0971 2924  BFE - ok
13:26:33.0034 2924  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
13:26:33.0096 2924  BITS - ok
13:26:33.0127 2924  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
13:26:33.0143 2924  blbdrive - ok
13:26:33.0205 2924  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
13:26:33.0221 2924  Bonjour Service - ok
13:26:33.0252 2924  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
13:26:33.0299 2924  bowser - ok
13:26:33.0315 2924  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:26:33.0361 2924  BrFiltLo - ok
13:26:33.0377 2924  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:26:33.0393 2924  BrFiltUp - ok
13:26:33.0424 2924  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
13:26:33.0439 2924  Browser - ok
13:26:33.0455 2924  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
13:26:33.0517 2924  Brserid - ok
13:26:33.0517 2924  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
13:26:33.0549 2924  BrSerWdm - ok
13:26:33.0549 2924  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
13:26:33.0580 2924  BrUsbMdm - ok
13:26:33.0595 2924  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
13:26:33.0611 2924  BrUsbSer - ok
13:26:33.0611 2924  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
13:26:33.0642 2924  BTHMODEM - ok
13:26:33.0658 2924  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
13:26:33.0705 2924  bthserv - ok
13:26:33.0720 2924  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
13:26:33.0767 2924  cdfs - ok
13:26:33.0814 2924  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\drivers\cdrom.sys
13:26:33.0845 2924  cdrom - ok
13:26:33.0876 2924  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
13:26:33.0923 2924  CertPropSvc - ok
13:26:33.0939 2924  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
13:26:33.0954 2924  circlass - ok
13:26:33.0970 2924  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
13:26:33.0985 2924  CLFS - ok
13:26:34.0032 2924  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:26:34.0032 2924  clr_optimization_v2.0.50727_32 - ok
13:26:34.0079 2924  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:26:34.0079 2924  clr_optimization_v2.0.50727_64 - ok
13:26:34.0141 2924  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:26:34.0266 2924  clr_optimization_v4.0.30319_32 - ok
13:26:34.0282 2924  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:26:34.0297 2924  clr_optimization_v4.0.30319_64 - ok
13:26:34.0329 2924  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
13:26:34.0329 2924  CmBatt - ok
13:26:34.0344 2924  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
13:26:34.0360 2924  cmdide - ok
13:26:34.0391 2924  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
13:26:34.0438 2924  CNG - ok
13:26:34.0453 2924  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
13:26:34.0469 2924  Compbatt - ok
13:26:34.0500 2924  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
13:26:34.0516 2924  CompositeBus - ok
13:26:34.0547 2924  COMSysApp - ok
13:26:34.0547 2924  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
13:26:34.0563 2924  crcdisk - ok
13:26:34.0578 2924  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
13:26:34.0625 2924  CryptSvc - ok
13:26:34.0687 2924  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC            C:\Windows\system32\drivers\csc.sys
13:26:34.0719 2924  CSC - ok
13:26:34.0765 2924  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
13:26:34.0797 2924  CscService - ok
13:26:34.0906 2924  [ 914A7156B0C0F10BE645A02E13F576B2 ] DAUpdaterSvc    D:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe
13:26:34.0921 2924  DAUpdaterSvc - ok
13:26:34.0968 2924  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
13:26:35.0015 2924  DcomLaunch - ok
13:26:35.0062 2924  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
13:26:35.0109 2924  defragsvc - ok
13:26:35.0140 2924  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
13:26:35.0187 2924  DfsC - ok
13:26:35.0202 2924  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
13:26:35.0249 2924  Dhcp - ok
13:26:35.0265 2924  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
13:26:35.0296 2924  discache - ok
13:26:35.0311 2924  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
13:26:35.0327 2924  Disk - ok
13:26:35.0343 2924  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
13:26:35.0389 2924  Dnscache - ok
13:26:35.0421 2924  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
13:26:35.0452 2924  dot3svc - ok
13:26:35.0483 2924  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
13:26:35.0530 2924  DPS - ok
13:26:35.0545 2924  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
13:26:35.0577 2924  drmkaud - ok
13:26:35.0639 2924  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
13:26:35.0670 2924  DXGKrnl - ok
13:26:35.0701 2924  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
13:26:35.0733 2924  EapHost - ok
13:26:35.0826 2924  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
13:26:35.0935 2924  ebdrv - ok
13:26:35.0982 2924  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
13:26:36.0029 2924  EFS - ok
13:26:36.0076 2924  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
13:26:36.0123 2924  ehRecvr - ok
13:26:36.0154 2924  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
13:26:36.0185 2924  ehSched - ok
13:26:36.0232 2924  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
13:26:36.0263 2924  elxstor - ok
13:26:36.0263 2924  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
13:26:36.0279 2924  ErrDev - ok
13:26:36.0310 2924  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
13:26:36.0357 2924  EventSystem - ok
13:26:36.0372 2924  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
13:26:36.0403 2924  exfat - ok
13:26:36.0419 2924  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
13:26:36.0466 2924  fastfat - ok
13:26:36.0528 2924  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
13:26:36.0575 2924  Fax - ok
13:26:36.0575 2924  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
13:26:36.0606 2924  fdc - ok
13:26:36.0606 2924  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
13:26:36.0653 2924  fdPHost - ok
13:26:36.0669 2924  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
13:26:36.0700 2924  FDResPub - ok
13:26:36.0715 2924  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
13:26:36.0715 2924  FileInfo - ok
13:26:36.0731 2924  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
13:26:36.0778 2924  Filetrace - ok
13:26:36.0840 2924  [ 227846995AFEEFA70D328BF5334A86A5 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
13:26:36.0871 2924  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
13:26:36.0871 2924  FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
13:26:36.0887 2924  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
13:26:36.0887 2924  flpydisk - ok
13:26:36.0918 2924  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
13:26:36.0934 2924  FltMgr - ok
13:26:36.0996 2924  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
13:26:37.0059 2924  FontCache - ok
13:26:37.0105 2924  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:26:37.0105 2924  FontCache3.0.0.0 - ok
13:26:37.0183 2924  [ 52B58A46BEEFB238C580B69FD051CB5B ] ForceWare Intelligent Application Manager (IAM) D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
13:26:37.0215 2924  ForceWare Intelligent Application Manager (IAM) - ok
13:26:37.0230 2924  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
13:26:37.0246 2924  FsDepends - ok
13:26:37.0261 2924  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
13:26:37.0277 2924  Fs_Rec - ok
13:26:37.0308 2924  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
13:26:37.0324 2924  fvevol - ok
13:26:37.0339 2924  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
13:26:37.0355 2924  gagp30kx - ok
13:26:37.0371 2924  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
13:26:37.0386 2924  GEARAspiWDM - ok
13:26:37.0449 2924  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
13:26:37.0495 2924  gpsvc - ok
13:26:37.0542 2924  [ C1B577B2169900F4CF7190C39F085794 ] gusvc          C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
13:26:37.0542 2924  gusvc - ok
13:26:37.0558 2924  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
13:26:37.0605 2924  hcw85cir - ok
13:26:37.0651 2924  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
13:26:37.0683 2924  HdAudAddService - ok
13:26:37.0714 2924  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
13:26:37.0729 2924  HDAudBus - ok
13:26:37.0745 2924  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
13:26:37.0761 2924  HidBatt - ok
13:26:37.0776 2924  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
13:26:37.0792 2924  HidBth - ok
13:26:37.0807 2924  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
13:26:37.0823 2924  HidIr - ok
13:26:37.0839 2924  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
13:26:37.0885 2924  hidserv - ok
13:26:37.0948 2924  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
13:26:37.0948 2924  HidUsb - ok
13:26:37.0979 2924  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
13:26:38.0026 2924  hkmsvc - ok
13:26:38.0057 2924  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
13:26:38.0104 2924  HomeGroupListener - ok
13:26:38.0119 2924  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
13:26:38.0151 2924  HomeGroupProvider - ok
13:26:38.0182 2924  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
13:26:38.0197 2924  HpSAMD - ok
13:26:38.0275 2924  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
13:26:38.0322 2924  HTTP - ok
13:26:38.0338 2924  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
13:26:38.0353 2924  hwpolicy - ok
13:26:38.0385 2924  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
13:26:38.0400 2924  i8042prt - ok
13:26:38.0416 2924  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
13:26:38.0431 2924  iaStorV - ok
13:26:38.0494 2924  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:26:38.0525 2924  idsvc - ok
13:26:38.0541 2924  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
13:26:38.0556 2924  iirsp - ok
13:26:38.0603 2924  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
13:26:38.0650 2924  IKEEXT - ok
13:26:38.0775 2924  [ A5F7CEF8A939EBE270462EDEFD629F20 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
13:26:38.0884 2924  IntcAzAudAddService - ok
13:26:38.0884 2924  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
13:26:38.0899 2924  intelide - ok
13:26:38.0915 2924  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
13:26:38.0946 2924  intelppm - ok
13:26:38.0962 2924  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
13:26:39.0009 2924  IPBusEnum - ok
13:26:39.0040 2924  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:26:39.0071 2924  IpFilterDriver - ok
13:26:39.0133 2924  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
13:26:39.0196 2924  iphlpsvc - ok
13:26:39.0211 2924  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
13:26:39.0227 2924  IPMIDRV - ok
13:26:39.0243 2924  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
13:26:39.0274 2924  IPNAT - ok
13:26:39.0336 2924  [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
13:26:39.0383 2924  iPod Service - ok
13:26:39.0399 2924  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
13:26:39.0477 2924  IRENUM - ok
13:26:39.0492 2924  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
13:26:39.0508 2924  isapnp - ok
13:26:39.0523 2924  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
13:26:39.0539 2924  iScsiPrt - ok
13:26:39.0570 2924  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
13:26:39.0570 2924  kbdclass - ok
13:26:39.0601 2924  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
13:26:39.0617 2924  kbdhid - ok
13:26:39.0633 2924  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
13:26:39.0648 2924  KeyIso - ok
13:26:39.0664 2924  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
13:26:39.0679 2924  KSecDD - ok
13:26:39.0711 2924  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
13:26:39.0726 2924  KSecPkg - ok
13:26:39.0742 2924  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
13:26:39.0773 2924  ksthunk - ok
13:26:39.0804 2924  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
13:26:39.0851 2924  KtmRm - ok
13:26:39.0851 2924  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
13:26:39.0898 2924  LanmanServer - ok
13:26:39.0929 2924  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
13:26:39.0976 2924  LanmanWorkstation - ok
13:26:40.0007 2924  [ B658B7076B1ACAA5876524595630F183 ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys
13:26:40.0023 2924  lirsgt ( UnsignedFile.Multi.Generic ) - warning
13:26:40.0023 2924  lirsgt - detected UnsignedFile.Multi.Generic (1)
13:26:40.0038 2924  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
13:26:40.0069 2924  lltdio - ok
13:26:40.0101 2924  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
13:26:40.0163 2924  lltdsvc - ok
13:26:40.0179 2924  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
13:26:40.0210 2924  lmhosts - ok
13:26:40.0225 2924  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
13:26:40.0241 2924  LSI_FC - ok
13:26:40.0241 2924  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
13:26:40.0257 2924  LSI_SAS - ok
13:26:40.0272 2924  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:26:40.0272 2924  LSI_SAS2 - ok
13:26:40.0288 2924  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:26:40.0303 2924  LSI_SCSI - ok
13:26:40.0319 2924  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
13:26:40.0350 2924  luafv - ok
13:26:40.0397 2924  [ A8FE8F2783B2929B56F5370A89356CE9 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
13:26:40.0413 2924  MBAMProtector - ok
13:26:40.0475 2924  [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler  D:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe
13:26:40.0491 2924  MBAMScheduler - ok
13:26:40.0553 2924  [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService    D:\Programme\Malwarebytes Anti-Malware\mbamservice.exe
13:26:40.0569 2924  MBAMService - ok
13:26:40.0600 2924  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
13:26:40.0631 2924  Mcx2Svc - ok
13:26:40.0693 2924  [ 7CF1B716372B89568AE4C0FE769F5869 ] MDM            C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
13:26:40.0709 2924  MDM ( UnsignedFile.Multi.Generic ) - warning
13:26:40.0709 2924  MDM - detected UnsignedFile.Multi.Generic (1)
13:26:40.0709 2924  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
13:26:40.0725 2924  megasas - ok
13:26:40.0740 2924  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
13:26:40.0756 2924  MegaSR - ok
13:26:40.0787 2924  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
13:26:40.0818 2924  MMCSS - ok
13:26:40.0834 2924  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
13:26:40.0865 2924  Modem - ok
13:26:40.0896 2924  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
13:26:40.0927 2924  monitor - ok
13:26:40.0943 2924  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
13:26:40.0959 2924  mouclass - ok
13:26:40.0990 2924  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
13:26:41.0005 2924  mouhid - ok
13:26:41.0037 2924  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
13:26:41.0052 2924  mountmgr - ok
13:26:41.0083 2924  [ 96AA8BA23142CC8E2B30F3CAE0C80254 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
13:26:41.0083 2924  MozillaMaintenance - ok
13:26:41.0115 2924  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
13:26:41.0115 2924  mpio - ok
13:26:41.0130 2924  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
13:26:41.0177 2924  mpsdrv - ok
13:26:41.0239 2924  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
13:26:41.0286 2924  MpsSvc - ok
13:26:41.0317 2924  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
13:26:41.0349 2924  MRxDAV - ok
13:26:41.0380 2924  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
13:26:41.0411 2924  mrxsmb - ok
13:26:41.0427 2924  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:26:41.0458 2924  mrxsmb10 - ok
13:26:41.0473 2924  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:26:41.0489 2924  mrxsmb20 - ok
13:26:41.0505 2924  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
13:26:41.0520 2924  msahci - ok
13:26:41.0536 2924  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
13:26:41.0551 2924  msdsm - ok
13:26:41.0551 2924  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
13:26:41.0583 2924  MSDTC - ok
13:26:41.0614 2924  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
13:26:41.0629 2924  Msfs - ok
13:26:41.0645 2924  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
13:26:41.0676 2924  mshidkmdf - ok
13:26:41.0707 2924  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
13:26:41.0723 2924  msisadrv - ok
13:26:41.0754 2924  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
13:26:41.0785 2924  MSiSCSI - ok
13:26:41.0785 2924  msiserver - ok
13:26:41.0817 2924  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
13:26:41.0848 2924  MSKSSRV - ok
13:26:41.0863 2924  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
13:26:41.0895 2924  MSPCLOCK - ok
13:26:41.0910 2924  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
13:26:41.0941 2924  MSPQM - ok
13:26:41.0973 2924  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
13:26:41.0988 2924  MsRPC - ok
13:26:42.0004 2924  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
13:26:42.0019 2924  mssmbios - ok
13:26:42.0019 2924  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
13:26:42.0066 2924  MSTEE - ok
13:26:42.0066 2924  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
13:26:42.0082 2924  MTConfig - ok
13:26:42.0097 2924  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
13:26:42.0113 2924  Mup - ok
13:26:42.0160 2924  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
13:26:42.0207 2924  napagent - ok
13:26:42.0222 2924  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
13:26:42.0253 2924  NativeWifiP - ok
13:26:42.0316 2924  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
13:26:42.0363 2924  NDIS - ok
13:26:42.0378 2924  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
13:26:42.0409 2924  NdisCap - ok
13:26:42.0425 2924  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
13:26:42.0456 2924  NdisTapi - ok
13:26:42.0487 2924  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
13:26:42.0519 2924  Ndisuio - ok
13:26:42.0534 2924  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
13:26:42.0581 2924  NdisWan - ok
13:26:42.0612 2924  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
13:26:42.0659 2924  NDProxy - ok
13:26:42.0675 2924  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
13:26:42.0721 2924  NetBIOS - ok
13:26:42.0753 2924  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
13:26:42.0784 2924  NetBT - ok
13:26:42.0799 2924  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
13:26:42.0815 2924  Netlogon - ok
13:26:42.0846 2924  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
13:26:42.0877 2924  Netman - ok
13:26:42.0940 2924  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:26:42.0940 2924  NetMsmqActivator - ok
13:26:42.0971 2924  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:26:42.0971 2924  NetPipeActivator - ok
13:26:43.0002 2924  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
13:26:43.0033 2924  netprofm - ok
13:26:43.0096 2924  [ E005682AE8F8EC4EB05F2A70A16EA1C5 ] netr28ux        C:\Windows\system32\DRIVERS\netr28ux.sys
13:26:43.0143 2924  netr28ux - ok
13:26:43.0158 2924  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:26:43.0174 2924  NetTcpActivator - ok
13:26:43.0174 2924  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:26:43.0189 2924  NetTcpPortSharing - ok
13:26:43.0189 2924  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
13:26:43.0205 2924  nfrd960 - ok
13:26:43.0236 2924  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
13:26:43.0252 2924  NlaSvc - ok
13:26:43.0283 2924  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
13:26:43.0299 2924  Npfs - ok
13:26:43.0314 2924  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
13:26:43.0361 2924  nsi - ok
13:26:43.0377 2924  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
13:26:43.0408 2924  nsiproxy - ok
13:26:43.0439 2924  [ 20E179A7FE78B37A02D30C4D34C870E7 ] nSvcIp          D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
13:26:43.0455 2924  nSvcIp - ok
13:26:43.0533 2924  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
13:26:43.0595 2924  Ntfs - ok
13:26:43.0611 2924  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
13:26:43.0642 2924  Null - ok
13:26:43.0689 2924  [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys
13:26:43.0720 2924  NVENETFD - ok
13:26:43.0735 2924  nvlddmkm - ok
13:26:43.0767 2924  [ C42C32BF90A78D72D4B7C144FF907FB6 ] NVNET          C:\Windows\system32\DRIVERS\nvmf6264.sys
13:26:43.0782 2924  NVNET - ok
13:26:43.0829 2924  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
13:26:43.0829 2924  nvraid - ok
13:26:43.0860 2924  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
13:26:43.0860 2924  nvstor - ok
13:26:43.0876 2924  [ 71B6ECD3C56FBF12FB1968DA3953B703 ] nvstor64        C:\Windows\system32\DRIVERS\nvstor64.sys
13:26:43.0891 2924  nvstor64 - ok
13:26:43.0907 2924  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
13:26:43.0907 2924  nv_agp - ok
13:26:43.0969 2924  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
13:26:43.0985 2924  odserv - ok
13:26:44.0016 2924  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
13:26:44.0032 2924  ohci1394 - ok
13:26:44.0063 2924  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:26:44.0079 2924  ose - ok
13:26:44.0094 2924  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
13:26:44.0125 2924  p2pimsvc - ok
13:26:44.0157 2924  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
13:26:44.0172 2924  p2psvc - ok
13:26:44.0188 2924  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
13:26:44.0203 2924  Parport - ok
13:26:44.0235 2924  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
13:26:44.0235 2924  partmgr - ok
13:26:44.0266 2924  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
13:26:44.0281 2924  PcaSvc - ok
13:26:44.0297 2924  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
13:26:44.0313 2924  pci - ok
13:26:44.0344 2924  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
13:26:44.0344 2924  pciide - ok
13:26:44.0375 2924  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
13:26:44.0391 2924  pcmcia - ok
13:26:44.0391 2924  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
13:26:44.0406 2924  pcw - ok
13:26:44.0453 2924  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
13:26:44.0500 2924  PEAUTH - ok
13:26:44.0562 2924  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
13:26:44.0656 2924  PeerDistSvc - ok
13:26:44.0718 2924  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
13:26:44.0734 2924  PerfHost - ok
13:26:44.0812 2924  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
13:26:44.0890 2924  pla - ok
13:26:44.0968 2924  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
13:26:44.0983 2924  PlugPlay - ok
13:26:44.0999 2924  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
13:26:45.0030 2924  PNRPAutoReg - ok
13:26:45.0046 2924  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
13:26:45.0061 2924  PNRPsvc - ok
13:26:45.0093 2924  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
13:26:45.0139 2924  PolicyAgent - ok
13:26:45.0155 2924  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
13:26:45.0202 2924  Power - ok
13:26:45.0217 2924  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
13:26:45.0249 2924  PptpMiniport - ok
13:26:45.0264 2924  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
13:26:45.0280 2924  Processor - ok
13:26:45.0295 2924  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
13:26:45.0342 2924  ProfSvc - ok
13:26:45.0358 2924  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
13:26:45.0358 2924  ProtectedStorage - ok
13:26:45.0405 2924  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
13:26:45.0436 2924  Psched - ok
13:26:45.0514 2924  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
13:26:45.0576 2924  ql2300 - ok
13:26:45.0592 2924  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
13:26:45.0607 2924  ql40xx - ok
13:26:45.0639 2924  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
13:26:45.0670 2924  QWAVE - ok
13:26:45.0685 2924  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
13:26:45.0701 2924  QWAVEdrv - ok
13:26:45.0732 2924  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
13:26:45.0763 2924  RasAcd - ok
13:26:45.0779 2924  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
13:26:45.0810 2924  RasAgileVpn - ok
13:26:45.0826 2924  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
13:26:45.0873 2924  RasAuto - ok
13:26:45.0904 2924  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
13:26:45.0935 2924  Rasl2tp - ok
13:26:45.0966 2924  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
13:26:46.0013 2924  RasMan - ok
13:26:46.0029 2924  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
13:26:46.0075 2924  RasPppoe - ok
13:26:46.0091 2924  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
13:26:46.0122 2924  RasSstp - ok
13:26:46.0153 2924  [ 81DDBF4FE998EF1F4BA230F7E8D8C67E ] Razerlow        C:\Windows\system32\drivers\Razerlow.sys
13:26:46.0185 2924  Razerlow - ok
13:26:46.0216 2924  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
13:26:46.0247 2924  rdbss - ok
13:26:46.0263 2924  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
13:26:46.0278 2924  rdpbus - ok
13:26:46.0294 2924  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
13:26:46.0325 2924  RDPCDD - ok
13:26:46.0341 2924  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
13:26:46.0387 2924  RDPDR - ok
13:26:46.0403 2924  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
13:26:46.0434 2924  RDPENCDD - ok
13:26:46.0450 2924  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
13:26:46.0481 2924  RDPREFMP - ok
13:26:46.0512 2924  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
13:26:46.0559 2924  RDPWD - ok
13:26:46.0575 2924  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
13:26:46.0590 2924  rdyboost - ok
13:26:46.0621 2924  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
13:26:46.0653 2924  RemoteAccess - ok
13:26:46.0684 2924  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
13:26:46.0731 2924  RemoteRegistry - ok
13:26:46.0746 2924  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
13:26:46.0793 2924  RpcEptMapper - ok
13:26:46.0809 2924  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
13:26:46.0840 2924  RpcLocator - ok
13:26:46.0887 2924  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
13:26:46.0918 2924  RpcSs - ok
13:26:46.0933 2924  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
13:26:46.0980 2924  rspndr - ok
13:26:46.0996 2924  [ E60C0A09F997826C7627B244195AB581 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
13:26:47.0027 2924  s3cap - ok
13:26:47.0043 2924  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
13:26:47.0058 2924  SamSs - ok
13:26:47.0074 2924  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
13:26:47.0089 2924  sbp2port - ok
13:26:47.0167 2924  [ 794D4B48DFB6E999537C7C3947863463 ] SBSDWSCService  D:\Programme\Spybot\SDWinSec.exe
13:26:47.0199 2924  SBSDWSCService - ok
13:26:47.0230 2924  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
13:26:47.0277 2924  SCardSvr - ok
13:26:47.0292 2924  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
13:26:47.0339 2924  scfilter - ok
13:26:47.0401 2924  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
13:26:47.0464 2924  Schedule - ok
13:26:47.0479 2924  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
13:26:47.0511 2924  SCPolicySvc - ok
13:26:47.0542 2924  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
13:26:47.0589 2924  SDRSVC - ok
13:26:47.0604 2924  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
13:26:47.0651 2924  secdrv - ok
13:26:47.0667 2924  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
13:26:47.0698 2924  seclogon - ok
13:26:47.0729 2924  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
13:26:47.0760 2924  SENS - ok
13:26:47.0760 2924  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
13:26:47.0791 2924  SensrSvc - ok
13:26:47.0807 2924  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
13:26:47.0807 2924  Serenum - ok
13:26:47.0838 2924  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
13:26:47.0838 2924  Serial - ok
13:26:47.0854 2924  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
13:26:47.0869 2924  sermouse - ok
13:26:47.0901 2924  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
13:26:47.0947 2924  SessionEnv - ok
13:26:47.0963 2924  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
13:26:48.0010 2924  sffdisk - ok
13:26:48.0025 2924  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
13:26:48.0041 2924  sffp_mmc - ok
13:26:48.0041 2924  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
13:26:48.0072 2924  sffp_sd - ok
13:26:48.0088 2924  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
13:26:48.0103 2924  sfloppy - ok
13:26:48.0135 2924  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
13:26:48.0181 2924  SharedAccess - ok
13:26:48.0213 2924  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
13:26:48.0244 2924  ShellHWDetection - ok
13:26:48.0259 2924  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:26:48.0275 2924  SiSRaid2 - ok
13:26:48.0291 2924  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
13:26:48.0291 2924  SiSRaid4 - ok
13:26:48.0337 2924  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    D:\Programme\Skype\Updater\Updater.exe
13:26:48.0353 2924  SkypeUpdate - ok
13:26:48.0369 2924  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
13:26:48.0415 2924  Smb - ok
13:26:48.0431 2924  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
13:26:48.0447 2924  SNMPTRAP - ok
13:26:48.0478 2924  [ 12583AF6CBE0050651EAF2723B3AD7B3 ] speedfan        C:\Windows\syswow64\speedfan.sys
13:26:48.0493 2924  speedfan - ok
13:26:48.0509 2924  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
13:26:48.0525 2924  spldr - ok
13:26:48.0571 2924  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
13:26:48.0634 2924  Spooler - ok
13:26:48.0743 2924  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
13:26:48.0868 2924  sppsvc - ok
13:26:48.0883 2924  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
13:26:48.0915 2924  sppuinotify - ok
13:26:48.0977 2924  [ A6CFF1AF7664627A296B6A0A96CF876E ] sptd            C:\Windows\System32\Drivers\sptd.sys
13:26:48.0977 2924  Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: A6CFF1AF7664627A296B6A0A96CF876E
13:26:48.0977 2924  sptd ( LockedFile.Multi.Generic ) - warning
13:26:48.0977 2924  sptd - detected LockedFile.Multi.Generic (1)
13:26:49.0024 2924  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
13:26:49.0055 2924  srv - ok
13:26:49.0086 2924  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
13:26:49.0102 2924  srv2 - ok
13:26:49.0133 2924  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
13:26:49.0164 2924  srvnet - ok
13:26:49.0180 2924  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
13:26:49.0211 2924  SSDPSRV - ok
13:26:49.0227 2924  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
13:26:49.0258 2924  SstpSvc - ok
13:26:49.0273 2924  Steam Client Service - ok
13:26:49.0289 2924  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
13:26:49.0289 2924  stexstor - ok
13:26:49.0320 2924  [ DECACB6921DED1A38642642685D77DAC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
13:26:49.0336 2924  StillCam - ok
13:26:49.0398 2924  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
13:26:49.0445 2924  stisvc - ok
13:26:49.0461 2924  [ 7785DC213270D2FC066538DAF94087E7 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
13:26:49.0476 2924  storflt - ok
13:26:49.0492 2924  [ C40841817EF57D491F22EB103DA587CC ] StorSvc        C:\Windows\system32\storsvc.dll
13:26:49.0539 2924  StorSvc - ok
13:26:49.0554 2924  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
13:26:49.0554 2924  storvsc - ok
13:26:49.0585 2924  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
13:26:49.0601 2924  swenum - ok
13:26:49.0632 2924  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
13:26:49.0679 2924  swprv - ok
13:26:49.0773 2924  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
13:26:49.0851 2924  SysMain - ok
13:26:49.0866 2924  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
13:26:49.0897 2924  TabletInputService - ok
13:26:49.0929 2924  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
13:26:49.0960 2924  TapiSrv - ok
13:26:49.0975 2924  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
13:26:50.0038 2924  TBS - ok
13:26:50.0116 2924  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
13:26:50.0194 2924  Tcpip - ok
13:26:50.0256 2924  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
13:26:50.0287 2924  TCPIP6 - ok
13:26:50.0303 2924  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
13:26:50.0319 2924  tcpipreg - ok
13:26:50.0334 2924  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
13:26:50.0397 2924  TDPIPE - ok
13:26:50.0412 2924  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
13:26:50.0428 2924  TDTCP - ok
13:26:50.0459 2924  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
13:26:50.0490 2924  tdx - ok
13:26:50.0490 2924  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
13:26:50.0506 2924  TermDD - ok
13:26:50.0553 2924  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
13:26:50.0615 2924  TermService - ok
13:26:50.0631 2924  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
13:26:50.0662 2924  Themes - ok
13:26:50.0677 2924  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
13:26:50.0709 2924  THREADORDER - ok
13:26:50.0724 2924  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
13:26:50.0755 2924  TrkWks - ok
13:26:50.0802 2924  [ 370A6907DDF79532A39319492B1FA38A ] truecrypt      C:\Windows\system32\drivers\truecrypt.sys
13:26:50.0818 2924  truecrypt - ok
13:26:50.0865 2924  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
13:26:50.0896 2924  TrustedInstaller - ok
13:26:50.0927 2924  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
13:26:50.0958 2924  tssecsrv - ok
13:26:50.0989 2924  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
13:26:51.0005 2924  TsUsbFlt - ok
13:26:51.0036 2924  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
13:26:51.0083 2924  tunnel - ok
13:26:51.0099 2924  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
13:26:51.0099 2924  uagp35 - ok
13:26:51.0130 2924  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
13:26:51.0177 2924  udfs - ok
13:26:51.0208 2924  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
13:26:51.0223 2924  UI0Detect - ok
13:26:51.0239 2924  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
13:26:51.0239 2924  uliagpkx - ok
13:26:51.0286 2924  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\drivers\umbus.sys
13:26:51.0301 2924  umbus - ok
13:26:51.0301 2924  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
13:26:51.0317 2924  UmPass - ok
13:26:51.0348 2924  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
13:26:51.0379 2924  UmRdpService - ok
13:26:51.0395 2924  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
13:26:51.0426 2924  upnphost - ok
13:26:51.0457 2924  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
13:26:51.0489 2924  usbccgp - ok
13:26:51.0520 2924  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
13:26:51.0551 2924  usbcir - ok
13:26:51.0567 2924  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
13:26:51.0582 2924  usbehci - ok
13:26:51.0598 2924  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
13:26:51.0645 2924  usbhub - ok
13:26:51.0660 2924  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
13:26:51.0660 2924  usbohci - ok
13:26:51.0676 2924  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
13:26:51.0707 2924  usbprint - ok
13:26:51.0707 2924  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:26:51.0738 2924  USBSTOR - ok
13:26:51.0754 2924  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
13:26:51.0769 2924  usbuhci - ok
13:26:51.0785 2924  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
13:26:51.0816 2924  UxSms - ok
13:26:51.0816 2924  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
13:26:51.0832 2924  VaultSvc - ok
13:26:51.0832 2924  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
13:26:51.0847 2924  vdrvroot - ok
13:26:51.0894 2924  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
13:26:51.0957 2924  vds - ok
13:26:51.0988 2924  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
13:26:51.0988 2924  vga - ok
13:26:52.0003 2924  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
13:26:52.0050 2924  VgaSave - ok
13:26:52.0066 2924  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
13:26:52.0081 2924  vhdmp - ok
13:26:52.0113 2924  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
13:26:52.0128 2924  viaide - ok
13:26:52.0144 2924  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus          C:\Windows\system32\drivers\vmbus.sys
13:26:52.0175 2924  vmbus - ok
13:26:52.0191 2924  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
13:26:52.0206 2924  VMBusHID - ok
13:26:52.0222 2924  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
13:26:52.0237 2924  volmgr - ok
13:26:52.0284 2924  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
13:26:52.0300 2924  volmgrx - ok
13:26:52.0315 2924  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
13:26:52.0331 2924  volsnap - ok
13:26:52.0362 2924  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
13:26:52.0378 2924  vsmraid - ok
13:26:52.0440 2924  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
13:26:52.0518 2924  VSS - ok
13:26:52.0534 2924  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
13:26:52.0565 2924  vwifibus - ok
13:26:52.0581 2924  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
13:26:52.0612 2924  vwififlt - ok
13:26:52.0627 2924  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
13:26:52.0674 2924  W32Time - ok
13:26:52.0690 2924  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
13:26:52.0705 2924  WacomPen - ok
13:26:52.0737 2924  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
13:26:52.0768 2924  WANARP - ok
13:26:52.0768 2924  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
13:26:52.0815 2924  Wanarpv6 - ok
13:26:52.0908 2924  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc    C:\Windows\system32\Wat\WatAdminSvc.exe
13:26:52.0955 2924  WatAdminSvc - ok
13:26:53.0033 2924  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
13:26:53.0111 2924  wbengine - ok
13:26:53.0127 2924  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
13:26:53.0142 2924  WbioSrvc - ok
13:26:53.0173 2924  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
13:26:53.0205 2924  wcncsvc - ok
13:26:53.0236 2924  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
13:26:53.0251 2924  WcsPlugInService - ok
13:26:53.0267 2924  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
13:26:53.0283 2924  Wd - ok
13:26:53.0329 2924  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
13:26:53.0376 2924  Wdf01000 - ok
13:26:53.0376 2924  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
13:26:53.0470 2924  WdiServiceHost - ok
13:26:53.0470 2924  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
13:26:53.0485 2924  WdiSystemHost - ok
13:26:53.0517 2924  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
13:26:53.0548 2924  WebClient - ok
13:26:53.0563 2924  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
13:26:53.0610 2924  Wecsvc - ok
13:26:53.0626 2924  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
13:26:53.0673 2924  wercplsupport - ok
13:26:53.0704 2924  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
13:26:53.0735 2924  WerSvc - ok
13:26:53.0766 2924  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
13:26:53.0797 2924  WfpLwf - ok
13:26:53.0797 2924  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
13:26:53.0813 2924  WIMMount - ok
13:26:53.0829 2924  WinDefend - ok
13:26:53.0829 2924  WinHttpAutoProxySvc - ok
13:26:53.0860 2924  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
13:26:53.0891 2924  Winmgmt - ok
13:26:53.0969 2924  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
13:26:54.0063 2924  WinRM - ok
13:26:54.0125 2924  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
13:26:54.0172 2924  Wlansvc - ok
13:26:54.0312 2924  [ 98F138897EF4246381D197CB81846D62 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
13:26:54.0406 2924  wlidsvc - ok
13:26:54.0421 2924  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
13:26:54.0453 2924  WmiAcpi - ok
13:26:54.0484 2924  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
13:26:54.0499 2924  wmiApSrv - ok
13:26:54.0889 2924  WMPNetworkSvc - ok
13:26:54.0905 2924  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
13:26:54.0921 2924  WPCSvc - ok
13:26:54.0952 2924  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
13:26:54.0967 2924  WPDBusEnum - ok
13:26:54.0983 2924  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
13:26:55.0030 2924  ws2ifsl - ok
13:26:55.0045 2924  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
13:26:55.0061 2924  wscsvc - ok
13:26:55.0077 2924  WSearch - ok
13:26:55.0170 2924  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
13:26:55.0248 2924  wuauserv - ok
13:26:55.0279 2924  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
13:26:55.0326 2924  WudfPf - ok
13:26:55.0342 2924  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
13:26:55.0373 2924  WUDFRd - ok
13:26:55.0404 2924  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
13:26:55.0420 2924  wudfsvc - ok
13:26:55.0435 2924  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
13:26:55.0451 2924  WwanSvc - ok
13:26:55.0482 2924  [ 2C6BC21B2D5B58D8B1D638C1704CB494 ] xusb21          C:\Windows\system32\DRIVERS\xusb21.sys
13:26:55.0482 2924  xusb21 - ok
13:26:55.0498 2924  ================ Scan global ===============================
13:26:55.0513 2924  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
13:26:55.0560 2924  [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll
13:26:55.0560 2924  [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll
13:26:55.0591 2924  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
13:26:55.0607 2924  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
13:26:55.0607 2924  [Global] - ok
13:26:55.0607 2924  ================ Scan MBR ==================================
13:26:55.0623 2924  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
13:26:56.0387 2924  \Device\Harddisk0\DR0 - ok
13:26:56.0403 2924  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk5\DR5
13:26:56.0496 2924  \Device\Harddisk5\DR5 - ok
13:26:56.0496 2924  ================ Scan VBR ==================================
13:26:56.0496 2924  [ 8392D3AEAF8D86C37912A0732F995857 ] \Device\Harddisk0\DR0\Partition1
13:26:56.0496 2924  \Device\Harddisk0\DR0\Partition1 - ok
13:26:56.0527 2924  [ A2D2950B658D5DC18742FA065D917704 ] \Device\Harddisk0\DR0\Partition2
13:26:56.0527 2924  \Device\Harddisk0\DR0\Partition2 - ok
13:26:56.0543 2924  [ 0B3E7C066D9C8741A236C2F5BD1B8472 ] \Device\Harddisk0\DR0\Partition3
13:26:56.0543 2924  \Device\Harddisk0\DR0\Partition3 - ok
13:26:56.0543 2924  [ 5E12B060BA736A1046DE72008453BE42 ] \Device\Harddisk5\DR5\Partition1
13:26:56.0543 2924  \Device\Harddisk5\DR5\Partition1 - ok
13:26:56.0543 2924  [ E66B21EADE3A447C549DDD2FF2AF6572 ] \Device\Harddisk5\DR5\Partition2
13:26:56.0543 2924  \Device\Harddisk5\DR5\Partition2 - ok
13:26:56.0543 2924  ============================================================
13:26:56.0543 2924  Scan finished
13:26:56.0543 2924  ============================================================
13:26:56.0559 2328  Detected object count: 5
13:26:56.0559 2328  Actual detected object count: 5
13:27:57.0726 2328  atksgt ( UnsignedFile.Multi.Generic ) - skipped by user
13:27:57.0726 2328  atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:27:57.0726 2328  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
13:27:57.0726 2328  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:27:57.0726 2328  lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user
13:27:57.0726 2328  lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:27:57.0726 2328  MDM ( UnsignedFile.Multi.Generic ) - skipped by user
13:27:57.0726 2328  MDM ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:27:57.0726 2328  sptd ( LockedFile.Multi.Generic ) - skipped by user
13:27:57.0726 2328  sptd ( LockedFile.Multi.Generic ) - User select action: Skip

cosinus 22.11.2012 14:11
Ist unauffällig

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Dirtbag 22.11.2012 14:24
Das Scan-Log von adwCleaner:
Code:
# AdwCleaner v2.008 - Datei am 22/11/2012 um 14:18:12 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Thomas - BEHEMOTH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Thomas\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Users\Thomas\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v12.0 (de)

Profilname : default
Datei : C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\ot4iz9jl.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Opera v [Version kann nicht ermittelt werden]

Datei : C:\Users\Thomas\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [960 octets] - [22/11/2012 14:18:12]

########## EOF - C:\AdwCleaner[R1].txt - [1019 octets] ##########
Nachdem inzwischen ja IE 10 draußen ist: ich nutze den Internet Explorer quasi nie, der ist nur als Backup installiert, für den unwahrscheinlichen Fall, dass Firefox und Opera eine Seite fehlerhaft darstellen sollten. Und für Besuche auf der Homepage von Microsoft, weil mir das ActiveX-Hickhack mit den nötigen Lizenzen bei Nutzung von Fremd-Browsern zu umständlich ist. Wenn das Update auf IE 10 empfehlenswert ist, werde ich das gleich noch machen.

cosinus 22.11.2012 14:39
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

Dirtbag 22.11.2012 15:16
Delete-Log von adwCleaner:
Code:
# AdwCleaner v2.008 - Datei am 22/11/2012 um 14:47:21 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Thomas - BEHEMOTH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Thomas\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Users\Thomas\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v12.0 (de)

Profilname : default
Datei : C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\ot4iz9jl.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Opera v [Version kann nicht ermittelt werden]

Datei : C:\Users\Thomas\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1088 octets] - [22/11/2012 14:18:12]
AdwCleaner[S1].txt - [1022 octets] - [22/11/2012 14:47:21]

########## EOF - C:\AdwCleaner[S1].txt - [1082 octets] ##########
OTL Scan-Log:
OTL Logfile:
Code:
OTL logfile created on: 22.11.2012 14:52:32 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Thomas\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 63.26% Memory free
8.00 Gb Paging File | 6.28 Gb Available in Paging File | 78.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 99.90 Gb Total Space | 60.25 Gb Free Space | 60.31% Space Free | Partition Type: NTFS
Drive D: | 272.61 Gb Total Space | 26.56 Gb Free Space | 9.74% Space Free | Partition Type: NTFS
Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 891.51 Gb Total Space | 432.46 Gb Free Space | 48.51% Space Free | Partition Type: NTFS
 
Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Thomas\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe ()
PRC - D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.)
PRC - D:\Programme\Spybot\SDWinSec.exe (Safer Networking Ltd.)
PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerofa.exe (Razer Inc.)
PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe ()
MOD - D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- D:\Programme\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- D:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- D:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (DAUpdaterSvc) -- D:\Spiele\Steam\SteamApps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe (BioWare)
SRV - (AntiVirSchedulerService) -- D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (nSvcIp) -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM) -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SBSDWSCService) -- D:\Programme\Spybot\SDWinSec.exe (Safer Networking Ltd.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (athur) -- C:\Windows\SysNative\drivers\athurx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Razerlow) -- C:\Windows\SysNative\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1C A8 96 AF 82 A8 CD 01  [binary data]
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: firefox@ghostery.com:2.8.3
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: D:\Programme\Java\64bit\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Programme\Java\32bit\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins
 
[2012.05.21 19:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Extensions
[2012.11.22 12:19:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions
[2012.09.20 09:47:35 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions\firefox@ghostery.com
[2012.11.22 12:19:56 | 000,804,737 | ---- | M] () (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\ot4iz9jl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 
O1 HOSTS File: ([2012.11.21 12:13:33 | 000,444,833 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15276 more lines...
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\64bit\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\64bit\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\32bit\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\32bit\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NVRaidService] C:\Programme\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Diamondback] D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [DAEMON Tools Lite] D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [Steam] D:\Spiele\Steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Thomas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..Trusted Domains: blank ([]about in Computer)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D798FFB-EC8F-413C-BC0C-E9CA871D27A4}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D45DA220-C9FD-4A87-88B3-1EB6143DA571}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.10.23 07:14:18 | 000,000,107 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\RunGame.exe -- [2004.10.23 07:14:18 | 000,192,512 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.22 13:25:05 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Thomas\Desktop\tdsskiller.exe
[2012.11.22 12:37:19 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\TrueCrypt
[2012.11.22 12:35:54 | 000,231,376 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2012.11.22 12:35:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
[2012.11.22 12:25:27 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Thomas\Desktop\aswMBR.exe
[2012.11.20 21:04:45 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Thomas\Desktop\OTL.exe
[2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp
[2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\Program Files\Core Temp
[2012.11.18 16:55:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPU-Z
[2012.11.15 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\4A Games
[2012.11.15 16:18:49 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2012.11.15 16:18:49 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2012.11.15 16:18:49 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2012.11.15 16:18:49 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2012.11.15 16:18:49 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2012.11.15 16:18:49 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2012.11.15 16:18:49 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2012.11.15 16:18:49 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2012.11.15 16:18:48 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll
[2012.11.15 16:18:48 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll
[2012.11.15 16:18:48 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll
[2012.11.15 16:18:48 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll
[2012.11.15 16:18:46 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll
[2012.11.15 16:18:46 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2012.11.15 16:18:45 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll
[2012.11.15 16:18:45 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll
[2012.11.15 16:18:44 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll
[2012.11.15 16:18:44 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll
[2012.11.15 16:18:42 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll
[2012.11.15 16:18:42 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2012.11.15 16:18:40 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll
[2012.11.15 16:18:40 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2012.11.15 16:18:39 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll
[2012.11.15 16:18:39 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll
[2012.11.15 16:18:39 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll
[2012.11.15 16:18:39 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll
[2012.11.15 16:18:37 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll
[2012.11.15 16:18:37 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll
[2012.11.15 16:18:36 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll
[2012.11.15 16:18:36 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll
[2012.11.15 16:18:36 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll
[2012.11.15 16:18:36 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll
[2012.11.15 16:18:36 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll
[2012.11.15 16:18:36 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll
[2012.11.15 16:18:35 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll
[2012.11.15 16:18:35 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll
[2012.11.15 16:18:34 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll
[2012.11.15 16:18:34 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll
[2012.11.15 16:18:34 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll
[2012.11.15 16:18:34 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll
[2012.11.15 16:18:32 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll
[2012.11.15 16:18:32 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2012.11.15 16:18:32 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll
[2012.11.15 16:18:32 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll
[2012.11.15 16:18:32 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll
[2012.11.15 16:18:32 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll
[2012.11.15 16:18:31 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll
[2012.11.15 16:18:31 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll
[2012.11.15 16:18:31 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll
[2012.11.15 16:18:31 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll
[2012.11.15 16:18:30 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll
[2012.11.15 16:18:30 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll
[2012.11.15 16:18:30 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll
[2012.11.15 16:18:30 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll
[2012.11.15 16:18:29 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll
[2012.11.15 16:18:29 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll
[2012.11.15 16:18:28 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll
[2012.11.15 16:18:28 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll
[2012.11.15 16:18:28 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll
[2012.11.15 16:18:28 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll
[2012.11.15 16:18:26 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll
[2012.11.15 16:18:26 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll
[2012.11.15 16:18:25 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll
[2012.11.15 16:18:25 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll
[2012.11.15 16:18:25 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll
[2012.11.15 16:18:25 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll
[2012.11.15 16:18:24 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll
[2012.11.15 16:18:24 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll
[2012.11.15 16:18:24 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll
[2012.11.15 16:18:24 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll
[2012.11.15 16:18:21 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll
[2012.11.15 16:18:21 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll
[2012.11.15 16:18:21 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll
[2012.11.15 16:18:21 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll
[2012.11.15 16:18:20 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll
[2012.11.15 16:18:20 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll
[2012.11.15 16:18:19 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll
[2012.11.15 16:18:19 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll
[2012.11.15 16:18:19 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll
[2012.11.15 16:18:19 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll
[2012.11.15 16:18:16 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll
[2012.11.15 16:18:16 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll
[2012.11.15 16:18:15 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll
[2012.11.15 16:18:15 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll
[2012.11.15 16:18:14 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll
[2012.11.15 16:18:14 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll
[2012.11.15 16:18:14 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll
[2012.11.15 16:18:14 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll
[2012.11.15 16:18:11 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll
[2012.11.15 16:18:11 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll
[2012.11.15 16:18:11 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll
[2012.11.15 16:18:11 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll
[2012.11.15 16:18:10 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll
[2012.11.15 16:18:10 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll
[2012.11.15 16:18:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll
[2012.11.15 16:18:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll
[2012.11.15 16:18:07 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll
[2012.11.15 16:18:07 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2012.11.15 16:18:07 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll
[2012.11.15 16:18:07 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll
[2012.11.15 16:18:07 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll
[2012.11.15 16:18:07 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll
[2012.11.15 16:18:05 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll
[2012.11.15 16:18:05 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll
[2012.11.15 16:18:05 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll
[2012.11.15 16:18:05 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll
[2012.11.15 16:18:04 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll
[2012.11.15 16:18:04 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2012.11.15 16:18:03 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll
[2012.11.15 16:18:03 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll
[2012.11.15 16:18:02 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll
[2012.11.15 16:18:02 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll
[2012.11.15 16:18:02 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll
[2012.11.15 16:18:02 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll
[2012.11.15 16:18:01 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll
[2012.11.15 16:18:01 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll
[2012.11.15 16:18:00 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll
[2012.11.15 16:18:00 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll
[2012.11.15 16:17:59 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll
[2012.11.15 16:17:59 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll
[2012.11.15 16:17:59 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll
[2012.11.15 16:17:59 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll
[2012.11.15 16:17:58 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll
[2012.11.15 16:17:58 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll
[2012.11.15 16:17:58 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll
[2012.11.15 16:17:58 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll
[2012.11.15 16:17:58 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll
[2012.11.15 16:17:58 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll
[2012.11.15 16:17:57 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll
[2012.11.15 16:17:57 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2012.11.15 16:17:56 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll
[2012.11.15 16:17:56 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll
[2012.11.15 16:17:56 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll
[2012.11.15 16:17:56 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll
[2012.11.15 16:17:56 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll
[2012.11.15 16:17:56 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll
[2012.11.15 16:17:55 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll
[2012.11.15 16:17:55 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll
[2012.11.15 16:17:55 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll
[2012.11.15 16:17:55 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll
[2012.11.15 16:17:50 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll
[2012.11.15 16:17:50 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2012.11.15 16:17:49 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll
[2012.11.15 16:17:49 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll
[2012.11.15 16:17:49 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll
[2012.11.15 16:17:49 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll
[2012.11.15 16:17:48 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll
[2012.11.15 16:17:48 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll
[2012.11.15 16:17:46 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll
[2012.11.15 16:17:46 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll
[2012.11.15 16:17:45 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll
[2012.11.15 16:17:45 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll
[2012.11.15 16:17:44 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll
[2012.11.15 16:17:44 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll
[2012.11.15 16:17:43 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll
[2012.11.15 16:17:43 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll
[2012.11.15 16:17:42 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll
[2012.11.15 16:17:42 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\ATI
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\ATI
[2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.11.15 16:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2012.11.15 16:00:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2012.11.15 16:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2012.11.15 16:00:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.11.15 15:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2012.11.15 15:58:53 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.11.15 15:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.11.15 15:57:33 | 000,000,000 | ---D | C] -- C:\AMD
[2012.11.15 15:22:57 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2012.11.15 15:22:57 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2012.11.15 15:18:04 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.11.15 15:18:04 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.11.15 15:18:03 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.11.15 15:18:03 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.11.15 15:18:03 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.11.15 15:18:03 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.11.15 15:18:03 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.11.15 15:18:03 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.11.15 15:18:02 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.11.15 15:18:02 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.11.15 15:18:02 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.11.15 15:18:02 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.11.15 15:18:01 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.11.15 15:18:01 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.11.15 15:18:01 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.11.15 15:15:22 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2012.11.15 15:15:22 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2012.11.15 15:15:22 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2012.11.15 15:15:22 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2012.11.15 14:43:00 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2012.11.15 14:43:00 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2012.11.15 14:43:00 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2012.11.15 14:43:00 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2012.11.15 14:43:00 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2012.11.15 14:43:00 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2012.11.15 14:42:51 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2012.11.15 14:42:51 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2012.11.15 14:42:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2012.11.15 14:42:16 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2012.11.15 14:42:16 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2012.11.15 14:41:32 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\4a games
[2012.11.12 12:33:34 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Diagnostics
[2012.11.08 16:40:07 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Electronic Arts
[2012.11.08 16:39:58 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electronic Arts
[2012.11.08 16:39:47 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll
[2012.11.08 16:39:47 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll
[2012.11.08 16:39:47 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll
[2012.11.08 16:39:47 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll
[2012.11.08 16:39:44 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll
[2012.11.08 16:39:44 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll
[2012.11.08 16:39:43 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll
[2012.11.08 16:39:20 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electrontic Arts
[2012.11.06 19:50:18 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.11.01 10:51:50 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\NFS Underground 2
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.22 14:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.22 14:48:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.22 14:48:33 | 3220,074,496 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.22 14:17:34 | 000,543,531 | ---- | M] () -- C:\Users\Thomas\Desktop\adwcleaner.exe
[2012.11.22 13:25:08 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Thomas\Desktop\tdsskiller.exe
[2012.11.22 13:18:16 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 13:18:16 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 12:35:58 | 000,000,739 | ---- | M] () -- C:\Users\Public\Desktop\TrueCrypt.lnk
[2012.11.22 12:35:54 | 000,231,376 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2012.11.22 12:25:47 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Thomas\Desktop\aswMBR.exe
[2012.11.21 12:13:33 | 000,444,833 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.11.20 21:04:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Thomas\Desktop\OTL.exe
[2012.11.20 12:27:42 | 000,000,741 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.18 18:09:15 | 440,077,062 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.11.18 17:45:46 | 000,000,672 | ---- | M] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk
[2012.11.18 17:45:45 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.11.18 16:59:32 | 000,001,387 | ---- | M] () -- C:\Users\Thomas\Desktop\Core Temp.lnk
[2012.11.15 16:11:50 | 000,001,017 | ---- | M] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk
[2012.11.15 16:07:53 | 000,000,208 | ---- | M] () -- C:\Users\Thomas\Desktop\Metro 2033.url
[2012.11.15 16:02:18 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2012.11.15 15:30:08 | 002,274,000 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.15 15:24:39 | 001,663,204 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.15 15:24:39 | 000,707,300 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.15 15:24:39 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.15 15:24:39 | 000,152,892 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.15 15:24:39 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.08 00:32:40 | 000,000,218 | ---- | M] () -- C:\Users\Thomas\.recently-used.xbel
[2012.11.01 10:50:09 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.22 14:17:25 | 000,543,531 | ---- | C] () -- C:\Users\Thomas\Desktop\adwcleaner.exe
[2012.11.22 12:35:58 | 000,000,739 | ---- | C] () -- C:\Users\Public\Desktop\TrueCrypt.lnk
[2012.11.18 17:45:46 | 000,000,672 | ---- | C] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk
[2012.11.18 17:45:45 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.11.18 16:59:32 | 000,001,387 | ---- | C] () -- C:\Users\Thomas\Desktop\Core Temp.lnk
[2012.11.15 16:11:50 | 000,001,017 | ---- | C] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk
[2012.11.15 16:07:53 | 000,000,208 | ---- | C] () -- C:\Users\Thomas\Desktop\Metro 2033.url
[2012.11.15 16:02:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.11.15 15:22:59 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 15:15:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.08 00:32:40 | 000,000,218 | ---- | C] () -- C:\Users\Thomas\.recently-used.xbel
[2012.11.06 19:50:12 | 440,077,062 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.11.01 10:50:09 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk
[2012.10.21 00:16:44 | 000,001,148 | ---- | C] () -- C:\Users\Thomas\AppData\Roaming\EasyToolz.ini
[2012.09.28 02:29:54 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.09.28 02:29:54 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.09.10 08:32:05 | 001,618,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.09.28 16:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
--- --- ---



OTL-Extras-Log:
OTL Logfile:
Code:
OTL Extras logfile created on: 22.11.2012 14:52:32 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Thomas\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 63.26% Memory free
8.00 Gb Paging File | 6.28 Gb Available in Paging File | 78.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 99.90 Gb Total Space | 60.25 Gb Free Space | 60.31% Space Free | Partition Type: NTFS
Drive D: | 272.61 Gb Total Space | 26.56 Gb Free Space | 9.74% Space Free | Partition Type: NTFS
Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 891.51 Gb Total Space | 432.46 Gb Free Space | 48.51% Space Free | Partition Type: NTFS
 
Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07EC683D-E99D-4D57-9DF1-FC211E10E2F8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{36B80E5C-E188-4FD0-BA15-EBBEBCB52539}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{41A3DD54-2B30-45CB-BF6E-D789CE33FFB8}" = lport=10243 | protocol=6 | dir=in | app=system |
"{43DFE6FD-A49F-4CEA-BE8F-D01617364F44}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{478565E3-5697-4F05-AE82-969EA716FBA9}" = rport=445 | protocol=6 | dir=out | app=system |
"{51B4D801-9810-4CD9-88D6-2C560D846A82}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{52C79A64-D927-487B-A2E5-1883FB9805C3}" = lport=56681 | protocol=6 | dir=in | name=pando media booster |
"{709B9683-8A96-4A5E-AB91-6774940A1414}" = lport=137 | protocol=17 | dir=in | app=system |
"{740862C4-321B-4AB5-B32E-BA4D0C4EFC92}" = lport=6004 | protocol=17 | dir=in | app=d:\programme\microsoft office\office12\outlook.exe |
"{7BD6C38B-A953-4924-B2A2-657687791F36}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7F1C73AB-8A53-433D-823F-65E965007A15}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8CE1451F-3D57-4731-BCD0-C0E9A5E8CAAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8D3C7EE8-1422-48ED-9B46-2333961B97F2}" = lport=445 | protocol=6 | dir=in | app=system |
"{8E804689-A7C1-45A7-91F6-C1685920FD74}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8EB8452C-AB07-474A-9857-B20D01FE8490}" = rport=138 | protocol=17 | dir=out | app=system |
"{934A4DE4-A8E1-4D94-B6AC-704EB7DAD932}" = lport=56681 | protocol=17 | dir=in | name=pando media booster |
"{9DA040D6-9FCA-4457-A942-59EB750A9338}" = rport=137 | protocol=17 | dir=out | app=system |
"{A6606C15-7A1F-486F-B161-EE6FB8416477}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D6082C2F-B122-479B-B791-DF02EE3A8648}" = lport=139 | protocol=6 | dir=in | app=system |
"{D7452FCA-FC78-40D5-A4E4-DB367C9004B5}" = rport=139 | protocol=6 | dir=out | app=system |
"{D8B8EC0C-6580-4D6C-A188-3F9FB2B3374A}" = lport=56681 | protocol=17 | dir=in | name=pando media booster |
"{DA529022-7A08-44D7-B3CF-16F846EBB6C6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DE95DDFA-A893-48D6-9F4B-48BAF6B305C5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E5B5A599-4478-4C02-B853-DD44F72A869A}" = lport=138 | protocol=17 | dir=in | app=system |
"{EF49318F-B5F3-4A36-BBA5-87DFFAC4BE00}" = lport=56681 | protocol=6 | dir=in | name=pando media booster |
"{FC0BA8F4-81C2-4068-8596-5EB317A51E6D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011F8F6C-13E2-40D6-9CE1-D01E2CDF6761}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\dead space.exe |
"{01A341BE-E845-45FD-A0D3-6F25B18E34BE}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\reliccoh.exe |
"{02E7A2A2-A520-4603-8280-6F127A145AAB}" = protocol=17 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"{032CC7F2-567C-478C-A736-28350105217B}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{0336141F-8113-4256-B1CF-AC65582AA5CF}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe |
"{03D071BD-EB30-4DAE-9E2E-E76EA04FC1F9}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\unreal tournament\system\unrealtournament.exe |
"{043DA7C4-AF78-4908-A22B-AD3F5FA01F96}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\setup.exe |
"{0677905C-5B9F-4B24-B369-3D204134E5BE}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{09DBDB3C-DFEB-44A2-90C2-1D029F35CF48}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight ii\torchlight2.exe |
"{0DE1A7DA-6CA2-4903-B7EC-D7E6860B7335}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{0EAFB3A8-7E8E-4AD7-8AD7-2F2991C1D37F}" = dir=in | app=d:\programme\skype\phone\skype.exe |
"{10F3560C-88CA-4414-9A16-B62BAC48A17A}" = protocol=6 | dir=in | app=d:\spiele\two worlds\twoworlds.exe |
"{11AAC1A7-80B0-464F-AC5E-89DAA7EE9DE9}" = protocol=17 | dir=in | app=d:\programme\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{159EA599-7214-4042-A4F4-BEC1CFC043E3}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2benchmarktool.exe |
"{175E9C5B-29E3-4FF5-9EEE-953517A81B86}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2editor.exe |
"{17E66AB5-4400-470D-92F7-6435678463D4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\warhammer 40,000 space marine\spacemarine.exe |
"{1B41CF59-3A52-43DF-BA5E-71B498660173}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2serverlauncher.exe |
"{1CAC1E1D-BA31-4EAC-B3D0-A5D3A63A37FA}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{2060886E-2204-4146-B835-C557217C972A}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\deus ex\system\deusex.exe |
"{21ABA4CE-9B5F-4C51-8600-5BE45888466F}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\darksiders 2\darksiders2.exe |
"{220C8F05-2186-4B83-93E6-6DDC67F48D5A}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic_ds.exe |
"{22734FAF-0125-4B20-9061-94F3478052DB}" = protocol=17 | dir=in | app=d:\spiele\hellgate london\launcher.exe |
"{232B94F4-5A07-4C69-B9C0-F94FE1CF40FC}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\deus ex\system\deusex.exe |
"{245D9E7C-E9BD-4E41-9723-201F98434DD0}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{262365AF-683E-43B3-8873-B001FAE567AC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{2664C695-4E63-41A3-9B12-E1CBB6A71E68}" = protocol=17 | dir=in | app=d:\spiele\steam\steam.exe |
"{2EB11F0E-FD9B-4A7D-A198-CDCF4A7EFF27}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight\torchlight.exe |
"{37B4C35E-0B9D-4116-87B5-4F3FC73B24C3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{41F39C58-C080-4D1D-BE38-579F6BFFB4DF}" = protocol=6 | dir=out | app=system |
"{445352DC-F8D0-4CCE-A72B-BF8DD7ED0E8E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\runlauncher.bat |
"{4885D15D-CA81-4829-B500-8E46773BE6D1}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4A0B8D30-AA77-44AB-8F43-7BAA34A03ABD}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\runlauncher.bat |
"{4AAD182A-0DE5-4AD0-8E16-64185BEF7C6B}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\game.exe |
"{4F78D620-218A-4279-8366-AFACF2BECA7B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{50142EE3-5A5C-4733-AE3C-FE0EE62F79B2}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\game.exe |
"{527945E3-6C5C-47EF-BA30-404769720190}" = protocol=6 | dir=in | app=d:\programme\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{5445A562-5198-49C9-A912-7FBB164D389D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{56107278-4962-4574-95A8-BD9EFA1A75A5}" = protocol=6 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"{587EB998-C501-43F5-B9B6-3589F1BC40AD}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic.exe |
"{5AC90AE4-707A-42B5-8475-ED08D953CE67}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5B4BBE06-AE21-4952-B728-C5AD564155C6}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5C1556AE-F638-4874-8CE7-651766B96745}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\doom 3\doom3.exe |
"{5C237E64-DF8E-48A9-B1D4-E06A29323073}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5CA3F426-306F-4D0D-921E-EC922F3F8F36}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm |
"{5CD044FA-5789-4C28-9EC6-31421B34BC7E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\quake 3 arena\quake3.exe |
"{5D1D2BF7-1D46-4E1A-84F7-D92E3C5DEC05}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight ii\torchlight2.exe |
"{5E114B25-CFBB-43B5-9C64-C6E0B1AA1A2D}" = protocol=17 | dir=in | app=d:\spiele\two worlds\twoworlds_radeon.exe |
"{5F3CBF0F-9D12-492A-A269-ABEE37755D74}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2serverlauncher.exe |
"{61353E43-4074-4B10-A6B8-6AF670ED391C}" = dir=out | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{61A6859E-0FE5-4CF3-88F1-63FCD67F8F07}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic_ds.exe |
"{62FC417A-C430-4B65-B058-217A42F39FDA}" = protocol=6 | dir=in | app=d:\spiele\grid\grid.exe |
"{6580BEFA-3494-4196-B979-90104A9834B9}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\farcry2.exe |
"{665D2583-3B66-43CB-95E1-DA2E64D78D67}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\soldiers heroes of world war 2\soldiers.exe |
"{69C2FDF7-68E7-4C5B-8BFD-126B83E73588}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war ii - retribution\dow2.exe |
"{6CB7F127-C8A0-494F-9626-A2F86D6CDC47}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6D389F27-FC1A-4E78-B735-2224A226211D}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033.exe |
"{6DDD992C-4A39-4033-BEEF-F99D856D98FB}" = protocol=6 | dir=in | app=d:\spiele\hellgate london\launcher.exe |
"{6EB14E16-F352-4F29-96E5-5782037236D5}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead island\deadislandgame.exe |
"{6F2D0EAB-03E3-4B26-820D-A302C447BA7D}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\farcry2.exe |
"{70419B49-56F2-482D-AA98-AC9AB508B2B0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{70579402-7A9A-4203-9996-D28332355B43}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\unreal tournament\system\unrealtournament.exe |
"{72063097-3475-4D0B-9D3A-C5870BC9D553}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{73278E89-001F-4A08-B343-E86D79AAAF26}" = protocol=6 | dir=in | app=d:\spiele\hellgate global\hgllauncher.exe |
"{7658317F-854C-4202-82F2-BF3BEF31D98B}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7751F293-10A5-481E-97D5-1E448DA2C55B}" = dir=in | app=d:\programme\itunes\itunes.exe |
"{79258FCB-4D58-4786-A39C-A7C9C46367BE}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\blood bowl legendary edition\bb_le.exe |
"{79586D60-A682-4280-B93C-B08921780AAB}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7AD8ABA7-A5A0-472B-A1DC-CF610889984E}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic_online.exe |
"{7B41FA90-502E-48BE-8E3A-C3CA1FDA34D1}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7CDA608E-639A-4AC1-A89C-833456AAA2BC}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{7EC3B1FD-C386-4F09-B340-7A49E9A2CFD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{809B4953-8D40-4081-9AB0-96CFDF47DAFC}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{81039886-0564-4D1E-A4D7-C3E74BBEC04F}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war 2\dow2.exe |
"{81F47B59-07FC-48AA-8C1D-C12E880B1786}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{82BFAFEB-9D20-4CD3-A5FC-52232C6BE4C6}" = protocol=17 | dir=in | app=d:\spiele\hellgate global\hgllauncher.exe |
"{85043CA3-8F49-45B2-B242-73CC3E0AA97C}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\reliccoh.exe |
"{8880F35D-E5F0-4B6F-B1B0-55D3C5753940}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead island\deadislandgame.exe |
"{8994A5B2-68C3-478C-B35F-BAB4F12E47AB}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\max payne\maxpayne.exe |
"{8B706717-D2FA-4A54-B8D2-5F9669BA8F10}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{8D0E0690-1324-4951-85B3-8F34B6698CB3}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\railroad tycoon 2 platinum\rt2_plat.exe |
"{8D17713C-AD04-48C7-9EF2-3577328FF38A}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2benchmarktool.exe |
"{8DDA8AA4-5196-4169-AA99-80CF06A8BCC6}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\warhammer 40,000 space marine\spacemarine.exe |
"{8F093585-CA87-4419-9868-C1238741F2B3}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{96FF9A6D-E3AA-4A58-8CE2-5F4D4EB0F460}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war 2\dow2.exe |
"{9CA55186-0048-4C6C-9923-48DC5B55321A}" = protocol=6 | dir=in | app=d:\spiele\two worlds\twoworlds_radeon.exe |
"{9D25E98C-AC76-4AFE-A6C2-20CE0D124F03}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\blood bowl legendary edition\bb_le.exe |
"{9D536F14-3D4D-4C0B-94A7-DF7E7E523E11}" = protocol=17 | dir=in | app=d:\spiele\two worlds\twoworlds.exe |
"{A29B1BA9-4D77-4050-96E2-B61C16BA06EC}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{A54E7B52-607F-4200-A729-94E2882412F3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AD5323AB-F9D7-496B-A4AC-560356BD3BC4}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{B35B9870-92EC-4C3E-AC38-34C75E532DEE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B368E4AB-BF74-4567-8FD8-112C10212771}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\binaries\win32\batmanac.exe |
"{B5988DD5-BBA1-45F9-B34F-EEC47FDC027E}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2editor.exe |
"{B5C914B1-664F-4575-B4C5-A479B0A77497}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe |
"{B5CB8E19-8809-4B03-83D3-37B89396054F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B862F30C-327C-4705-80EF-AFBB29F49569}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B8EF78C1-188E-4467-8077-23BC70997714}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\tomb raider legend\trl.exe |
"{BA90E971-04B1-4301-84B0-55C3DF03255B}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war ii - retribution\dow2.exe |
"{BE8DA6E6-0FF6-4705-B43A-A12D15DB3A83}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\tomb raider legend\trl.exe |
"{BEA883AF-5A2E-4565-A8BB-A48558F6D4B5}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\soldiers heroes of world war 2\soldiers.exe |
"{C153E3A2-600E-4930-ADF6-C446F5D26CAF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C65463C2-6C16-4151-940D-7AD5A460734B}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic.exe |
"{C76E85D9-416A-4D59-A96A-95A0B63BE3D3}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic_online.exe |
"{C8B653D6-939A-4D20-9F17-75068363006B}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm |
"{C8E1B9D7-BDC8-4013-851E-A8C59C56EA34}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{CB1C4E43-1FD1-4BAB-90B0-33203DF40CB0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{CF39232F-9E36-42C0-B6D0-8E17EE67A7FC}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{CF8E504B-E86C-4D47-AA01-EC77F1A5CAF5}" = protocol=17 | dir=in | app=d:\spiele\grid\grid.exe |
"{D2C8F4AC-2818-4AA7-92D2-B6DEACABB57A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D35572CA-75CA-47CC-BC2E-10CDA7CF94E8}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\setup.exe |
"{D442D84B-5235-48D9-867E-971FD3B96626}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{D46EE8DE-F9D1-4EF6-9A5E-97A9611B329D}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\darksiders 2\darksiders2.exe |
"{D503B77F-72FA-4868-AEC6-81D7FF2C54EF}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\portal 2\portal2.exe |
"{D51CE6EE-12AD-4EB6-8334-4D24E3210A3F}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{DBE13617-398C-4C68-A9E9-07FC9DB5E0F1}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\railroad tycoon 2 platinum\rt2_plat.exe |
"{DC46B56C-355A-4B8B-A360-CAF0E747640D}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DE1A36EB-C4B3-4E19-B7C0-EE17252E90B8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DFE589EA-51E1-429E-8548-45C58258F65E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E2824A49-8AFF-45FB-810C-381397BE7ADB}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{E57E3618-6504-4700-9BAB-19133AE86F07}" = protocol=6 | dir=in | app=d:\spiele\steam\steam.exe |
"{E7F462F6-6AB6-4051-93D3-3D8A4655ECA5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ECD0BA67-C1E0-43B7-8E45-F2A39896769E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\binaries\win32\batmanac.exe |
"{ECEA6759-0817-4ACD-8CF8-2C825C1493F7}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033.exe |
"{EFDF0205-374C-4493-AC8A-DB8029BD0E59}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight\torchlight.exe |
"{F033055C-0185-48C7-9A58-F8CAA9D2B3AC}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\portal 2\portal2.exe |
"{F0C18CA6-CD07-4CBD-88EE-83679BD7EDE1}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\doom 3\doom3.exe |
"{F1F6E2D5-90E9-49E1-8F4F-7748DA9677A4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\dead space.exe |
"{F1FFA869-F1AA-4A80-B21D-A9145561F407}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FE73B50F-C34A-400D-BB8E-1D29394BC540}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\quake 3 arena\quake3.exe |
"{FED7FA85-DB7F-4D37-B0E1-77504F42D6C4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\max payne\maxpayne.exe |
"TCP Query User{08EDFD40-0A66-4B7A-8A65-D4F5CFB0DDCE}D:\programme\java\64bit\bin\javaw.exe" = protocol=6 | dir=in | app=d:\programme\java\64bit\bin\javaw.exe |
"TCP Query User{223341D4-7AF3-49B7-813A-E82CC87AAD8A}D:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe |
"TCP Query User{2768D805-4503-47AA-A07D-E89E352EA859}D:\programme\opera\opera.exe" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"TCP Query User{3F3FEE1B-B9EE-49C2-AA67-085A692551BC}D:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"TCP Query User{4091BA76-C2F1-4673-BE83-4421DB6AB3DB}D:\wot testserver\worldoftanks.exe" = protocol=6 | dir=in | app=d:\wot testserver\worldoftanks.exe |
"TCP Query User{54D491BA-F435-440D-84B9-E90ADEDDB339}D:\spiele\world of tanks\worldoftanks.exe" = protocol=6 | dir=in | app=d:\spiele\world of tanks\worldoftanks.exe |
"TCP Query User{6D6ECECC-6FE8-41B4-BD68-499E9086658B}C:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{74069D8E-A6F9-4269-9B43-9E24D0AC7376}D:\programme\pidgin\pidgin.exe" = protocol=6 | dir=in | app=d:\programme\pidgin\pidgin.exe |
"TCP Query User{90FD85C8-4579-4421-BA60-67C5F9C56025}D:\spiele\call of duty modern warfare 2\iw4sp.exe" = protocol=6 | dir=in | app=d:\spiele\call of duty modern warfare 2\iw4sp.exe |
"TCP Query User{AD09432D-C061-4543-8676-1355E204EC32}D:\spiele\world of tanks\wotlauncher.exe" = protocol=6 | dir=in | app=d:\spiele\world of tanks\wotlauncher.exe |
"TCP Query User{C420AE6F-46B1-49E0-97C2-DDA219FC8104}D:\wot testserver\wotlauncher.exe" = protocol=6 | dir=in | app=d:\wot testserver\wotlauncher.exe |
"TCP Query User{D7BE9B92-B9C4-4A40-9EC9-30ED6149D225}D:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"UDP Query User{1231C1C9-6461-48CD-AAC0-F011C5E7D74E}D:\spiele\call of duty modern warfare 2\iw4sp.exe" = protocol=17 | dir=in | app=d:\spiele\call of duty modern warfare 2\iw4sp.exe |
"UDP Query User{25E6B7C9-80A5-432E-87BD-577D50DA1AF3}D:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe |
"UDP Query User{3D4AAFE0-1457-4634-9C1F-06D7C04BDAF9}D:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"UDP Query User{3E75366E-1459-47FA-9BAE-8E6C0409616C}D:\programme\opera\opera.exe" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"UDP Query User{65CFDE6C-7192-4BDF-98C0-3D371FEB8D97}D:\programme\pidgin\pidgin.exe" = protocol=17 | dir=in | app=d:\programme\pidgin\pidgin.exe |
"UDP Query User{662EEBE0-0976-4A27-993F-9CA075D3E9C4}D:\spiele\world of tanks\wotlauncher.exe" = protocol=17 | dir=in | app=d:\spiele\world of tanks\wotlauncher.exe |
"UDP Query User{77127263-BBE2-46BD-B394-1D033568DED6}C:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{A8813CA3-E732-4C0F-B455-9A8159643CF1}D:\wot testserver\worldoftanks.exe" = protocol=17 | dir=in | app=d:\wot testserver\worldoftanks.exe |
"UDP Query User{B01DFDD4-AB73-4442-89F3-CBC845C948B8}D:\wot testserver\wotlauncher.exe" = protocol=17 | dir=in | app=d:\wot testserver\wotlauncher.exe |
"UDP Query User{BE461C6D-AD26-4E03-BB8E-A64B743E80B7}D:\spiele\world of tanks\worldoftanks.exe" = protocol=17 | dir=in | app=d:\spiele\world of tanks\worldoftanks.exe |
"UDP Query User{F3D6690A-E993-4BB6-B774-CD0A5488A0A4}D:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"UDP Query User{FEE44D81-0CF7-4D5F-B2A2-FCF1084E0C52}D:\programme\java\64bit\bin\javaw.exe" = protocol=17 | dir=in | app=d:\programme\java\64bit\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0407893F-352C-B182-E04A-A8C3333DA29B}" = AMD Drag and Drop Transcoding
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC4
"{0DCAB5DD-CC69-271A-CF03-F2BD6B60BD8A}" = AMD Media Foundation Decoders
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86417004FF}" = Java(TM) 7 Update 4 (64-bit)
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = MPC-HC 1.6.2.4902 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}" = AMD Catalyst Install Manager
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{504184A2-1B0E-5D93-603A-517E93E7EDB3}" = AMD Accelerated Video Transcoding
"{57580625-C673-7FEA-8791-E84B7AAF5069}" = ccc-utility64
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{8219EDCB-CE5A-4348-B056-AAC0FE4E99D0}" = Microsoft IntelliType Pro 8.2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A2B4455D-1046-4732-BFBC-0821BEFC07BC}" = Hellgate: London
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{E0FE1E14-3A7A-4DB0-9FFA-0DD945AE84DB}" = HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.62
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft IntelliType Pro 8.2" = Microsoft IntelliType Pro 8.2
"NVIDIA Drivers" = NVIDIA Drivers
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0F7A6FD0-87F5-FB5D-973C-CF604DE1BC6B}" = CCC Help Polish
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A9BE3D6-4D53-2C9D-B77D-562D85936B91}" = CCC Help Norwegian
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C8CT1}_is1" = World of Tanks - Common Test
"{210DFA65-F805-1A2B-4F83-8E27279AE385}" = Catalyst Control Center Graphics Previews Common
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{29822CAD-C76A-0BEE-55F5-AAA524DA814F}" = CCC Help Greek
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{38A1E3ED-D913-41D2-9953-A93D5ACE3ADF}" = TL-WN721N/TL-WN722N Driver
"{3A1293DF-7D09-BB0F-9576-EC47EE4A9362}" = CCC Help Italian
"{47416F0B-6589-591E-C6F8-4235D2230B14}" = Catalyst Control Center InstallProxy
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{625FC7D1-656D-1BEC-F86F-3EACAFDAA8FE}" = CCC Help English
"{65DF3688-6EF3-4C86-83DE-54AB46029F07}" = Hellgate
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7351EEF8-9D6C-5F46-5A19-F2C7456CE132}" = CCC Help German
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F172E34-4107-8964-6AEA-5051FFD265FF}" = CCC Help Portuguese
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86095E92-1959-8364-920E-82E81F64F8FB}" = Catalyst Control Center
"{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}" = HP Officejet Pro 8500 A910 Hilfe
"{89D05F35-933A-89C0-B935-C92BEE4229BD}" = CCC Help French
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{959E4378-CCA1-E4E4-2425-793DA92E8D95}" = CCC Help Czech
"{96BB3C67-4EB4-9757-E0C2-C0D2FE9053B1}" = CCC Help Turkish
"{974F4B73-2017-E174-9070-3F58F01B341F}" = CCC Help Danish
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98E20A18-3C29-86FA-50B4-918C2B34A082}" = CCC Help Hungarian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9E2E5EB3-DC6E-9277-E9DB-13175E7DDA39}" = CCC Help Dutch
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{AAACC0A5-4382-04D0-C75E-0669C7B949B6}" = CCC Help Japanese
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACEF4078-9B86-2455-E18D-34D52D37D9D5}" = CCC Help Chinese Standard
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B1B669F9-B9FE-486D-924F-D6678FDB0FD5}" = Adobe Setup
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B55FB422-B803-11F5-5582-B3666EA1B9AC}" = Catalyst Control Center Localization All
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B75932F6-EC0A-4E3A-AA7A-11AAC267B8A3}" = Adobe Creative Suite 3 Design Premium
"{B8010864-15F8-613B-20EF-AC35B14B3E0D}" = CCC Help Russian
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C1342411-5A98-DE8A-5629-D0C518E1C280}" = CCC Help Finnish
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
"{D08B4177-5160-6B66-8934-2F9012134D61}" = CCC Help Thai
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D34A6029-FB1A-9EA8-A938-5393F82A3A00}" = CCC Help Korean
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE4CF159-4AD2-4754-BDA0-5FB088C8B58B}" = Razer Diamondback
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3A09D13-4D40-3CF8-7D32-8BD55F8D1533}" = CCC Help Spanish
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = World in Conflict: Soviet Assault
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2C35491-9323-3AE7-6023-6B4128045153}" = CCC Help Swedish
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8A2AB6C-CB98-419C-BC96-95809B455AA7}" = WOT Statistics
"{FC66A32F-1A57-AC5C-4F12-DAC2F4CB77A0}" = CCC Help Chinese Traditional
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_dba14d7ef3aa07282d2b5a7a98d902a" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Fallout 2_is1" = Fallout 2
"Fraps" = Fraps
"G3QP231012008_is1" = Questpaket 4 Update 2 Deinstallation
"GameSpy Arcade" = GameSpy Arcade
"ImgBurn" = ImgBurn
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenAL" = OpenAL
"Opera 12.10.1652" = Opera 12.10
"Picasa 3" = Picasa 3
"Pidgin" = Pidgin
"SpeedFan" = SpeedFan (remove only)



----------------!!!!--------------
EDIT
Aufzählung der Steam-Apps aus der Liste entfernt

----------------!!!!--------------



"TrueCrypt" = TrueCrypt
"Two Worlds" = Two Worlds
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.11.2012 10:39:04 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15585
 
Error - 21.11.2012 10:39:04 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15585
 
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3076917
 
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3076917
 
Error - 21.11.2012 18:23:44 | Computer Name = Behemoth | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "d:\programme\Spybot\DelZip179.dll".
 Fehler in Manifest- oder Richtliniendatei "d:\programme\Spybot\DelZip179.dll" in
 Zeile 8.  Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 21.11.2012 19:57:24 | Computer Name = Behemoth | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: hellgate_sp_dx9_x64.exe, Version:
 1.18074.70.4256, Zeitstempel: 0x4804f713  Name des fehlerhaften Moduls: hellgate_sp_dx9_x64.exe,
 Version: 1.18074.70.4256, Zeitstempel: 0x4804f713  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0000000000406dcd  ID des fehlerhaften Prozesses: 0x1194  Startzeit der fehlerhaften
 Anwendung: 0x01cdc83838c10cc0  Pfad der fehlerhaften Anwendung: D:\Spiele\Hellgate
 London\SP_x64\hellgate_sp_dx9_x64.exe  Pfad des fehlerhaften Moduls: D:\Spiele\Hellgate
 London\SP_x64\hellgate_sp_dx9_x64.exe  Berichtskennung: 31836af0-3437-11e2-9296-00044b038885
 
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15600
 
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15600
 
[ System Events ]
Error - 20.11.2012 07:37:35 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 20.11.2012 07:37:43 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 20.11.2012 09:39:08 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 20.11.2012 09:39:22 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 21.11.2012 03:49:49 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 21.11.2012 03:49:59 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 22.11.2012 04:27:22 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 22.11.2012 04:27:28 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 22.11.2012 09:49:06 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 
Error - 22.11.2012 09:49:19 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%577
 

< End of report >
--- --- ---


Beim Extras-Log habe ich die Aufzählung der installierten Steam-Apps wegen der kürzlich bekanntgewordenen Sicherheitslücke bei Steam entfernt. Sollten sie relevant sein, kann ich sie aber nachliefern.

cosinus 22.11.2012 15:18
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Dirtbag 22.11.2012 19:16
So, nach einem laaaangen Scan von ESET hier die beiden Log-Files. Sämtliche externen HDDs und USB-Sticks angeschlossen.

Malwarebytes Anti-Malware:
Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.22.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Thomas :: BEHEMOTH [Administrator]

22.11.2012 15:20:35
mbam-log-2012-11-22 (15-20-35).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 201552
Laufzeit: 2 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

ESET Scan-Log:
Code:
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9c8013b20d1c7b4e86c135bbed0539cb
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-22 06:11:34
# local_time=2012-11-22 07:11:34 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 6208 105224528 0 0
# compatibility_mode=8192 67108863 100 0 3791 3791 0 0
# scanned=418825
# found=0
# cleaned=0
# scan_time=13216

cosinus 22.11.2012 20:29
Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Dirtbag 22.11.2012 22:32
Nein, keine Funde, keine Probleme.

Vielen, vielen Dank für die Hilfe (und für das Vertrauen). :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:44 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20