Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Email gehackt und merkwürdiges windows update mit Registryänderung? (https://www.trojaner-board.de/131686-email-gehackt-merkwuerdiges-windows-update-registryaenderung.html)

freac 01.03.2013 13:59
Email gehackt und merkwürdiges windows update mit Registryänderung?
 
Hallo,

mein Problem gliedert sich in mehrere Teile.

Seit zwei Tagen habe ich den Verdacht, dass mein email-Konto gehackt wurde. Ein Kontakt aus meinem Adressbuch hat mir eine e-mail geschickt, obwohl ich den Kontakt persönlich gefragt habe und er es nicht getan hat.

Zudem bekam ich von Facebook die Nachricht, dass mein Konto gesperrt wurde mit folgender Fehlermeldung:" Jemand hat kürzlich versucht sich von einem unbekannten Gerät oder Standort für dein Konto anzumelden. Bitte bestätige, dass du diese Person warst. "

Drittens wurde gestern beim Hochfahren beim Updatevorgang angezeigt: Update 4042 von 4042. Weiterhin wurde angezeigt, dass Einträge in der Registry geändert wurden.

Ich vermute dass es irgendwie mit dem Wifi aus dem Urlaub zu tun hat. Dieses war nur mit WEP geschützt. Danach tauchten auch erst die Probleme auf.

Vielen Dank schonmal für Eure Lösungsvorschläge.

Anbei noch die LOGfiles

markusg 01.03.2013 14:38
Hi
wenn der kontakt dir ne mail gesendet hatt, ist wohl sein account gehackt worden.
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

freac 01.03.2013 14:48
Das ging ja schnell!!

Anbei der Logfile

markusg 01.03.2013 17:11
Hi,
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

freac 01.03.2013 17:57
Hier also der Combofix logfile

[Code]
Combofix Logfile:
Code:
ComboFix 13-02-26.01 - XXX 01.03.2013  17:20:27.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8044.5905 [GMT 1:00]
ausgeführt von:: c:\users\XXX\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\XXX\136887863
c:\users\XXX\136887863\Alex_137179987\img_010281334_normal.jpg
c:\users\XXX\136887863\Alex_137179987\img_010281336_normal.jpg
c:\users\XXX\136887863\Alex_137179987\Thumbs.db
c:\users\XXX\136887863\Da BoZz_351552812\ap2808500k.wmv
c:\users\XXX\136887863\Da BoZz_351552812\ps-aslm2-a.avi
c:\users\XXX\136887863\JuLe_257416876\jule.bmp
c:\users\XXX\136887863\JuLe_257416876\S4200843.JPG
c:\users\XXX\136887863\JuLe_257416876\Thumbs.db
c:\users\XXX\AppData\Local\assembly\tmp
c:\windows\IsUn0407.exe
c:\windows\SysWow64\ccrpTmr6.dll
c:\windows\SysWow64\URTTemp
c:\windows\SysWow64\URTTemp\regtlib.exe
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-02-01 bis 2013-03-01  ))))))))))))))))))))))))))))))
.
.
2013-03-01 16:40 . 2013-03-01 16:40        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-03-01 16:40 . 2013-03-01 16:40        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-02-19 18:01 . 2013-02-19 18:01        --------        d-----w-        c:\users\XXX\AppData\Local\Passbild_Generator
2013-02-19 18:01 . 2013-02-19 18:01        --------        d-----w-        c:\program files (x86)\Passbild-Generator
2013-02-16 16:25 . 2012-12-13 13:26        112080        ----a-r-        c:\windows\system32\drivers\acsock64.sys
2013-02-16 16:25 . 2013-02-16 17:00        --------        d-----w-        c:\program files (x86)\Cisco
2013-02-16 16:25 . 2013-02-16 16:25        --------        d-----w-        c:\users\XXX\AppData\Local\Cisco
2013-02-16 16:23 . 2013-02-16 17:00        --------        d-----w-        c:\programdata\Cisco
2013-02-15 22:31 . 2013-02-15 22:31        186432        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-02-14 09:37 . 2013-01-09 01:10        996352        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:37 . 2013-01-08 22:01        768000        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 10:18 . 2013-01-04 03:26        3153408        ----a-w-        c:\windows\system32\win32k.sys
2013-02-13 10:18 . 2013-01-05 05:53        5553512        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-02-13 10:18 . 2013-01-05 05:00        3967848        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-02-13 10:18 . 2013-01-05 05:00        3913064        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-02-13 10:18 . 2013-01-04 05:46        215040        ----a-w-        c:\windows\system32\winsrv.dll
2013-02-13 10:18 . 2013-01-04 04:51        5120        ----a-w-        c:\windows\SysWow64\wow32.dll
2013-02-13 10:18 . 2013-01-04 02:47        25600        ----a-w-        c:\windows\SysWow64\setup16.exe
2013-02-13 10:18 . 2013-01-04 02:47        7680        ----a-w-        c:\windows\SysWow64\instnm.exe
2013-02-13 10:18 . 2013-01-04 02:47        2048        ----a-w-        c:\windows\SysWow64\user.exe
2013-02-13 10:18 . 2013-01-04 02:47        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll
2013-02-13 10:18 . 2013-01-03 06:00        1913192        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-02-13 10:18 . 2013-01-03 06:00        288088        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-08 15:22 . 2013-02-08 15:22        --------        d-----r-        c:\program files (x86)\Skype
2013-02-08 15:22 . 2013-02-08 15:22        --------        d-----w-        c:\program files (x86)\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-27 17:54 . 2012-04-02 07:13        691568        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-02-27 17:54 . 2011-09-25 11:52        71024        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 09:45 . 2011-09-24 13:14        70004024        ----a-w-        c:\windows\system32\MRT.exe
2013-01-04 04:43 . 2013-02-13 10:18        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2012-12-30 19:36 . 2011-09-25 10:13        29480        ----a-w-        c:\windows\SysWow64\msxml3a.dll
2012-12-30 19:36 . 2011-05-31 10:06        505128        ----a-w-        c:\windows\SysWow64\msvcp71.dll
2012-12-30 19:36 . 2011-05-31 10:06        353576        ----a-w-        c:\windows\SysWow64\msvcr71.dll
2012-12-16 17:11 . 2012-12-22 18:05        46080        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-22 18:05        367616        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-22 18:05        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-22 18:05        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2012-12-14 15:49 . 2011-09-24 21:59        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-12-13 13:44 . 2012-12-13 13:44        11336        ----a-w-        c:\windows\SysWow64\vpncategories.dll
2012-12-13 13:44 . 2012-12-13 13:44        34376        ----a-w-        c:\windows\SysWow64\vpnevents.dll
2012-12-07 13:20 . 2013-01-09 13:06        441856        ----a-w-        c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-09 13:06        2746368        ----a-w-        c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-09 13:06        308736        ----a-w-        c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-09 13:06        2576384        ----a-w-        c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-09 13:06        30720        ----a-w-        c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-09 13:06        43520        ----a-w-        c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-09 13:06        23552        ----a-w-        c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-09 13:06        45568        ----a-w-        c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-09 13:06        44544        ----a-w-        c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-09 13:06        46592        ----a-w-        c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-09 13:06        40960        ----a-w-        c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-09 13:06        21504        ----a-w-        c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-09 13:06        15360        ----a-w-        c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-09 13:06        55296        ----a-w-        c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-09 13:06        51712        ----a-w-        c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-09 13:06        43520        ----a-w-        c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-09 13:06        30720        ----a-w-        c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-09 13:06        45568        ----a-w-        c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-09 13:06        44544        ----a-w-        c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-09 13:06        23552        ----a-w-        c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-09 13:06        46592        ----a-w-        c:\windows\SysWow64\fpb.rs
2012-12-07 10:46 . 2013-01-09 13:06        20480        ----a-w-        c:\windows\SysWow64\pegi.rs
2012-12-07 10:46 . 2013-01-09 13:06        21504        ----a-w-        c:\windows\SysWow64\grb.rs
2012-12-07 10:46 . 2013-01-09 13:06        40960        ----a-w-        c:\windows\SysWow64\cob-au.rs
2012-12-07 10:46 . 2013-01-09 13:06        15360        ----a-w-        c:\windows\SysWow64\djctq.rs
2012-12-07 10:46 . 2013-01-09 13:06        55296        ----a-w-        c:\windows\SysWow64\cero.rs
2012-12-07 10:46 . 2013-01-09 13:06        51712        ----a-w-        c:\windows\SysWow64\esrb.rs
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160]
"BackupManagerTray"="c:\program files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" [2012-01-05 295448]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-14 1081424]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-12-08 75048]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-12-13 702024]
.
c:\users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-12-11 110592]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-12-10 1133856]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/12/30 20:38;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2010-10-08 254448]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2012-12-13 112080]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2010-12-10 349224]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-12-10 39464]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 SimpleSlideShowServer;SimpleSlideShowServer;c:\program files (x86)\Samsung\AllShare\AllShareSlideShowService.exe [2012-03-02 27584]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-10-08 150016]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-03-30 25960]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-01-07 279616]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336]
S2 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2011-05-10 872552]
S2 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [2011-05-26 29696]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]
S2 Live Updater Service;Live Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2011-04-22 244624]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [2012-10-23 230416]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [2012-01-05 256536]
S2 SamsungAllShareV2.0;Samsung AllShare PC;c:\program files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [2012-03-02 25504]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-10-08 19192]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-22 2656280]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-12-13 544840]
S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\DRIVERS\b57xdbd.sys [2011-01-21 67624]
S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\DRIVERS\b57xdmp.sys [2011-01-21 19496]
S3 bScsiMSa;bScsiMSa;c:\windows\system32\DRIVERS\bScsiMSa.sys [2011-05-16 51240]
S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys [2011-05-06 86056]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2011-01-17 412712]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 44720578
*Deregistered* - 44720578
*Deregistered* - CLKMDRV10_38F51D56
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-05-09 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-05-09 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-05-09 416024]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
"Power Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2011-05-10 1831528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService
FontCache
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://packardbell.msn.com
mStart Page = hxxp://packardbell.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &Preispiratensuche nach markiertem Text - c:\\Program Files (x86)\\Preispiraten6\\preispiraten.html
IE: An OneNote s&enden - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube to MP3 Converter - c:\users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\anyzy7tp.default\
FF - prefs.js: keyword.URL - hxxp://search.hotspotshield.com/g/results.php?c=s&q=
FF - ExtSQL: 2013-02-19 13:16; toolbar@web.de; c:\users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{f0381dbd-e018-4e07-ae40-d96ab15083f0} - (no file)
Toolbar-Locked - (no file)
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll
Toolbar-Locked - (no file)
WebBrowser-{F0381DBD-E018-4E07-AE40-D96AB15083F0} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Photoshop 7.0 - c:\windows\ISUN0407.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-03-01  17:45:59
ComboFix-quarantined-files.txt  2013-03-01 16:45
.
Vor Suchlauf: 13 Verzeichnis(se), 412.181.090.304 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 421.045.870.592 Bytes frei
.
- - End Of File - - 091E19047E736DB22D7171B0FC8412D9
--- --- ---

markusg 01.03.2013 18:02
Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

freac 01.03.2013 18:41
Ich hab mit Malwarebytes vorher schon gescannt und nichts gefunden. Ich lasse den jetzt nochmal durchlaufen....

Aber dieses Update mit 4042 von 4042 Updates beim Systemstart macht mich stutzig.

Hier nochmal der Malwarevbytes Logfile

Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.28.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
XXX :: XXX-PC [Administrator]

01.03.2013 18:39:24
mbam-log-2013-03-01 (18-39-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 660828
Laufzeit: 5 Stunde(n), 40 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Nochmal OTL
Code:
OTL logfile created on: 01.03.2013 09:43:51 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\XXX\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,86 Gb Total Physical Memory | 5,90 Gb Available Physical Memory | 75,07% Memory free
15,71 Gb Paging File | 13,53 Gb Available in Paging File | 86,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 678,54 Gb Total Space | 383,54 Gb Free Space | 56,52% Space Free | Partition Type: NTFS
 
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.20 20:29:18 | 028,539,272 | ---- | M] (Dropbox, Inc.) -- C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013.01.11 14:15:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.13 14:44:45 | 000,702,024 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
PRC - [2012.12.13 14:44:31 | 000,544,840 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.18 17:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.03.02 16:00:26 | 000,025,504 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
PRC - [2012.01.05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
PRC - [2012.01.05 14:22:02 | 000,295,448 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.09.13 13:49:14 | 000,986,208 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
PRC - [2011.05.26 07:40:48 | 000,029,696 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
PRC - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe
PRC - [2011.03.30 23:05:00 | 002,009,704 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.03.14 12:44:38 | 000,414,800 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2011.03.14 12:44:38 | 000,334,416 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2011.03.14 12:44:36 | 001,081,424 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2011.03.14 12:44:36 | 000,352,336 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.12.22 21:25:02 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.12.22 21:24:58 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.12.08 16:54:46 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
PRC - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2010.09.14 02:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.09.14 02:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2010.04.27 03:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.14 13:01:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013.01.10 13:29:54 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\c24dc5c1953c9617b9529172e61ba202\IAStorCommon.ni.dll
MOD - [2013.01.10 13:29:53 | 000,475,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\01d0ecf3e47d2559aa403d296ad5320a\IAStorUtil.ni.dll
MOD - [2013.01.10 11:26:00 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 11:24:44 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 11:24:15 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.10 11:24:02 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 11:23:54 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.10 11:23:52 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 11:23:40 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.13 14:45:20 | 000,063,560 | ---- | M] () -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
MOD - [2012.01.05 14:22:36 | 000,465,344 | ---- | M] () -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\sqlite3.dll
MOD - [2011.08.04 01:25:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2011.03.30 23:05:00 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.27 18:54:49 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.08 17:01:32 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.13 14:44:31 | 000,544,840 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2012.10.23 22:59:18 | 000,230,416 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Programme\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3)
SRV - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.02 16:00:26 | 000,025,504 | ---- | M] (Samsung Electronics Co., Ltd.) [Auto | Running] -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe -- (SamsungAllShareV2.0)
SRV - [2012.03.02 16:00:20 | 000,027,584 | ---- | M] (Samsung Electronics Co., Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe -- (SimpleSlideShowServer)
SRV - [2012.01.05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011.11.06 16:10:36 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.09.30 13:48:32 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.05.26 07:40:48 | 000,029,696 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService)
SRV - [2011.05.10 13:01:08 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.03.30 23:05:00 | 002,009,704 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.03.14 12:44:36 | 000,352,336 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2011.03.01 20:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.12.22 21:25:02 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.12.22 21:24:58 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.12.10 17:36:54 | 000,153,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 14:53:34 | 000,953,632 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.10.08 15:33:12 | 000,254,448 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2010.10.08 01:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 22:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.14 02:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.06.01 23:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.12.13 14:26:36 | 000,112,080 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)
DRV:64bit: - [2012.10.17 10:13:38 | 000,027,048 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2012.07.18 17:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.18 17:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.18 17:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.07 12:40:02 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.12.29 00:57:26 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.05.16 22:57:32 | 000,051,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2011.05.13 03:21:04 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.05.13 03:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.05.13 03:21:02 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.05.06 18:11:12 | 000,086,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2011.04.15 19:08:28 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.03.30 23:05:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.01 15:33:16 | 004,720,704 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2011.01.21 02:15:30 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2011.01.21 02:15:28 | 000,067,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2011.01.17 23:56:14 | 000,412,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.12.10 09:05:02 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.12.10 09:04:52 | 000,349,224 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.15 09:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.10.08 01:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.09.30 06:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.09.30 06:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.09.14 06:59:16 | 000,138,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.09.14 06:59:10 | 000,021,416 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.09.14 02:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.08.20 08:21:38 | 000,106,536 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.07.29 14:30:48 | 001,383,472 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.03.19 02:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.02.08 07:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.11.09 04:28:08 | 000,091,568 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2008.11.16 17:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\..\URLSearchHook: {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{1F0C0E4A-72C8-4560-9612-27AD083921F1}: "URL" = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}
IE - HKCU\..\SearchScopes\{47F43F50-68E2-4F28-B949-26EE0EC9C505}: "URL" = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..keyword.URL: "hxxp://search.hotspotshield.com/g/results.php?c=s&q="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.15 20:34:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.07.25 07:39:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.08 17:01:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.24 15:23:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.08 17:01:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.24 15:23:33 | 000,000,000 | ---D | M]
 
[2011.09.24 21:38:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2013.02.19 13:16:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\anyzy7tp.default\extensions
[2013.02.10 20:11:49 | 000,000,000 | ---D | M] (AF-HSS Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\anyzy7tp.default\extensions\{f0381dbd-e018-4e07-ae40-d96ab15083f0}
[2013.02.19 13:16:18 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi
[2012.12.14 22:23:54 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.02.19 13:16:21 | 000,000,911 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\11-suche.xml
[2013.02.19 13:16:21 | 000,002,273 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\englische-ergebnisse.xml
[2013.02.19 13:16:21 | 000,010,563 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\gmx-suche.xml
[2013.02.19 13:16:21 | 000,002,432 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\lastminute.xml
[2013.02.19 13:16:21 | 000,005,545 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\webde-suche.xml
[2013.02.08 17:01:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.02.08 17:01:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.02.08 17:01:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.02.08 17:01:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.02.08 17:01:33 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.01.01 20:10:04 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.16 19:27:43 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.01 20:10:04 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.01 20:10:04 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.02.08 16:22:48 | 000,001,987 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SP_amazonde.xml
[2007.01.08 12:48:12 | 000,009,095 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SP_preispiraten_de.xml
[2012.01.01 20:10:04 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.01 20:10:04 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (amazon) - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\PROGRA~2\PREISP~1\IEBUTT~1.DLL ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Preispiraten) - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\PROGRA~2\PREISP~1\IEBUTT~2.DLL ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {F0381DBD-E018-4E07-AE40-D96AB15083F0} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten6\\preispiraten.html ()
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten6\\preispiraten.html ()
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten6\preispiraten3ie.exe ()
O9 - Extra 'Tools' menuitem : Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten6\preispiraten3ie.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home File not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home File not found
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DC096DF-4478-4D61-84C9-0129A69AE8BF}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{014664fa-fbac-11e0-82ea-b870f4b2b04c}\Shell - "" = AutoRun
O33 - MountPoints2\{014664fa-fbac-11e0-82ea-b870f4b2b04c}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{048116e9-3924-11e1-8b2a-b870f4b2b04c}\Shell - "" = AutoRun
O33 - MountPoints2\{048116e9-3924-11e1-8b2a-b870f4b2b04c}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\{04b29ffd-5fc0-11e1-9a66-804307028105}\Shell - "" = AutoRun
O33 - MountPoints2\{04b29ffd-5fc0-11e1-9a66-804307028105}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{dabb1b77-eb5d-11e0-bea1-b870f4b2b04c}\Shell - "" = AutoRun
O33 - MountPoints2\{dabb1b77-eb5d-11e0-bea1-b870f4b2b04c}\Shell\AutoRun\command - "" = H:\setup.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\E\Shell\configure\command - "" = E:\SETUP.EXE
O33 - MountPoints2\E\Shell\install\command - "" = E:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.28 23:04:06 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\XXX\Desktop\HiJackThis204.exe
[2013.02.28 23:03:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2013.02.27 19:11:25 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.02.27 19:11:25 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.02.27 19:11:25 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.02.27 19:11:25 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.02.27 19:11:20 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.02.27 19:11:20 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.02.27 19:11:15 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.02.27 19:11:15 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.27 19:11:15 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.27 19:11:15 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.27 19:11:15 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.27 19:11:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.27 19:11:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.27 19:11:15 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.27 19:11:15 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.27 19:11:14 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.02.27 19:11:14 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.02.27 19:11:14 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.27 19:11:13 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.02.27 19:11:13 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.02.27 19:11:13 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.02.27 19:11:13 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.02.27 19:11:13 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.02.27 19:11:13 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.02.27 19:11:13 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.02.27 19:11:13 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.02.27 19:11:13 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.02.27 19:11:12 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.02.27 19:11:12 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.02.27 19:11:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.02.27 19:11:12 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.02.19 19:01:34 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Passbild_Generator
[2013.02.19 19:01:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Passbild-Generator
[2013.02.19 19:01:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Passbild-Generator
[2013.02.19 18:32:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BFE07D40-40F7-43B5-9B6B-D93C37EF3EC3}
[2013.02.16 18:00:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco
[2013.02.16 17:25:41 | 000,112,080 | R--- | C] (Cisco Systems, Inc.) -- C:\Windows\SysNative\drivers\acsock64.sys
[2013.02.16 17:25:36 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Cisco
[2013.02.16 17:25:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2013.02.16 17:23:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Cisco
[2013.02.14 10:32:24 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.02.14 10:32:24 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.02.14 10:32:22 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.02.14 10:32:22 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.02.14 10:32:21 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.02.14 10:32:21 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.02.14 10:32:19 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.02.14 10:32:18 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.02.14 10:32:17 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.02.14 10:32:17 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.02.14 10:32:16 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.02.14 10:32:16 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.02.14 10:32:14 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.02.14 10:32:14 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.02.14 10:32:14 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.02.13 11:18:25 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.02.13 11:18:24 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.02.13 11:18:24 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.02.13 11:18:22 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.02.13 11:18:21 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.02.13 11:18:21 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.02.13 11:18:21 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.02.13 11:18:21 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.02.13 11:18:21 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.02.13 11:18:19 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.02.08 17:01:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.02.08 16:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.08 16:22:17 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.02.08 16:22:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.01 09:28:57 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.01 09:28:57 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.01 09:20:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.01 09:20:42 | 2030,981,119 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.28 23:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.28 22:58:25 | 001,793,806 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.28 22:58:25 | 000,759,366 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.28 22:58:25 | 000,719,508 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.28 22:58:25 | 000,170,692 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.28 22:58:25 | 000,146,336 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.27 18:54:49 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.02.27 18:54:49 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.02.22 17:26:59 | 000,107,398 | ---- | M] () -- C:\Users\XXX\Desktop\Leistungsnachweis.pdf
[2013.02.16 17:59:16 | 000,000,375 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2013.02.16 17:28:15 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF
[2013.02.14 12:55:11 | 000,454,384 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.03 12:15:13 | 000,001,157 | ---- | M] () -- C:\Users\Public\Desktop\CEWE FOTOSCHAU.lnk
[2013.02.03 12:15:13 | 000,001,142 | ---- | M] () -- C:\Users\Public\Desktop\dm-Fotowelt.lnk
[2013.02.03 09:15:06 | 000,001,069 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.02.03 09:15:04 | 000,000,680 | ---- | M] () -- C:\Windows\wininit.ini
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.28 23:03:52 | 000,365,568 | ---- | C] () -- C:\Users\XXX\Desktop\gmer-2.0.18444.exe
[2013.02.22 17:26:59 | 000,107,398 | ---- | C] () -- C:\Users\XXX\Desktop\Leistungsnachweis.pdf
[2013.02.16 17:27:12 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF
[2013.01.11 14:17:32 | 000,000,020 | ---- | C] () -- C:\Users\XXX\defogger_reenable
[2012.10.14 22:11:10 | 000,025,978 | ---- | C] () -- C:\Users\XXX\.TransferManager.db
[2012.10.07 21:11:29 | 000,000,001 | R--- | C] () -- C:\Users\XXX\serverport
[2012.06.11 15:44:08 | 000,000,680 | ---- | C] () -- C:\Windows\wininit.ini
[2012.05.30 13:31:27 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2012.05.30 13:30:39 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2012.01.01 17:46:49 | 000,000,069 | ---- | C] () -- C:\Windows\bpe.INI
[2012.01.01 17:28:03 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll
[2012.01.01 17:28:03 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2012.01.01 17:26:11 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2012.01.01 17:26:11 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.11.06 16:13:06 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011.09.29 14:22:26 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.09.25 09:31:37 | 001,821,424 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.31 11:11:46 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.05.31 11:11:45 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.05.31 11:11:44 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.05.31 11:11:43 | 013,359,616 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.05.31 11:11:43 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

freac 02.03.2013 14:47
Extras
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 01.03.2013 09:43:51 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\XXX\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,86 Gb Total Physical Memory | 5,90 Gb Available Physical Memory | 75,07% Memory free
15,71 Gb Paging File | 13,53 Gb Available in Paging File | 86,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 678,54 Gb Total Space | 383,54 Gb Free Space | 56,52% Space Free | Partition Type: NTFS
 
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files (x86)\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files (x86)\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0883F3D7-803B-4C49-B96A-12758DD78567}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{38706E0C-8A9E-4DB6-AC4D-1379DEE44E53}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{46908DDD-268C-4904-AF28-8CA26878687E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4ACF54DC-42A3-48BF-AABD-CF835E911072}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4D136F27-AEE9-4B0F-B973-BC2C2C521A8E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4F7BE862-03C5-47F5-BF81-2E8218B20E65}" = lport=138 | protocol=17 | dir=in | app=system |
"{5105AE5F-A0EF-4268-B05A-4CD04DB7C86F}" = rport=445 | protocol=6 | dir=out | app=system |
"{5357D6C9-7A36-4151-9CE7-15D22ACFC336}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6822BA78-04E1-4494-8E8B-8677A78294C3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{71F17EC9-98CC-4027-94C9-FE8C7718C382}" = lport=10243 | protocol=6 | dir=in | app=system |
"{72BE56E0-CD67-4FE5-978A-DC2E96ADD13A}" = lport=137 | protocol=17 | dir=in | app=system |
"{750E66EE-05CF-4640-AC59-CB71D5547814}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{83BF2C09-1430-4CCA-A745-FD41F26651FD}" = lport=139 | protocol=6 | dir=in | app=system |
"{A2943DD8-FF65-4386-9A5D-98AE9A47F87B}" = rport=138 | protocol=17 | dir=out | app=system |
"{A57F193A-3D28-4131-8B1C-85239627654C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A628B142-6AD6-4E77-96B4-C001B29760BC}" = lport=445 | protocol=6 | dir=in | app=system |
"{AAEEEAF3-89D7-4D43-A331-00D3973BC96D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B7223A3B-62AC-4A91-A944-D48ED94E5E03}" = rport=139 | protocol=6 | dir=out | app=system |
"{BC83F442-5749-483A-A7AF-133D385F631C}" = rport=137 | protocol=17 | dir=out | app=system |
"{C4BAC63E-7A0D-446A-A651-51F09469D3AD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EBD550AB-5951-47B7-BB3B-6254B9FB6D0A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ECD70914-F91C-42E7-8FF5-3D02CCE7E67E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F54FACF6-707F-4624-A506-30683FEE503C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09506E9E-AE38-4F90-B07F-C0397F0CF216}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{163FE0D5-9860-4799-9D60-05122DEB688A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1AB91966-11D8-4B3C-B6EA-9C1DB56D822C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{2BEFFA86-39D0-488B-993E-BD61CB742D3E}" = dir=in | app=c:\program files (x86)\samsung\allshare\allshare.exe |
"{2E20E75D-B919-4023-84DF-93A24455D13F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{379CA82B-C69C-4D48-B945-FCC4BCA3D449}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{430922E7-A5FB-48D1-89E6-58101514BC72}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{43988222-CE1B-454C-B6B0-BEF3A51AF03E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46AFBD89-FD40-4540-BCF5-EBE5D88AB127}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4C5DB8C6-5345-4B1F-8DB6-89D3C24D19E9}" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"{5B80337C-3889-4E33-AD62-60011B2AFF8E}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{5B921983-CDCE-46AE-ADC5-B1C77D28FF92}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{637B47F6-EF0A-4D70-8B3B-7F5DF8C19E68}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{85CF54EA-A853-4EDD-BFCA-19EA655D4747}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8DB4DCA9-A9DF-44A9-91CE-991DC6C1E1D7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{978FABC4-DE7C-4753-9E71-48FF6B26E327}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9BA765E5-13DD-4974-AACF-ACCB085734F2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9CDE560D-BA82-421C-BAD8-B456300F1CCF}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{9FCEA087-D956-48B4-82BC-2875A6C51394}" = dir=in | app=c:\program files (x86)\samsung\allshare\allshareagent.exe |
"{A143677B-6BF6-4620-85F5-03EAF27966D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A520B4B7-ACBA-4EAE-8C9F-A8AF5B8318AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AB44EC30-EEC8-445A-AF7E-FCEB31B7BEBF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{AD779564-A6B8-4963-B15E-9322B26B4011}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{B40514BC-5D48-4EFB-8F89-A2AF50AE3E2C}" = dir=in | app=c:\program files (x86)\samsung\allshare\allsharedms\allsharedms.exe |
"{C49DAF3A-2F8E-44C4-AC08-E36A105AC45D}" = protocol=6 | dir=out | app=system |
"{C630E16B-5D74-4244-BB3A-CAE37584ECFB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D629E24C-4A3F-4086-94F8-FD0456439EC2}" = protocol=17 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"{E4E84C6D-AC3D-45EF-B1AA-C69B021E525E}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{EC6CF3F1-9A88-44E9-85D5-D51D55FBF863}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FD2C47C5-2FD5-49F2-9DC2-03133500AEDD}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"TCP Query User{09CD68CE-9648-4171-B0D3-24F5ACAD451D}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{3C99FBB4-2356-43CE-9F23-04993E1BAC6E}C:\users\XXX\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light |
"TCP Query User{4ACE18F7-63BF-4CFD-9892-DA9D7EE4925C}C:\users\XXX\appdata\local\temp\6299.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\6299.tmp\kmservice.exe |
"TCP Query User{656D781D-197F-4193-8696-EF33C34B4DF8}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"TCP Query User{8F700880-770D-40BA-9166-422DCC508A1F}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{A7CAE12F-732B-42DE-A167-D858C0231197}C:\users\XXX\appdata\local\temp\ef5d.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\ef5d.tmp\kmservice.exe |
"TCP Query User{AA16659C-1903-49B7-B96B-A68682013F60}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{F4D28F7E-B91D-4BD3-96F7-5A37964DD1A5}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{090D698A-94DD-4950-AB32-0453654B59EE}C:\users\XXX\appdata\local\temp\6299.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\6299.tmp\kmservice.exe |
"UDP Query User{1E1C39F9-BD8E-4F19-93DE-A065CE3A883B}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{30A42F46-4553-4D7A-B4D3-6580256D8BE3}C:\users\XXX\appdata\local\temp\ef5d.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\ef5d.tmp\kmservice.exe |
"UDP Query User{5D8CED19-C76C-426E-AA39-5F0A9C8D3CFF}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{B6994318-1D70-4104-AE4E-7F41BA5D7859}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{C490C8FC-B76E-469D-A57F-6A5BCBAFFD42}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{DEF3751A-5DD5-4322-8AB9-52011BF2DFEE}C:\users\XXX\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light |
"UDP Query User{FCEF1883-4314-4A5D-8ECD-FFEBD5626917}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{14A7DBEC-1E2D-4AE2-BDD8-287472B714E3}" = Microsoft SQL Server 2012 RC0 Setup (English)
"{1553D712-B35F-4A82-BC72-D6B11A94BE3E}" = Windows Live Remote Service Resources
"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources
"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources
"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources
"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources
"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources
"{4710662C-8204-4334-A977-B1AC9E547819}" = Broadcom Card Reader Driver Installer
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources
"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources
"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources
"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources
"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{702A632F-99CE-4E2D-B8F2-BF980E9CF62F}" = Windows Live Remote Client Resources
"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{8F7F2D9C-2DBE-4F10-9C7C-2724110A3339}" = Windows Live Remote Service Resources
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97A295A7-8840-4B35-BB61-27A8F4512CA3}" = Windows Live Remote Service Resources
"{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client
"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources
"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources
"{A2AA3E06-2A11-4803-8515-A49628E65515}" = Nitro Reader 3
"{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{A6E0F6BE-30AC-4D36-97B0-1AC20E23CB83}" = Windows Live Remote Client Resources
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 268.00
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 268.00
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B636C9B9-A3F2-4DCE-ADCC-72E095018385}" = Microsoft SQL Server VSS Writer
"{B680A663-1A15-47A5-A07C-7DF9A97558B7}" = Windows Live Remote Client Resources
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Überwachungstool für die Intel® Turbo-Boost-Technik 2.0
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C91DCB72-F5BB-410D-A91A-314F5D1B4284}" = Broadcom Gigabit NetLink Controller
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources
"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"MatlabR2008a" = MATLAB R2008a
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh
"{0125DB4D-98A0-4DBF-B68A-23BF08FFA6A3}" = Windows Live Messenger
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Video Web Camera
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{0557BBDA-69D3-4FA4-A93C-A5300F7034B4}" = Windows Live Writer
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{06B05153-97E4-427E-B1A8-E098F6C5E52F}" = Windows Live Essentials
"{073F306D-9851-4969-B828-7B6444D07D55}" = Windows Live Photo Common
"{0785A0B6-07DF-43CF-B147-E1EB4CEA0345}" = Windows Live Messenger
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0A9256E0-C924-46DE-921B-F6C4548A1C64}" = Windows Live Messenger
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Backup Manager V3
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail
"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh
"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh
"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer
"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar
"{120C160F-F53D-4A15-A873-E79BF5B98B48}" = Windows Live Photo Common
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker
"{148E08FF-D7C4-46ED-8D4D-601C67FE0AFD}" = Rosetta Stone Version 3
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer
"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20381A8A-808E-4A53-B6CD-AD2B85E16365}" = Windows Live UX Platform Language Pack
"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack
"{226F0D93-76DE-4F1C-B14D-DE10443ADB60}" = Windows Live Movie Maker
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail
"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C7E8AA1-9C03-4606-BF34-5D99D07964DA}" = Windows Live Messenger
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh
"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{303143DD-1F6D-4BC5-9342-FFC2E19B2DBD}" = Windows Live Messenger
"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{34C4F5AF-D757-4E6A-ABCA-65AB5A50A1A8}" = Windows Live Messenger
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39BDD209-5704-480C-9F4A-B69D0370DDBB}" = Windows Live Messenger
"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh
"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3D0C22FA-96D7-4789-BC5B-991A5A99BFFA}" = Windows Live Messenger
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell Power Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials
"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer
"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{439D9ABF-8D1B-4C09-A50D-C9794510D0E4}" = Samsung PC Studio 3
"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials
"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live
"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources
"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{4736B0ED-F6A1-48EC-A1B7-C053027648F1}" = Galeria fotogràfica del Windows Live
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{48F597DD-D397-4CFA-91A0-4C033A0113BD}" = Windows Live Mail
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials
"{4A275FD1-2F24-4274-8C01-813F5AD1A92D}" = Windows Live Messenger
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack
"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack
"{4D7BAC8A-51B8-4243-8567-1415C4272D13}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{50300123-F8FC-4B50-B449-E847D04F1BA2}" = Windows Live Messenger
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack
"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources
"{5384EA8A-FECA-4D6E-B7B4-3D4D9D47E5DF}" = Preispiraten
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5495E9A4-501A-4D4C-87C9-E80916CA9478}" = Windows Live UX Platform Language Pack
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri
"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources
"{5D90ABE5-8A35-4947-8269-6F40BCE47A95}" = Windows Live Messenger
"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer
"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack
"{5F6E678A-7E61-448A-86CB-BC2AD1E04138}" = Windows Live Messenger
"{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger
"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker
"{625D45F0-5DCB-48BF-8770-C240A84DAAEB}" = Windows Live Mesh
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BF4BD3-B1F6-4FA2-8388-CC0647ACBF86}" = Nero Multimedia Suite 10 Essentials
"{63AE67AA-1AB1-4565-B4EF-ABBC5C841E8D}" = Windows Live Messenger
"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail
"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh
"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials
"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker
"{64EF903E-D00A-414C-94A4-FBA368FFCDC9}" = Packard Bell Social Networks
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6986737B-F286-40D1-87AF-938339DCF6AB}" = Windows Live Messenger
"{69C9C672-400A-43A0-B2DE-9DB38C371282}" = Windows Live Writer
"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6A563426-3474-41C6-B847-42B39F1485B2}" = Windows Live Messenger
"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6D30E864-46AE-435B-8230-8B5D42B4AE37}" = Windows Live Messenger
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6DEF11C0-35FF-4160-A543-FDD336C4DAE5}" = Microsoft SQL Server 2005 Express Edition
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6EE9F44A-B8C7-4CDB-B2A9-441AF2AE315A}" = Windows Live Messenger
"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker
"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{709E38A9-7F80-4598-96CC-44B0D553FECE}" = Windows Live Messenger
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-packardbell" = WildTangent Games App (Packard Bell Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71527C7C-5289-4CB2-88C9-23344C0FF6C1}" = Windows Live Movie Maker
"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer
"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh
"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár
"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack
"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources
"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}" = OPC Core Components Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common
"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker
"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live
"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common
"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources
"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7D926AD2-16D6-42C2-8CA1-AB09E96040BA}" = Windows Live Writer Resources
"{7D99B933-E29C-4599-92F0-DAED2AF041E3}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources
"{7F6021AE-E688-4D03-843A-C2260482BA0D}" = Windows Live Messenger
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh
"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials
"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery
"{86F444A5-C9B9-41DC-AF28-B5E46F5497C7}" = Windows Live Argazki Galeria
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery
"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E258ED0-CFA1-4DC9-B031-9D1009CA2A0D}" = Process Modeling (HYSYS) V7.1
"{8E285C75-9BE2-4349-972B-DECDDF472656}" = Windows Live Writer Resources
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_VISPRO_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_VISPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{CE144BF4-4950-4CDB-A5F7-CCE1888F49CB}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{3CB0380B-0413-4C44-A63B-DCD6369EAF4E}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{93C4B7D5-4E00-491F-BA3E-25B7B63EE7F6}" = Windows Live Mail
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria
"{99BE7F5D-AB52-4404-9E03-4240FFAA7DE9}" = Windows Live Mesh
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA9FEE7-9F99-4E69-947A-49F7DA0DDA3A}" = Cisco AnyConnect Secure Mobility Client
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9E2C5B0E-7A2D-4767-A9B2-77469FB1873A}" = Windows Live Mesh
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker
"{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = HomeMedia
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh
"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{ABE2F2AA-7ADC-4717-9573-BF3F83C696AC}" = Windows Live Mail
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common
"{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{B7B67AA5-12DA-4F01-918D-B1BF66779D8A}" = Windows Live Writer Resources
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common
"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C01FCACE-CC3D-49A2-ADC2-583A49857C58}" = Windows Live Essentials
"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker
"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery
"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D54A52A8-DF24-4CE8-850B-074CA47DFA74}" = Windows Live Messenger
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer
"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{DF47ACA3-7C78-4C08-8007-AC682563C9F1}" = Samsung AllShare
"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5377D46-83C5-445A-A1F1-830336B42A10}" = Windows Live Galerija fotografija
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live
"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E7688C7D-DE09-4D43-9785-534EDE9BC18E}" = Windows Live Messenger
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources
"{EA777812-4905-4C08-8F6E-13BDCC734609}" = Windows Live UX Platform Language Pack
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Packard Bell Updater
"{EE492B20-FB15-4A98-883C-3054354A11F8}" = Windows Live Messenger
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F0F5D89A-197C-495B-827E-3E98B811CD2E}" = Windows Live Photo Common
"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F13587F7-AA4C-4C2E-AE7D-F33F3CCE57A9}" = Windows Live Messenger
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F694D1F7-1F12-4550-9B7A-C871273ABAD5}" = Windows Live Messenger
"{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail
"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker
"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCBC19F7-E068-4B7A-ACBB-CE9CCEB4B21F}" = Windows Live Messenger
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials
"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"{FF737490-5A2D-4269-9D82-97DB2F7C0B09}" = Windows Live Movie Maker
"ACDLabs in C__ACDFREE12_" = ACD/Labs Software in C:\ACDFREE12\
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"AIMP2" = AIMP2
"Avira AntiVir Desktop" = Avira Free Antivirus
"BKChem_is1" = BKChem-0.14.0-pre2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup" = DivX-Setup
"dm-Fotowelt" = dm-Fotowelt
"DSMT6" = MathType 6
"EASEUS Data Recovery Wizard Free Edition 5.5.1_is1" = EASEUS Data Recovery Wizard Free Edition 5.5.1
"exe" = eXe -- eLearning XHTML editor
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
"Identity Card" = Identity Card
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Video Web Camera
"InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Packard Bell MyBackup
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}" = Packard Bell Social Networks
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}" = Samsung AllShare
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Opera 12.14.1738" = Opera 12.14
"Packard Bell Registration" = Packard Bell Registration
"Packard Bell Screensaver" = Packard Bell ScreenSaver
"Packard Bell Welcome Center" = Welcome Center
"Passbild-Generator_is1" = Bewerbungsfoto-/Passbild-Generator v3.5b
"PowerISO" = PowerISO
"PremElem90" = Adobe Premiere Elements 9
"Uninstall_is1" = Uninstall 1.0.0.1
"Veetle TV" = Veetle TV
"VISPRO" = Microsoft Office Visio Professional 2007
"VLC media player" = VLC media player 1.1.11
"WildTangent packardbell Master Uninstall" = Packard Bell Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WTA-06eb6600-64b5-47c3-b6fa-7ff1ff2f3cfc" = Jewel Quest Solitaire
"WTA-07606b8a-2b3b-4542-be1e-1fbd0fb8a291" = FATE
"WTA-08088377-5408-490f-bc00-811ab5c6a155" = Slingo Deluxe
"WTA-0f12f38c-a64a-46af-b289-be2a46c95da0" = Mystery P.I. - The London Caper
"WTA-46208327-facf-4724-b4eb-fcd31a20c91a" = Virtual Villagers - The Secret City
"WTA-71cb4c31-7f0a-4f0e-8614-b0758e707d95" = Bejeweled 2 Deluxe
"WTA-7a931507-7018-49b2-8194-f5270f35e64a" = Zuma Deluxe
"WTA-813785b6-6024-4c2d-9ceb-4ed1e8a22c86" = Torchlight
"WTA-82596a95-dbbf-4624-92d7-4a0580689489" = Polar Bowler
"WTA-82c3f7f1-e3e5-4d3e-879e-fed9df6ddd15" = Wedding Dash
"WTA-93b4139e-5995-45d6-b869-7e49ad69221d" = John Deere Drive Green
"WTA-98473aaf-1a49-4a16-86b0-e0d836409520" = Diner Dash 2 Restaurant Rescue
"WTA-9e7c7af7-67b5-4fe6-b560-e140de7c5560" = Crazy Chicken Kart 2
"WTA-aa97fe7c-8120-467e-a783-7e1ffa9a52fc" = Plants vs. Zombies - Game of the Year
"WTA-b98c8cd9-181a-464d-b6f1-2e8e061acf54" = Penguins!
"WTA-c2b35758-fa65-4d7c-9f2d-924256554958" = Agatha Christie - 4:50 from Paddington
"WTA-f63728e7-2d28-4ae0-a675-d8025ecad800" = Chuzzle Deluxe
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"pdfsam" = pdfsam
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.02.2013 10:21:11 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 24.02.2013 10:23:39 | Computer Name = XXX-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 12.14.1738.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 17d0    Startzeit:
 01ce129a4685d7b7    Endzeit: 78    Anwendungspfad: C:\Program Files (x86)\Opera\opera.exe

Berichts-ID:
 b87ea746-7e8d-11e2-9683-b870f4b2b04c 
 
Error - 25.02.2013 04:05:07 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 25.02.2013 15:33:10 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 25.02.2013 15:41:34 | Computer Name = XXX-PC | Source = Windows Backup | ID = 4103
Description =
 
Error - 28.02.2013 12:27:33 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 28.02.2013 17:44:35 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 28.02.2013 18:29:46 | Computer Name = XXX-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: c04    Startzeit:
01ce15ffa2849fef    Endzeit: 0    Anwendungspfad: C:\Users\XXX\Desktop\OTL.exe    Berichts-ID:
 
 
Error - 01.03.2013 04:21:50 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 01.03.2013 04:43:41 | Computer Name = XXX-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 11c0    Startzeit:
 01ce165836ac7a56    Endzeit: 0    Anwendungspfad: C:\Users\XXX\Desktop\OTL.exe    Berichts-ID:
 
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 01.03.2013 04:21:53 | Computer Name = XXX-PC | Source = acvpnui | ID = 67108865
Description = Function: ConnectMgr::activateConnectEvent File: .\ConnectMgr.cpp Line:
 1336 NULL object. Cannot establish a connection at this time.
 
Error - 01.03.2013 04:22:01 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CTlsTransport::OnSocketReadComplete File: .\IP\TlsTransport.cpp
Line:
 519 Invoked Function: ISocketTransportCB::OnSocketReadComplete Return Code: -31588336
 (0xFE1E0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was
 shutdown by the operating system or a remote peer.
 
Error - 01.03.2013 04:22:01 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnSocketReadComplete File: .\IP\HttpSessionAsync.cpp
Line:
 1464 Invoked Function: CSocketTransport::readSocket Return Code: -31588336 (0xFE1E0010)
Description:
 SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was shutdown by the operating
 system or a remote peer.
 
Error - 01.03.2013 04:22:01 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnSendRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
 373 Invoked Function: CHttpSessionAsync::OnSendRequestComplete Return Code: -31588336
 (0xFE1E0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was
 shutdown by the operating system or a remote peer.
 
Error - 01.03.2013 04:26:00 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
 274 m_pIServicePlugin is NULL
 
Error - 01.03.2013 04:26:00 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
 274 m_pIServicePlugin is NULL
 
Error - 01.03.2013 04:26:00 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108865
Description = Function: CTelemetryPluginMgr::GetSettings File: .\TelemetryPluginMgr.cpp
Line:
 311 m_pITelemetryPlugin is NULL
 
Error - 01.03.2013 06:05:18 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CTlsTransport::OnSocketReadComplete File: .\IP\TlsTransport.cpp
Line:
 519 Invoked Function: ISocketTransportCB::OnSocketReadComplete Return Code: -31588336
 (0xFE1E0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was
 shutdown by the operating system or a remote peer.
 
Error - 01.03.2013 06:05:18 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnSocketReadComplete File: .\IP\HttpSessionAsync.cpp
Line:
 1464 Invoked Function: CSocketTransport::readSocket Return Code: -31588336 (0xFE1E0010)
Description:
 SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was shutdown by the operating
 system or a remote peer.
 
Error - 01.03.2013 06:05:18 | Computer Name = XXX-PC | Source = acvpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnSendRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
 373 Invoked Function: CHttpSessionAsync::OnSendRequestComplete Return Code: -31588336
 (0xFE1E0010) Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was
 shutdown by the operating system or a remote peer.
 
[ Media Center Events ]
Error - 09.10.2011 12:43:55 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 18:43:55 - Fehler beim Herstellen der Internetverbindung.  18:43:55
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 09.10.2011 12:44:04 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 18:44:01 - Fehler beim Herstellen der Internetverbindung.  18:44:01
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 10.10.2011 04:08:22 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 10:08:22 - Directory konnte nicht abgerufen werden (Fehler: Die Verbindung
 mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 10.10.2011 04:08:41 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 10:08:38 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 10.10.2011 04:08:44 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 10:08:43 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 10.10.2011 04:08:46 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = 10:08:46 - Broadband konnte nicht abgerufen werden (Fehler: Die Verbindung
 mit dem Remoteserver kann nicht hergestellt werden.) 
 
[ System Events ]
Error - 25.02.2013 04:04:15 | Computer Name = XXX-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 25.02.2013 04:04:52 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  StarOpen
 
Error - 25.02.2013 15:31:15 | Computer Name = XXX-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 25.02.2013 15:31:47 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  StarOpen
 
Error - 28.02.2013 12:26:03 | Computer Name = XXX-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 28.02.2013 12:27:09 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  StarOpen
 
Error - 28.02.2013 17:43:42 | Computer Name = XXX-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 28.02.2013 17:44:20 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  StarOpen
 
Error - 01.03.2013 04:20:39 | Computer Name = XXX-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 01.03.2013 04:21:17 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  StarOpen
 
 
< End of report >
--- --- ---

freac 02.03.2013 14:55
Gmer
Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-03-01 13:33:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.01.0 698,64GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\kgriruod.sys
---- User code sections - GMER 2.0 ----
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                              00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                            00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                            00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                            00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                    000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                  000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                              000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\ole32.dll!CoCreateInstance                                                      000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1412] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                    000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                        0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                  00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                    0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                  0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                      0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                          0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                  000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                        0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1356] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                          0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                    00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                      00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                    00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                    00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                      00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                      00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                      00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                          00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                    00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                      00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                        00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                      00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                    00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                  00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                00000000765e144a 2 bytes [5E, 76]
.text    ...                                                                                                                        * 9
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                    00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                            00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                    00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                            00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                  00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                        00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                  00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                      00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                  00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                            00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[3276] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                            00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17              00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17              00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42              00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                  00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17          00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                  00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17          00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                      00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17              00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                    00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17              00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20          00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31          00000000765e16bd 2 bytes [5E, 76]
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                      00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                    00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                    00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                    00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                            000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                        000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                          000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                              000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                      000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                        000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                      000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                              000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Windows\System32\igfxpers.exe[4552] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                            000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                        00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                      00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                      00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                      00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                          000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                        000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4612] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                      00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                    00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                    00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                    00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                              000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                          000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                            000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                              000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                        000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                        000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                      000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\ole32.dll!CoCreateInstance                                                              000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4744] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                              000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                            00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                          00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                          00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                          00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\kernel32.dll!RegSetValueExA                                  000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                              000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                    000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                            000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                              000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                            000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\ole32.dll!CoCreateInstance                                    000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[4768] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                  000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                          00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                        00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                        00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                        00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                  000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                            000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                          000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                  000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\dxgi.dll!DXGID3D10CreateDevice                                                              000007fef8d7c638 5 bytes JMP 000007fff8d50148
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                  000007fef8d7dc88 5 bytes JMP 000007fff8d500d8
.text    C:\Program Files\Windows Sidebar\sidebar.exe[4780] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                000007fef8d7de10 5 bytes JMP 000007fff8d50110
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                              00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                              00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                              00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                      000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                        000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                  000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4808] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                          000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                    0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                          00000000765e1401 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                            00000000765e1419 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                          00000000765e1431 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                          00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                              00000000765e14dd 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                      00000000765e14f5 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                              00000000765e150d 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                      00000000765e1525 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                            00000000765e153d 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                  00000000765e1555 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                          00000000765e156d 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                            00000000765e1585 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                00000000765e159d 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                            00000000765e15b5 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                          00000000765e15cd 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                      00000000765e16b2 2 bytes [5E, 76]
.text    C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                      00000000765e16bd 2 bytes [5E, 76]
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                              00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                              00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                              00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                        000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                    000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                      000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                        000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                  000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                        000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                        000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                  000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Windows\system32\wbem\unsecapp.exe[5056] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                    00000000765e1401 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                      00000000765e1419 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                    00000000765e1431 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                    00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                        00000000765e14dd 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                00000000765e14f5 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                        00000000765e150d 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                00000000765e1525 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                      00000000765e153d 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                            00000000765e1555 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                    00000000765e156d 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                      00000000765e1585 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                          00000000765e159d 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                      00000000765e15b5 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                    00000000765e15cd 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                00000000765e16b2 2 bytes [5E, 76]
.text    C:\Windows\SysWOW64\RunDll32.exe[1364] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                      000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                      00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                      00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                        00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                            0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                          0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                              0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4396] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                      0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                              000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                  0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                    0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                      0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                              00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                              00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                              00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                  00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                          00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                  00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                          00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                      00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                              00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                    00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                              00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                          00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[1040] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                          00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                            0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                  000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                  00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                  00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                    00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                        0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                      0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                          0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                            0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                    000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                            0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                            0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                    00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                      00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                    00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                    00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                      00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                      00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                      00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                          00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                    00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                      00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                        00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                      00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                    00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\LManager.exe[500] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\kernel32.dll!RegSetValueExA          0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW  000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx  00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation  00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW    00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW      0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW    0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW        0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary            0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList    000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo      000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket          0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4460] C:\Windows\syswow64\ole32.dll!CoCreateInstance            0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                        0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                              000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                              00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                              00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                    0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                  0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                      0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                        0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                  000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                        0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\CyberLink\Shared Files\brs.exe[4372] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                        0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                          00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                        00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                        00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                        00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\kernel32.dll!RegSetValueExA                                  000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                              000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                  000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                            000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                            000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[4492] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                          000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                              0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                      000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                      00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                      00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                        00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                          0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                        0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                            0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                              0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                      00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                        00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                      00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                      00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                          00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                  00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                          00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                  00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                        00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                              00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                      00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                        00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                            00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                        00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                      00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                  00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                  00000000765e16bd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                    00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                  00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                  00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                  00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                          000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                      000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                        000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                            000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                    000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4900] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                    000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                      00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                    00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                    00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                    00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                            000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                              000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                        000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[4400] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                      000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                          0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                  000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                  00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                  00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                    00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                      0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                    0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                        0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                            0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                    000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                          0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Program Files (x86)\Launch Manager\LMworker.exe[2564] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                            0000000076859d0b 5 bytes JMP 0000000172441c70
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                      00000000776aefe0 5 bytes JMP 000000016fff0148
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                    00000000776d99b0 7 bytes JMP 000000016fff00d8
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                    00000000776e94d0 5 bytes JMP 000000016fff0180
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                    00000000776e9640 5 bytes JMP 000000016fff0110
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                              000000007770a500 7 bytes JMP 000000016fff01b8
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                          000007fefdd43460 7 bytes JMP 000007fffdd300d8
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                            000007fefdd49940 6 bytes JMP 000007fffdd30148
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                              000007fefdd49fb0 5 bytes JMP 000007fffdd30180
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                        000007fefdd4a150 5 bytes JMP 000007fffdd30110
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                        000007feff7f89e0 8 bytes JMP 000007fffdd301f0
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                      000007feff7fbe40 8 bytes JMP 000007fffdd301b8
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                              000007feff2a7490 11 bytes JMP 000007fffdd30228
.text    C:\Windows\system32\taskeng.exe[4444] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                              000007feff2bbf00 7 bytes JMP 000007fffdd30260
.text    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe[5460] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                            0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe[5460] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                    000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe[5460] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                    00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe[5460] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                    00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe[5460] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                      00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                00000000765e1401 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                  00000000765e1419 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                00000000765e1431 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                00000000765e144a 2 bytes [5E, 76]
.text    ...* 9
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                    00000000765e14dd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                            00000000765e14f5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                    00000000765e150d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                            00000000765e1525 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                  00000000765e153d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                        00000000765e1555 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                00000000765e156d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                  00000000765e1585 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                      00000000765e159d 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                  00000000765e15b5 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                00000000765e15cd 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                            00000000765e16b2 2 bytes [5E, 76]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                            00000000765e16bd 2 bytes [5E, 76]
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                0000000076721429 7 bytes JMP 0000000172441e90
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                      000000007673b223 5 bytes JMP 0000000172441da0
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                      00000000767b88f4 7 bytes JMP 0000000172441d90
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                      00000000767b8979 5 bytes JMP 0000000172441e80
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                        00000000767b8ccf 5 bytes JMP 0000000172441e10
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                            0000000076f71d1b 5 bytes JMP 0000000172442450
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                          0000000076f71dc9 5 bytes JMP 00000001724424b0
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                              0000000076f72aa4 5 bytes JMP 0000000172442520
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                0000000076f72d0a 5 bytes JMP 0000000172442620
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                        000000007537e9a2 5 bytes JMP 0000000172441a00
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                          000000007537ebdc 5 bytes JMP 0000000172441a90
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                0000000076825ea5 5 bytes JMP 0000000172441ce0
.text    C:\Users\XXX\Desktop\gmer-2.0.18444.exe[5780] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                0000000076859d0b 5 bytes JMP 0000000172441c70

---- Threads - GMER 2.0 ----

Thread  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320:3924]                                                                                              000000001000e2eb
Thread  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320:4040]                                                                                              00000000010266e0
Thread  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320:4044]                                                                                              00000000010266e0
Thread  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320:4048]                                                                                              00000000010266e0
Thread  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320:4052]                                                                                              0000000001022560
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2444]                                                                            00000000779c3e45
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2468]                                                                            00000000779c2e25
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2480]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2484]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2488]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2492]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2496]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2572]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2576]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2608]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2616]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2620]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2628]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2640]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2644]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2660]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2668]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2680]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2684]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2696]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2956]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3000]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3004]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3016]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3028]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3032]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3040]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3048]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3056]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3068]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2084]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2036]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:1296]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2344]                                                                            00000000779c3e45
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:2040]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3608]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3640]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3644]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3648]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3652]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3656]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3660]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3664]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3668]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3672]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3912]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3916]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3920]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:3424]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:1980]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2172:6020]                                                                            00000000779c7111
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2504]                                                                            00000000779c3e45
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2520]                                                                            00000000779c2e25
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2592]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2596]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2600]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2604]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2612]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2624]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2632]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2636]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2648]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2664]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2672]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2676]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2688]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2700]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2704]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2728]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2732]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2736]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2960]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2964]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2968]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3020]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3024]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3036]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3044]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3052]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3060]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3064]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2136]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2160]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2244]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2312]                                                                            00000000779c3e45
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:2432]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3176]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3180]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3184]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3188]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3192]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3224]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3236]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3240]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3244]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3248]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3252]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:3256]                                                                            00000000720e29e1
Thread  C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2452:5044]                                                                            00000000779c7111
---- Processes - GMER 2.0 ----
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1320]                                                                          0000000073040000
---- Registry - GMER 2.0 ----
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004ea62d35                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004ea62d35@0007abbc70d1                                                                          0xF6 0xE0 0x6C 0xA7 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004ea62d35@0021d2525735                                                                          0x6F 0xB0 0xD3 0xA7 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                C:\Program Files (x86)\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                0
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                            0x15 0xCB 0xA6 0xC9 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                      0xA0 0x02 0x00 0x00 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                    0x06 0xB2 0x17 0xAA ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                              0xE9 0xFA 0x8F 0x1E ...
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004ea62d35 (not active ControlSet)                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004ea62d35@0007abbc70d1                                                                              0xF6 0xE0 0x6C 0xA7 ...
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004ea62d35@0021d2525735                                                                              0x6F 0xB0 0xD3 0xA7 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                    C:\Program Files (x86)\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                    0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                    0
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                0x15 0xCB 0xA6 0xC9 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                          0xA0 0x02 0x00 0x00 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                        0x06 0xB2 0x17 0xAA ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                                               
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                                  0xE9 0xFA 0x8F 0x1E ...
---- EOF - GMER 2.0 ----

markusg 03.03.2013 20:08
Hi,
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

freac 03.03.2013 21:40
TDDS hat zwei verdächtige Objekte gefunden.

Was ist denn mit den anderen scans irgendetwas auffälliges??

Code:
21:35:18.0684 17616  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:35:18.0886 17616  ============================================================
21:35:18.0886 17616  Current date / time: 2013/03/03 21:35:18.0886
21:35:18.0886 17616  SystemInfo:
21:35:18.0886 17616 
21:35:18.0886 17616  OS Version: 6.1.7601 ServicePack: 1.0
21:35:18.0886 17616  Product type: Workstation
21:35:18.0886 17616  ComputerName: XXX-PC
21:35:18.0886 17616  UserName: XXX
21:35:18.0886 17616  Windows directory: C:\Windows
21:35:18.0886 17616  System windows directory: C:\Windows
21:35:18.0886 17616  Running under WOW64
21:35:18.0886 17616  Processor architecture: Intel x64
21:35:18.0886 17616  Number of processors: 8
21:35:18.0886 17616  Page size: 0x1000
21:35:18.0886 17616  Boot type: Normal boot
21:35:18.0886 17616  ============================================================
21:35:19.0885 17616  Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:35:19.0900 17616  ============================================================
21:35:19.0900 17616  \Device\Harddisk0\DR0:
21:35:19.0900 17616  MBR partitions:
21:35:19.0900 17616  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2800800, BlocksNum 0x32000
21:35:19.0900 17616  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2832800, BlocksNum 0x54D13000
21:35:19.0900 17616  ============================================================
21:35:19.0932 17616  C: <-> \Device\Harddisk0\DR0\Partition2
21:35:19.0932 17616  ============================================================
21:35:19.0932 17616  Initialize success
21:35:19.0932 17616  ============================================================
21:35:31.0788 17740  ============================================================
21:35:31.0788 17740  Scan started
21:35:31.0788 17740  Mode: Manual; SigCheck; TDLFS;
21:35:31.0788 17740  ============================================================
21:35:33.0816 17740  ================ Scan system memory ========================
21:35:33.0816 17740  System memory - ok
21:35:33.0816 17740  ================ Scan services =============================
21:35:34.0097 17740  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
21:35:34.0331 17740  1394ohci - ok
21:35:34.0377 17740  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
21:35:34.0409 17740  ACPI - ok
21:35:34.0424 17740  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
21:35:34.0533 17740  AcpiPmi - ok
21:35:34.0611 17740  [ 5AE65DCD983077278A6173C2872BCA99 ] acsock          C:\Windows\system32\DRIVERS\acsock64.sys
21:35:34.0658 17740  acsock - ok
21:35:34.0752 17740  [ 1474F121C3DF1232D3E7239C03691EE6 ] AdobeActiveFileMonitor9.0 c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
21:35:34.0783 17740  AdobeActiveFileMonitor9.0 - ok
21:35:34.0861 17740  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:35:34.0892 17740  AdobeARMservice - ok
21:35:35.0064 17740  [ 9942DC4CC265CDA00486504444EF521D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:35:35.0079 17740  AdobeFlashPlayerUpdateSvc - ok
21:35:35.0142 17740  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
21:35:35.0220 17740  adp94xx - ok
21:35:35.0251 17740  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
21:35:35.0298 17740  adpahci - ok
21:35:35.0313 17740  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
21:35:35.0345 17740  adpu320 - ok
21:35:35.0376 17740  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
21:35:35.0672 17740  AeLookupSvc - ok
21:35:35.0735 17740  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
21:35:35.0828 17740  AFD - ok
21:35:35.0875 17740  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
21:35:35.0906 17740  agp440 - ok
21:35:35.0937 17740  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
21:35:36.0031 17740  ALG - ok
21:35:36.0047 17740  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
21:35:36.0078 17740  aliide - ok
21:35:36.0093 17740  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
21:35:36.0125 17740  amdide - ok
21:35:36.0140 17740  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
21:35:36.0187 17740  AmdK8 - ok
21:35:36.0203 17740  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
21:35:36.0249 17740  AmdPPM - ok
21:35:36.0296 17740  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
21:35:36.0343 17740  amdsata - ok
21:35:36.0343 17740  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
21:35:36.0390 17740  amdsbs - ok
21:35:36.0405 17740  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
21:35:36.0452 17740  amdxata - ok
21:35:36.0546 17740  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
21:35:36.0561 17740  AntiVirSchedulerService - ok
21:35:36.0608 17740  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
21:35:36.0639 17740  AntiVirService - ok
21:35:36.0686 17740  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
21:35:36.0920 17740  AppID - ok
21:35:36.0967 17740  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
21:35:37.0092 17740  AppIDSvc - ok
21:35:37.0123 17740  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
21:35:37.0232 17740  Appinfo - ok
21:35:37.0279 17740  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
21:35:37.0326 17740  arc - ok
21:35:37.0341 17740  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
21:35:37.0373 17740  arcsas - ok
21:35:37.0451 17740  aspnet_state - ok
21:35:37.0466 17740  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
21:35:37.0591 17740  AsyncMac - ok
21:35:37.0638 17740  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
21:35:37.0669 17740  atapi - ok
21:35:37.0716 17740  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
21:35:37.0841 17740  AudioEndpointBuilder - ok
21:35:37.0856 17740  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
21:35:37.0965 17740  AudioSrv - ok
21:35:38.0043 17740  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
21:35:38.0075 17740  avgntflt - ok
21:35:38.0106 17740  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
21:35:38.0137 17740  avipbb - ok
21:35:38.0153 17740  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
21:35:38.0199 17740  avkmgr - ok
21:35:38.0231 17740  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
21:35:38.0371 17740  AxInstSV - ok
21:35:38.0433 17740  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
21:35:38.0511 17740  b06bdrv - ok
21:35:38.0558 17740  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
21:35:38.0636 17740  b57nd60a - ok
21:35:38.0667 17740  [ A424CB46A145E5AABF15621550976DF2 ] b57xdbd        C:\Windows\system32\DRIVERS\b57xdbd.sys
21:35:38.0714 17740  b57xdbd - ok
21:35:38.0730 17740  [ BE4E6FD5A898812B85D5817AD9754A9F ] b57xdmp        C:\Windows\system32\DRIVERS\b57xdmp.sys
21:35:38.0761 17740  b57xdmp - ok
21:35:38.0823 17740  [ 93EE7D9C35AE7E9FFDA148D7805F1421 ] BBSvc          C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
21:35:38.0870 17740  BBSvc - ok
21:35:39.0042 17740  [ 85111026F1C5A1C4CCE3697F0DA7BC1A ] BCM43XX        C:\Windows\system32\DRIVERS\bcmwl664.sys
21:35:39.0307 17740  BCM43XX - ok
21:35:39.0354 17740  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
21:35:39.0447 17740  BDESVC - ok
21:35:39.0463 17740  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
21:35:39.0588 17740  Beep - ok
21:35:39.0650 17740  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
21:35:39.0775 17740  BFE - ok
21:35:39.0822 17740  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\system32\qmgr.dll
21:35:40.0009 17740  BITS - ok
21:35:40.0040 17740  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
21:35:40.0087 17740  blbdrive - ok
21:35:40.0134 17740  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
21:35:40.0212 17740  bowser - ok
21:35:40.0243 17740  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
21:35:40.0305 17740  BrFiltLo - ok
21:35:40.0305 17740  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
21:35:40.0352 17740  BrFiltUp - ok
21:35:40.0399 17740  [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
21:35:40.0524 17740  BridgeMP - ok
21:35:40.0539 17740  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
21:35:40.0649 17740  Browser - ok
21:35:40.0680 17740  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
21:35:40.0789 17740  Brserid - ok
21:35:40.0805 17740  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
21:35:40.0867 17740  BrSerWdm - ok
21:35:40.0867 17740  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
21:35:40.0914 17740  BrUsbMdm - ok
21:35:40.0914 17740  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
21:35:40.0961 17740  BrUsbSer - ok
21:35:41.0007 17740  [ 0970D8B7151E9113BF8D44CE2E954DF7 ] bScsiMSa        C:\Windows\system32\DRIVERS\bScsiMSa.sys
21:35:41.0039 17740  bScsiMSa - ok
21:35:41.0085 17740  [ 0C1EEE5AF32402D306874B110DE237EC ] bScsiSDa        C:\Windows\system32\DRIVERS\bScsiSDa.sys
21:35:41.0117 17740  bScsiSDa - ok
21:35:41.0179 17740  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
21:35:41.0304 17740  BthEnum - ok
21:35:41.0335 17740  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
21:35:41.0382 17740  BTHMODEM - ok
21:35:41.0413 17740  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
21:35:41.0475 17740  BthPan - ok
21:35:41.0522 17740  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
21:35:41.0631 17740  BTHPORT - ok
21:35:41.0663 17740  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
21:35:41.0772 17740  bthserv - ok
21:35:41.0803 17740  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
21:35:41.0865 17740  BTHUSB - ok
21:35:41.0912 17740  [ 9DE56FA4533E485AE5409D3C11747143 ] BTWAMPFL        C:\Windows\system32\DRIVERS\btwampfl.sys
21:35:41.0975 17740  BTWAMPFL - ok
21:35:42.0037 17740  [ F6135859A582A7294BA7A3336E08BAA1 ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
21:35:42.0068 17740  btwaudio - ok
21:35:42.0099 17740  [ 3DEF2370E414B4E299673558BA171A51 ] btwavdt        C:\Windows\system32\DRIVERS\btwavdt.sys
21:35:42.0146 17740  btwavdt - ok
21:35:42.0224 17740  [ 5B6B009D4F4449E77264AFD6DAD185E0 ] btwdins        C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
21:35:42.0302 17740  btwdins - ok
21:35:42.0318 17740  [ E8D2BCD080EA91E74775B9F5EA051F97 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
21:35:42.0349 17740  btwl2cap - ok
21:35:42.0380 17740  [ 9937E0E4DFC0030560A6DFE9D3A94B39 ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
21:35:42.0411 17740  btwrchid - ok
21:35:42.0427 17740  catchme - ok
21:35:42.0474 17740  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
21:35:42.0583 17740  cdfs - ok
21:35:42.0614 17740  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
21:35:42.0677 17740  cdrom - ok
21:35:42.0708 17740  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
21:35:42.0817 17740  CertPropSvc - ok
21:35:42.0864 17740  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
21:35:42.0911 17740  circlass - ok
21:35:42.0942 17740  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
21:35:42.0989 17740  CLFS - ok
21:35:43.0098 17740  [ 7AD6AD732247CC3D7A943465748C0D47 ] CLKMSVC10_38F51D56 C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe
21:35:43.0269 17740  CLKMSVC10_38F51D56 - ok
21:35:43.0316 17740  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:35:43.0363 17740  clr_optimization_v2.0.50727_32 - ok
21:35:43.0425 17740  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:35:43.0472 17740  clr_optimization_v2.0.50727_64 - ok
21:35:43.0550 17740  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:35:43.0613 17740  clr_optimization_v4.0.30319_32 - ok
21:35:43.0659 17740  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:35:43.0675 17740  clr_optimization_v4.0.30319_64 - ok
21:35:43.0722 17740  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
21:35:43.0769 17740  CmBatt - ok
21:35:43.0800 17740  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
21:35:43.0831 17740  cmdide - ok
21:35:43.0893 17740  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
21:35:43.0987 17740  CNG - ok
21:35:44.0018 17740  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
21:35:44.0049 17740  Compbatt - ok
21:35:44.0096 17740  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
21:35:44.0143 17740  CompositeBus - ok
21:35:44.0159 17740  COMSysApp - ok
21:35:44.0190 17740  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
21:35:44.0221 17740  crcdisk - ok
21:35:44.0268 17740  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
21:35:44.0611 17740  CryptSvc - ok
21:35:44.0705 17740  [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc          C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
21:35:44.0798 17740  cvhsvc - ok
21:35:44.0814 17740  [ 44BDDEB03C84A1C993C992FFB5700357 ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA64.sys
21:35:44.0845 17740  CVirtA - ok
21:35:44.0892 17740  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
21:35:45.0017 17740  DcomLaunch - ok
21:35:45.0063 17740  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
21:35:45.0204 17740  defragsvc - ok
21:35:45.0235 17740  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
21:35:45.0344 17740  DfsC - ok
21:35:45.0360 17740  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
21:35:45.0453 17740  Dhcp - ok
21:35:45.0500 17740  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
21:35:45.0609 17740  discache - ok
21:35:45.0641 17740  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
21:35:45.0687 17740  Disk - ok
21:35:45.0719 17740  [ 05CB5910B3CA6019FC3CCA815EE06FFB ] DNE            C:\Windows\system32\DRIVERS\dne64x.sys
21:35:45.0750 17740  DNE - ok
21:35:45.0781 17740  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
21:35:45.0828 17740  Dnscache - ok
21:35:45.0843 17740  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
21:35:45.0984 17740  dot3svc - ok
21:35:46.0015 17740  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
21:35:46.0109 17740  DPS - ok
21:35:46.0155 17740  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
21:35:46.0202 17740  drmkaud - ok
21:35:46.0265 17740  [ 4AB2A58816CC6BE771F1D8C768B804C5 ] DsiWMIService  C:\Program Files (x86)\Launch Manager\dsiwmis.exe
21:35:46.0296 17740  DsiWMIService - ok
21:35:46.0343 17740  [ 400582B09E0BB557D0EC28A945150EEB ] dtsoftbus01    C:\Windows\system32\DRIVERS\dtsoftbus01.sys
21:35:46.0389 17740  dtsoftbus01 - ok
21:35:46.0421 17740  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
21:35:46.0514 17740  DXGKrnl - ok
21:35:46.0561 17740  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
21:35:46.0686 17740  EapHost - ok
21:35:46.0779 17740  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
21:35:46.0998 17740  ebdrv - ok
21:35:47.0029 17740  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
21:35:47.0107 17740  EFS - ok
21:35:47.0185 17740  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
21:35:47.0294 17740  ehRecvr - ok
21:35:47.0310 17740  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
21:35:47.0372 17740  ehSched - ok
21:35:47.0419 17740  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
21:35:47.0497 17740  elxstor - ok
21:35:47.0575 17740  [ AC5C64F828C0A6A1350971501AC2A0C7 ] ePowerSvc      C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
21:35:47.0653 17740  ePowerSvc - ok
21:35:47.0653 17740  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
21:35:47.0700 17740  ErrDev - ok
21:35:47.0778 17740  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
21:35:47.0887 17740  EventSystem - ok
21:35:47.0934 17740  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
21:35:48.0059 17740  exfat - ok
21:35:48.0074 17740  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
21:35:48.0199 17740  fastfat - ok
21:35:48.0246 17740  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
21:35:48.0355 17740  Fax - ok
21:35:48.0402 17740  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
21:35:48.0449 17740  fdc - ok
21:35:48.0480 17740  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
21:35:48.0573 17740  fdPHost - ok
21:35:48.0589 17740  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
21:35:48.0683 17740  FDResPub - ok
21:35:48.0714 17740  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
21:35:48.0761 17740  FileInfo - ok
21:35:48.0776 17740  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
21:35:48.0885 17740  Filetrace - ok
21:35:48.0963 17740  [ BB0667B0171B632B97EA759515476F07 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:35:49.0057 17740  FLEXnet Licensing Service - ok
21:35:49.0088 17740  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
21:35:49.0119 17740  flpydisk - ok
21:35:49.0166 17740  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
21:35:49.0229 17740  FltMgr - ok
21:35:49.0307 17740  [ C4C183E6551084039EC862DA1C945E3D ] FontCache      C:\Windows\system32\FntCache.dll
21:35:49.0416 17740  FontCache - ok
21:35:49.0478 17740  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:35:49.0525 17740  FontCache3.0.0.0 - ok
21:35:49.0556 17740  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
21:35:49.0603 17740  FsDepends - ok
21:35:49.0634 17740  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
21:35:49.0665 17740  Fs_Rec - ok
21:35:49.0697 17740  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
21:35:49.0743 17740  fvevol - ok
21:35:49.0759 17740  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
21:35:49.0806 17740  gagp30kx - ok
21:35:49.0868 17740  [ C403C5DB49A0F9AAF4F2128EDC0106D8 ] GamesAppService C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
21:35:49.0931 17740  GamesAppService - ok
21:35:49.0977 17740  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
21:35:50.0118 17740  gpsvc - ok
21:35:50.0165 17740  [ 84E58FEA8B1A7537696A20C59CB9B0C9 ] GREGService    C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
21:35:50.0196 17740  GREGService ( UnsignedFile.Multi.Generic ) - warning
21:35:50.0196 17740  GREGService - detected UnsignedFile.Multi.Generic (1)
21:35:50.0227 17740  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
21:35:50.0321 17740  hcw85cir - ok
21:35:50.0352 17740  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
21:35:50.0414 17740  HdAudAddService - ok
21:35:50.0461 17740  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
21:35:50.0508 17740  HDAudBus - ok
21:35:50.0508 17740  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
21:35:50.0555 17740  HidBatt - ok
21:35:50.0570 17740  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
21:35:50.0617 17740  HidBth - ok
21:35:50.0664 17740  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
21:35:50.0695 17740  HidIr - ok
21:35:50.0726 17740  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\System32\hidserv.dll
21:35:50.0835 17740  hidserv - ok
21:35:50.0867 17740  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
21:35:50.0898 17740  HidUsb - ok
21:35:50.0929 17740  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
21:35:51.0054 17740  hkmsvc - ok
21:35:51.0085 17740  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
21:35:51.0147 17740  HomeGroupListener - ok
21:35:51.0179 17740  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
21:35:51.0225 17740  HomeGroupProvider - ok
21:35:51.0257 17740  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
21:35:51.0303 17740  HpSAMD - ok
21:35:51.0335 17740  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
21:35:51.0459 17740  HTTP - ok
21:35:51.0491 17740  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
21:35:51.0522 17740  hwpolicy - ok
21:35:51.0537 17740  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
21:35:51.0584 17740  i8042prt - ok
21:35:51.0647 17740  [ F7CE9BE72EDAC499B713ECA6DAE5D26F ] iaStor          C:\Windows\system32\drivers\iaStor.sys
21:35:51.0678 17740  iaStor - ok
21:35:51.0740 17740  [ B25F192EA1F84A316EB7C19EFCCCF33D ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
21:35:51.0771 17740  IAStorDataMgrSvc - ok
21:35:51.0818 17740  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
21:35:51.0881 17740  iaStorV - ok
21:35:51.0959 17740  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
21:35:52.0005 17740  IDriverT ( UnsignedFile.Multi.Generic ) - warning
21:35:52.0005 17740  IDriverT - detected UnsignedFile.Multi.Generic (1)
21:35:52.0068 17740  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:35:52.0193 17740  idsvc - ok
21:35:52.0536 17740  [ 6383899C5F964D71B0F96B81FBE59BB8 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
21:35:53.0175 17740  igfx - ok
21:35:53.0222 17740  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
21:35:53.0253 17740  iirsp - ok
21:35:53.0316 17740  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
21:35:53.0456 17740  IKEEXT - ok
21:35:53.0581 17740  [ B60ACCD29F8FAFC4A6344CD2BD5CA3A5 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
21:35:53.0799 17740  IntcAzAudAddService - ok
21:35:53.0846 17740  [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
21:35:53.0924 17740  IntcDAud - ok
21:35:53.0955 17740  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
21:35:53.0987 17740  intelide - ok
21:35:54.0018 17740  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
21:35:54.0065 17740  intelppm - ok
21:35:54.0111 17740  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
21:35:54.0236 17740  IPBusEnum - ok
21:35:54.0252 17740  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:35:54.0345 17740  IpFilterDriver - ok
21:35:54.0392 17740  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
21:35:54.0501 17740  iphlpsvc - ok
21:35:54.0517 17740  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
21:35:54.0564 17740  IPMIDRV - ok
21:35:54.0579 17740  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
21:35:54.0689 17740  IPNAT - ok
21:35:54.0720 17740  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
21:35:54.0767 17740  IRENUM - ok
21:35:54.0798 17740  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
21:35:54.0829 17740  isapnp - ok
21:35:54.0845 17740  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
21:35:54.0907 17740  iScsiPrt - ok
21:35:54.0954 17740  [ 0469BFF65BBDEE9E46D0C45EE32A08BD ] k57nd60a        C:\Windows\system32\DRIVERS\k57nd60a.sys
21:35:55.0047 17740  k57nd60a - ok
21:35:55.0063 17740  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
21:35:55.0094 17740  kbdclass - ok
21:35:55.0110 17740  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
21:35:55.0157 17740  kbdhid - ok
21:35:55.0188 17740  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
21:35:55.0219 17740  KeyIso - ok
21:35:55.0250 17740  KMService - ok
21:35:55.0281 17740  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
21:35:55.0328 17740  KSecDD - ok
21:35:55.0344 17740  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
21:35:55.0391 17740  KSecPkg - ok
21:35:55.0406 17740  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
21:35:55.0515 17740  ksthunk - ok
21:35:55.0547 17740  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
21:35:55.0687 17740  KtmRm - ok
21:35:55.0749 17740  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\System32\srvsvc.dll
21:35:55.0859 17740  LanmanServer - ok
21:35:55.0890 17740  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
21:35:55.0983 17740  LanmanWorkstation - ok
21:35:56.0046 17740  [ B705C7097F9A0EC941D02DCE7C7D426C ] Live Updater Service C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
21:35:56.0061 17740  Live Updater Service - ok
21:35:56.0124 17740  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
21:35:56.0233 17740  lltdio - ok
21:35:56.0280 17740  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
21:35:56.0420 17740  lltdsvc - ok
21:35:56.0436 17740  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
21:35:56.0545 17740  lmhosts - ok
21:35:56.0592 17740  [ D7E0BED3EA21D7BDDD410ADE51708D90 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:35:56.0623 17740  LMS - ok
21:35:56.0685 17740  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
21:35:56.0717 17740  LSI_FC - ok
21:35:56.0732 17740  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
21:35:56.0779 17740  LSI_SAS - ok
21:35:56.0779 17740  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
21:35:56.0810 17740  LSI_SAS2 - ok
21:35:56.0826 17740  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
21:35:56.0857 17740  LSI_SCSI - ok
21:35:56.0888 17740  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
21:35:56.0997 17740  luafv - ok
21:35:57.0044 17740  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
21:35:57.0107 17740  Mcx2Svc - ok
21:35:57.0107 17740  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
21:35:57.0153 17740  megasas - ok
21:35:57.0200 17740  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
21:35:57.0247 17740  MegaSR - ok
21:35:57.0294 17740  [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
21:35:57.0325 17740  MEIx64 - ok
21:35:57.0434 17740  Microsoft SharePoint Workspace Audit Service - ok
21:35:57.0465 17740  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
21:35:57.0559 17740  MMCSS - ok
21:35:57.0575 17740  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
21:35:57.0684 17740  Modem - ok
21:35:57.0715 17740  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
21:35:57.0762 17740  monitor - ok
21:35:57.0793 17740  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
21:35:57.0824 17740  mouclass - ok
21:35:57.0855 17740  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
21:35:57.0902 17740  mouhid - ok
21:35:57.0933 17740  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
21:35:57.0965 17740  mountmgr - ok
21:35:58.0027 17740  [ 5C5E45DDABEFBC9F564F1D5C83258B8F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:35:58.0058 17740  MozillaMaintenance - ok
21:35:58.0074 17740  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
21:35:58.0121 17740  mpio - ok
21:35:58.0152 17740  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
21:35:58.0245 17740  mpsdrv - ok
21:35:58.0308 17740  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
21:35:58.0433 17740  MpsSvc - ok
21:35:58.0464 17740  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
21:35:58.0526 17740  MRxDAV - ok
21:35:58.0557 17740  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
21:35:58.0651 17740  mrxsmb - ok
21:35:58.0682 17740  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:35:58.0745 17740  mrxsmb10 - ok
21:35:58.0760 17740  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:35:58.0807 17740  mrxsmb20 - ok
21:35:58.0838 17740  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
21:35:58.0869 17740  msahci - ok
21:35:58.0869 17740  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
21:35:58.0916 17740  msdsm - ok
21:35:58.0947 17740  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
21:35:58.0979 17740  MSDTC - ok
21:35:59.0025 17740  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
21:35:59.0119 17740  Msfs - ok
21:35:59.0135 17740  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
21:35:59.0244 17740  mshidkmdf - ok
21:35:59.0259 17740  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
21:35:59.0291 17740  msisadrv - ok
21:35:59.0337 17740  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
21:35:59.0447 17740  MSiSCSI - ok
21:35:59.0462 17740  msiserver - ok
21:35:59.0493 17740  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
21:35:59.0587 17740  MSKSSRV - ok
21:35:59.0587 17740  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
21:35:59.0696 17740  MSPCLOCK - ok
21:35:59.0727 17740  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
21:35:59.0821 17740  MSPQM - ok
21:35:59.0852 17740  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
21:35:59.0930 17740  MsRPC - ok
21:35:59.0946 17740  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
21:35:59.0977 17740  mssmbios - ok
21:36:00.0102 17740  MSSQL$SQLEXPRESS - ok
21:36:00.0164 17740  MSSQLSERVER - ok
21:36:00.0227 17740  [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe
21:36:00.0305 17740  MSSQLServerADHelper - ok
21:36:00.0351 17740  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
21:36:00.0461 17740  MSTEE - ok
21:36:00.0461 17740  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
21:36:00.0492 17740  MTConfig - ok
21:36:00.0523 17740  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
21:36:00.0554 17740  Mup - ok
21:36:00.0601 17740  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
21:36:00.0726 17740  napagent - ok
21:36:00.0757 17740  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
21:36:00.0851 17740  NativeWifiP - ok
21:36:00.0913 17740  [ 9D1CCE440552500DED3A62F9D779CDB4 ] NAUpdate        C:\Program Files (x86)\Nero\Update\NASvc.exe
21:36:00.0960 17740  NAUpdate - ok
21:36:01.0022 17740  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
21:36:01.0100 17740  NDIS - ok
21:36:01.0131 17740  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
21:36:01.0225 17740  NdisCap - ok
21:36:01.0256 17740  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
21:36:01.0350 17740  NdisTapi - ok
21:36:01.0397 17740  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
21:36:01.0490 17740  Ndisuio - ok
21:36:01.0521 17740  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
21:36:01.0631 17740  NdisWan - ok
21:36:01.0662 17740  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
21:36:01.0771 17740  NDProxy - ok
21:36:01.0787 17740  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
21:36:01.0880 17740  NetBIOS - ok
21:36:01.0896 17740  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
21:36:01.0989 17740  NetBT - ok
21:36:02.0005 17740  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
21:36:02.0036 17740  Netlogon - ok
21:36:02.0067 17740  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
21:36:02.0177 17740  Netman - ok
21:36:02.0208 17740  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
21:36:02.0317 17740  netprofm - ok
21:36:02.0379 17740  [ 618C55B392238B9467F9113E13525C49 ] netr28ux        C:\Windows\system32\DRIVERS\netr28ux.sys
21:36:02.0489 17740  netr28ux - ok
21:36:02.0520 17740  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:36:02.0567 17740  NetTcpPortSharing - ok
21:36:02.0598 17740  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
21:36:02.0645 17740  nfrd960 - ok
21:36:02.0738 17740  [ 30128D3FC1F388E4CBE746F659C69415 ] NitroReaderDriverReadSpool3 C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
21:36:02.0801 17740  NitroReaderDriverReadSpool3 - ok
21:36:02.0847 17740  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
21:36:02.0894 17740  NlaSvc - ok
21:36:03.0019 17740  [ 5839A8027D6D324A7CD494051A96628C ] NOBU            C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
21:36:03.0191 17740  NOBU - ok
21:36:03.0222 17740  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
21:36:03.0315 17740  Npfs - ok
21:36:03.0347 17740  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
21:36:03.0425 17740  nsi - ok
21:36:03.0440 17740  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
21:36:03.0549 17740  nsiproxy - ok
21:36:03.0627 17740  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
21:36:03.0799 17740  Ntfs - ok
21:36:03.0861 17740  [ D27A4546417ED7C4AEA7B3420D4F1F50 ] NTI IScheduleSvc C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
21:36:03.0893 17740  NTI IScheduleSvc - ok
21:36:03.0924 17740  [ 64DDD0DEE976302F4BD93E5EFCC2F013 ] NTIDrvr        C:\Windows\system32\drivers\NTIDrvr.sys
21:36:03.0955 17740  NTIDrvr - ok
21:36:03.0971 17740  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
21:36:04.0064 17740  Null - ok
21:36:04.0111 17740  [ 786DB821BFD57C0551DBBE4F75384A7D ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
21:36:04.0173 17740  nusb3hub - ok
21:36:04.0205 17740  [ DAA8005CAF745042BB427A1ED7433354 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
21:36:04.0251 17740  nusb3xhc - ok
21:36:04.0626 17740  [ 73DC184AF4D2ADDC41B37344636D2CC7 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:36:05.0390 17740  nvlddmkm - ok
21:36:05.0421 17740  [ 477A3CF725C4040F77EB9E2C17B922A0 ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
21:36:05.0437 17740  nvpciflt - ok
21:36:05.0468 17740  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
21:36:05.0515 17740  nvraid - ok
21:36:05.0531 17740  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
21:36:05.0577 17740  nvstor - ok
21:36:05.0640 17740  [ 6D1056430AFC72A6097409A70A716C15 ] NVSvc          C:\Windows\system32\nvvsvc.exe
21:36:05.0718 17740  NVSvc - ok
21:36:05.0811 17740  [ A072423C3812472D326BC774610055CF ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
21:36:05.0936 17740  nvUpdatusService - ok
21:36:05.0967 17740  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
21:36:06.0014 17740  nv_agp - ok
21:36:06.0108 17740  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
21:36:06.0170 17740  odserv - ok
21:36:06.0201 17740  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
21:36:06.0248 17740  ohci1394 - ok
21:36:06.0311 17740  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:36:06.0326 17740  ose - ok
21:36:06.0529 17740  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:36:06.0794 17740  osppsvc - ok
21:36:06.0825 17740  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
21:36:06.0935 17740  p2pimsvc - ok
21:36:06.0966 17740  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
21:36:07.0013 17740  p2psvc - ok
21:36:07.0044 17740  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
21:36:07.0075 17740  Parport - ok
21:36:07.0122 17740  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
21:36:07.0153 17740  partmgr - ok
21:36:07.0169 17740  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
21:36:07.0215 17740  PcaSvc - ok
21:36:07.0247 17740  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
21:36:07.0278 17740  pci - ok
21:36:07.0293 17740  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
21:36:07.0325 17740  pciide - ok
21:36:07.0325 17740  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
21:36:07.0371 17740  pcmcia - ok
21:36:07.0403 17740  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
21:36:07.0434 17740  pcw - ok
21:36:07.0449 17740  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
21:36:07.0605 17740  PEAUTH - ok
21:36:07.0746 17740  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
21:36:07.0793 17740  PerfHost - ok
21:36:07.0855 17740  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
21:36:08.0027 17740  pla - ok
21:36:08.0073 17740  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
21:36:08.0167 17740  PlugPlay - ok
21:36:08.0183 17740  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
21:36:08.0229 17740  PNRPAutoReg - ok
21:36:08.0261 17740  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
21:36:08.0292 17740  PNRPsvc - ok
21:36:08.0339 17740  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
21:36:08.0479 17740  PolicyAgent - ok
21:36:08.0526 17740  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
21:36:08.0635 17740  Power - ok
21:36:08.0682 17740  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
21:36:08.0791 17740  PptpMiniport - ok
21:36:08.0807 17740  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
21:36:08.0853 17740  Processor - ok
21:36:08.0900 17740  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
21:36:08.0978 17740  ProfSvc - ok
21:36:08.0994 17740  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
21:36:09.0025 17740  ProtectedStorage - ok
21:36:09.0056 17740  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
21:36:09.0165 17740  Psched - ok
21:36:09.0212 17740  [ 87B04878A6D59D6C79251DC960C674C1 ] PxHlpa64        C:\Windows\system32\Drivers\PxHlpa64.sys
21:36:09.0243 17740  PxHlpa64 - ok
21:36:09.0321 17740  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
21:36:09.0477 17740  ql2300 - ok
21:36:09.0493 17740  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
21:36:09.0540 17740  ql40xx - ok
21:36:09.0571 17740  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
21:36:09.0649 17740  QWAVE - ok
21:36:09.0665 17740  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
21:36:09.0727 17740  QWAVEdrv - ok
21:36:09.0727 17740  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
21:36:09.0836 17740  RasAcd - ok
21:36:09.0867 17740  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
21:36:09.0977 17740  RasAgileVpn - ok
21:36:10.0008 17740  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
21:36:10.0117 17740  RasAuto - ok
21:36:10.0148 17740  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
21:36:10.0257 17740  Rasl2tp - ok
21:36:10.0289 17740  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
21:36:10.0398 17740  RasMan - ok
21:36:10.0413 17740  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
21:36:10.0523 17740  RasPppoe - ok
21:36:10.0554 17740  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
21:36:10.0679 17740  RasSstp - ok
21:36:10.0710 17740  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
21:36:10.0835 17740  rdbss - ok
21:36:10.0850 17740  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys
21:36:10.0897 17740  rdpbus - ok
21:36:10.0928 17740  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
21:36:11.0022 17740  RDPCDD - ok
21:36:11.0037 17740  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
21:36:11.0147 17740  RDPENCDD - ok
21:36:11.0147 17740  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
21:36:11.0240 17740  RDPREFMP - ok
21:36:11.0271 17740  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
21:36:11.0349 17740  RDPWD - ok
21:36:11.0396 17740  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
21:36:11.0443 17740  rdyboost - ok
21:36:11.0474 17740  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
21:36:11.0583 17740  RemoteAccess - ok
21:36:11.0630 17740  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
21:36:11.0755 17740  RemoteRegistry - ok
21:36:11.0802 17740  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
21:36:11.0849 17740  RFCOMM - ok
21:36:11.0880 17740  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
21:36:11.0973 17740  RpcEptMapper - ok
21:36:12.0005 17740  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
21:36:12.0036 17740  RpcLocator - ok
21:36:12.0067 17740  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
21:36:12.0161 17740  RpcSs - ok
21:36:12.0207 17740  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
21:36:12.0317 17740  rspndr - ok
21:36:12.0332 17740  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
21:36:12.0363 17740  SamSs - ok
21:36:12.0457 17740  [ 328100AF2EFD951EAB657384EC361B6F ] SamsungAllShareV2.0 C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
21:36:12.0473 17740  SamsungAllShareV2.0 - ok
21:36:12.0504 17740  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
21:36:12.0535 17740  sbp2port - ok
21:36:12.0566 17740  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
21:36:12.0675 17740  SCardSvr - ok
21:36:12.0753 17740  [ 07237C66E05DA6778E9F3CB67FA00736 ] SCDEmu          C:\Windows\system32\drivers\SCDEmu.sys
21:36:12.0800 17740  SCDEmu - ok
21:36:12.0816 17740  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
21:36:12.0925 17740  scfilter - ok
21:36:12.0956 17740  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
21:36:13.0097 17740  Schedule - ok
21:36:13.0128 17740  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
21:36:13.0206 17740  SCPolicySvc - ok
21:36:13.0253 17740  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
21:36:13.0299 17740  sdbus - ok
21:36:13.0331 17740  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
21:36:13.0409 17740  SDRSVC - ok
21:36:13.0471 17740  [ CC781378E7EDA615D2CDCA3B17829FA4 ] SeaPort        C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
21:36:13.0518 17740  SeaPort - ok
21:36:13.0549 17740  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
21:36:13.0658 17740  secdrv - ok
21:36:13.0689 17740  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
21:36:13.0783 17740  seclogon - ok
21:36:13.0814 17740  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\system32\sens.dll
21:36:13.0923 17740  SENS - ok
21:36:13.0939 17740  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
21:36:14.0001 17740  SensrSvc - ok
21:36:14.0017 17740  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\drivers\serenum.sys
21:36:14.0064 17740  Serenum - ok
21:36:14.0079 17740  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys
21:36:14.0142 17740  Serial - ok
21:36:14.0157 17740  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
21:36:14.0220 17740  sermouse - ok
21:36:14.0251 17740  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
21:36:14.0360 17740  SessionEnv - ok
21:36:14.0360 17740  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
21:36:14.0407 17740  sffdisk - ok
21:36:14.0423 17740  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
21:36:14.0485 17740  sffp_mmc - ok
21:36:14.0485 17740  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
21:36:14.0532 17740  sffp_sd - ok
21:36:14.0547 17740  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
21:36:14.0594 17740  sfloppy - ok
21:36:14.0657 17740  [ C6CC9297BD53E5229653303E556AA539 ] Sftfs          C:\Windows\system32\DRIVERS\Sftfslh.sys
21:36:14.0719 17740  Sftfs - ok
21:36:14.0781 17740  [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist        C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
21:36:14.0859 17740  sftlist - ok
21:36:14.0875 17740  [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay        C:\Windows\system32\DRIVERS\Sftplaylh.sys
21:36:14.0922 17740  Sftplay - ok
21:36:14.0937 17740  [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir        C:\Windows\system32\DRIVERS\Sftredirlh.sys
21:36:14.0969 17740  Sftredir - ok
21:36:14.0969 17740  [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol          C:\Windows\system32\DRIVERS\Sftvollh.sys
21:36:15.0000 17740  Sftvol - ok
21:36:15.0031 17740  [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa          C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
21:36:15.0047 17740  sftvsa - ok
21:36:15.0093 17740  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
21:36:15.0203 17740  SharedAccess - ok
21:36:15.0249 17740  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
21:36:15.0374 17740  ShellHWDetection - ok
21:36:15.0421 17740  [ 1980FE1F5A32067DAD1D8776B63C2669 ] SimpleSlideShowServer C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe
21:36:15.0468 17740  SimpleSlideShowServer - ok
21:36:15.0499 17740  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
21:36:15.0530 17740  SiSRaid2 - ok
21:36:15.0546 17740  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
21:36:15.0577 17740  SiSRaid4 - ok
21:36:15.0639 17740  [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
21:36:15.0671 17740  SkypeUpdate - ok
21:36:15.0686 17740  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
21:36:15.0795 17740  Smb - ok
21:36:15.0842 17740  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
21:36:15.0889 17740  SNMPTRAP - ok
21:36:15.0905 17740  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
21:36:15.0936 17740  spldr - ok
21:36:15.0983 17740  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
21:36:16.0076 17740  Spooler - ok
21:36:16.0170 17740  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
21:36:16.0419 17740  sppsvc - ok
21:36:16.0435 17740  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
21:36:16.0529 17740  sppuinotify - ok
21:36:16.0591 17740  sptd - ok
21:36:16.0700 17740  [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser      C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
21:36:16.0763 17740  SQLBrowser - ok
21:36:16.0809 17740  [ 3C432A96363097870995E2A3C8B66ABD ] SQLWriter      C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
21:36:16.0841 17740  SQLWriter - ok
21:36:16.0887 17740  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
21:36:16.0981 17740  srv - ok
21:36:16.0997 17740  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
21:36:17.0075 17740  srv2 - ok
21:36:17.0090 17740  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
21:36:17.0137 17740  srvnet - ok
21:36:17.0215 17740  [ 8F8324ED1DE63FFC7B1A02CD2D963C72 ] ssadbus        C:\Windows\system32\DRIVERS\ssadbus.sys
21:36:17.0309 17740  ssadbus - ok
21:36:17.0355 17740  [ 58221EFCB74167B73667F0024C661CE0 ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys
21:36:17.0418 17740  ssadmdfl - ok
21:36:17.0449 17740  [ 4DA7C71BFAC5AD71255B7E4CAB980163 ] ssadmdm        C:\Windows\system32\DRIVERS\ssadmdm.sys
21:36:17.0511 17740  ssadmdm - ok
21:36:17.0558 17740  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
21:36:17.0667 17740  SSDPSRV - ok
21:36:17.0699 17740  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
21:36:17.0792 17740  SstpSvc - ok
21:36:17.0823 17740  StarOpen - ok
21:36:17.0855 17740  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
21:36:17.0886 17740  stexstor - ok
21:36:17.0933 17740  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
21:36:18.0011 17740  stisvc - ok
21:36:18.0011 17740  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
21:36:18.0042 17740  swenum - ok
21:36:18.0073 17740  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
21:36:18.0198 17740  swprv - ok
21:36:18.0260 17740  [ EF51B22706DB03F0857FADE127C804EC ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
21:36:18.0385 17740  SynTP - ok
21:36:18.0432 17740  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
21:36:18.0557 17740  SysMain - ok
21:36:18.0572 17740  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
21:36:18.0650 17740  TabletInputService - ok
21:36:18.0697 17740  [ F33FDC72298DF4BF9813A55D21F4EB31 ] taphss          C:\Windows\system32\DRIVERS\taphss.sys
21:36:18.0728 17740  taphss - ok
21:36:18.0744 17740  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
21:36:18.0837 17740  TapiSrv - ok
21:36:18.0869 17740  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
21:36:18.0962 17740  TBS - ok
21:36:19.0056 17740  [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
21:36:19.0274 17740  Tcpip - ok
21:36:19.0321 17740  [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
21:36:19.0415 17740  TCPIP6 - ok
21:36:19.0446 17740  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
21:36:19.0477 17740  tcpipreg - ok
21:36:19.0524 17740  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
21:36:19.0586 17740  TDPIPE - ok
21:36:19.0617 17740  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
21:36:19.0649 17740  TDTCP - ok
21:36:19.0680 17740  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
21:36:19.0789 17740  tdx - ok
21:36:19.0820 17740  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
21:36:19.0851 17740  TermDD - ok
21:36:19.0883 17740  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
21:36:20.0039 17740  TermService - ok
21:36:20.0054 17740  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
21:36:20.0101 17740  Themes - ok
21:36:20.0117 17740  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
21:36:20.0210 17740  THREADORDER - ok
21:36:20.0226 17740  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
21:36:20.0335 17740  TrkWks - ok
21:36:20.0366 17740  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
21:36:20.0475 17740  TrustedInstaller - ok
21:36:20.0522 17740  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
21:36:20.0616 17740  tssecsrv - ok
21:36:20.0631 17740  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
21:36:20.0694 17740  TsUsbFlt - ok
21:36:20.0694 17740  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
21:36:20.0725 17740  TsUsbGD - ok
21:36:20.0756 17740  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
21:36:20.0865 17740  tunnel - ok
21:36:20.0897 17740  [ 48743B69EA47C020A792D8649F753F44 ] TurboB          C:\Windows\system32\DRIVERS\TurboB.sys
21:36:20.0928 17740  TurboB - ok
21:36:21.0006 17740  [ 759F59E3EA3802FF23F93DCDB6FE9171 ] TurboBoost      C:\Program Files\Intel\TurboBoost\TurboBoost.exe
21:36:21.0037 17740  TurboBoost - ok
21:36:21.0053 17740  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
21:36:21.0099 17740  uagp35 - ok
21:36:21.0146 17740  [ 2E22C1FD397A5A9FFEF55E9D1FC96C00 ] UBHelper        C:\Windows\system32\drivers\UBHelper.sys
21:36:21.0162 17740  UBHelper - ok
21:36:21.0193 17740  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
21:36:21.0318 17740  udfs - ok
21:36:21.0349 17740  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
21:36:21.0396 17740  UI0Detect - ok
21:36:21.0411 17740  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
21:36:21.0458 17740  uliagpkx - ok
21:36:21.0474 17740  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
21:36:21.0521 17740  umbus - ok
21:36:21.0552 17740  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
21:36:21.0599 17740  UmPass - ok
21:36:21.0739 17740  [ A678E5DDD974903DD71F503BDCACA218 ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:36:21.0895 17740  UNS - ok
21:36:21.0942 17740  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
21:36:22.0051 17740  upnphost - ok
21:36:22.0082 17740  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
21:36:22.0145 17740  usbccgp - ok
21:36:22.0191 17740  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
21:36:22.0238 17740  usbcir - ok
21:36:22.0269 17740  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
21:36:22.0316 17740  usbehci - ok
21:36:22.0347 17740  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
21:36:22.0441 17740  usbhub - ok
21:36:22.0472 17740  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
21:36:22.0519 17740  usbohci - ok
21:36:22.0535 17740  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
21:36:22.0597 17740  usbprint - ok
21:36:22.0644 17740  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
21:36:22.0691 17740  usbscan - ok
21:36:22.0706 17740  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:36:22.0784 17740  USBSTOR - ok
21:36:22.0815 17740  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
21:36:22.0862 17740  usbuhci - ok
21:36:22.0909 17740  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
21:36:22.0956 17740  usbvideo - ok
21:36:22.0971 17740  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
21:36:23.0081 17740  UxSms - ok
21:36:23.0096 17740  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
21:36:23.0127 17740  VaultSvc - ok
21:36:23.0159 17740  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
21:36:23.0190 17740  vdrvroot - ok
21:36:23.0221 17740  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
21:36:23.0361 17740  vds - ok
21:36:23.0377 17740  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
21:36:23.0424 17740  vga - ok
21:36:23.0439 17740  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
21:36:23.0549 17740  VgaSave - ok
21:36:23.0549 17740  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
21:36:23.0595 17740  vhdmp - ok
21:36:23.0627 17740  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
21:36:23.0658 17740  viaide - ok
21:36:23.0689 17740  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
21:36:23.0720 17740  volmgr - ok
21:36:23.0751 17740  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
21:36:23.0783 17740  volmgrx - ok
21:36:23.0798 17740  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
21:36:23.0861 17740  volsnap - ok
21:36:23.0970 17740  [ 19AFBA7191A78EDCA6D235456D65E002 ] vpnagent        C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
21:36:24.0017 17740  vpnagent - ok
21:36:24.0032 17740  [ A8D4FED106B4BD337DF3DA20BA44E18E ] vpnva          C:\Windows\system32\DRIVERS\vpnva64.sys
21:36:24.0063 17740  vpnva - ok
21:36:24.0095 17740  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
21:36:24.0141 17740  vsmraid - ok
21:36:24.0204 17740  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
21:36:24.0422 17740  VSS - ok
21:36:24.0469 17740  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
21:36:24.0531 17740  vwifibus - ok
21:36:24.0563 17740  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
21:36:24.0625 17740  vwififlt - ok
21:36:24.0672 17740  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
21:36:24.0719 17740  vwifimp - ok
21:36:24.0765 17740  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
21:36:24.0859 17740  W32Time - ok
21:36:24.0890 17740  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
21:36:24.0937 17740  WacomPen - ok
21:36:24.0984 17740  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
21:36:25.0093 17740  WANARP - ok
21:36:25.0093 17740  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
21:36:25.0187 17740  Wanarpv6 - ok
21:36:25.0233 17740  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
21:36:25.0405 17740  wbengine - ok
21:36:25.0436 17740  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
21:36:25.0499 17740  WbioSrvc - ok
21:36:25.0530 17740  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
21:36:25.0608 17740  wcncsvc - ok
21:36:25.0623 17740  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
21:36:25.0686 17740  WcsPlugInService - ok
21:36:25.0717 17740  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
21:36:25.0748 17740  Wd - ok
21:36:25.0795 17740  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
21:36:25.0904 17740  Wdf01000 - ok
21:36:25.0920 17740  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
21:36:26.0045 17740  WdiServiceHost - ok
21:36:26.0045 17740  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
21:36:26.0091 17740  WdiSystemHost - ok
21:36:26.0138 17740  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
21:36:26.0232 17740  WebClient - ok
21:36:26.0247 17740  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
21:36:26.0357 17740  Wecsvc - ok
21:36:26.0372 17740  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
21:36:26.0466 17740  wercplsupport - ok
21:36:26.0497 17740  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
21:36:26.0591 17740  WerSvc - ok
21:36:26.0637 17740  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
21:36:26.0731 17740  WfpLwf - ok
21:36:26.0747 17740  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
21:36:26.0778 17740  WIMMount - ok
21:36:26.0793 17740  WinDefend - ok
21:36:26.0809 17740  WinHttpAutoProxySvc - ok
21:36:26.0871 17740  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
21:36:26.0965 17740  Winmgmt - ok
21:36:27.0059 17740  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
21:36:27.0308 17740  WinRM - ok
21:36:27.0371 17740  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
21:36:27.0402 17740  WinUsb - ok
21:36:27.0449 17740  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
21:36:27.0542 17740  Wlansvc - ok
21:36:27.0620 17740  [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
21:36:27.0651 17740  wlcrasvc - ok
21:36:27.0745 17740  [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:36:27.0885 17740  wlidsvc - ok
21:36:27.0917 17740  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
21:36:27.0963 17740  WmiAcpi - ok
21:36:27.0995 17740  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
21:36:28.0057 17740  wmiApSrv - ok
21:36:28.0088 17740  WMPNetworkSvc - ok
21:36:28.0119 17740  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
21:36:28.0182 17740  WPCSvc - ok
21:36:28.0197 17740  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
21:36:28.0275 17740  WPDBusEnum - ok
21:36:28.0307 17740  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
21:36:28.0400 17740  ws2ifsl - ok
21:36:28.0431 17740  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\system32\wscsvc.dll
21:36:28.0494 17740  wscsvc - ok
21:36:28.0494 17740  WSearch - ok
21:36:28.0603 17740  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
21:36:28.0759 17740  wuauserv - ok
21:36:28.0790 17740  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
21:36:28.0868 17740  WudfPf - ok
21:36:28.0915 17740  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
21:36:28.0962 17740  WUDFRd - ok
21:36:28.0993 17740  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
21:36:29.0040 17740  wudfsvc - ok
21:36:29.0087 17740  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
21:36:29.0165 17740  WwanSvc - ok
21:36:29.0227 17740  ================ Scan global ===============================
21:36:29.0258 17740  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
21:36:29.0289 17740  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:36:29.0321 17740  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:36:29.0336 17740  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
21:36:29.0367 17740  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
21:36:29.0383 17740  [Global] - ok
21:36:29.0383 17740  ================ Scan MBR ==================================
21:36:29.0399 17740  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
21:36:30.0381 17740  \Device\Harddisk0\DR0 - ok
21:36:30.0381 17740  ================ Scan VBR ==================================
21:36:30.0381 17740  [ 5294F6C9A1CA83793769CD67130B4485 ] \Device\Harddisk0\DR0\Partition1
21:36:30.0381 17740  \Device\Harddisk0\DR0\Partition1 - ok
21:36:30.0413 17740  [ 23F296F98784E2F4FA9FDE6B133A540D ] \Device\Harddisk0\DR0\Partition2
21:36:30.0413 17740  \Device\Harddisk0\DR0\Partition2 - ok
21:36:30.0413 17740  ============================================================
21:36:30.0413 17740  Scan finished
21:36:30.0413 17740  ============================================================
21:36:30.0444 7788  Detected object count: 2
21:36:30.0444 7788  Actual detected object count: 2
21:36:35.0639 7788  GREGService ( UnsignedFile.Multi.Generic ) - skipped by user
21:36:35.0639 7788  GREGService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:36:35.0639 7788  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
21:36:35.0639 7788  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:36:38.0103 5960  Deinitialize success

markusg 04.03.2013 18:35
passt

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

freac 04.03.2013 21:42
Hmm also hab gerade nochmal antivir laufen lassen und das hat 106 Funde gemeldet!!!!!!!!!!!!! Die anderen Softwares aber nichts oder nur einen...... Hier mal das Antivir LOG
Code:

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 4. März 2013  17:30

Es wird nach 5129762 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Home Premium
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : XXX
Computername  : XXX-PC

Versionsinformationen:
BUILD.DAT      : 12.1.9.1236    40872 Bytes  11.10.2012 15:29:00
AVSCAN.EXE    : 12.3.0.48    468256 Bytes  14.11.2012 12:56:59
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  18.07.2012 16:04:38
LUKE.DLL      : 12.3.0.15      68304 Bytes  18.07.2012 16:04:31
AVSCPLR.DLL    : 12.3.0.27      97064 Bytes  18.07.2012 16:04:24
AVREG.DLL      : 12.3.0.33    232232 Bytes  18.07.2012 16:04:23
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 23:22:12
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 23:31:36
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 09:58:50
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 22:37:35
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 16:04:37
VBASE006.VDF  : 7.11.41.250  4902400 Bytes  06.09.2012 18:58:39
VBASE007.VDF  : 7.11.50.230  3904512 Bytes  22.11.2012 13:42:04
VBASE008.VDF  : 7.11.60.10  6627328 Bytes  07.02.2013 22:04:16
VBASE009.VDF  : 7.11.60.11      2048 Bytes  07.02.2013 22:04:16
VBASE010.VDF  : 7.11.60.12      2048 Bytes  07.02.2013 22:04:16
VBASE011.VDF  : 7.11.60.13      2048 Bytes  07.02.2013 22:04:16
VBASE012.VDF  : 7.11.60.14      2048 Bytes  07.02.2013 22:04:16
VBASE013.VDF  : 7.11.60.62    351232 Bytes  08.02.2013 22:03:34
VBASE014.VDF  : 7.11.60.115  190976 Bytes  09.02.2013 22:03:34
VBASE015.VDF  : 7.11.60.177  282624 Bytes  11.02.2013 22:03:33
VBASE016.VDF  : 7.11.60.249  215552 Bytes  13.02.2013 11:59:53
VBASE017.VDF  : 7.11.61.65    151040 Bytes  15.02.2013 11:59:51
VBASE018.VDF  : 7.11.61.135  159232 Bytes  18.02.2013 19:55:21
VBASE019.VDF  : 7.11.61.163  152064 Bytes  18.02.2013 20:24:37
VBASE020.VDF  : 7.11.61.207  164352 Bytes  19.02.2013 20:24:37
VBASE021.VDF  : 7.11.62.43    206336 Bytes  21.02.2013 08:47:42
VBASE022.VDF  : 7.11.62.111  136192 Bytes  23.02.2013 14:26:07
VBASE023.VDF  : 7.11.62.157  143360 Bytes  25.02.2013 19:36:40
VBASE024.VDF  : 7.11.62.237  199168 Bytes  27.02.2013 17:26:07
VBASE025.VDF  : 7.11.63.71    209408 Bytes  01.03.2013 18:51:15
VBASE026.VDF  : 7.11.63.121  257536 Bytes  04.03.2013 16:16:46
VBASE027.VDF  : 7.11.63.122    2048 Bytes  04.03.2013 16:16:46
VBASE028.VDF  : 7.11.63.123    2048 Bytes  04.03.2013 16:16:46
VBASE029.VDF  : 7.11.63.124    2048 Bytes  04.03.2013 16:16:46
VBASE030.VDF  : 7.11.63.125    2048 Bytes  04.03.2013 16:16:47
VBASE031.VDF  : 7.11.63.136    45056 Bytes  04.03.2013 16:16:47
Engineversion  : 8.2.12.10
AEVDF.DLL      : 8.1.2.10      102772 Bytes  29.08.2012 14:54:53
AESCRIPT.DLL  : 8.1.4.94      467324 Bytes  24.02.2013 14:26:15
AESCN.DLL      : 8.1.10.0      131445 Bytes  14.12.2012 21:25:26
AESBX.DLL      : 8.2.5.12      606578 Bytes  18.07.2012 16:04:20
AERDL.DLL      : 8.2.0.88      643444 Bytes  10.01.2013 17:49:57
AEPACK.DLL    : 8.3.1.12      815480 Bytes  28.02.2013 17:26:47
AEOFFICE.DLL  : 8.1.2.50      201084 Bytes  05.11.2012 14:58:03
AEHEUR.DLL    : 8.1.4.222    5767545 Bytes  28.02.2013 17:26:46
AEHELP.DLL    : 8.1.25.2      258423 Bytes  11.10.2012 15:06:19
AEGEN.DLL      : 8.1.6.16      434549 Bytes  25.01.2013 08:42:17
AEEXP.DLL      : 8.4.0.6      192885 Bytes  28.02.2013 17:26:47
AEEMU.DLL      : 8.1.3.2      393587 Bytes  29.08.2012 14:54:52
AECORE.DLL    : 8.1.31.2      201080 Bytes  19.02.2013 20:24:38
AEBB.DLL      : 8.1.1.4        53619 Bytes  05.11.2012 14:58:02
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  18.07.2012 16:04:25
AVPREF.DLL    : 12.3.0.32      50720 Bytes  14.11.2012 12:56:59
AVREP.DLL      : 12.3.0.15    179208 Bytes  18.07.2012 16:04:23
AVARKT.DLL    : 12.3.0.33    209696 Bytes  14.11.2012 12:56:59
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  18.07.2012 16:04:22
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  18.07.2012 16:04:34
AVSMTP.DLL    : 12.3.0.32      63480 Bytes  18.07.2012 16:04:24
NETNT.DLL      : 12.3.0.15      17104 Bytes  18.07.2012 16:04:31
RCIMAGE.DLL    : 12.3.0.31    4444408 Bytes  18.07.2012 16:04:41
RCTEXT.DLL    : 12.3.0.32      98848 Bytes  14.11.2012 12:56:58

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, Q:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Montag, 4. März 2013  17:30

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'Q:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'opera.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'DeviceDetector.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'RunDll32.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnui.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMworker.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'brs.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'BackupManagerTray.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AllShareDMS.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'NASvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlbrowser.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'IScheduleSvc.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlservr.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlservr.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'UpdaterService.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'GREGsvc.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMutilps32.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'dsiwmis.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnagent.exe' - '67' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '5978' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Packard Bell>
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\82bfec0-5d28e075
  [0] Archivtyp: ZIP
  --> main.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\2935be4b-4b5f4677
  [0] Archivtyp: ZIP
  --> main.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.BK
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\7168ca0e-1cff4e4e
  [0] Archivtyp: ZIP
  --> s_a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/3544.CU.1.B
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> s_d.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> lz.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CX.2
  --> s_b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CN.1
  --> s_c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\710ec8d0-6bf6eec5
  [0] Archivtyp: ZIP
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2010-0840.CM
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HE
  --> t.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\3f0d2d51-5f3de9ce
  [0] Archivtyp: ZIP
  --> a/Help.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> a/Test.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\40feb752-4ab4ba8a
  [0] Archivtyp: ZIP
  --> syyflqdglpbafelc/atcqmmftagwhue.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Mabowl.Gen
  --> syyflqdglpbafelc/csfqmtlnjbc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-4452
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\599cce57-172d38e5
  [0] Archivtyp: ZIP
  --> s_a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/3544.CU.1.B
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> s_d.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> lz.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CX.2
  --> s_b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CN.1
  --> s_c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\16582319-26a704d0
  [0] Archivtyp: ZIP
  --> Effect.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Pycle.Gen
  --> Field.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Small.AO.2
  --> first.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/Java.Expkit.J
  --> Photo.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\407c4183-4beccb28
  [0] Archivtyp: ZIP
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.DC
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> zb.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> zc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> za.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HE
  --> t.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\76a555a2-16264ea4
  [0] Archivtyp: ZIP
  --> a/Help.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> a/Test.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\3754a6e6-4a11092b
  [0] Archivtyp: ZIP
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HR
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HE
  --> t.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\41a8eba9-605bce7f
  [0] Archivtyp: ZIP
  --> wkftybt/ypffsjryf.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  --> wkftybt/wpknbwqsgpyjnevrhwrsust.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Jovab.Gen
  --> wkftybt/ujsemdmwhglyrblyjglcutfa.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Jovab.Gen
  --> wkftybt/pavpgcl.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Jovab.Gen
  --> wkftybt/dayufnbbqpvemvedydfg.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Jovab.Gen
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\1fd605aa-25ab8ef2
  [0] Archivtyp: ZIP
  --> rrtrqbrgcu/abedcqlptewvphn.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.PW
  --> rrtrqbrgcu/aedgmy.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.CK.1
  --> rrtrqbrgcu/jphpbkj.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.ES
  --> rrtrqbrgcu/ntlngvftegheyncbcsj.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.ET
  --> rrtrqbrgcu/rhkbtuythjaqlnb.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.A.437
  --> rrtrqbrgcu/uyneecumcgfvcpf.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.EU
  --> rrtrqbrgcu/vvqnvftuyy.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.PX
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\487ac36b-3fdc3921
  [0] Archivtyp: ZIP
  --> Effect.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Pycle.Gen
  --> Field.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.A.10
  --> first.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.A.81
  --> Matrix.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.A.4
  --> Photo.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.PC
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\f7167f0-66ae0aff
  [0] Archivtyp: ZIP
  --> kmkcfysyekmhbnnllk/gkemgre.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.DV
  --> kmkcfysyekmhbnnllk/grgpldk.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Mabowl.Gen
  --> kmkcfysyekmhbnnllk/hashbjnsedqqhjyyrqbaph.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EA
  --> kmkcfysyekmhbnnllk/jlltvmmjeffbfvvnvcfhrmlk.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Mabowl.Gen
  --> kmkcfysyekmhbnnllk/mkwfbwngesmgmkjaccnhsrl.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Niabil.Gen
  --> kmkcfysyekmhbnnllk/vfgdwahasmffcjyjyghjkv.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Mabowl.Gen
  --> kmkcfysyekmhbnnllk/wnkpptpgsr.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.DZ
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\580cc9b5-35b05ca0
  [0] Archivtyp: ZIP
  --> Field.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HG
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> m.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\3a9987fa-51060aec
  [0] Archivtyp: ZIP
  --> roiqa/roiqa.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ivinest.Gen
  --> roiqa/roiqc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-1723.A.9
  --> roiqa/roiqd.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-1723.A.18
  --> roiqa/roiqb.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-1723.A.7
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\26ea53bc-7e4c3db0
  [0] Archivtyp: ZIP
  --> n111111a/n111111f.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> n111111a/n111111a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.GY
  --> n111111a/n111111c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-0507.DM
  --> n111111a/n111111d.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Kara.BB
  --> n111111a/n111111b.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Kara.BC
  --> n111111a/n111111e.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2008-5353.CR
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\3543a7fc-4362dd07
  [0] Archivtyp: ZIP
  --> s_a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/3544.CU.1.B
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> s_d.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> lz.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CX.2
  --> s_b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.CN.1
  --> s_c.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\24e1467d-46bebb40
  [0] Archivtyp: ZIP
  --> hw.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-0507.DW
  --> mac.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.DO
  --> test.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-0507.DX
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\17db837e-3f1a5016
  [0] Archivtyp: ZIP
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.DI
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> b.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> a.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> t.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Pesur.BM
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\2c67de3e-1692557d
  [0] Archivtyp: ZIP
  --> ER.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.DC
  --> Inc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> zb.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  --> zc.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  --> za.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.HE
  --> t.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\60f656c7-61716cb3
  [0] Archivtyp: ZIP
  --> a/Help.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternub.Gen
  --> a/Test.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
C:\Users\XXX\exe\UNI-Programme\aspenONEV71\aspenONEV71\aspenONEV7.1dvd1\AES\aspenonev7.1dvd1\Aspen Basic Engineering V7.1\AZ9FEA~1.cab
  [0] Archivtyp: CAB (Microsoft)
  --> AZAspRead.dll
      [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen7
C:\Users\XXX\exe\UNI-Programme\aspenONEV71\aspenONEV71\aspenONEV7.1dvd1\AES\aspenonev7.1dvd1\Aspen Process Manual V7.1\AS62BD~1.cab
  [0] Archivtyp: CAB (Microsoft)
  --> promanstruct.dll
      [FUND]      Ist das Trojanische Pferd TR/BHO.Gen

Beginne mit der Desinfektion:
C:\Users\XXX\exe\UNI-Programme\aspenONEV71\aspenONEV71\aspenONEV7.1dvd1\AES\aspenonev7.1dvd1\Aspen Process Manual V7.1\AS62BD~1.cab
  [FUND]      Ist das Trojanische Pferd TR/BHO.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57d0a89a.qua' verschoben!
C:\Users\XXX\exe\UNI-Programme\aspenONEV71\aspenONEV71\aspenONEV7.1dvd1\AES\aspenonev7.1dvd1\Aspen Basic Engineering V7.1\AZ9FEA~1.cab
  [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen7
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f428734.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\60f656c7-61716cb3
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1de8ddaa.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\2c67de3e-1692557d
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7b2f9227.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\17db837e-3f1a5016
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Pesur.BM
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3e59bf4d.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\24e1467d-46bebb40
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-0507.DX
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '41418d2b.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\3543a7fc-4362dd07
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0d0aa160.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\26ea53bc-7e4c3db0
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2008-5353.CR
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '71e1e137.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\3a9987fa-51060aec
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-1723.A.7
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c4fce11.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\580cc9b5-35b05ca0
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Ruios.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '452cf5e3.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\f7167f0-66ae0aff
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.DZ
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2973d9d2.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\487ac36b-3fdc3921
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.PC
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '58c0e046.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\1fd605aa-25ab8ef2
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.PX
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '562fd0d3.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\41a8eba9-605bce7f
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Jovab.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1309a9c4.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\3754a6e6-4a11092b
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1afead69.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\76a555a2-16264ea4
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4243b403.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\407c4183-4beccb28
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6e4dcdd5.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\16582319-26a704d0
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50b5ad15.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\599cce57-172d38e5
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '33bf866b.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\40feb752-4ab4ba8a
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-4452
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1582c661.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\3f0d2d51-5f3de9ce
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '27e8bd8e.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\710ec8d0-6bf6eec5
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.CF
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2dad96a5.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\7168ca0e-1cff4e4e
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.EB
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '12f0f2e0.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\2935be4b-4b5f4677
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2011-3544.BK
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6cdffecf.qua' verschoben!
C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\82bfec0-5d28e075
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3958fa0d.qua' verschoben!


Ende des Suchlaufs: Montag, 4. März 2013  21:39
Benötigte Zeit:  4:05:44 Stunde(n)

Der Suchlauf wurde abgebrochen!

  30927 Verzeichnisse wurden überprüft
 1813296 Dateien wurden geprüft
    106 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
    25 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 1813190 Dateien ohne Befall
  20773 Archive wurden durchsucht
      0 Warnungen
    25 Hinweise
 1135281 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

markusg 04.03.2013 21:49
und, stand was von avira in meiner letzten Anweisung? den Scan hättest du dir sparen können, denn die Dateien währen gelöscht worden, würdest du meine Schritte ausführen

freac 04.03.2013 22:17
ne stand nichts aber wollte in der Zwischenzeit nicht tatenlos sein.
Wollte Deinen Sachverstand nicht in Frage stellen oder so....
Also jetzt der cccleaner....

so hier die ccleaner liste
Code:
ACD/Labs Software in C:\ACDFREE12\        ACD/Labs        09.11.2012                v12.00, FREE  notwendig
Acrobat.com        Adobe Systems Incorporated        31.05.2011        1,60MB        1.6.65  notwendig
Adobe AIR        Adobe Systems Inc.        03.08.2011                1.5.3.9130
Adobe Community Help        Adobe Systems Incorporated        03.08.2011                3.2.1.650
Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        27.02.2013        6,00MB        11.6.602.171 notwendig
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        27.02.2013        6,00MB        11.6.602.171 notwendig
Adobe Photoshop 7.0        Adobe Systems, Inc.        11.12.2011                7.0 notwendig
Adobe Photoshop Elements 9        Adobe Systems Incorporated        03.08.2011        2,60GB        9.0 notwendig
Adobe Premiere Elements 9        Adobe Systems Incorporated        03.08.2011        1,23GB        9.0 notwendig
Adobe Reader X (10.1.6) - Deutsch        Adobe Systems Incorporated        24.02.2013        169MB        10.1.6 notwendig
AIMP2        AIMP DevTeam        25.09.2011        notwendig       
Apple Application Support        Apple Inc.        11.01.2013        64,9MB        2.3 unnötig
Apple Software Update        Apple Inc.        25.09.2011        2,38MB        2.1.3.127 unnötig
Avira Free Antivirus        Avira        14.11.2012        110MB        12.1.9.1236 notwendig
Bewerbungsfoto-/Passbild-Generator v3.5b                19.02.2013        1,28MB        notwendig
Bing Bar        Microsoft Corporation        03.08.2011        24,4MB        7.0.610.0 unnötig
BKChem-0.14.0-pre2        Reinis Danne        25.10.2011        19,9MB        notwendig
Broadcom Card Reader Driver Installer        Broadcom Corporation        31.05.2011        2,76MB        14.8.2.2 notwendig
Broadcom Gigabit NetLink Controller        Broadcom Corporation        31.05.2011        496KB        14.6.1.2 notwendig
CCleaner        Piriform        25.02.2013                3.28 notwendig
Cisco AnyConnect Secure Mobility Client        Cisco Systems, Inc.        16.02.2013                3.1.02026 notwendig
Citavi        Swiss Academic Software        23.10.2012        70,4MB        3.3.0.0 notwendig
CyberLink MediaEspresso        CyberLink Corp.        31.05.2011        164MB        6.5.2113_41116 unnötig
CyberLink PowerDVD 10        CyberLink Corp.        25.09.2011        228MB        10.0.2428.52 notwendig
DAEMON Tools Lite        DT Soft Ltd        06.01.2012                4.45.1.0236 notwendig
DivX-Setup        DivX, LLC        10.07.2012                2.6.1.9 notwendig
dm-Fotowelt        CEWE COLOR AG u Co. OHG        03.02.2013        394MB        5.0.1 notwendig
Dropbox        Dropbox, Inc.        03.02.2013                1.6.16 notwendig
EASEUS Data Recovery Wizard Free Edition 5.5.1        EASEUS        25.02.2012        33,9MB notwendig       
eXe -- eLearning XHTML editor        eXe Project        27.09.2011                notwendig
Free Audio CD Burner version 1.3        DVDVideoSoft Limited.        30.12.2011        8,06MB        unnötig
Free YouTube to MP3 Converter version 3.10.14.1206        DVDVideoSoft Ltd.        30.12.2011        77,6MB        unnötig
HomeMedia        CyberLink Corporation        03.08.2011                2.0.8520 notwendig
Identity Card        Packard Bell        03.08.2011                1.00.3006 notwendig
Intel(R) Control Center        Intel Corporation        03.08.2011                1.2.1.1007  notwendig
Intel(R) Management Engine Components        Intel Corporation        04.08.2011                7.0.0.1144 notwendig
Intel(R) Processor Graphics        Intel Corporation        04.08.2011                8.15.10.2372 notwendig
Intel(R) Rapid Storage Technology        Intel Corporation        04.08.2011                10.0.0.1046 notwendig
Java 7 Update 17        Oracle        04.03.2013        129MB        7.0.170  notwendig
Launch Manager        Packard Bell        03.08.2011                5.1.4 notwendig
Malwarebytes Anti-Malware Version 1.70.0.1100        Malwarebytes Corporation        04.01.2013        18,4MB        1.70.0.1100 notwendig
MathType 6        Design Science, Inc.        23.10.2011                6.7 notwendig
MATLAB R2008a        The MathWorks, Inc.        03.01.2012                7.6 notwendig
Microsoft .NET Framework 1.1        Microsoft        01.01.2012        34,8MB        1.1.4322 unbekannt
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        10.07.2012        38,8MB        4.0.30320 unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        10.07.2012        2,93MB        4.0.30320  notwendig
Microsoft Office Klick-und-Los 2010        Microsoft Corporation        25.09.2011                14.0.4763.1000  notwendig
Microsoft Office Professional Plus 2010        Microsoft Corporation        15.10.2011                14.0.6029.1000 notwendig
Microsoft Office Visio Professional 2007        Microsoft Corporation        27.03.2012                12.0.6612.1000  notwendig
Microsoft Silverlight        Microsoft Corporation        14.05.2012        100MB        4.1.10329.0 notwendig
Microsoft SQL Server 2005        Microsoft Corporation        09.01.2012        notwendig       
Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        31.05.2011        1,69MB        3.1.0000  notwendig
Microsoft SQL Server 2012 RC0 Setup (English)        Microsoft Corporation        01.01.2012        42,2MB        11.0.1750.32  notwendig
Microsoft SQL Server Native Client        Microsoft Corporation        02.01.2012        5,83MB        9.00.5000.00  notwendig
Microsoft SQL Server Setup Support Files (English)        Microsoft Corporation        09.01.2012        24,5MB        9.00.5000.00  notwendig
Microsoft SQL Server VSS Writer        Microsoft Corporation        02.01.2012        1,10MB        9.00.5000.00  notwendig
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        24.01.2012        250KB        8.0.50727.4053 unbekannt
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        25.09.2011        298KB        8.0.61001 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148        Microsoft Corporation        31.05.2011        784KB        9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161        Microsoft Corporation        25.09.2011        788KB        9.0.30729.6161 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729        Microsoft Corporation        29.02.2012        234KB        9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        31.05.2011        240KB        9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        31.05.2011        596KB        9.0.30729.4148  unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        25.09.2011        600KB        9.0.30729.6161 unbekannt
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219        Microsoft Corporation        02.01.2012        13,8MB        10.0.40219 unbekannt
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        02.01.2012        15,0MB        10.0.40219 unbekannt
Mozilla Firefox 19.0 (x86 de)        Mozilla        02.03.2013        44,9MB        19.0 notwendig
Mozilla Maintenance Service        Mozilla        02.03.2013        330KB        19.0  notwendig
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        24.09.2011        1,27MB        4.20.9870.0  notwendig
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        24.09.2011        1,33MB        4.20.9876.0  notwendig
Nero DiscSpeed 10        Nero AG        31.05.2011        7,21MB        6.2.10500.2.100  notwendig
Nero Express 10        Nero AG        31.05.2011        165MB        10.2.12000.21.100    notwendig
Nero Multimedia Suite 10 Essentials        Nero AG        31.05.2011        372MB        10.5.10300  notwendig
Nero StartSmart 10        Nero AG        31.05.2011        143MB        10.2.11600.14.100  notwendig
Nero Update        Nero AG        31.05.2011        1,43MB        1.0.0018  notwendig
Nitro Reader 3        Nitro        01.11.2012        108MB        3.0.5.5 notwendig
Norton Online Backup        Symantec Corporation        31.05.2011        6,19MB        2.1.17869 unnötig
NVIDIA Grafiktreiber 306.97        NVIDIA Corporation        04.03.2013                306.97 notwendig
NVIDIA PhysX        NVIDIA Corporation        03.08.2011        78,9MB        9.10.0514 notwendig
NVIDIA Update 1.10.8        NVIDIA Corporation        04.03.2013                1.10.8 notwendig
OPC Core Components Redistributable        OPC Foundation        01.01.2012        892KB        3.00.101  unbekannt
Opera 12.14        Opera Software ASA        09.02.2013                12.14.1738 notwendig
Packard Bell Games        WildTangent        31.05.2011                1.0.2.4  unnötig
Packard Bell MyBackup        NTI Corporation        23.02.2012        349MB        3.0.0.100 notwendig
Packard Bell Power Management        Packard Bell        03.08.2011                6.00.3007 notwendig
Packard Bell Recovery Management        Packard Bell        31.05.2011                5.00.3004 notwendig
Packard Bell Registration        Packard Bell        03.08.2011                1.04.3501 notwendig
Packard Bell ScreenSaver        Packard Bell        03.08.2011                1.1.0811.2010 notwendig
Packard Bell Social Networks        CyberLink Corp.        31.05.2011        26,2MB        2.0.2913 unnötig
Packard Bell Updater        Packard Bell        31.05.2011                1.02.3500  notwendig
pdfsam                24.03.2012                2.2.0  notwendig
PowerISO        PowerISO Computing, Inc.        29.09.2011                4.6  notwendig
Preispiraten        metaspinner net GmbH        25.09.2011                6  notwendig
Process Modeling (HYSYS) V7.1        AspenTech        07.01.2012        8,72GB        23.0.0  unbekannt
QuickTime        Apple Inc.        11.01.2013        73,1MB        7.73.80.64  notwendig
Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        03.08.2011                6.0.1.6329  notwendig
Renesas Electronics USB 3.0 Host Controller Driver        Renesas Electronics Corporation        03.08.2011        1,00MB        2.0.26.0  notwendig
Rosetta Stone Version 3        Rosetta Stone Ltd.        30.09.2011        138MB        3.3.5.2  notwendig
Samsung AllShare        Samsung Electronics Co., Ltd.        10.07.2012        74,3MB        2.1.0.12031_10  notwendig
SAMSUNG Mobile Composite Device Software                30.05.2012        notwendig       
SAMSUNG Mobile Modem Driver Set                30.05.2012                notwendig
Samsung Mobile phone USB driver Drive Software                30.05.2012  notwendig               
SAMSUNG Mobile USB Modem 1.0 Software                30.05.2012        notwendig       
SAMSUNG Mobile USB Modem Software                30.05.2012        notwendig       
Samsung PC Studio 3        Samsung Electronics Co., Ltd.        30.05.2012                3.2.2.80404  notwendig
Samsung PC Studio 3 USB Driver Installer        Samsung Electronics Co., Ltd.        30.05.2012                3.2.0.70701    notwendig
Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002)        Microsoft        01.01.2012        288KB        1.0.0  unbekannt
Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002)        Microsoft        01.01.2012        57,0KB        1.0.0  unbekannt
Skype™ 6.1        Skype Technologies S.A.        08.02.2013        21,1MB        6.1.129  notwendig
Synaptics Pointing Device Driver        Synaptics Incorporated        03.08.2011        46,4MB        15.1.6.0  unbekannt
Uninstall 1.0.0.1                30.12.2011        10,5MB        unbekannt
Veetle TV        Veetle, Inc        27.09.2011                0.9.18 unnötig
Video Web Camera        CyberLink Corp.        03.08.2011        33,7MB        1.0.1523  notwendig
VLC media player 1.1.11        VideoLAN        24.09.2011                1.1.11  notwendig
Welcome Center        Packard Bell        03.08.2011                1.02.3501  unnötig
WIDCOMM Bluetooth Software        Broadcom Corporation        03.08.2011        183MB        6.3.0.7300  notwendig
Windows Live Essentials        Microsoft Corporation        31.05.2011                15.4.3508.1109  notwendig
WinRAR                24.09.2011                notwendig
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0        Intel        03.08.2011        27,5MB        2.0.82.0  notwendig

markusg 05.03.2013 14:55
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
Bing
Free : beide
Veetle

Öffne CCleaner, analysieren, starten, PC neustarten
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

freac 05.03.2013 16:15
So hier der Adwarecleaner log

Code:
# AdwCleaner v2.114 - Datei am 05/03/2013 um 16:08:29 erstellt
# Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : XXX - XXX-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\anyzy7tp.default\searchplugins\11-suche.xml
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Users\XXX\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\XXX\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\XXX\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\XXX\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\anyzy7tp.default\extensions\{f0381dbd-e018-4e07-ae40-d96ab15083f0}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Ask.com.tmp
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2765711
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0 (de)

Datei : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\anyzy7tp.default\prefs.js

Gelöscht : user_pref("keyword.URL", "hxxp://search.hotspotshield.com/g/results.php?c=s&q=");

-\\ Opera v12.14.1738.0

Datei : C:\Users\XXX\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [2566 octets] - [05/03/2013 16:03:16]
AdwCleaner[S1].txt - [345 octets] - [05/03/2013 16:08:11]
AdwCleaner[S2].txt - [2562 octets] - [05/03/2013 16:08:29]

########## EOF - C:\AdwCleaner[S2].txt - [2622 octets] ##########

markusg 05.03.2013 16:55
Hi,
HitmanPro - Download - Filepony
Hitmanpro laden, doppelklicken, lizenz, Testlizenz.
Auf Scan.
Nichts löschen.
auf weiter.
Log als xml exportieren und posten, bzw packen und anhängen

freac 05.03.2013 17:33
Hi Markus hier der Hitman Log
Code:
<Log computer="XXX-PC" windows="6.1.1.7601.X64/8" scan="Normal" version="3.7.2.190" date="2013-03-05T17:01:08" timeSpentInSecs="1447" filesProcessed="143436">
<Item type="Suspicious" score="55.0" status="None">
<File path="C:\Users\XXX\exe\UNI-Programme\HP Chem Stations\HP ChemStation Datenanalyse\MANUALS\READER\AR32E30.EXE" hash="47AA72D2DD4A746BC63FC5171D8F475C7691F317F8B1E5007832FA7100C10923"/>
</Item>
</Log

markusg 05.03.2013 18:05
ok sieht gut aus.
neustarten, neues otl log bitte

freac 05.03.2013 19:11
Ich sehe gerade das im Ordner C\users\all users ca. 40 mal und öfter der Unterordner "Anwendungsdaten" vorhanden ist wenn man drauf klickt. Ich hab mal die versteckten Ornder anzeigen lassen und dort immer wieder eine Verknüpfung mit "Anwendungsdaten" gefunden. Was ist das denn für ein Quatsch???

Hier das OTL ohne Defogger vorher

Code:
OTL logfile created on: 05.03.2013 18:10:14 - Run 5
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,86 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 76,42% Memory free
15,71 Gb Paging File | 13,65 Gb Available in Paging File | 86,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 678,54 Gb Total Space | 432,46 Gb Free Space | 63,73% Space Free | Partition Type: NTFS
 
Computer Name:XXX| User Name:  XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.20 20:29:18 | 028,539,272 | ---- | M] (Dropbox, Inc.) -- C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013.01.11 14:15:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\Antivirenprogramme\OTL.exe
PRC - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.13 14:44:45 | 000,702,024 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
PRC - [2012.12.13 14:44:31 | 000,544,840 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2012.10.08 11:42:54 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.18 17:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.03.02 16:00:26 | 000,025,504 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
PRC - [2012.01.05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
PRC - [2012.01.05 14:22:02 | 000,295,448 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.09.13 13:49:14 | 000,986,208 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
PRC - [2011.05.26 07:40:48 | 000,029,696 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
PRC - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe
PRC - [2011.03.14 12:44:38 | 000,414,800 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2011.03.14 12:44:38 | 000,334,416 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2011.03.14 12:44:36 | 001,081,424 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2011.03.14 12:44:36 | 000,352,336 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.12.22 21:24:58 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.12.08 16:54:46 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
PRC - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2010.09.14 02:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.09.14 02:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2010.04.27 03:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.14 13:01:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013.01.10 13:29:54 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\c24dc5c1953c9617b9529172e61ba202\IAStorCommon.ni.dll
MOD - [2013.01.10 13:29:53 | 000,475,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\01d0ecf3e47d2559aa403d296ad5320a\IAStorUtil.ni.dll
MOD - [2013.01.10 11:26:00 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 11:24:44 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 11:24:15 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.10 11:24:02 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 11:23:54 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.10 11:23:52 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 11:23:40 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.13 14:45:20 | 000,063,560 | ---- | M] () -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
MOD - [2012.01.05 14:22:36 | 000,465,344 | ---- | M] () -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\sqlite3.dll
MOD - [2011.08.04 01:25:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.03.05 15:38:09 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.03.02 01:08:24 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.13 14:44:31 | 000,544,840 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2012.10.23 22:59:18 | 000,230,416 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Programme\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3)
SRV - [2012.10.08 11:42:54 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.02 16:00:26 | 000,025,504 | ---- | M] (Samsung Electronics Co., Ltd.) [Auto | Running] -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe -- (SamsungAllShareV2.0)
SRV - [2012.03.02 16:00:20 | 000,027,584 | ---- | M] (Samsung Electronics Co., Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe -- (SimpleSlideShowServer)
SRV - [2012.01.05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011.11.06 16:10:36 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.09.30 13:48:32 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.05.26 07:40:48 | 000,029,696 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService)
SRV - [2011.05.10 13:01:08 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.03.14 12:44:36 | 000,352,336 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.12.22 21:25:02 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.12.22 21:24:58 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.12.10 17:36:54 | 000,153,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 14:53:34 | 000,953,632 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.10.08 15:33:12 | 000,254,448 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2010.10.08 01:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 22:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.14 02:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.06.01 23:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.12.13 14:26:36 | 000,112,080 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)
DRV:64bit: - [2012.10.17 10:13:38 | 000,027,048 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2012.10.08 11:42:36 | 000,030,056 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.07.18 17:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.18 17:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.18 17:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.07 12:40:02 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.12.29 00:57:26 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.05.16 22:57:32 | 000,051,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2011.05.13 03:21:04 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.05.13 03:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.05.13 03:21:02 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.05.06 18:11:12 | 000,086,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2011.04.15 19:08:28 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.01 15:33:16 | 004,720,704 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2011.01.21 02:15:30 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2011.01.21 02:15:28 | 000,067,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2011.01.17 23:56:14 | 000,412,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.12.10 09:05:02 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.12.10 09:04:52 | 000,349,224 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2010.11.21 04:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.15 09:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.10.08 01:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.09.30 06:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.09.30 06:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.09.14 06:59:16 | 000,138,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.09.14 06:59:10 | 000,021,416 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.09.14 02:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.08.20 08:21:38 | 000,106,536 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.07.29 14:30:48 | 001,383,472 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.03.19 02:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.02.08 07:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.11.09 04:28:08 | 000,091,568 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2008.11.16 17:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
 
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{1F0C0E4A-72C8-4560-9612-27AD083921F1}: "URL" = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}
IE - HKCU\..\SearchScopes\{47F43F50-68E2-4F28-B949-26EE0EC9C505}: "URL" = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9
FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.4
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.15 20:34:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.07.25 07:39:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.02 01:08:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.03.05 15:41:57 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.02 01:08:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.03.05 15:41:57 | 000,000,000 | ---D | M]
 
[2011.09.24 21:38:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2013.03.05 16:08:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\anyzy7tp.default\extensions
[2013.02.19 13:16:18 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi
[2012.12.14 22:23:54 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.02 09:42:22 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.19 13:16:21 | 000,002,273 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\englische-ergebnisse.xml
[2013.02.19 13:16:21 | 000,010,563 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\gmx-suche.xml
[2013.02.19 13:16:21 | 000,002,432 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\lastminute.xml
[2013.02.19 13:16:21 | 000,005,545 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\webde-suche.xml
[2013.03.04 21:56:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.03.02 01:08:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.03.02 01:08:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.03.02 01:08:24 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.01.01 20:10:04 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.16 19:27:43 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.01 20:10:04 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.01 20:10:04 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.02.08 16:22:48 | 000,001,987 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SP_amazonde.xml
[2007.01.08 12:48:12 | 000,009,095 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SP_preispiraten_de.xml
[2012.01.01 20:10:04 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.01 20:10:04 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2013.03.01 17:41:07 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (amazon) - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\PROGRA~2\PREISP~1\IEBUTT~1.DLL ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Preispiraten) - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\PROGRA~2\PREISP~1\IEBUTT~2.DLL ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\XXX\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten6\\preispiraten.html ()
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten6\\preispiraten.html ()
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten6\preispiraten3ie.exe ()
O9 - Extra 'Tools' menuitem : Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten6\preispiraten3ie.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home File not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home File not found
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DC096DF-4478-4D61-84C9-0129A69AE8BF}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.05 16:58:49 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2013.03.05 16:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013.03.05 16:57:57 | 009,565,552 | ---- | C] (SurfRight B.V.) -- C:\Users\XXX\Desktop\HitmanPro_x64.exe
[2013.03.05 16:42:11 | 000,000,000 | ---D | C] -- C:\Users\XXX\Organisatorisches
[2013.03.05 16:41:15 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Antivirenprogramme
[2013.03.05 16:33:40 | 000,000,000 | ---D | C] -- C:\Users\XXX\Möbel
[2013.03.05 15:38:09 | 000,691,568 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.03.05 15:38:09 | 000,071,024 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.03.04 22:20:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013.03.04 22:20:03 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013.03.04 22:07:01 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2013.03.04 22:07:01 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2013.03.04 22:07:00 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2013.03.04 22:06:59 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2013.03.04 22:06:59 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbGD.sys
[2013.03.04 22:06:59 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2013.03.04 22:06:57 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2013.03.04 22:06:57 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2013.03.04 22:06:57 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll
[2013.03.04 22:06:56 | 001,048,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe
[2013.03.04 22:06:56 | 000,384,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe
[2013.03.04 22:06:56 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll
[2013.03.04 22:06:56 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll
[2013.03.04 22:06:56 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll
[2013.03.04 22:06:56 | 000,228,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpendp_winip.dll
[2013.03.04 22:06:56 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpendp_winip.dll
[2013.03.04 22:06:56 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe
[2013.03.04 22:06:56 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll
[2013.03.04 22:06:56 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll
[2013.03.04 22:06:56 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2013.03.04 22:06:56 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll
[2013.03.04 22:06:55 | 003,174,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2013.03.04 22:06:55 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe
[2013.03.04 22:06:54 | 005,773,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2013.03.04 22:06:54 | 004,916,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2013.03.04 22:02:17 | 001,448,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013.03.04 22:02:15 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2013.03.04 22:02:15 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2013.03.04 21:58:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.03.04 21:58:09 | 000,262,560 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.03.04 21:57:47 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.03.04 21:57:47 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.03.04 21:57:47 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.03.02 01:08:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.03.01 17:50:10 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.03.01 17:17:02 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.01 17:17:02 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.01 17:17:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.01 17:16:47 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.01 17:16:28 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.01 12:29:45 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.02.27 19:11:25 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.02.27 19:11:25 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.02.27 19:11:25 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.02.27 19:11:25 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.02.27 19:11:20 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.02.27 19:11:20 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.02.27 19:11:15 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.02.27 19:11:15 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.27 19:11:15 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.27 19:11:15 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.27 19:11:15 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.27 19:11:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.27 19:11:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.27 19:11:15 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.27 19:11:15 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.27 19:11:14 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.02.27 19:11:14 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.02.27 19:11:14 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.27 19:11:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.27 19:11:13 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.02.27 19:11:13 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.02.27 19:11:13 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.02.27 19:11:13 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.02.27 19:11:13 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.02.27 19:11:13 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.02.27 19:11:13 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.02.27 19:11:13 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.02.27 19:11:13 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.02.27 19:11:12 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.02.27 19:11:12 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.02.27 19:11:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.02.27 19:11:12 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.02.19 19:01:34 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Passbild_Generator
[2013.02.19 19:01:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Passbild-Generator
[2013.02.19 19:01:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Passbild-Generator
[2013.02.19 18:32:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BFE07D40-40F7-43B5-9B6B-D93C37EF3EC3}
[2013.02.16 18:00:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco
[2013.02.16 17:25:41 | 000,112,080 | R--- | C] (Cisco Systems, Inc.) -- C:\Windows\SysNative\drivers\acsock64.sys
[2013.02.16 17:25:36 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Cisco
[2013.02.16 17:25:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2013.02.16 17:23:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Cisco
[2013.02.14 10:32:24 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.02.14 10:32:24 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.02.14 10:32:22 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.02.14 10:32:22 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.02.14 10:32:21 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.02.14 10:32:21 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.02.14 10:32:19 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.02.14 10:32:18 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.02.14 10:32:17 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.02.14 10:32:17 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.02.14 10:32:16 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.02.14 10:32:16 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.02.14 10:32:14 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.02.14 10:32:14 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.02.14 10:32:14 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.02.13 11:18:25 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.02.13 11:18:24 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.02.13 11:18:24 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.02.13 11:18:22 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.02.13 11:18:21 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.02.13 11:18:21 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.02.13 11:18:21 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.02.13 11:18:21 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.02.13 11:18:21 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.02.13 11:18:19 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.02.08 16:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.08 16:22:17 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.02.08 16:22:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.05 18:15:25 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.05 18:15:25 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.05 18:07:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.05 18:07:20 | 2030,981,119 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.05 17:59:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.05 17:32:07 | 000,000,850 | ---- | M] () -- C:\Users\XXX\Desktop\HitmanPro_20130305_1732.xml
[2013.03.05 16:58:50 | 000,001,921 | ---- | M] () -- C:\Users\Public\Desktop\HitmanPro.lnk
[2013.03.05 16:57:57 | 009,565,552 | ---- | M] (SurfRight B.V.) -- C:\Users\XXX\Desktop\HitmanPro_x64.exe
[2013.03.05 16:48:11 | 000,001,148 | ---- | M] () -- C:\Users\XXX\Desktop\Ausland - Verknüpfung.lnk
[2013.03.05 16:44:10 | 000,001,008 | ---- | M] () -- C:\Users\XXX\Desktop\Studium - Verknüpfung.lnk
[2013.03.05 15:38:09 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.03.05 15:38:09 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.03.05 15:33:10 | 000,452,128 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.03.04 21:57:30 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.03.04 21:57:29 | 000,861,088 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll
[2013.03.04 21:57:29 | 000,782,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.03.04 21:57:29 | 000,262,560 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.03.04 21:57:29 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.03.04 21:57:29 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.03.01 18:04:00 | 001,793,806 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.01 18:04:00 | 000,759,366 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.01 18:04:00 | 000,719,508 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.01 18:04:00 | 000,170,692 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.01 18:04:00 | 000,146,336 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.01 17:41:07 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.22 17:26:59 | 000,107,398 | ---- | M] () -- C:\Users\XXX\Desktop\Leistungsnachweis.pdf
[2013.02.16 17:59:16 | 000,000,375 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2013.02.16 17:28:15 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.05 17:32:07 | 000,000,850 | ---- | C] () -- C:\Users\XXX\Desktop\HitmanPro_20130305_1732.xml
[2013.03.05 16:58:50 | 000,001,921 | ---- | C] () -- C:\Users\Public\Desktop\HitmanPro.lnk
[2013.03.05 16:44:10 | 000,001,008 | ---- | C] () -- C:\Users\XXX\Desktop\Studium - Verknüpfung.lnk
[2013.03.05 15:41:57 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013.03.05 15:38:11 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.01 17:17:02 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.01 17:17:02 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.01 17:17:02 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.01 17:17:02 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.01 17:17:02 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.02.22 17:26:59 | 000,107,398 | ---- | C] () -- C:\Users\XXX\Desktop\Leistungsnachweis.pdf
[2013.02.16 17:27:12 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF
[2013.01.11 14:17:32 | 000,000,020 | ---- | C] () -- C:\Users\XXX\defogger_reenable
[2012.10.14 22:11:10 | 000,025,978 | ---- | C] () -- C:\Users\XXX\.TransferManager.db
[2012.10.07 21:11:29 | 000,000,001 | R--- | C] () -- C:\Users\XXX\serverport
[2012.05.30 13:31:27 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2012.05.30 13:30:39 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2012.01.01 17:46:49 | 000,000,069 | ---- | C] () -- C:\Windows\bpe.INI
[2012.01.01 17:28:03 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll
[2012.01.01 17:28:03 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2012.01.01 17:28:03 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2012.01.01 17:26:11 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2012.01.01 17:26:11 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.11.06 16:13:06 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011.09.29 14:22:26 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.09.25 09:31:37 | 001,821,424 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.31 11:11:46 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.05.31 11:11:45 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.05.31 11:11:44 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.05.31 11:11:43 | 013,359,616 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.05.31 11:11:43 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Brauchste das Extras Log auch??

markusg 05.03.2013 21:06
Hi,


otl fix

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
IE - HKCU\..\SearchScopes\{47F43F50-68E2-4F28-B949-26EE0EC9C505}: "URL" = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}category=deutschhow=andsearchtype=simpleWeb=onwiki_tab=onwiki_tab_old=+CHECKEDebay_tab=onebay_tab_old=+CHECKEDshoppingcom_tab=onshoppingcom_tab_old=+CHECKEDpirat_tab=onpirat_tab_old=+CHECKEDJavaScript=enabledsubmit=SUCHEN
FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.4
[2013.02.19 13:16:18 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi
[2013.02.19 13:16:21 | 000,005,545 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\webde-suche.xml
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O8:64bit: - Extra context menu item: An OneNote senden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft Excel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft Exel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote senden - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft Excel exportieren - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft Exel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home File
not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home
File not found
:files
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.

starte in den normalen modus.

freac 05.03.2013 21:34
Hi der PC läuft normal, vielleicht sogar ein bischen schneller....

hier das fixlog
Code:
All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{47F43F50-68E2-4F28-B949-26EE0EC9C505}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47F43F50-68E2-4F28-B949-26EE0EC9C505}\ not found.
Prefs.js: toolbar%40web.de:2.4 removed from extensions.enabledAddons
C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi moved successfully.
C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\webde-suche.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IntelTBRunOnce not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote senden\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Excel exportieren\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Exel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote senden\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Excel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Exel exportieren\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E029088-432F-4EBF-9537-0171A4C37870}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
File hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
File hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home not found.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: XXX
->Temp folder emptied: 6014329 bytes
->Temporary Internet Files folder emptied: 3318084 bytes
->Java cache emptied: 7064963 bytes
->FireFox cache emptied: 65188162 bytes
->Opera cache emptied: 188 bytes
->Flash cache emptied: 2386 bytes

markusg 06.03.2013 14:15
ist unvollständig.

test fehlt auch.

freac 06.03.2013 17:54
Da habe ich wohl nur die Hälfte kopiert.
Hier nochmal der ganze Log

Welchen Test meinst Du??

Code:
All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{47F43F50-68E2-4F28-B949-26EE0EC9C505}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47F43F50-68E2-4F28-B949-26EE0EC9C505}\ not found.
Prefs.js: toolbar%40web.de:2.4 removed from extensions.enabledAddons
C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\extensions\toolbar@web.de.xpi moved successfully.
C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\anyzy7tp.default\searchplugins\webde-suche.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IntelTBRunOnce not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote senden\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Excel exportieren\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Exel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote senden\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Excel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Exel exportieren\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E029088-432F-4EBF-9537-0171A4C37870}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
File hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E029088-432F-4EBF-9537-0171A4C37870}\ not found.
File hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=mainsite=home not found.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: XXX
->Temp folder emptied: 6014329 bytes
->Temporary Internet Files folder emptied: 3318084 bytes
->Java cache emptied: 7064963 bytes
->FireFox cache emptied: 65188162 bytes
->Opera cache emptied: 188 bytes
->Flash cache emptied: 2386 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1533399 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4409408 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 84,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 03052013_212214

Files\Folders moved on Reboot...
C:\Users\XXX\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\XXX\AppData\Local\Temp\MMDUtl.log moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

markusg 06.03.2013 18:09
steht eig unter der anweisung für den fix, du sollst testen wie der pc läuft etc,

freac 06.03.2013 18:34
Hab ich doch vor zwei Posts geschrieben. s.o.

PC läuft normal vielleicht ein bischen schneller.
Browser laufen problemlos.....
Oder meinse richtig ne Performance Software???

Hey Markus,

Gibt es noch etwas zu tun????

markusg 08.03.2013 17:23
Passt
öffne otl, bereinigen, pc startet neu, remover werden gelöscht.
Lösche übrig gebliebene, von uns genutzte Programme, setups, logs, leere den papierkorb
pc absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:56 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132