Trojaner-Board - wisptis.exe, csrss... (Prozesse doppelt, nicht deaktivierbar), schädlich?

Guten Tag,

Ich bin neu im Forum. Beim Durchgucken meiner laufenden Prozesse im Windows Taskmanager ist mir aufgefallen, dass einige Prozesse weder deaktivierbar sind, noch Befehlszeile, Benutzernamen oder Abbildpfadnamen besitzen.

wisptis.exe ist zweimal vorhanden. ePowerEvent.exe, winlogon.exe und csrss.exe sind ohne jede Beschreibung von Ort oder Zweck vorhanden.

Jetzt frag ich mich, ob es schädliche Prozesse sind.
-------------------------------------------------
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:52 on 11/04/2012 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-
-----------------------------------------------
Die DDS.txt soll man direkt posten, einmal unten den Zeilen.
Der andere (Attach ist im Anhang)

Danke schon mal im Vorraus.

.DDS Logfile:
Code:
DDS (Ver_2011-08-26.01) - NTFSAMD64 

Internet Explorer: 8.0.7601.17514

Run by *** at 10:54:36 on 2012-04-11

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3999.2620 [GMT 2:00]

.

AV: Computer Security *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}

SP: Computer Security *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Computer Security *Enabled* {2D7AC0A6-6241-D774-E168-461178D9686C}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\F-Secure\fshoster32.exe

C:\Program Files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe

C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\FSGK32.EXE

D:\Programme\Hamachi\hamachi-2.exe

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSMA32.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\fssm32.exe

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSHDLL64.EXE

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\FWES\Program\fsdfwd.exe

C:\Windows\system32\taskhost.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\Dwm.exe

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Launch Manager\LManager.EXE

C:\Program Files (x86)\F-Secure\fshoster32.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSM32.EXE

C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Spam Control\fsscoepl_x64.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.de/

mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1820pt&r=273605100516l0423z165t4573e328

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1820pt&r=273605100516l0423z165t4573e328

mWinlogon: Userinit=userinit.exe

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: QUICKfind BHO Object: {c08df07a-3e49-4e25-9ab0-d3882835f153} - D:\Programme\QUICKfind\PlugIns\IEHelp.dll

BHO: Browsing Protection Class: {c6867eb7-8350-4856-877f-93cf8ae3dc9c} - C:\Program Files (x86)\F-Secure\apps\OnlineSafety\BPP\iescript\BaseLitmus.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - D:\Programme\Java\bin\jp2ssv.dll

TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - C:\Program Files (x86)\F-Secure\apps\OnlineSafety\BPP\iescript\BaseLitmus.dll

{555d4d79-4bd2-4094-a395-cfc534424a05}

uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

mRun: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [F-Secure Hoster] "C:\Program Files (x86)\F-Secure\fshoster32.exe" -app -hosterid:1

mRun: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSM32.EXE" /splash

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - D:\OFFICE~1\Office12\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - D:\PROGRA~1\OFFICE~1\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - D:\PROGRA~1\OFFICE~1\Office12\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{33430AA6-EE3A-4B13-BDD0-A343AEC49345} : DhcpNameServer = 139.7.30.126 139.7.30.125

TCP: Interfaces\{4A293B8E-2082-4902-975B-5A7302AAB24D} : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1} : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\145545F4742594C4C4 : DhcpNameServer = 192.168.208.254

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\64259445A51224F6870264F6E60275C414E40273035303 : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\7737F6 : DhcpNameServer = 192.168.123.1

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\C4F6269726964737 : DhcpNameServer = 195.50.140.116 195.50.140.180

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\D497E45647 : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{9787C18B-A169-4AF5-A31F-DDFF006ECEF1}\E45657660275966496 : DhcpNameServer = 84.103.237.141 86.64.145.141

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{C08DF07A-3E49-4E25-9AB0-D3882835F153}

{C6867EB7-8350-4856-877F-93CF8AE3DC9C}

{DBC80044-A445-435b-BC74-9C25C1C588A9}

{265EEE8E-3228-44D3-AEA5-F7FDF5860049}

EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File

mRun-x64: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"

mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun-x64: [F-Secure Hoster] "C:\Program Files (x86)\F-Secure\fshoster32.exe" -app -hosterid:1

mRun-x64: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSM32.EXE" /splash

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\cxgae4ay.default\

FF - prefs.js: browser.startup.homepage - goggle.de

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

FF - plugin: D:\Programme\Adobe Reader\Reader\AIR\nppdf32.dll

FF - plugin: D:\Programme\Adobe Reader\Reader\browser\nppdf32.dll

.

============= SERVICES / DRIVERS ===============

.

R1 F-Secure HIPS;F-Secure HIPS Driver;C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys [2012-3-12 61976]

R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys --> C:\Windows\system32\drivers\fses.sys [?]

R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys --> C:\Windows\system32\drivers\fsdfw.sys [?]

R1 fsvista;F-Secure Vista Support Driver;C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [2011-11-26 13976]

R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]

R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]

R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]

R1 VWiFiFlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-1-12 844320]

R2 fshoster;F-Secure Dll Hoster;C:\Program Files (x86)\F-Secure\fshoster32.exe [2011-12-14 160424]

R2 FSORSPClient;F-Secure ORSP Client;C:\Program Files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe [2011-12-12 61120]

R2 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-8-28 1150496]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;D:\Programme\Hamachi\hamachi-2.exe -s --> D:\Programme\Hamachi\hamachi-2.exe -s [?]

R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe [2009-9-10 305448]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-9-25 62720]

R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-1-12 240160]

R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [2011-11-26 198808]

R3 fsccsys1331654251;F-Secure Content Control Driver;\??\C:\Windows\System32\drivers\fsccsys.sys --> C:\Windows\System32\drivers\fsccsys.sys [?]

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]

R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys --> C:\Windows\system32\DRIVERS\NETw5s64.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;D:\Programme\Skype\Updater\Updater.exe [2012-2-29 158856]

S3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS --> C:\Windows\system32\drivers\AmUStor.SYS [?]

S3 btusbflt;Bluetooth USB Filter;C:\Windows\system32\drivers\btusbflt.sys --> C:\Windows\system32\drivers\btusbflt.sys [?]

S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]

S3 ewusbnet;HUAWEI USB-NDIS miniport;C:\Windows\system32\DRIVERS\ewusbnet.sys --> C:\Windows\system32\DRIVERS\ewusbnet.sys [?]

S3 hwusbfake;Huawei DataCard USB Fake;C:\Windows\system32\DRIVERS\ewusbfake.sys --> C:\Windows\system32\DRIVERS\ewusbfake.sys [?]

S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

S3 S6000KNT;S6000KNT_WebCam Driver;C:\Windows\system32\Drivers\S6000KNT.sys --> C:\Windows\system32\Drivers\S6000KNT.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]

S4 F-Secure Gatekeeper Handler Starter;FSGKHS;C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\fsgk32st.exe [2011-11-26 221864]

.

=============== Created Last 30 ================

.

2012-04-10 15:46:50        8669240        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3A0FFED3-C30D-4762-99CE-306B62B0BA99}\mpengine.dll

2012-04-09 12:35:22        --------        d-----w-        C:\Users\***\AppData\Roaming\.minecraft

2012-04-08 15:15:15        --------        d-----w-        C:\Users\***\.thumbnails

2012-03-28 21:14:01        --------        d-----w-        C:\Users\***\AppData\Local\{7726AD8A-0636-4CA1-A61D-C0AACE9F327B}

2012-03-26 19:30:43        5559152        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2012-03-26 19:30:42        3968368        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2012-03-26 19:30:41        3913584        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2012-03-26 18:16:51        3145728        ----a-w-        C:\Windows\System32\win32k.sys

2012-03-26 18:16:45        1544192        ----a-w-        C:\Windows\System32\DWrite.dll

2012-03-26 18:16:44        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll

2012-03-26 18:16:20        9216        ----a-w-        C:\Windows\System32\rdrmemptylst.exe

2012-03-26 18:16:20        77312        ----a-w-        C:\Windows\System32\rdpwsx.dll

2012-03-26 18:16:20        149504        ----a-w-        C:\Windows\System32\rdpcorekmts.dll

2012-03-26 18:16:05        1031680        ----a-w-        C:\Windows\System32\rdpcore.dll

2012-03-26 18:16:04        826880        ----a-w-        C:\Windows\SysWow64\rdpcore.dll

2012-03-26 18:16:04        23552        ----a-w-        C:\Windows\System32\drivers\tdtcp.sys

2012-03-26 18:16:04        210944        ----a-w-        C:\Windows\System32\drivers\rdpwd.sys

.

==================== Find3M  ====================

.

2012-02-23 10:39:29        414368        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-23 07:18:36        279656        ------w-        C:\Windows\System32\MpSigStub.exe

.

============= FINISH: 10:56:25,88 ===============
--- --- ---