Trojaner-Board - failed save system 32, hilfe :(

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - failed save system 32, hilfe :( (https://www.trojaner-board.de/108513-failed-save-system-32-hilfe.html)

failed save system 32, hilfe :(

Hallo,

ich habe Windows 7 und seit ein paar Tagen einen schwarzen Bildschirm und es kommt immer die Fehlermeldung failed save 32 System, außerdem ist ein Fenster System Check offen und ich kann Task Manager nicht aufmachen.

Da ich absolut keine Ahnung von Computern hab, bitte alles verständlich zu erklären :/
Danke im Voraus.

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Code:

ESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=e88c0aa566127647a0828df28f328372

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-25 01:22:18

# local_time=2012-01-25 02:22:18 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=1792 16777215 100 0 87447 87447 0 0

# compatibility_mode=3588 16777214 85 79 1417697 31342048 0 0

# compatibility_mode=5893 16776573 100 94 34839 79079092 0 0

# compatibility_mode=8192 67108863 100 0 3826 3826 0 0

# scanned=174001

# found=10

# cleaned=0

# scan_time=5296

C:\ProgramData\2Mhk1BXXOm5qGF.exe        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\FpNsnrTURn.exe        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\2Mhk1BXXOm5qGF.exe        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\FpNsnrTURn.exe        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\mary\AppData\Local\Temp\dUqeFs2Mhk1BXX.exe.tmp        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\mary\AppData\Local\Temp\vTMHYQxt79YIph.exe.tmp        a variant of Win32/Kryptik.ZGE trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\mary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\58ce481b-38bb348a        a variant of Java/TrojanDownloader.Agent.ME trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\mary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\816f23d-1efe718a        Java/TrojanDownloader.OpenStream.NCO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\mary\Downloads\SoftonicDownloader_fuer_firefox.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I

${Memory}        multiple threats        00000000000000000000000000000000        I

Du solltest eigentlich erst den Vollscan mit Malwarebytes machen...

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.25.03
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

mary :: MARY-HP [Administrator]
 

Schutz: Aktiviert
 

25.01.2012 16:25:33

mbam-log-2012-01-25 (16-25-33).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 177424

Laufzeit: 5 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 2

C:\ProgramData\FpNsnrTURn.exe (Rogue.FakeHDD) -> 4068 -> Löschen bei Neustart.

C:\ProgramData\2Mhk1BXXOm5qGF.exe (Rogue.FakeAlert) -> 2220 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|FpNsnrTURn.exe (Rogue.FakeHDD) -> Daten: C:\ProgramData\FpNsnrTURn.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 5

C:\ProgramData\FpNsnrTURn.exe (Rogue.FakeHDD) -> Löschen bei Neustart.

C:\ProgramData\2Mhk1BXXOm5qGF.exe (Rogue.FakeAlert) -> Löschen bei Neustart.

C:\Users\mary\AppData\Local\Temp\dUqeFs2Mhk1BXX.exe.tmp (Rogue.FakeHDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\mary\AppData\Local\Temp\vTMHYQxt79YIph.exe.tmp (Rogue.FakeHDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\mary\Downloads\SoftonicDownloader_fuer_firefox.exe (PUP.BundleOffer.Downloader.S) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.25.03
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

mary :: MARY-HP [Administrator]
 

Schutz: Aktiviert
 

25.01.2012 16:39:15

mbam-log-2012-01-25 (16-39-15).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 342543

Laufzeit: 1 Stunde(n), 13 Minute(n), 55 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.25.03
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

mary :: MARY-HP [Administrator]
 

Schutz: Aktiviert
 

25.01.2012 16:39:15

mbam-log-2012-01-25 (16-39-15).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 342543

Laufzeit: 1 Stunde(n), 13 Minute(n), 55 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

2012/01/25 16:24:52 +0100        MARY-HP        mary        MESSAGE        Starting protection

2012/01/25 16:24:54 +0100        MARY-HP        mary        MESSAGE        Protection started successfully

2012/01/25 16:24:57 +0100        MARY-HP        mary        MESSAGE        Starting IP protection

2012/01/25 16:24:59 +0100        MARY-HP        mary        MESSAGE        IP Protection started successfully

2012/01/25 16:32:06 +0100        MARY-HP        mary        MESSAGE        Executing scheduled update:  Daily

2012/01/25 16:32:07 +0100        MARY-HP        mary        MESSAGE        Database already up-to-date

2012/01/25 16:35:00 +0100        MARY-HP        mary        MESSAGE        Starting protection

2012/01/25 16:35:03 +0100        MARY-HP        mary        MESSAGE        Protection started successfully

2012/01/25 16:35:06 +0100        MARY-HP        mary        MESSAGE        Starting IP protection

2012/01/25 16:35:09 +0100        MARY-HP        mary        MESSAGE        IP Protection started successfully

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 21.01.2012 03:57:43 - Run 3

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\mary

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,90 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 53,59% Memory free

7,80 Gb Paging File | 5,90 Gb Available in Paging File | 75,57% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 448,47 Gb Total Space | 399,26 Gb Free Space | 89,03% Space Free | Partition Type: NTFS

Drive F: | 1,99 Gb Total Space | 1,98 Gb Free Space | 99,77% Space Free | Partition Type: FAT32

 

Computer Name: MARY-HP | User Name: mary | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.21 03:28:22 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\mary\OTL.exe

PRC - [2012.01.21 01:11:27 | 000,360,704 | -H-- | M] () -- C:\ProgramData\2Mhk1BXXOm5qGF.exe

PRC - [2012.01.21 01:08:38 | 000,457,984 | -H-- | M] () -- C:\ProgramData\FpNsnrTURn.exe

PRC - [2011.09.10 15:08:17 | 000,347,008 | -H-- | M] (EasyBits Software AS) -- C:\ProgramData\GameXN\GameXNGO.exe

PRC - [2011.04.17 01:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

PRC - [2010.07.13 00:47:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

PRC - [2010.07.06 15:01:16 | 002,634,048 | ---- | M] (Veoh Networks) -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

PRC - [2010.04.10 00:54:38 | 001,441,544 | ---- | M] (Motorola, Inc.) -- C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe

PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

PRC - [2010.03.01 19:27:22 | 000,264,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe

PRC - [2010.01.12 21:27:38 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe

PRC - [2008.11.09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.01.21 01:11:27 | 000,360,704 | -H-- | M] () -- C:\ProgramData\2Mhk1BXXOm5qGF.exe

MOD - [2012.01.21 01:08:38 | 000,457,984 | -H-- | M] () -- C:\ProgramData\FpNsnrTURn.exe

MOD - [2012.01.11 10:58:39 | 011,824,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\b8ee7bf7d7ac34623238f731b05395a2\System.Web.ni.dll

MOD - [2012.01.11 10:58:31 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\442eed762e21796e8e497fcd14f1295a\System.Runtime.Remoting.ni.dll

MOD - [2011.10.15 18:31:18 | 000,452,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\cf95add46bfba066f035bd78f6e21d86\IAStorUtil.ni.dll

MOD - [2011.10.14 14:05:46 | 012,431,360 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll

MOD - [2011.10.14 14:05:36 | 001,586,688 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll

MOD - [2011.10.14 14:05:21 | 003,325,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\3136e12cfb8809d39813e76c766c782c\WindowsBase.ni.dll

MOD - [2011.10.14 14:05:13 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll

MOD - [2011.10.14 14:05:09 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll

MOD - [2011.10.14 14:05:08 | 007,949,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll

MOD - [2011.10.14 14:04:57 | 011,490,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll

MOD - [2010.12.10 04:40:53 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010.12.10 04:40:49 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll

MOD - [2010.11.17 12:16:56 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2010.06.28 13:21:42 | 009,905,152 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtWebKit4.dll

MOD - [2010.06.28 13:21:42 | 007,793,152 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtGui4.dll

MOD - [2010.06.28 13:21:42 | 002,530,304 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtXmlPatterns4.dll

MOD - [2010.06.28 13:21:42 | 002,094,592 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtCore4.dll

MOD - [2010.06.28 13:21:42 | 001,116,160 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtScript4.dll

MOD - [2010.06.28 13:21:42 | 000,915,456 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtNetwork4.dll

MOD - [2010.06.28 13:21:42 | 000,232,960 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\phonon4.dll

MOD - [2010.06.28 13:21:42 | 000,120,320 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll

MOD - [2010.06.28 13:21:42 | 000,022,016 | ---- | M] () -- C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\imageformats\qgif4.dll

MOD - [2010.01.22 19:30:00 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll

MOD - [2010.01.22 19:29:58 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll

MOD - [2010.01.22 19:29:58 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.03.30 10:45:40 | 001,028,096 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)

SRV:64bit: - [2010.06.29 19:52:12 | 004,181,256 | ---- | M] (Motorola, Inc.) [On_Demand | Running] -- C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe -- (Bluetooth Device Manager)

SRV:64bit: - [2010.05.20 21:28:14 | 000,677,128 | ---- | M] (Motorola, Inc.) [Auto | Running] -- C:\Program Files\Motorola\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)

SRV:64bit: - [2010.05.20 21:28:12 | 001,096,968 | ---- | M] (Motorola, Inc.) [On_Demand | Running] -- C:\Program Files\Motorola\Bluetooth\audiosrv.exe -- (Bluetooth Media Service)

SRV:64bit: - [2010.01.29 05:15:24 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_21dba265e7e67cda\stacsv64.exe -- (STacSV)

SRV:64bit: - [2009.11.02 21:11:52 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)

SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV:64bit: - [2009.03.03 11:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_21dba265e7e67cda\AESTSr64.exe -- (AESTFilters)

SRV - [2011.04.17 01:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)

SRV - [2011.03.30 10:45:40 | 000,647,680 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.02.05 17:20:54 | 000,119,688 | ---- | M] (SecureW2 B.V.) [Auto | Running] -- C:\Program Files (x86)\SecureW2\sw2_service.exe -- (SW2SVC)

SRV - [2010.07.13 00:47:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2010.05.03 21:48:04 | 002,782,552 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)

SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010.03.01 19:27:22 | 000,264,248 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe -- (hpHotkeyMonitor)

SRV - [2010.01.12 21:27:38 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.11.09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011.07.08 16:45:12 | 000,386,168 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys -- (SymNetS)

DRV:64bit: - [2011.05.11 19:40:39 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)

DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011.03.31 04:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys -- (SRTSP)

DRV:64bit: - [2011.03.31 04:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)

DRV:64bit: - [2011.03.15 03:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys -- (SymEFA)

DRV:64bit: - [2011.03.11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.01.27 07:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys -- (SymDS)

DRV:64bit: - [2011.01.27 06:07:06 | 000,171,128 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys -- (SymIRON)

DRV:64bit: - [2010.07.08 23:45:22 | 003,232,768 | ---- | M] (Motorola, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmusb.sys -- (BTMUSB)

DRV:64bit: - [2010.06.29 17:01:38 | 000,931,168 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)

DRV:64bit: - [2010.05.21 03:06:38 | 000,096,384 | ---- | M] (Realtek Semiconductor Corp.) [2 MP Fixed] [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvc.sys -- (rtsuvc)

DRV:64bit: - [2010.05.03 23:44:02 | 000,331,880 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010.04.10 00:53:04 | 000,052,736 | ---- | M] (Motorola, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmcom.sys -- (BTMCOM)

DRV:64bit: - [2010.03.19 12:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2010.03.15 04:45:26 | 000,145,408 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)

DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010.02.16 21:24:20 | 000,025,912 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV:64bit: - [2010.01.29 05:15:24 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2010.01.25 14:51:02 | 007,842,272 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2010.01.22 19:26:50 | 000,305,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.11.02 21:12:00 | 001,209,856 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 00:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2009.07.14 00:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV - [2010.08.13 10:00:00 | 001,791,536 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS -- (NAVEX15)

DRV - [2010.08.13 10:00:00 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)

DRV - [2010.08.13 10:00:00 | 000,132,656 | -H-- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2010.08.13 10:00:00 | 000,117,808 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS -- (NAVENG)

DRV - [2010.08.09 04:11:49 | 000,945,200 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys -- (BHDrvx64)

DRV - [2010.06.27 05:05:05 | 000,463,408 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys -- (IDSVia64)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)

IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

IE - HKCU\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 67.207.128.249:3128

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "WEB.DE Suche"

FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "WEB.DE Suche"

FF - prefs.js..browser.search.order.2: "amazon.de"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://go.web.de/br/ff3_startpage"

FF - prefs.js..extensions.enabledItems: allglassv2@ambroos.neowin.net:2.1.4

FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5

FF - prefs.js..extensions.enabledItems: {a82d0125-000a-4a57-abbc-5d4b0dbaab54}:2.0

FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.2

FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.2.0

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.9.0.3

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.7

FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2011.7.4.3

FF - prefs.js..keyword.URL: "hxxp://wa.ui-portal.de/webde/webde/s?produkte.browser.link.searchlink&s_brand=webde&t_link=searchlink&ns_type=clickin&ns_url=hxxp://suche.web.de/search/web/?origin=br_urlbar_ff&su="

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\Firefox [2010.12.10 05:07:24 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.12.10 05:07:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010.12.10 05:07:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011.09.28 10:28:17 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_4_3 [2012.01.21 03:03:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.19 11:18:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.19 11:18:04 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Program Files (x86)\PriceGong\2.2.0\FF [2011.04.30 03:28:55 | 000,000,000 | ---D | M]

 

[2011.11.24 18:06:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mary\AppData\Roaming\mozilla\Extensions

[2012.01.20 18:34:30 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (Update Notifier) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] (WEB.DE Firefox Addon) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] ("All-Glass Firefox mod, based on Glasser") -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\allglassv2@ambroos.neowin.net

[2011.11.24 18:06:49 | 000,001,371 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\amazonde.xml

[2011.11.28 16:12:22 | 000,000,931 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\conduit.xml

[2011.11.25 22:08:17 | 000,001,420 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\preisvergleich.xml

[2011.11.24 18:06:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.11.24 18:06:08 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2011.11.24 18:06:07 | 000,000,000 | ---D | M] (WEB.DE Firefox Addon) -- C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2011.04.30 03:28:55 | 000,000,000 | ---D | M] (PriceGong) -- C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF

[2012.01.21 03:03:57 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3

[2011.09.28 10:28:17 | 000,000,000 | ---D | M] (Symantec IPS) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN

[2011.12.03 17:13:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.12.03 17:13:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.12.03 17:13:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.12.03 17:13:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.12.03 17:13:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Conduit (Enabled)

CHR - default_search_provider: search_url = hxxp://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=CT2269050

CHR - default_search_provider: suggest_url = hxxp://search.conduit.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll

CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll

CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: DVDVideoSoftTB = C:\Users\mary\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\2.3.3.3_0\

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (PriceGong Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.2.0\PriceGongIE.dll (PriceGong)

O2 - BHO: (Fast Search by Surf Canyon) - {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll (Surf Canyon Incorporated)

O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL (Symantec Corporation)

O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)

O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [WEB.DE Update] C:\Program Files (x86)\WEB.DE\LiveUpdate\m2LUTray.exe (mquadr.at software engineering und consulting GmbH)

O4 - HKCU..\Run: [FpNsnrTURn.exe] C:\ProgramData\FpNsnrTURn.exe ()

O4 - HKCU..\Run: [GameXN] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [GameXN (news)] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [GameXN (update)] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [VeohPlugin] C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)

O4 - Startup: C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\mary\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10B3E137-B082-4A3C-ABFA-FC9E5A59AC25}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B05A5FB4-3A2A-43C0-A73B-434729217352}: DhcpNameServer = 192.168.1.254

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.21 03:28:16 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\mary\OTL.exe

[2012.01.21 01:11:34 | 000,000,000 | -H-D | C] -- C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

[2012.01.12 12:41:29 | 001,446,912 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\lsasrv.dll

[2012.01.12 12:41:28 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\webio.dll

[2012.01.12 12:41:28 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\webio.dll

[2012.01.12 12:41:28 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\sspicli.dll

[2012.01.12 12:41:28 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\sspisrv.dll

[2012.01.12 12:41:28 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\secur32.dll

[2012.01.11 17:04:14 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\quartz.dll

[2012.01.11 17:04:14 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\quartz.dll

[2012.01.11 17:04:14 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\qdvd.dll

[2012.01.11 17:04:13 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll

[2012.01.11 17:04:13 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\qdvd.dll

[2012.01.11 17:04:12 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll

[2012.01.11 17:04:11 | 001,739,160 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ntdll.dll

[2012.01.11 17:04:10 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\packager.dll

[2012.01.11 17:04:10 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\packager.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2034.07.30 04:02:38 | 001,144,100 | -H-- | M] () -- C:\Users\mary\Desktop\100_2634.JPG

[2012.01.21 03:28:22 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\mary\OTL.exe

[2012.01.21 03:23:01 | 000,019,760 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.21 03:23:01 | 000,019,760 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.6b

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.6a

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.69

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.68

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.67

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.66

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.65

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.64

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.63

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.62

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.61

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.60

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5v

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5u

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5t

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5s

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5r

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5q

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5p

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5o

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5n

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5m

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5l

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5k

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5j

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5i

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5h

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5g

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5f

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5e

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5d

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5c

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5b

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.5a

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.59

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.58

[2012.01.21 03:04:49 | 000,000,000 | -H-- | M] () -- C:\t2i8.57

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.56

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.55

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.54

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.53

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.52

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.51

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.50

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.4a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.49

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.48

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.47

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.46

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.45

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.44

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.43

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.42

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.41

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.40

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.3a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.39

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.38

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.37

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.36

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.35

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.34

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.33

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.32

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.31

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.30

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.2a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.29

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.28

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.27

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.26

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.25

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.24

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.23

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.22

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.21

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.20

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.1a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.19

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.18

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.17

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.16

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.15

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.14

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.13

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.12

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.11

[2012.01.21 03:04:48 | 000,000,000 | -H-- | M] () -- C:\t2i8.10

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.b

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.a

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.9

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.8

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.7

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.6

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.5

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.4

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.3

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.2

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8.1

[2012.01.21 03:04:47 | 000,000,000 | -H-- | M] () -- C:\t2i8

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.9

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.8

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.7

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.6

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.5

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.4

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.39

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.38

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.37

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.36

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.35

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.34

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.33

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.32

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.31

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.30

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.3

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.29

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.28

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.27

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.26

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.25

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.24

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.23

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.22

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.21

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.20

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.2

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.19

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.18

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.17

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.16

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.15

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.14

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.13

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.12

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.11

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.10

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4.1

[2012.01.21 03:04:27 | 000,000,000 | -H-- | M] () -- C:\tv4

[2012.01.21 03:03:49 | 000,000,408 | ---- | M] () -- C:\windows\tasks\Final Media Player Update Checker.job

[2012.01.21 03:03:39 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2012.01.21 03:03:22 | 4190,388,224 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.21 02:22:59 | 001,498,506 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

[2012.01.21 02:22:59 | 000,654,166 | ---- | M] () -- C:\windows\SysNative\perfh007.dat

[2012.01.21 02:22:59 | 000,616,008 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

[2012.01.21 02:22:59 | 000,130,006 | ---- | M] () -- C:\windows\SysNative\perfc007.dat

[2012.01.21 02:22:59 | 000,106,388 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

[2012.01.21 01:13:52 | 000,000,440 | -H-- | M] () -- C:\ProgramData\2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,653 | -H-- | M] () -- C:\Users\mary\Desktop\System Check.lnk

[2012.01.21 01:11:35 | 000,000,296 | -H-- | M] () -- C:\ProgramData\~2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~2Mhk1BXXOm5qGFr

[2012.01.21 01:11:27 | 000,360,704 | -H-- | M] () -- C:\ProgramData\2Mhk1BXXOm5qGF.exe

[2012.01.21 01:08:38 | 000,457,984 | -H-- | M] () -- C:\ProgramData\FpNsnrTURn.exe

[2012.01.19 23:02:18 | 000,024,604 | -H-- | M] () -- C:\Users\mary\Desktop\presentation research methodes.odt

[2012.01.19 20:04:07 | 000,021,643 | -H-- | M] () -- C:\Users\mary\Desktop\Unbenannt 1.odt

[2012.01.18 17:58:03 | 000,016,249 | -H-- | M] () -- C:\Users\mary\Desktop\Research_proposal Marianna & Johannes.odt

[2012.01.18 14:36:23 | 455,606,273 | ---- | M] () -- C:\windows\MEMORY.DMP

[2012.01.17 22:02:28 | 000,073,337 | -H-- | M] () -- C:\Users\mary\Desktop\Final potato for vld with pages 15 and 16.ods

 
 ========== Files Created - No Company Name ==========

 

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.6b

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.6a

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.69

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.68

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.67

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.66

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.65

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.64

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.63

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.62

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.61

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.60

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5v

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5u

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5t

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5s

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5r

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5q

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5p

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5o

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5n

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5m

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5l

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5k

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5j

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5i

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5h

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5g

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5f

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5e

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5d

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5c

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5b

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.5a

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.59

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.58

[2012.01.21 03:04:49 | 000,000,000 | -H-- | C] () -- C:\t2i8.57

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.56

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.55

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.54

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.53

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.52

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.51

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.50

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.4a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.49

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.48

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.47

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.46

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.45

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.44

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.43

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.42

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.41

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.40

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.3a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.39

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.38

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.37

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.36

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.35

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.34

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.33

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.32

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.31

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.30

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.2a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.29

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.28

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.27

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.26

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.25

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.24

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.23

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.22

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.21

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.20

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1v

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1u

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1t

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1s

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1r

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1q

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1p

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1o

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1n

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1m

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1l

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1k

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1j

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1i

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1h

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1g

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1f

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1e

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1d

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1c

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1b

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.1a

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.19

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.18

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.17

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.16

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.15

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.14

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.13

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.12

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.11

[2012.01.21 03:04:48 | 000,000,000 | -H-- | C] () -- C:\t2i8.10

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.b

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.a

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.9

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.8

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.7

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.6

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.5

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.4

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.3

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.2

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8.1

[2012.01.21 03:04:47 | 000,000,000 | -H-- | C] () -- C:\t2i8

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.9

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.8

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.7

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.6

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.5

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.4

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.39

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.38

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.37

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.36

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.35

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.34

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.33

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.32

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.31

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.30

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.3

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.29

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.28

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.27

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.26

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.25

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.24

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.23

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.22

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.21

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.20

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.2

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1v

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1u

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1t

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1s

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1r

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1q

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1p

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1o

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1n

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1m

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1l

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1k

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1j

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1i

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1h

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1g

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1f

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1e

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1d

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1c

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1b

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1a

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.19

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.18

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.17

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.16

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.15

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.14

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.13

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.12

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.11

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.10

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4.1

[2012.01.21 03:04:27 | 000,000,000 | -H-- | C] () -- C:\tv4

[2012.01.21 01:11:35 | 000,000,296 | -H-- | C] () -- C:\ProgramData\~2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~2Mhk1BXXOm5qGFr

[2012.01.21 01:11:34 | 000,000,653 | -H-- | C] () -- C:\Users\mary\Desktop\System Check.lnk

[2012.01.21 01:11:32 | 000,000,440 | -H-- | C] () -- C:\ProgramData\2Mhk1BXXOm5qGF

[2012.01.21 01:11:27 | 000,360,704 | -H-- | C] () -- C:\ProgramData\2Mhk1BXXOm5qGF.exe

[2012.01.21 01:08:39 | 000,457,984 | -H-- | C] () -- C:\ProgramData\FpNsnrTURn.exe

[2012.01.18 17:58:01 | 000,016,249 | -H-- | C] () -- C:\Users\mary\Desktop\Research_proposal Marianna & Johannes.odt

[2012.01.18 17:57:48 | 000,024,604 | -H-- | C] () -- C:\Users\mary\Desktop\presentation research methodes.odt

[2012.01.18 14:36:23 | 455,606,273 | ---- | C] () -- C:\windows\MEMORY.DMP

[2012.01.17 22:02:23 | 000,073,337 | -H-- | C] () -- C:\Users\mary\Desktop\Final potato for vld with pages 15 and 16.ods

[2012.01.16 20:48:58 | 000,021,643 | -H-- | C] () -- C:\Users\mary\Desktop\Unbenannt 1.odt

[2011.05.15 12:14:41 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.04.29 12:10:30 | 000,000,088 | RHS- | C] () -- C:\ProgramData\916F6A88B8.sys

[2011.04.29 12:09:59 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011.03.30 10:50:07 | 000,014,051 | ---- | C] () -- C:\windows\SysWow64\RaCoInst.dat

[2010.01.25 14:48:56 | 000,982,224 | ---- | C] () -- C:\windows\SysWow64\igkrng500.bin

[2010.01.25 14:48:56 | 000,439,336 | ---- | C] () -- C:\windows\SysWow64\igcompkrng500.bin

[2010.01.25 14:48:56 | 000,092,292 | ---- | C] () -- C:\windows\SysWow64\igfcg500m.bin

[2010.01.25 13:43:18 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll

[2010.01.25 13:43:18 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\windows\SysWow64\igfcg500.bin

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat
 

< End of report >

Ich weiß zwar nicht was du gemacht hast, es war aber kein CustomScan. Bitte einfach mal die Anleitung lesen und umsetzen

hallo Arne,

erstmals danke dass du mir hilfst, aber ich bin auf OTL gegangen, hab den Text reinkopiert, minimal Ausgabe gewählt und dann auf quick scan und dass kam dann raus

:)

Das Log entspricht aber keinem CustomScan. Wiederhol das

Code:

OTL logfile created on: 25.01.2012 20:56:28 - Run 8

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\mary\Downloads

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,90 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 58,27% Memory free

7,80 Gb Paging File | 5,98 Gb Available in Paging File | 76,59% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 448,47 Gb Total Space | 399,38 Gb Free Space | 89,05% Space Free | Partition Type: NTFS

Drive F: | 1,99 Gb Total Space | 1,98 Gb Free Space | 99,77% Space Free | Partition Type: FAT32

 

Computer Name: MARY-HP | User Name: mary | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\mary\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation)

PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)

PRC - C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe (Motorola, Inc.)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe (Hewlett-Packard Company)

PRC - C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)

PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\442eed762e21796e8e497fcd14f1295a\System.Runtime.Remoting.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\cf95add46bfba066f035bd78f6e21d86\IAStorUtil.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\3136e12cfb8809d39813e76c766c782c\WindowsBase.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()

MOD - C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Macrovision Europe Ltd.)

SRV:64bit: - (Bluetooth Device Manager) -- C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe (Motorola, Inc.)

SRV:64bit: - (Bluetooth OBEX Service) -- C:\Program Files\Motorola\Bluetooth\obexsrv.exe (Motorola, Inc.)

SRV:64bit: - (Bluetooth Media Service) -- C:\Program Files\Motorola\Bluetooth\audiosrv.exe (Motorola, Inc.)

SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_21dba265e7e67cda\stacsv64.exe (IDT, Inc.)

SRV:64bit: - (AgereModemAudio) -- C:\Program Files\LSI SoftModem\agr64svc.exe (LSI Corporation)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_21dba265e7e67cda\AESTSr64.exe (Andrea Electronics Corporation)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (SW2SVC) -- C:\Program Files (x86)\SecureW2\sw2_service.exe (SecureW2 B.V.)

SRV - (HPDrvMntSvc.exe) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)

SRV - (NOBU) -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (hpHotkeyMonitor) -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe (Hewlett-Packard Company)

SRV - (pdfcDispatcher) -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (YahooAUService) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys (Symantec Corporation)

DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys (Symantec Corporation)

DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys (Symantec Corporation)

DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys (Symantec Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys (Symantec Corporation)

DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys (Symantec Corporation)

DRV:64bit: - (BTMUSB) -- C:\Windows\SysNative\drivers\btmusb.sys (Motorola, Inc.)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (rtsuvc) -- C:\Windows\SysNative\drivers\rtsuvc.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (BTMCOM) -- C:\Windows\SysNative\drivers\btmcom.sys (Motorola, Inc.)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (IntcHdmiAddService) Intel(R) -- C:\Windows\SysNative\drivers\IntcHdmi.sys (Intel(R) Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Company)

DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)

DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS (Symantec Corporation)

DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)

DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)

DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS (Symantec Corporation)

DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys (Symantec Corporation)

DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys (Symantec Corporation)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10

IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)

IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

IE - HKCU\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 67.207.128.249:3128

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "WEB.DE Suche"

FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "WEB.DE Suche"

FF - prefs.js..browser.search.order.2: "amazon.de"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://go.web.de/br/ff3_startpage"

FF - prefs.js..extensions.enabledItems: allglassv2@ambroos.neowin.net:2.1.4

FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5

FF - prefs.js..extensions.enabledItems: {a82d0125-000a-4a57-abbc-5d4b0dbaab54}:2.0

FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.2

FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.2.0

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.9.0.3

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.7

FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2011.7.4.3

FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.8.0.8855

FF - prefs.js..keyword.URL: "hxxp://wa.ui-portal.de/webde/webde/s?produkte.browser.link.searchlink&s_brand=webde&t_link=searchlink&ns_type=clickin&ns_url=hxxp://suche.web.de/search/web/?origin=br_urlbar_ff&su="

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\Firefox [2010.12.10 05:07:24 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.12.10 05:07:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010.12.10 05:07:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011.09.28 10:28:17 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_4_3 [2012.01.25 16:34:13 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.19 11:18:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.19 11:18:04 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Program Files (x86)\PriceGong\2.2.0\FF [2011.04.30 03:28:55 | 000,000,000 | ---D | M]

 

[2011.11.24 18:06:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mary\AppData\Roaming\mozilla\Extensions

[2012.01.25 20:34:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (Update Notifier) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] (WEB.DE Firefox Addon) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] ("All-Glass Firefox mod, based on Glasser") -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\allglassv2@ambroos.neowin.net

[2011.11.24 18:06:49 | 000,001,371 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\amazonde.xml

[2011.11.28 16:12:22 | 000,000,931 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\conduit.xml

[2011.11.25 22:08:17 | 000,001,420 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\preisvergleich.xml

[2012.01.25 17:04:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.01.25 17:13:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.11.24 18:06:08 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2011.11.24 18:06:07 | 000,000,000 | ---D | M] (WEB.DE Firefox Addon) -- C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2011.04.30 03:28:55 | 000,000,000 | ---D | M] (PriceGong) -- C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF

[2012.01.25 16:34:13 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3

[2011.09.28 10:28:17 | 000,000,000 | ---D | M] (Symantec IPS) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN

[2011.12.03 17:13:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.12.03 17:13:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.12.03 17:13:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.12.03 17:13:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.12.03 17:13:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Conduit (Enabled)

CHR - default_search_provider: search_url = hxxp://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=CT2269050

CHR - default_search_provider: suggest_url = hxxp://search.conduit.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll

CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\mary\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll

CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: DVDVideoSoftTB = C:\Users\mary\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\2.3.3.3_0\

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (PriceGong Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.2.0\PriceGongIE.dll (PriceGong)

O2 - BHO: (Fast Search by Surf Canyon) - {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll (Surf Canyon Incorporated)

O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL (Symantec Corporation)

O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)

O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [WEB.DE Update] C:\Program Files (x86)\WEB.DE\LiveUpdate\m2LUTray.exe (mquadr.at software engineering und consulting GmbH)

O4 - HKCU..\Run: [GameXN] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [GameXN (news)] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [GameXN (update)] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)

O4 - HKCU..\Run: [VeohPlugin] C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)

O4 - Startup: C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\mary\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10B3E137-B082-4A3C-ABFA-FC9E5A59AC25}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B05A5FB4-3A2A-43C0-A73B-434729217352}: DhcpNameServer = 192.168.1.254

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

 

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {89E0D7E9-61E2-BC66-0FB0-EEFD4BC49DFA} - Microsoft Windows Media Player

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7B7EA601-042D-175F-C5E5-B92FB9FC23A7} - LightScribe Control Panel

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {BC5F5D49-F35A-3133-38A0-F24ADD93893F} - Browser Customizations

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {ECBD7C6B-FB47-8E4B-4427-7946CD6AC45A} - Internet Explorer

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.25 17:03:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.01.25 17:03:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2012.01.25 16:24:05 | 000,000,000 | ---D | C] -- C:\Users\mary\AppData\Roaming\Malwarebytes

[2012.01.25 16:23:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.25 16:23:57 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

[2012.01.25 16:23:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.25 16:23:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.01.25 00:50:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.01.24 01:42:04 | 000,000,000 | -H-D | C] -- C:\Users\mary\AppData\Roaming\Avira

[2012.01.24 01:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.01.24 01:36:36 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\windows\SysNative\drivers\avipbb.sys

[2012.01.24 01:36:36 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\windows\SysNative\drivers\avgntflt.sys

[2012.01.24 01:36:36 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\windows\SysNative\drivers\avkmgr.sys

[2012.01.24 01:36:35 | 000,000,000 | -H-D | C] -- C:\ProgramData\Avira

[2012.01.24 01:36:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira

[2012.01.24 01:32:29 | 000,000,000 | ---D | C] -- C:\windows\SysNative\Macromed

[2012.01.23 22:55:52 | 000,000,000 | ---D | C] -- C:\Users\mary\AppData\Local\ElevatedDiagnostics

[2012.01.21 01:11:34 | 000,000,000 | -H-D | C] -- C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

 
 ========== Files - Modified Within 30 Days ==========

 

[2034.07.30 04:02:38 | 001,144,100 | -H-- | M] () -- C:\Users\mary\Desktop\100_2634.JPG

[2012.01.25 18:50:40 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2012.01.25 16:41:53 | 000,019,760 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.25 16:41:53 | 000,019,760 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.25 16:33:56 | 000,000,408 | ---- | M] () -- C:\windows\tasks\Final Media Player Update Checker.job

[2012.01.25 16:33:41 | 4190,388,224 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.25 16:23:59 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.23 22:22:47 | 000,023,971 | -H-- | M] () -- C:\Users\mary\mary.zip

[2012.01.23 20:55:40 | 000,012,341 | -H-- | M] () -- C:\Users\mary\Desktop\OpenDocument Text (neu) (2).odt

[2012.01.23 20:02:04 | 000,000,000 | -H-- | M] () -- C:\Users\mary\defogger_reenable

[2012.01.22 21:57:58 | 001,498,506 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

[2012.01.22 21:57:58 | 000,654,166 | ---- | M] () -- C:\windows\SysNative\perfh007.dat

[2012.01.22 21:57:58 | 000,616,008 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

[2012.01.22 21:57:58 | 000,130,006 | ---- | M] () -- C:\windows\SysNative\perfc007.dat

[2012.01.22 21:57:58 | 000,106,388 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

[2012.01.21 18:52:24 | 000,000,638 | -H-- | M] () -- C:\Users\mary\Desktop\mary - Verknüpfung.lnk

[2012.01.21 04:36:24 | 000,029,253 | -H-- | M] () -- C:\Users\mary\extras.odt

[2012.01.21 04:34:26 | 000,007,334 | -H-- | M] () -- C:\Users\mary\Desktop\OpenDocument Text (neu).odt

[2012.01.21 01:13:52 | 000,000,440 | -H-- | M] () -- C:\ProgramData\2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,653 | -H-- | M] () -- C:\Users\mary\Desktop\System Check.lnk

[2012.01.21 01:11:35 | 000,000,296 | -H-- | M] () -- C:\ProgramData\~2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~2Mhk1BXXOm5qGFr

[2012.01.19 23:02:18 | 000,024,604 | -H-- | M] () -- C:\Users\mary\Desktop\presentation research methodes.odt

[2012.01.19 20:04:07 | 000,021,643 | -H-- | M] () -- C:\Users\mary\Desktop\Unbenannt 1.odt

[2012.01.18 17:58:03 | 000,016,249 | -H-- | M] () -- C:\Users\mary\Desktop\Research_proposal Marianna & Johannes.odt

[2012.01.18 14:36:23 | 455,606,273 | ---- | M] () -- C:\windows\MEMORY.DMP

[2012.01.17 22:02:28 | 000,073,337 | -H-- | M] () -- C:\Users\mary\Desktop\Final potato for vld with pages 15 and 16.ods

 
 ========== Files Created - No Company Name ==========

 

[2012.01.25 16:23:59 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.23 22:22:47 | 000,023,971 | -H-- | C] () -- C:\Users\mary\mary.zip

[2012.01.23 20:55:28 | 000,012,341 | -H-- | C] () -- C:\Users\mary\Desktop\OpenDocument Text (neu) (2).odt

[2012.01.23 20:02:04 | 000,000,000 | -H-- | C] () -- C:\Users\mary\defogger_reenable

[2012.01.21 18:52:24 | 000,000,638 | -H-- | C] () -- C:\Users\mary\Desktop\mary - Verknüpfung.lnk

[2012.01.21 04:36:21 | 000,029,253 | -H-- | C] () -- C:\Users\mary\extras.odt

[2012.01.21 04:34:26 | 000,007,334 | -H-- | C] () -- C:\Users\mary\Desktop\OpenDocument Text (neu).odt

[2012.01.21 01:11:35 | 000,000,296 | -H-- | C] () -- C:\ProgramData\~2Mhk1BXXOm5qGF

[2012.01.21 01:11:35 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~2Mhk1BXXOm5qGFr

[2012.01.21 01:11:34 | 000,000,653 | -H-- | C] () -- C:\Users\mary\Desktop\System Check.lnk

[2012.01.21 01:11:32 | 000,000,440 | -H-- | C] () -- C:\ProgramData\2Mhk1BXXOm5qGF

[2012.01.18 17:58:01 | 000,016,249 | -H-- | C] () -- C:\Users\mary\Desktop\Research_proposal Marianna & Johannes.odt

[2012.01.18 17:57:48 | 000,024,604 | -H-- | C] () -- C:\Users\mary\Desktop\presentation research methodes.odt

[2012.01.18 14:36:23 | 455,606,273 | ---- | C] () -- C:\windows\MEMORY.DMP

[2012.01.17 22:02:23 | 000,073,337 | -H-- | C] () -- C:\Users\mary\Desktop\Final potato for vld with pages 15 and 16.ods

[2012.01.16 20:48:58 | 000,021,643 | -H-- | C] () -- C:\Users\mary\Desktop\Unbenannt 1.odt

[2011.05.15 12:14:41 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.04.29 12:10:30 | 000,000,088 | RHS- | C] () -- C:\ProgramData\916F6A88B8.sys

[2011.04.29 12:09:59 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011.03.30 10:50:07 | 000,014,051 | ---- | C] () -- C:\windows\SysWow64\RaCoInst.dat

[2010.01.25 14:48:56 | 000,982,224 | ---- | C] () -- C:\windows\SysWow64\igkrng500.bin

[2010.01.25 14:48:56 | 000,439,336 | ---- | C] () -- C:\windows\SysWow64\igcompkrng500.bin

[2010.01.25 14:48:56 | 000,092,292 | ---- | C] () -- C:\windows\SysWow64\igfcg500m.bin

[2010.01.25 13:43:18 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll

[2010.01.25 13:43:18 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\windows\SysWow64\igfcg500.bin

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat

 
 ========== LOP Check ==========

 

[2012.01.21 00:49:06 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Dropbox

[2011.11.29 18:21:57 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\DVDVideoSoft

[2011.11.29 18:21:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.01.21 02:45:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\FinalMediaPlayer

[2012.01.25 16:06:41 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\go

[2011.05.12 23:27:20 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\OpenOffice.org

[2012.01.25 16:33:56 | 000,000,408 | ---- | M] () -- C:\windows\Tasks\Final Media Player Update Checker.job

[2011.11.30 09:04:11 | 000,032,608 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.04.29 20:23:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Adobe

[2011.09.19 00:00:53 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Apple Computer

[2012.01.24 01:42:04 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Avira

[2011.04.29 12:10:29 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Corel

[2012.01.21 02:45:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\CorelHomeOffice

[2012.01.21 00:49:06 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Dropbox

[2011.11.29 18:21:57 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\DVDVideoSoft

[2011.11.29 18:21:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.01.21 02:45:17 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\FinalMediaPlayer

[2012.01.25 16:06:41 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\go

[2011.04.29 12:03:25 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Hewlett-Packard

[2011.04.29 12:01:39 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\hpqLog

[2011.04.29 12:06:24 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Identities

[2011.04.29 12:06:44 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Intel Corporation

[2011.04.29 20:23:20 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Macromedia

[2012.01.25 16:24:05 | 000,000,000 | ---D | M] -- C:\Users\mary\AppData\Roaming\Malwarebytes

[2012.01.21 02:45:16 | 000,000,000 | --SD | M] -- C:\Users\mary\AppData\Roaming\Microsoft

[2011.11.24 18:06:34 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Mozilla

[2011.05.12 23:27:20 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\OpenOffice.org

[2012.01.25 19:55:43 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Skype

[2011.10.30 17:08:06 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\skypePM

[2012.01.21 18:49:47 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\vlc

[2011.04.30 03:28:50 | 000,000,000 | -H-D | M] -- C:\Users\mary\AppData\Roaming\Yahoo!

 
 < %APPDATA%\*.exe /s >

[2011.09.02 01:42:06 | 024,183,152 | -H-- | M] (Dropbox, Inc.) -- C:\Users\mary\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2011.09.02 01:42:12 | 000,174,784 | -H-- | M] (Dropbox, Inc.) -- C:\Users\mary\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2011.06.21 15:20:53 | 003,120,288 | -H-- | M] (Adobe Systems, Inc.) -- C:\Users\mary\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2011.05.12 23:23:53 | 168,166,968 | -H-- | M] () -- C:\OOo_3.3.0_Win_x86_install-wJRE_de.exe

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_0dbde3119acb22ca\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_dab2e93700ba2683\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16552_none_394a8c733b252fb9\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16593_none_39204d0d3b44b8d4\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20669_none_39d05b5854449cd5\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20713_none_3a006b1e5421763d\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.03.04 04:33:26 | 000,435,736 | -H-- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\swsetup\Drivers\32\HDD\iaStor.sys

[2010.03.04 04:33:26 | 000,435,736 | -H-- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\swsetup\INTELRST\Drivers\x32\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | -H-- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\swsetup\Drivers\64\HDD\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | -H-- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\swsetup\INTELRST\Drivers\x64\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\windows\SysNative\drivers\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_d73865c94450cce1\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2010.05.12 09:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys

[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\drivers\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

[2010.05.12 09:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\windows\SysNative\netlogon.dll

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2010.05.12 09:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\drivers\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2010.05.12 09:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys

[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\windows\SysNative\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\windows\SysNative\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\windows\SysNative\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2010.12.10 05:06:45 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.12.10 05:06:45 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\windows\SysNative\winlogon.exe

[2010.12.10 05:06:45 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCOM/10

IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2269050

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)

IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

IE - HKCU\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 67.207.128.249:3128

FF - prefs.js..browser.search.defaultenginename: "WEB.DE Suche"

FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "WEB.DE Suche"

FF - prefs.js..browser.search.order.2: "amazon.de"

FF - prefs.js..browser.startup.homepage: "http://go.web.de/br/ff3_startpage"

FF - prefs.js..extensions.enabledItems: allglassv2@ambroos.neowin.net:2.1.4

FF - prefs.js..keyword.URL: "http://wa.ui-portal.de/webde/webde/s?produkte.browser.link.searchlink&s_brand=webde&t_link=searchlink&ns_type=clickin&ns_url=http://suche.web.de/search/web/?origin=br_urlbar_ff&su="

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[2012.01.21 02:45:14 | 000,000,000 | -H-D | M] (Update Notifier) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] (WEB.DE Firefox Addon) -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2012.01.21 02:45:13 | 000,000,000 | -H-D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.11.24 18:06:49 | 000,001,371 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\amazonde.xml

[2011.11.28 16:12:22 | 000,000,931 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\conduit.xml

[2011.11.25 22:08:17 | 000,001,420 | -H-- | M] () -- C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\preisvergleich.xml

[2012.01.25 17:13:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.11.24 18:06:08 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}

[2011.11.24 18:06:07 | 000,000,000 | ---D | M] (WEB.DE Firefox Addon) -- C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}

[2011.04.30 03:28:55 | 000,000,000 | ---D | M] (PriceGong) -- C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF

[2012.01.25 16:34:13 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3

[2011.09.28 10:28:17 | 000,000,000 | ---D | M] (Symantec IPS) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN

CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=CT2269050

CHR - default_search_provider: suggest_url = http://search.conduit.com/

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (PriceGong Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.2.0\PriceGongIE.dll (PriceGong)

O2 - BHO: (Fast Search by Surf Canyon) - {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll (Surf Canyon Incorporated)

O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL (Symantec Corporation)

O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll (Symantec Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

O4 - HKLM..\Run: [WEB.DE Update] C:\Program Files (x86)\WEB.DE\LiveUpdate\m2LUTray.exe (mquadr.at software engineering und consulting GmbH)

:Files

C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

C:\ProgramData\2Mhk1BXXOm5qGF

C:\Users\mary\Desktop\System Check.lnk

C:\ProgramData\~2Mhk1BXXOm5qGF

C:\ProgramData\~2Mhk1BXXOm5qGFr

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.

C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll moved successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}\ deleted successfully.

C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll moved successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.

File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}\ deleted successfully.

C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll moved successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Prefs.js: "WEB.DE Suche" removed from browser.search.defaultenginename

Prefs.js: "DVDVideoSoftTB Customized Web Search" removed from browser.search.defaultthis.engineName

Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl

Prefs.js: "WEB.DE Suche" removed from browser.search.order.1

Prefs.js: "amazon.de" removed from browser.search.order.2

Prefs.js: "hxxp://go.web.de/br/ff3_startpage" removed from browser.startup.homepage

Prefs.js: allglassv2@ambroos.neowin.net:2.1.4 removed from extensions.enabledItems

Prefs.js: "hxxp://wa.ui-portal.de/webde/webde/s?produkte.browser.link.searchlink&s_brand=webde&t_link=searchlink&ns_type=clickin&ns_url=hxxp://suche.web.de/search/web/?origin=br_urlbar_ff&su=" removed from keyword.URL

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\modules folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\defaults\preferences folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\defaults folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\components folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\chrome folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66} folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\searchplugins folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\defaults\preferences folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\defaults folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\locale\de-DE folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\locale folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\content folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54} folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.

C:\Users\mary\AppData\Roaming\mozilla\Firefox\Profiles\4l9ke1jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.

C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\amazonde.xml moved successfully.

C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\conduit.xml moved successfully.

C:\Users\mary\AppData\Roaming\Mozilla\Firefox\Profiles\4l9ke1jf.default\searchplugins\preisvergleich.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\default folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\defaults\preferences folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\defaults folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\components folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66}\chrome folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66} folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\defaults\preferences folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\defaults folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\locale\de-DE folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\locale folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome\content folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54}\chrome folder moved successfully.

C:\Program Files (x86)\mozilla firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54} folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\modules folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\components folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\chrome\skin folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\chrome\locale\en-US folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\chrome\locale folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\chrome\content folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF\chrome folder moved successfully.

C:\PROGRAM FILES (X86)\PRICEGONG\2.2.0\FF folder moved successfully.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\content scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3 scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN scheduled to be moved on reboot.

Unable to fix default_search_provider items.

Unable to fix default_search_provider items.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.

C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}\ deleted successfully.

C:\Program Files (x86)\PriceGong\2.2.0\PriceGongIE.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AB7104A-B71F-49AD-9154-F7F8806AE848}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AB7104A-B71F-49AD-9154-F7F8806AE848}\ deleted successfully.

C:\Program Files (x86)\Surf Canyon\surfcanyon.dll moved successfully.

Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ scheduled to be deleted on reboot.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ .

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll scheduled to be moved on reboot.

Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}\ scheduled to be deleted on reboot.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}\ .

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL scheduled to be moved on reboot.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.

File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.

C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}\ not found.

File C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully.

C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ .

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll scheduled to be moved on reboot.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.

File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.

File C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.

File C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ .

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll scheduled to be moved on reboot.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}\ not found.

File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WEB.DE Update deleted successfully.

C:\Program Files (x86)\WEB.DE\LiveUpdate\m2LUTray.exe moved successfully.

========== FILES ==========

C:\Users\mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check folder moved successfully.

C:\ProgramData\2Mhk1BXXOm5qGF moved successfully.

C:\Users\mary\Desktop\System Check.lnk moved successfully.

C:\ProgramData\~2Mhk1BXXOm5qGF moved successfully.

C:\ProgramData\~2Mhk1BXXOm5qGFr moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: mary

->Temp folder emptied: 3187796025 bytes

->Temporary Internet Files folder emptied: 377056094 bytes

->Java cache emptied: 15772892 bytes

->FireFox cache emptied: 96119518 bytes

->Google Chrome cache emptied: 322267373 bytes

->Flash cache emptied: 3229163 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 115338612 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 1825712 bytes

 

Total Files Cleaned = 3.929,00 mb

 

C:\windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01262012_150117
 

Files\Folders moved on Reboot...

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\content scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\content scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\COFFPLGN_2011_7_4_3 scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\components scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome\skin scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN\chrome scheduled to be moved on reboot.

Folder move failed. C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN scheduled to be moved on reboot.

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll scheduled to be moved on reboot.

File move failed. C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL scheduled to be moved on reboot.

C:\Users\mary\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ scheduled to be deleted on reboot.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ .

Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}\ scheduled to be deleted on reboot.

Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}\ .

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Code:

21:14:29.0980 1548        TDSS rootkit removing tool 2.7.7.0 Jan 24 2012 16:44:27

21:14:30.0089 1548        ============================================================

21:14:30.0089 1548        Current date / time: 2012/01/26 21:14:30.0089

21:14:30.0089 1548        SystemInfo:

21:14:30.0089 1548        

21:14:30.0089 1548        OS Version: 6.1.7600 ServicePack: 0.0

21:14:30.0089 1548        Product type: Workstation

21:14:30.0089 1548        ComputerName: MARY-HP

21:14:30.0089 1548        UserName: mary

21:14:30.0089 1548        Windows directory: C:\windows

21:14:30.0089 1548        System windows directory: C:\windows

21:14:30.0089 1548        Running under WOW64

21:14:30.0089 1548        Processor architecture: Intel x64

21:14:30.0089 1548        Number of processors: 2

21:14:30.0089 1548        Page size: 0x1000

21:14:30.0089 1548        Boot type: Normal boot

21:14:30.0089 1548        ============================================================

21:14:30.0696 1548        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

21:14:30.0818 1548        Initialize success

21:14:35.0132 4256        Deinitialize success

Code:

21:14:54.0842 5164        TDSS rootkit removing tool 2.7.7.0 Jan 24 2012 16:44:27

21:14:54.0957 5164        ============================================================

21:14:54.0957 5164        Current date / time: 2012/01/26 21:14:54.0957

21:14:54.0957 5164        SystemInfo:

21:14:54.0957 5164        

21:14:54.0957 5164        OS Version: 6.1.7600 ServicePack: 0.0

21:14:54.0957 5164        Product type: Workstation

21:14:54.0957 5164        ComputerName: MARY-HP

21:14:54.0957 5164        UserName: mary

21:14:54.0957 5164        Windows directory: C:\windows

21:14:54.0957 5164        System windows directory: C:\windows

21:14:54.0957 5164        Running under WOW64

21:14:54.0958 5164        Processor architecture: Intel x64

21:14:54.0958 5164        Number of processors: 2

21:14:54.0958 5164        Page size: 0x1000

21:14:54.0958 5164        Boot type: Normal boot

21:14:54.0958 5164        ============================================================

21:14:55.0395 5164        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

21:14:55.0562 5164        Initialize success

21:16:00.0154 5824        ============================================================

21:16:00.0154 5824        Scan started

21:16:00.0154 5824        Mode: Manual; SigCheck; TDLFS; 

21:16:00.0154 5824        ============================================================

21:16:00.0958 5824        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys

21:16:01.0168 5824        1394ohci - ok

21:16:01.0292 5824        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys

21:16:01.0332 5824        ACPI - ok

21:16:01.0447 5824        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys

21:16:01.0534 5824        AcpiPmi - ok

21:16:01.0652 5824        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys

21:16:01.0724 5824        adp94xx - ok

21:16:01.0845 5824        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys

21:16:01.0899 5824        adpahci - ok

21:16:02.0020 5824        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys

21:16:02.0064 5824        adpu320 - ok

21:16:02.0206 5824        AFD             (6ef20ddf3172e97d69f596fb90602f29) C:\windows\system32\drivers\afd.sys

21:16:02.0319 5824        AFD - ok

21:16:02.0464 5824        AgereSoftModem  (a6ab6f0ace87da76b4c401813d18be95) C:\windows\system32\DRIVERS\agrsm64.sys

21:16:02.0616 5824        AgereSoftModem - ok

21:16:02.0706 5824        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys

21:16:02.0747 5824        agp440 - ok

21:16:02.0871 5824        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys

21:16:02.0905 5824        aliide - ok

21:16:02.0929 5824        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys

21:16:02.0963 5824        amdide - ok

21:16:03.0020 5824        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys

21:16:03.0084 5824        AmdK8 - ok

21:16:03.0183 5824        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys

21:16:03.0255 5824        AmdPPM - ok

21:16:03.0351 5824        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys

21:16:03.0390 5824        amdsata - ok

21:16:03.0448 5824        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys

21:16:03.0491 5824        amdsbs - ok

21:16:03.0534 5824        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys

21:16:03.0569 5824        amdxata - ok

21:16:03.0735 5824        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys

21:16:03.0826 5824        AppID - ok

21:16:03.0949 5824        arc             (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys

21:16:03.0981 5824        arc - ok

21:16:04.0021 5824        arcsas          (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys

21:16:04.0052 5824        arcsas - ok

21:16:04.0150 5824        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys

21:16:04.0228 5824        AsyncMac - ok

21:16:04.0341 5824        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys

21:16:04.0364 5824        atapi - ok

21:16:04.0500 5824        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\windows\system32\DRIVERS\avgntflt.sys

21:16:04.0839 5824        avgntflt - ok

21:16:04.0990 5824        avipbb          (f1c9db5f7b2a56a0b29667d22ba540fc) C:\windows\system32\DRIVERS\avipbb.sys

21:16:05.0022 5824        avipbb - ok

21:16:05.0143 5824        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\windows\system32\DRIVERS\avkmgr.sys

21:16:05.0175 5824        avkmgr - ok

21:16:05.0323 5824        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys

21:16:05.0429 5824        b06bdrv - ok

21:16:05.0572 5824        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys

21:16:05.0650 5824        b57nd60a - ok

21:16:05.0794 5824        Beep            (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys

21:16:05.0890 5824        Beep - ok

21:16:06.0068 5824        BHDrvx64        (95da658498248d5832aa240850706150) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys

21:16:06.0148 5824        BHDrvx64 - ok

21:16:06.0246 5824        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys

21:16:06.0302 5824        blbdrive - ok

21:16:06.0452 5824        bowser          (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys

21:16:06.0530 5824        bowser - ok

21:16:06.0630 5824        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys

21:16:06.0683 5824        BrFiltLo - ok

21:16:06.0720 5824        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys

21:16:06.0745 5824        BrFiltUp - ok

21:16:06.0780 5824        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys

21:16:06.0850 5824        Brserid - ok

21:16:06.0954 5824        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys

21:16:07.0017 5824        BrSerWdm - ok

21:16:07.0106 5824        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys

21:16:07.0179 5824        BrUsbMdm - ok

21:16:07.0284 5824        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys

21:16:07.0338 5824        BrUsbSer - ok

21:16:07.0442 5824        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\windows\system32\drivers\BthEnum.sys

21:16:07.0508 5824        BthEnum - ok

21:16:07.0609 5824        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys

21:16:07.0671 5824        BTHMODEM - ok

21:16:07.0768 5824        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\windows\system32\DRIVERS\bthpan.sys

21:16:07.0825 5824        BthPan - ok

21:16:07.0949 5824        BTHPORT         (538392664fee486620dfea146f2500bc) C:\windows\System32\Drivers\BTHport.sys

21:16:08.0043 5824        BTHPORT - ok

21:16:08.0151 5824        BTHUSB          (6e71522e317b22257d8e37a1584b5829) C:\windows\System32\Drivers\BTHUSB.sys

21:16:08.0201 5824        BTHUSB - ok

21:16:08.0300 5824        BTMCOM          (e588420b950dac5ac397f76660bce520) C:\windows\system32\Drivers\btmcom.sys

21:16:08.0365 5824        BTMCOM - ok

21:16:08.0522 5824        BTMUSB          (d1bcd0e189378f81e3fe57783684b3da) C:\windows\system32\Drivers\btmusb.sys

21:16:08.0709 5824        BTMUSB - ok

21:16:08.0799 5824        cdfs            (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys

21:16:08.0899 5824        cdfs - ok

21:16:09.0019 5824        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys

21:16:09.0077 5824        cdrom - ok

21:16:09.0190 5824        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys

21:16:09.0268 5824        circlass - ok

21:16:09.0344 5824        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys

21:16:09.0400 5824        CLFS - ok

21:16:09.0529 5824        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys

21:16:09.0579 5824        CmBatt - ok

21:16:09.0598 5824        cmdide          (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys

21:16:09.0633 5824        cmdide - ok

21:16:09.0686 5824        CNG             (937beb186a735aca91d717044a49d17e) C:\windows\system32\Drivers\cng.sys

21:16:09.0755 5824        CNG - ok

21:16:09.0880 5824        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys

21:16:09.0914 5824        Compbatt - ok

21:16:09.0978 5824        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys

21:16:10.0018 5824        CompositeBus - ok

21:16:10.0104 5824        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys

21:16:10.0136 5824        crcdisk - ok

21:16:10.0276 5824        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\windows\system32\Drivers\dfsc.sys

21:16:10.0326 5824        DfsC - ok

21:16:10.0430 5824        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys

21:16:10.0530 5824        discache - ok

21:16:10.0648 5824        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys

21:16:10.0686 5824        Disk - ok

21:16:10.0783 5824        drmkaud         (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys

21:16:10.0840 5824        drmkaud - ok

21:16:10.0906 5824        DXGKrnl         (1633b9abf52784a1331476397a48cbef) C:\windows\System32\drivers\dxgkrnl.sys

21:16:10.0982 5824        DXGKrnl - ok

21:16:11.0086 5824        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys

21:16:11.0264 5824        ebdrv - ok

21:16:11.0380 5824        eeCtrl          (066108ae4c35835081598827a1a7d08d) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys

21:16:11.0446 5824        eeCtrl - ok

21:16:11.0569 5824        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys

21:16:11.0639 5824        elxstor - ok

21:16:11.0761 5824        EraserUtilRebootDrv (12866876e3851f1e5d462b2a83e25578) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

21:16:11.0796 5824        EraserUtilRebootDrv - ok

21:16:11.0886 5824        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys

21:16:11.0937 5824        ErrDev - ok

21:16:12.0056 5824        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys

21:16:12.0148 5824        exfat - ok

21:16:12.0192 5824        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys

21:16:12.0262 5824        fastfat - ok

21:16:12.0377 5824        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys

21:16:12.0425 5824        fdc - ok

21:16:12.0520 5824        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys

21:16:12.0559 5824        FileInfo - ok

21:16:12.0575 5824        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys

21:16:12.0700 5824        Filetrace - ok

21:16:12.0815 5824        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys

21:16:12.0864 5824        flpydisk - ok

21:16:12.0958 5824        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys

21:16:13.0013 5824        FltMgr - ok

21:16:13.0040 5824        FsDepends       (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys

21:16:13.0063 5824        FsDepends - ok

21:16:13.0078 5824        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys

21:16:13.0099 5824        Fs_Rec - ok

21:16:13.0200 5824        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys

21:16:13.0251 5824        fvevol - ok

21:16:13.0304 5824        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys

21:16:13.0327 5824        gagp30kx - ok

21:16:13.0452 5824        GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys

21:16:13.0481 5824        GEARAspiWDM - ok

21:16:13.0526 5824        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys

21:16:13.0595 5824        hcw85cir - ok

21:16:13.0698 5824        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys

21:16:13.0773 5824        HdAudAddService - ok

21:16:13.0884 5824        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys

21:16:13.0936 5824        HDAudBus - ok

21:16:14.0035 5824        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys

21:16:14.0086 5824        HidBatt - ok

21:16:14.0176 5824        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys

21:16:14.0241 5824        HidBth - ok

21:16:14.0334 5824        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys

21:16:14.0390 5824        HidIr - ok

21:16:14.0510 5824        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys

21:16:14.0579 5824        HidUsb - ok

21:16:14.0750 5824        HpqKbFiltr      (b98ee5d4535a685634b90f7e04de0df7) C:\windows\system32\DRIVERS\HpqKbFiltr.sys

21:16:14.0782 5824        HpqKbFiltr - ok

21:16:14.0909 5824        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys

21:16:14.0943 5824        HpSAMD - ok

21:16:15.0064 5824        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys

21:16:15.0181 5824        HTTP - ok

21:16:15.0271 5824        hwpolicy        (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys

21:16:15.0307 5824        hwpolicy - ok

21:16:15.0418 5824        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys

21:16:15.0464 5824        i8042prt - ok

21:16:15.0578 5824        iaStor          (abbf174cb394f5c437410a788b7e404a) C:\windows\system32\DRIVERS\iaStor.sys

21:16:15.0616 5824        iaStor - ok

21:16:15.0745 5824        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys

21:16:15.0802 5824        iaStorV - ok

21:16:15.0953 5824        IDSVia64        (c3292140bf458b46cf8abbfd7e177bbe) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys

21:16:16.0013 5824        IDSVia64 - ok

21:16:16.0282 5824        igfx            (7467ae8f96ea983423148c62458669fa) C:\windows\system32\DRIVERS\igdkmd64.sys

21:16:16.0610 5824        igfx - ok

21:16:16.0721 5824        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys

21:16:16.0757 5824        iirsp - ok

21:16:16.0869 5824        IntcHdmiAddService (b014ce58f0a8048d3924ba8d5ccbc5f1) C:\windows\system32\drivers\IntcHdmi.sys

21:16:16.0933 5824        IntcHdmiAddService - ok

21:16:17.0028 5824        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys

21:16:17.0062 5824        intelide - ok

21:16:17.0145 5824        intelppm        (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys

21:16:17.0188 5824        intelppm - ok

21:16:17.0238 5824        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys

21:16:17.0322 5824        IpFilterDriver - ok

21:16:17.0422 5824        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys

21:16:17.0479 5824        IPMIDRV - ok

21:16:17.0573 5824        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys

21:16:17.0688 5824        IPNAT - ok

21:16:17.0803 5824        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys

21:16:17.0846 5824        IRENUM - ok

21:16:17.0881 5824        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys

21:16:17.0903 5824        isapnp - ok

21:16:17.0924 5824        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys

21:16:17.0954 5824        iScsiPrt - ok

21:16:18.0042 5824        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys

21:16:18.0072 5824        kbdclass - ok

21:16:18.0175 5824        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys

21:16:18.0223 5824        kbdhid - ok

21:16:18.0332 5824        KSecDD          (16c1b906fc5ead84769f90b736b6bf0e) C:\windows\system32\Drivers\ksecdd.sys

21:16:18.0374 5824        KSecDD - ok

21:16:18.0399 5824        KSecPkg         (0b711550c56444879d71c7daabda6c83) C:\windows\system32\Drivers\ksecpkg.sys

21:16:18.0425 5824        KSecPkg - ok

21:16:18.0463 5824        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys

21:16:18.0520 5824        ksthunk - ok

21:16:18.0671 5824        lltdio          (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys

21:16:18.0774 5824        lltdio - ok

21:16:18.0890 5824        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys

21:16:18.0929 5824        LSI_FC - ok

21:16:18.0972 5824        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys

21:16:19.0010 5824        LSI_SAS - ok

21:16:19.0051 5824        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys

21:16:19.0089 5824        LSI_SAS2 - ok

21:16:19.0115 5824        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys

21:16:19.0156 5824        LSI_SCSI - ok

21:16:19.0257 5824        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys

21:16:19.0357 5824        luafv - ok

21:16:19.0479 5824        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\windows\system32\drivers\mbam.sys

21:16:19.0508 5824        MBAMProtector - ok

21:16:19.0599 5824        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys

21:16:19.0634 5824        megasas - ok

21:16:19.0657 5824        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys

21:16:19.0704 5824        MegaSR - ok

21:16:19.0805 5824        Modem           (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys

21:16:19.0893 5824        Modem - ok

21:16:20.0009 5824        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys

21:16:20.0066 5824        monitor - ok

21:16:20.0174 5824        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys

21:16:20.0211 5824        mouclass - ok

21:16:20.0362 5824        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys

21:16:20.0411 5824        mouhid - ok

21:16:20.0511 5824        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys

21:16:20.0553 5824        mountmgr - ok

21:16:20.0593 5824        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys

21:16:20.0636 5824        mpio - ok

21:16:20.0682 5824        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys

21:16:20.0740 5824        mpsdrv - ok

21:16:20.0763 5824        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys

21:16:20.0806 5824        MRxDAV - ok

21:16:20.0849 5824        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\windows\system32\DRIVERS\mrxsmb.sys

21:16:20.0893 5824        mrxsmb - ok

21:16:20.0999 5824        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\windows\system32\DRIVERS\mrxsmb10.sys

21:16:21.0055 5824        mrxsmb10 - ok

21:16:21.0161 5824        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\windows\system32\DRIVERS\mrxsmb20.sys

21:16:21.0204 5824        mrxsmb20 - ok

21:16:21.0277 5824        msahci          (5e939cf91ea4a841dbafe4627e0292bb) C:\windows\system32\DRIVERS\msahci.sys

21:16:21.0316 5824        msahci - ok

21:16:21.0354 5824        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys

21:16:21.0398 5824        msdsm - ok

21:16:21.0483 5824        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys

21:16:21.0911 5824        Msfs - ok

21:16:22.0008 5824        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys

21:16:22.0261 5824        mshidkmdf - ok

21:16:22.0336 5824        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys

21:16:22.0360 5824        msisadrv - ok

21:16:22.0479 5824        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys

21:16:22.0554 5824        MSKSSRV - ok

21:16:22.0672 5824        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys

21:16:22.0732 5824        MSPCLOCK - ok

21:16:22.0833 5824        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys

21:16:22.0898 5824        MSPQM - ok

21:16:22.0964 5824        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys

21:16:22.0998 5824        MsRPC - ok

21:16:23.0049 5824        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys

21:16:23.0068 5824        mssmbios - ok

21:16:23.0111 5824        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys

21:16:23.0175 5824        MSTEE - ok

21:16:23.0209 5824        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys

21:16:23.0246 5824        MTConfig - ok

21:16:23.0304 5824        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys

21:16:23.0331 5824        Mup - ok

21:16:23.0448 5824        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys

21:16:23.0512 5824        NativeWifiP - ok

21:16:23.0653 5824        NAVENG          (a507b7d1c5f957a1aab98794eb377654) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS

21:16:23.0670 5824        NAVENG - ok

21:16:23.0840 5824        NAVEX15         (0d7d6c0fd46f12780c3bab6af891ede3) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS

21:16:23.0886 5824        NAVEX15 - ok

21:16:24.0013 5824        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys

21:16:24.0063 5824        NDIS - ok

21:16:24.0162 5824        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys

21:16:24.0229 5824        NdisCap - ok

21:16:24.0333 5824        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys

21:16:24.0403 5824        NdisTapi - ok

21:16:24.0505 5824        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys

21:16:24.0568 5824        Ndisuio - ok

21:16:24.0673 5824        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys

21:16:24.0755 5824        NdisWan - ok

21:16:24.0846 5824        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys

21:16:24.0919 5824        NDProxy - ok

21:16:25.0015 5824        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys

21:16:25.0073 5824        NetBIOS - ok

21:16:25.0137 5824        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys

21:16:25.0219 5824        NetBT - ok

21:16:25.0348 5824        netr28x         (b964d4c524a80aba22db16fc1eded0a9) C:\windows\system32\DRIVERS\netr28x.sys

21:16:25.0406 5824        netr28x - ok

21:16:25.0463 5824        nfrd960         (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys

21:16:25.0488 5824        nfrd960 - ok

21:16:25.0619 5824        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys

21:16:25.0691 5824        Npfs - ok

21:16:25.0791 5824        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys

21:16:25.0856 5824        nsiproxy - ok

21:16:25.0975 5824        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys

21:16:26.0080 5824        Ntfs - ok

21:16:26.0175 5824        Null            (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys

21:16:26.0243 5824        Null - ok

21:16:26.0342 5824        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys

21:16:26.0371 5824        nvraid - ok

21:16:26.0388 5824        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys

21:16:26.0420 5824        nvstor - ok

21:16:26.0461 5824        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys

21:16:26.0490 5824        nv_agp - ok

21:16:26.0512 5824        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys

21:16:26.0550 5824        ohci1394 - ok

21:16:26.0698 5824        Parport         (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys

21:16:26.0730 5824        Parport - ok

21:16:26.0764 5824        partmgr         (7daa117143316c4a1537e074a5a9eaf0) C:\windows\system32\drivers\partmgr.sys

21:16:26.0791 5824        partmgr - ok

21:16:26.0820 5824        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\windows\system32\DRIVERS\pci.sys

21:16:26.0856 5824        pci - ok

21:16:26.0882 5824        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys

21:16:26.0905 5824        pciide - ok

21:16:26.0925 5824        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys

21:16:26.0958 5824        pcmcia - ok

21:16:27.0003 5824        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys

21:16:27.0029 5824        pcw - ok

21:16:27.0149 5824        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys

21:16:27.0256 5824        PEAUTH - ok

21:16:27.0380 5824        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys

21:16:27.0454 5824        PptpMiniport - ok

21:16:27.0518 5824        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys

21:16:27.0561 5824        Processor - ok

21:16:27.0688 5824        Psched          (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys

21:16:27.0762 5824        Psched - ok

21:16:27.0830 5824        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\windows\system32\Drivers\PxHlpa64.sys

21:16:27.0854 5824        PxHlpa64 - ok

21:16:27.0947 5824        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys

21:16:28.0024 5824        ql2300 - ok

21:16:28.0050 5824        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys

21:16:28.0079 5824        ql40xx - ok

21:16:28.0116 5824        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys

21:16:28.0260 5824        QWAVEdrv - ok

21:16:28.0387 5824        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys

21:16:28.0509 5824        RasAcd - ok

21:16:28.0659 5824        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys

21:16:28.0739 5824        RasAgileVpn - ok

21:16:28.0837 5824        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys

21:16:28.0900 5824        Rasl2tp - ok

21:16:28.0947 5824        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys

21:16:29.0031 5824        RasPppoe - ok

21:16:29.0139 5824        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys

21:16:29.0212 5824        RasSstp - ok

21:16:29.0315 5824        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys

21:16:29.0405 5824        rdbss - ok

21:16:29.0528 5824        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys

21:16:29.0624 5824        rdpbus - ok

21:16:29.0725 5824        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys

21:16:29.0846 5824        RDPCDD - ok

21:16:29.0963 5824        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys

21:16:30.0090 5824        RDPENCDD - ok

21:16:30.0167 5824        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys

21:16:30.0220 5824        RDPREFMP - ok

21:16:30.0252 5824        RDPWD           (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\windows\system32\drivers\RDPWD.sys

21:16:30.0333 5824        RDPWD - ok

21:16:30.0450 5824        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys

21:16:30.0512 5824        rdyboost - ok

21:16:30.0620 5824        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\windows\system32\DRIVERS\rfcomm.sys

21:16:30.0672 5824        RFCOMM - ok

21:16:30.0793 5824        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys

21:16:30.0866 5824        rspndr - ok

21:16:30.0985 5824        RTL8167         (ba3e57c89e6f63808d3f2b11e1a2ad3c) C:\windows\system32\DRIVERS\Rt64win7.sys

21:16:31.0016 5824        RTL8167 - ok

21:16:31.0097 5824        rtsuvc          (73157d4a4f6da18c5148e47cb958af58) C:\windows\system32\DRIVERS\rtsuvc.sys

21:16:31.0159 5824        rtsuvc - ok

21:16:31.0284 5824        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys

21:16:31.0311 5824        sbp2port - ok

21:16:31.0360 5824        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys

21:16:31.0437 5824        scfilter - ok

21:16:31.0554 5824        sdbus           (54e47ad086782d3ae9417c155cdceb9b) C:\windows\system32\DRIVERS\sdbus.sys

21:16:31.0606 5824        sdbus - ok

21:16:31.0729 5824        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys

21:16:31.0798 5824        secdrv - ok

21:16:31.0920 5824        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys

21:16:31.0949 5824        Serenum - ok

21:16:31.0994 5824        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys

21:16:32.0032 5824        Serial - ok

21:16:32.0094 5824        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys

21:16:32.0122 5824        sermouse - ok

21:16:32.0157 5824        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys

21:16:32.0218 5824        sffdisk - ok

21:16:32.0326 5824        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys

21:16:32.0352 5824        sffp_mmc - ok

21:16:32.0415 5824        sffp_sd         (178298f767fe638c9fedcbdef58bb5e4) C:\windows\system32\DRIVERS\sffp_sd.sys

21:16:32.0453 5824        sffp_sd - ok

21:16:32.0495 5824        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys

21:16:32.0534 5824        sfloppy - ok

21:16:32.0578 5824        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys

21:16:32.0603 5824        SiSRaid2 - ok

21:16:32.0625 5824        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys

21:16:32.0651 5824        SiSRaid4 - ok

21:16:32.0697 5824        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys

21:16:32.0764 5824        Smb - ok

21:16:32.0889 5824        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys

21:16:32.0913 5824        spldr - ok

21:16:33.0005 5824        SRTSP           (90ef30c3867bcde4579c01a6d6e75a7a) C:\windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS

21:16:33.0060 5824        SRTSP - ok

21:16:33.0083 5824        SRTSPX          (c513e8a5e7978da49077f5484344ee1b) C:\windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS

21:16:33.0104 5824        SRTSPX - ok

21:16:33.0153 5824        srv             (2408c0366d96bcdf63e8f1c78e4a29c5) C:\windows\system32\DRIVERS\srv.sys

21:16:33.0230 5824        srv - ok

21:16:33.0351 5824        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\windows\system32\DRIVERS\srv2.sys

21:16:33.0414 5824        srv2 - ok

21:16:33.0538 5824        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\windows\system32\DRIVERS\srvnet.sys

21:16:33.0582 5824        srvnet - ok

21:16:33.0718 5824        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys

21:16:33.0743 5824        stexstor - ok

21:16:33.0871 5824        STHDA           (c962f5c90bdbefb6446b5b252c70fe33) C:\windows\system32\DRIVERS\stwrt64.sys

21:16:33.0943 5824        STHDA - ok

21:16:34.0091 5824        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys

21:16:34.0114 5824        swenum - ok

21:16:34.0258 5824        SymDS           (6160145c7a87fc7672e8e3b886888176) C:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS

21:16:34.0314 5824        SymDS - ok

21:16:34.0487 5824        SymEFA          (96aeed40d4d3521568b42027687e69e0) C:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS

21:16:34.0545 5824        SymEFA - ok

21:16:34.0663 5824        SymEvent        (21a1c2d694c3cf962d31f5e873ab3d6f) C:\windows\system32\Drivers\SYMEVENT64x86.SYS

21:16:34.0689 5824        SymEvent - ok

21:16:34.0793 5824        SymIRON         (bd0d711d8cbfcaa19ca123306eaf53a5) C:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS

21:16:34.0820 5824        SymIRON - ok

21:16:34.0849 5824        SymNetS         (a6adb3d83023f8daa0f7b6fda785d83b) C:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS

21:16:34.0902 5824        SymNetS - ok

21:16:35.0035 5824        SynTP           (be2b928de9af2848289db7a54c7e2398) C:\windows\system32\DRIVERS\SynTP.sys

21:16:35.0066 5824        SynTP - ok

21:16:35.0165 5824        Tcpip           (f18f56efc0bfb9c87ba01c37b27f4da5) C:\windows\system32\drivers\tcpip.sys

21:16:35.0324 5824        Tcpip - ok

21:16:35.0487 5824        TCPIP6          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\windows\system32\DRIVERS\tcpip.sys

21:16:35.0541 5824        TCPIP6 - ok

21:16:35.0603 5824        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys

21:16:35.0673 5824        tcpipreg - ok

21:16:35.0785 5824        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys

21:16:35.0849 5824        TDPIPE - ok

21:16:35.0959 5824        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys

21:16:36.0034 5824        TDTCP - ok

21:16:36.0160 5824        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys

21:16:36.0234 5824        tdx - ok

21:16:36.0361 5824        TermDD          (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys

21:16:36.0386 5824        TermDD - ok

21:16:36.0514 5824        TPM             (dbcc20c02e8a3e43b03c304a4e40a84f) C:\windows\system32\drivers\tpm.sys

21:16:36.0558 5824        TPM - ok

21:16:36.0680 5824        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys

21:16:36.0733 5824        tssecsrv - ok

21:16:36.0855 5824        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys

21:16:36.0928 5824        tunnel - ok

21:16:37.0037 5824        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys

21:16:37.0064 5824        uagp35 - ok

21:16:37.0133 5824        udfs            (c06e6f4679ceb8f430b90a51d76d8d3c) C:\windows\system32\DRIVERS\udfs.sys

21:16:37.0182 5824        udfs - ok

21:16:37.0316 5824        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys

21:16:37.0343 5824        uliagpkx - ok

21:16:37.0395 5824        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys

21:16:37.0438 5824        umbus - ok

21:16:37.0557 5824        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys

21:16:37.0598 5824        UmPass - ok

21:16:37.0739 5824        USBAAPL64       (aa33fc47ed58c34e6e9261e4f850b7eb) C:\windows\system32\Drivers\usbaapl64.sys

21:16:37.0791 5824        USBAAPL64 - ok

21:16:37.0905 5824        usbccgp         (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\windows\system32\DRIVERS\usbccgp.sys

21:16:37.0957 5824        usbccgp - ok

21:16:38.0090 5824        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys

21:16:38.0136 5824        usbcir - ok

21:16:38.0252 5824        usbehci         (fbb21ebe49f6d560db37ac25fbc68e66) C:\windows\system32\DRIVERS\usbehci.sys

21:16:38.0347 5824        usbehci - ok

21:16:38.0504 5824        usbhub          (6b7a8a99c4a459e73c286a6763ea24cc) C:\windows\system32\DRIVERS\usbhub.sys

21:16:38.0549 5824        usbhub - ok

21:16:38.0673 5824        usbohci         (8c88aa7617b4cbc2e4bed61d26b33a27) C:\windows\system32\drivers\usbohci.sys

21:16:38.0710 5824        usbohci - ok

21:16:38.0807 5824        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys

21:16:38.0851 5824        usbprint - ok

21:16:38.0962 5824        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys

21:16:39.0005 5824        usbscan - ok

21:16:39.0114 5824        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS

21:16:39.0170 5824        USBSTOR - ok

21:16:39.0277 5824        usbuhci         (0b5b3b2df3fd1709618acfa50b8392b0) C:\windows\system32\DRIVERS\usbuhci.sys

21:16:39.0314 5824        usbuhci - ok

21:16:39.0442 5824        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys

21:16:39.0500 5824        usbvideo - ok

21:16:39.0648 5824        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys

21:16:39.0672 5824        vdrvroot - ok

21:16:39.0808 5824        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys

21:16:39.0837 5824        vga - ok

21:16:39.0884 5824        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys

21:16:39.0945 5824        VgaSave - ok

21:16:40.0073 5824        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys

21:16:40.0109 5824        vhdmp - ok

21:16:40.0220 5824        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys

21:16:40.0243 5824        viaide - ok

21:16:40.0325 5824        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys

21:16:40.0351 5824        volmgr - ok

21:16:40.0415 5824        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys

21:16:40.0459 5824        volmgrx - ok

21:16:40.0582 5824        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys

21:16:40.0628 5824        volsnap - ok

21:16:40.0753 5824        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys

21:16:40.0783 5824        vsmraid - ok

21:16:40.0880 5824        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys

21:16:40.0910 5824        vwifibus - ok

21:16:41.0036 5824        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys

21:16:41.0076 5824        vwififlt - ok

21:16:41.0145 5824        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys

21:16:41.0203 5824        WacomPen - ok

21:16:41.0326 5824        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

21:16:41.0403 5824        WANARP - ok

21:16:41.0409 5824        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

21:16:41.0455 5824        Wanarpv6 - ok

21:16:41.0591 5824        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys

21:16:41.0626 5824        Wd - ok

21:16:41.0695 5824        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys

21:16:41.0756 5824        Wdf01000 - ok

21:16:41.0907 5824        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys

21:16:41.0972 5824        WfpLwf - ok

21:16:42.0013 5824        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys

21:16:42.0042 5824        WIMMount - ok

21:16:42.0218 5824        WinUsb          (817eaff5d38674edd7713b9dfb8e9791) C:\windows\system32\DRIVERS\WinUsb.sys

21:16:42.0276 5824        WinUsb - ok

21:16:42.0410 5824        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys

21:16:42.0454 5824        WmiAcpi - ok

21:16:42.0533 5824        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys

21:16:42.0625 5824        ws2ifsl - ok

21:16:42.0767 5824        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys

21:16:42.0869 5824        WudfPf - ok

21:16:42.0879 5824        Scan interrupted by user!

21:16:42.0879 5824        Scan interrupted by user!

21:16:42.0879 5824        Scan interrupted by user!

21:16:42.0879 5824        ============================================================

21:16:42.0879 5824        Scan finished

21:16:42.0879 5824        ============================================================

21:16:42.0906 5132        Detected object count: 0

21:16:42.0906 5132        Actual detected object count: 0

21:16:45.0918 6124        Deinitialize success

Code:

21:19:17.0892 4248        TDSS rootkit removing tool 2.7.7.0 Jan 24 2012 16:44:27

21:19:17.0927 4248        ============================================================

21:19:17.0927 4248        Current date / time: 2012/01/26 21:19:17.0927

21:19:17.0927 4248        SystemInfo:

21:19:17.0927 4248        

21:19:17.0927 4248        OS Version: 6.1.7600 ServicePack: 0.0

21:19:17.0927 4248        Product type: Workstation

21:19:17.0927 4248        ComputerName: MARY-HP

21:19:17.0928 4248        UserName: mary

21:19:17.0928 4248        Windows directory: C:\windows

21:19:17.0928 4248        System windows directory: C:\windows

21:19:17.0928 4248        Running under WOW64

21:19:17.0928 4248        Processor architecture: Intel x64

21:19:17.0928 4248        Number of processors: 2

21:19:17.0928 4248        Page size: 0x1000

21:19:17.0928 4248        Boot type: Normal boot

21:19:17.0928 4248        ============================================================

21:19:18.0371 4248        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

21:19:18.0515 4248        Initialize success

21:19:25.0404 4060        ============================================================

21:19:25.0404 4060        Scan started

21:19:25.0404 4060        Mode: Manual; SigCheck; TDLFS; 

21:19:25.0404 4060        ============================================================

21:19:25.0815 4060        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys

21:19:25.0977 4060        1394ohci - ok

21:19:26.0059 4060        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys

21:19:26.0094 4060        ACPI - ok

21:19:26.0181 4060        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys

21:19:26.0218 4060        AcpiPmi - ok

21:19:26.0264 4060        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys

21:19:26.0302 4060        adp94xx - ok

21:19:26.0422 4060        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys

21:19:26.0455 4060        adpahci - ok

21:19:26.0564 4060        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys

21:19:26.0597 4060        adpu320 - ok

21:19:26.0729 4060        AFD             (6ef20ddf3172e97d69f596fb90602f29) C:\windows\system32\drivers\afd.sys

21:19:26.0770 4060        AFD - ok

21:19:26.0920 4060        AgereSoftModem  (a6ab6f0ace87da76b4c401813d18be95) C:\windows\system32\DRIVERS\agrsm64.sys

21:19:26.0972 4060        AgereSoftModem - ok

21:19:27.0073 4060        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys

21:19:27.0122 4060        agp440 - ok

21:19:27.0327 4060        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys

21:19:27.0345 4060        aliide - ok

21:19:27.0696 4060        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys

21:19:27.0721 4060        amdide - ok

21:19:27.0820 4060        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys

21:19:27.0853 4060        AmdK8 - ok

21:19:27.0972 4060        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys

21:19:28.0005 4060        AmdPPM - ok

21:19:28.0107 4060        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys

21:19:28.0136 4060        amdsata - ok

21:19:28.0248 4060        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys

21:19:28.0280 4060        amdsbs - ok

21:19:28.0379 4060        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys

21:19:28.0407 4060        amdxata - ok

21:19:28.0602 4060        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys

21:19:28.0643 4060        AppID - ok

21:19:28.0783 4060        arc             (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys

21:19:28.0812 4060        arc - ok

21:19:28.0877 4060        arcsas          (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys

21:19:28.0907 4060        arcsas - ok

21:19:29.0028 4060        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys

21:19:29.0082 4060        AsyncMac - ok

21:19:29.0230 4060        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys

21:19:29.0253 4060        atapi - ok

21:19:29.0378 4060        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\windows\system32\DRIVERS\avgntflt.sys

21:19:29.0429 4060        avgntflt - ok

21:19:29.0568 4060        avipbb          (f1c9db5f7b2a56a0b29667d22ba540fc) C:\windows\system32\DRIVERS\avipbb.sys

21:19:29.0598 4060        avipbb - ok

21:19:29.0710 4060        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\windows\system32\DRIVERS\avkmgr.sys

21:19:29.0738 4060        avkmgr - ok

21:19:29.0856 4060        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys

21:19:29.0896 4060        b06bdrv - ok

21:19:30.0017 4060        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys

21:19:30.0053 4060        b57nd60a - ok

21:19:30.0183 4060        Beep            (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys

21:19:30.0256 4060        Beep - ok

21:19:30.0435 4060        BHDrvx64        (95da658498248d5832aa240850706150) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys

21:19:30.0485 4060        BHDrvx64 - ok

21:19:30.0579 4060        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys

21:19:30.0612 4060        blbdrive - ok

21:19:30.0763 4060        bowser          (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys

21:19:30.0797 4060        bowser - ok

21:19:30.0886 4060        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys

21:19:30.0922 4060        BrFiltLo - ok

21:19:30.0954 4060        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys

21:19:30.0976 4060        BrFiltUp - ok

21:19:31.0016 4060        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys

21:19:31.0051 4060        Brserid - ok

21:19:31.0089 4060        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys

21:19:31.0118 4060        BrSerWdm - ok

21:19:31.0196 4060        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys

21:19:31.0234 4060        BrUsbMdm - ok

21:19:31.0252 4060        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys

21:19:31.0285 4060        BrUsbSer - ok

21:19:31.0377 4060        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\windows\system32\drivers\BthEnum.sys

21:19:31.0410 4060        BthEnum - ok

21:19:31.0466 4060        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys

21:19:31.0504 4060        BTHMODEM - ok

21:19:31.0614 4060        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\windows\system32\DRIVERS\bthpan.sys

21:19:31.0653 4060        BthPan - ok

21:19:31.0761 4060        BTHPORT         (538392664fee486620dfea146f2500bc) C:\windows\System32\Drivers\BTHport.sys

21:19:31.0802 4060        BTHPORT - ok

21:19:31.0841 4060        BTHUSB          (6e71522e317b22257d8e37a1584b5829) C:\windows\System32\Drivers\BTHUSB.sys

21:19:31.0874 4060        BTHUSB - ok

21:19:31.0968 4060        BTMCOM          (e588420b950dac5ac397f76660bce520) C:\windows\system32\Drivers\btmcom.sys

21:19:31.0998 4060        BTMCOM - ok

21:19:32.0101 4060        BTMUSB          (d1bcd0e189378f81e3fe57783684b3da) C:\windows\system32\Drivers\btmusb.sys

21:19:32.0159 4060        BTMUSB - ok

21:19:32.0200 4060        cdfs            (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys

21:19:32.0242 4060        cdfs - ok

21:19:32.0342 4060        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys

21:19:32.0374 4060        cdrom - ok

21:19:32.0469 4060        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys

21:19:32.0507 4060        circlass - ok

21:19:32.0590 4060        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys

21:19:32.0620 4060        CLFS - ok

21:19:32.0753 4060        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys

21:19:32.0786 4060        CmBatt - ok

21:19:32.0810 4060        cmdide          (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys

21:19:32.0838 4060        cmdide - ok

21:19:32.0887 4060        CNG             (937beb186a735aca91d717044a49d17e) C:\windows\system32\Drivers\cng.sys

21:19:32.0935 4060        CNG - ok

21:19:32.0982 4060        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys

21:19:33.0001 4060        Compbatt - ok

21:19:33.0101 4060        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys

21:19:33.0140 4060        CompositeBus - ok

21:19:33.0249 4060        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys

21:19:33.0277 4060        crcdisk - ok

21:19:33.0422 4060        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\windows\system32\Drivers\dfsc.sys

21:19:33.0456 4060        DfsC - ok

21:19:33.0520 4060        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys

21:19:33.0579 4060        discache - ok

21:19:33.0704 4060        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys

21:19:33.0728 4060        Disk - ok

21:19:33.0851 4060        drmkaud         (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys

21:19:33.0887 4060        drmkaud - ok

21:19:33.0962 4060        DXGKrnl         (1633b9abf52784a1331476397a48cbef) C:\windows\System32\drivers\dxgkrnl.sys

21:19:34.0006 4060        DXGKrnl - ok

21:19:34.0108 4060        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys

21:19:34.0166 4060        ebdrv - ok

21:19:34.0260 4060        eeCtrl          (066108ae4c35835081598827a1a7d08d) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys

21:19:34.0293 4060        eeCtrl - ok

21:19:34.0437 4060        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys

21:19:34.0478 4060        elxstor - ok

21:19:34.0585 4060        EraserUtilRebootDrv (12866876e3851f1e5d462b2a83e25578) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

21:19:34.0613 4060        EraserUtilRebootDrv - ok

21:19:34.0710 4060        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys

21:19:34.0743 4060        ErrDev - ok

21:19:34.0835 4060        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys

21:19:34.0898 4060        exfat - ok

21:19:34.0994 4060        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys

21:19:35.0047 4060        fastfat - ok

21:19:35.0145 4060        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys

21:19:35.0177 4060        fdc - ok

21:19:35.0288 4060        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys

21:19:35.0313 4060        FileInfo - ok

21:19:35.0343 4060        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys

21:19:35.0397 4060        Filetrace - ok

21:19:35.0472 4060        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys

21:19:35.0500 4060        flpydisk - ok

21:19:35.0548 4060        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys

21:19:35.0580 4060        FltMgr - ok

21:19:35.0608 4060        FsDepends       (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys

21:19:35.0630 4060        FsDepends - ok

21:19:35.0646 4060        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys

21:19:35.0667 4060        Fs_Rec - ok

21:19:35.0747 4060        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys

21:19:35.0783 4060        fvevol - ok

21:19:35.0816 4060        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys

21:19:35.0845 4060        gagp30kx - ok

21:19:35.0898 4060        GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys

21:19:35.0920 4060        GEARAspiWDM - ok

21:19:35.0961 4060        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys

21:19:35.0994 4060        hcw85cir - ok

21:19:36.0111 4060        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys

21:19:36.0154 4060        HdAudAddService - ok

21:19:36.0240 4060        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys

21:19:36.0279 4060        HDAudBus - ok

21:19:36.0347 4060        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys

21:19:36.0380 4060        HidBatt - ok

21:19:36.0444 4060        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys

21:19:36.0481 4060        HidBth - ok

21:19:36.0513 4060        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys

21:19:36.0542 4060        HidIr - ok

21:19:36.0600 4060        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys

21:19:36.0633 4060        HidUsb - ok

21:19:36.0796 4060        HpqKbFiltr      (b98ee5d4535a685634b90f7e04de0df7) C:\windows\system32\DRIVERS\HpqKbFiltr.sys

21:19:36.0823 4060        HpqKbFiltr - ok

21:19:36.0922 4060        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys

21:19:36.0951 4060        HpSAMD - ok

21:19:37.0066 4060        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys

21:19:37.0134 4060        HTTP - ok

21:19:37.0150 4060        hwpolicy        (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys

21:19:37.0172 4060        hwpolicy - ok

21:19:37.0220 4060        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys

21:19:37.0254 4060        i8042prt - ok

21:19:37.0291 4060        iaStor          (abbf174cb394f5c437410a788b7e404a) C:\windows\system32\DRIVERS\iaStor.sys

21:19:37.0323 4060        iaStor - ok

21:19:37.0458 4060        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys

21:19:37.0494 4060        iaStorV - ok

21:19:37.0655 4060        IDSVia64        (c3292140bf458b46cf8abbfd7e177bbe) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys

21:19:37.0687 4060        IDSVia64 - ok

21:19:37.0955 4060        igfx            (7467ae8f96ea983423148c62458669fa) C:\windows\system32\DRIVERS\igdkmd64.sys

21:19:38.0058 4060        igfx - ok

21:19:38.0178 4060        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys

21:19:38.0206 4060        iirsp - ok

21:19:38.0315 4060        IntcHdmiAddService (b014ce58f0a8048d3924ba8d5ccbc5f1) C:\windows\system32\drivers\IntcHdmi.sys

21:19:38.0342 4060        IntcHdmiAddService - ok

21:19:38.0385 4060        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys

21:19:38.0406 4060        intelide - ok

21:19:38.0446 4060        intelppm        (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys

21:19:38.0480 4060        intelppm - ok

21:19:38.0572 4060        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys

21:19:38.0647 4060        IpFilterDriver - ok

21:19:38.0691 4060        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys

21:19:38.0724 4060        IPMIDRV - ok

21:19:38.0763 4060        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys

21:19:38.0805 4060        IPNAT - ok

21:19:38.0838 4060        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys

21:19:38.0861 4060        IRENUM - ok

21:19:38.0894 4060        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys

21:19:38.0916 4060        isapnp - ok

21:19:38.0938 4060        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys

21:19:38.0972 4060        iScsiPrt - ok

21:19:39.0077 4060        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys

21:19:39.0105 4060        kbdclass - ok

21:19:39.0199 4060        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys

21:19:39.0232 4060        kbdhid - ok

21:19:39.0278 4060        KSecDD          (16c1b906fc5ead84769f90b736b6bf0e) C:\windows\system32\Drivers\ksecdd.sys

21:19:39.0295 4060        KSecDD - ok

21:19:39.0323 4060        KSecPkg         (0b711550c56444879d71c7daabda6c83) C:\windows\system32\Drivers\ksecpkg.sys

21:19:39.0340 4060        KSecPkg - ok

21:19:39.0431 4060        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys

21:19:39.0490 4060        ksthunk - ok

21:19:39.0628 4060        lltdio          (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys

21:19:39.0692 4060        lltdio - ok

21:19:39.0757 4060        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys

21:19:39.0783 4060        LSI_FC - ok

21:19:39.0817 4060        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys

21:19:39.0840 4060        LSI_SAS - ok

21:19:39.0863 4060        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys

21:19:39.0886 4060        LSI_SAS2 - ok

21:19:39.0904 4060        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys

21:19:39.0921 4060        LSI_SCSI - ok

21:19:40.0024 4060        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys

21:19:40.0098 4060        luafv - ok

21:19:40.0235 4060        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\windows\system32\drivers\mbam.sys

21:19:40.0260 4060        MBAMProtector - ok

21:19:40.0322 4060        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys

21:19:40.0343 4060        megasas - ok

21:19:40.0368 4060        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys

21:19:40.0395 4060        MegaSR - ok

21:19:40.0438 4060        Modem           (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys

21:19:40.0495 4060        Modem - ok

21:19:40.0609 4060        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys

21:19:40.0644 4060        monitor - ok

21:19:40.0753 4060        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys

21:19:40.0782 4060        mouclass - ok

21:19:40.0918 4060        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys

21:19:40.0951 4060        mouhid - ok

21:19:40.0989 4060        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys

21:19:41.0019 4060        mountmgr - ok

21:19:41.0049 4060        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys

21:19:41.0080 4060        mpio - ok

21:19:41.0127 4060        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys

21:19:41.0192 4060        mpsdrv - ok

21:19:41.0219 4060        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys

21:19:41.0244 4060        MRxDAV - ok

21:19:41.0271 4060        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\windows\system32\DRIVERS\mrxsmb.sys

21:19:41.0292 4060        mrxsmb - ok

21:19:41.0332 4060        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\windows\system32\DRIVERS\mrxsmb10.sys

21:19:41.0366 4060        mrxsmb10 - ok

21:19:41.0395 4060        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\windows\system32\DRIVERS\mrxsmb20.sys

21:19:41.0414 4060        mrxsmb20 - ok

21:19:41.0467 4060        msahci          (5e939cf91ea4a841dbafe4627e0292bb) C:\windows\system32\DRIVERS\msahci.sys

21:19:41.0492 4060        msahci - ok

21:19:41.0521 4060        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys

21:19:41.0545 4060        msdsm - ok

21:19:41.0595 4060        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys

21:19:41.0651 4060        Msfs - ok

21:19:41.0665 4060        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys

21:19:41.0705 4060        mshidkmdf - ok

21:19:41.0737 4060        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys

21:19:41.0754 4060        msisadrv - ok

21:19:41.0813 4060        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys

21:19:41.0875 4060        MSKSSRV - ok

21:19:41.0895 4060        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys

21:19:41.0951 4060        MSPCLOCK - ok

21:19:41.0968 4060        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys

21:19:42.0023 4060        MSPQM - ok

21:19:42.0054 4060        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys

21:19:42.0074 4060        MsRPC - ok

21:19:42.0116 4060        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys

21:19:42.0144 4060        mssmbios - ok

21:19:42.0190 4060        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys

21:19:42.0263 4060        MSTEE - ok

21:19:42.0298 4060        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys

21:19:42.0331 4060        MTConfig - ok

21:19:42.0371 4060        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys

21:19:42.0400 4060        Mup - ok

21:19:42.0494 4060        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys

21:19:42.0531 4060        NativeWifiP - ok

21:19:42.0665 4060        NAVENG          (a507b7d1c5f957a1aab98794eb377654) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS

21:19:42.0693 4060        NAVENG - ok

21:19:42.0869 4060        NAVEX15         (0d7d6c0fd46f12780c3bab6af891ede3) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS

21:19:42.0917 4060        NAVEX15 - ok

21:19:43.0038 4060        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys

21:19:43.0089 4060        NDIS - ok

21:19:43.0174 4060        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys

21:19:43.0235 4060        NdisCap - ok

21:19:43.0267 4060        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys

21:19:43.0308 4060        NdisTapi - ok

21:19:43.0417 4060        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys

21:19:43.0477 4060        Ndisuio - ok

21:19:43.0507 4060        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys

21:19:43.0549 4060        NdisWan - ok

21:19:43.0570 4060        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys

21:19:43.0611 4060        NDProxy - ok

21:19:43.0716 4060        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys

21:19:43.0776 4060        NetBIOS - ok

21:19:43.0839 4060        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys

21:19:43.0900 4060        NetBT - ok

21:19:44.0071 4060        netr28x         (b964d4c524a80aba22db16fc1eded0a9) C:\windows\system32\DRIVERS\netr28x.sys

21:19:44.0116 4060        netr28x - ok

21:19:44.0242 4060        nfrd960         (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys

21:19:44.0271 4060        nfrd960 - ok

21:19:44.0431 4060        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys

21:19:44.0494 4060        Npfs - ok

21:19:44.0570 4060        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys

21:19:44.0638 4060        nsiproxy - ok

21:19:44.0735 4060        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys

21:19:44.0781 4060        Ntfs - ok

21:19:44.0842 4060        Null            (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys

21:19:44.0915 4060        Null - ok

21:19:45.0032 4060        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys

21:19:45.0063 4060        nvraid - ok

21:19:45.0133 4060        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys

21:19:45.0164 4060        nvstor - ok

21:19:45.0307 4060        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys

21:19:45.0337 4060        nv_agp - ok

21:19:45.0469 4060        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys

21:19:45.0502 4060        ohci1394 - ok

21:19:45.0633 4060        Parport         (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys

21:19:45.0667 4060        Parport - ok

21:19:45.0788 4060        partmgr         (7daa117143316c4a1537e074a5a9eaf0) C:\windows\system32\drivers\partmgr.sys

21:19:45.0817 4060        partmgr - ok

21:19:45.0944 4060        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\windows\system32\DRIVERS\pci.sys

21:19:45.0976 4060        pci - ok

21:19:46.0105 4060        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys

21:19:46.0133 4060        pciide - ok

21:19:46.0171 4060        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys

21:19:46.0204 4060        pcmcia - ok

21:19:46.0249 4060        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys

21:19:46.0278 4060        pcw - ok

21:19:46.0407 4060        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys

21:19:46.0478 4060        PEAUTH - ok

21:19:46.0636 4060        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys

21:19:46.0707 4060        PptpMiniport - ok

21:19:46.0807 4060        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys

21:19:46.0836 4060        Processor - ok

21:19:46.0978 4060        Psched          (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys

21:19:47.0044 4060        Psched - ok

21:19:47.0176 4060        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\windows\system32\Drivers\PxHlpa64.sys

21:19:47.0203 4060        PxHlpa64 - ok

21:19:47.0319 4060        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys

21:19:47.0374 4060        ql2300 - ok

21:19:47.0473 4060        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys

21:19:47.0503 4060        ql40xx - ok

21:19:47.0627 4060        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys

21:19:47.0665 4060        QWAVEdrv - ok

21:19:47.0710 4060        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys

21:19:47.0777 4060        RasAcd - ok

21:19:47.0927 4060        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys

21:19:47.0982 4060        RasAgileVpn - ok

21:19:48.0105 4060        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys

21:19:48.0177 4060        Rasl2tp - ok

21:19:48.0293 4060        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys

21:19:48.0367 4060        RasPppoe - ok

21:19:48.0486 4060        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys

21:19:48.0561 4060        RasSstp - ok

21:19:48.0673 4060        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys

21:19:48.0729 4060        rdbss - ok

21:19:48.0830 4060        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys

21:19:48.0868 4060        rdpbus - ok

21:19:48.0982 4060        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys

21:19:49.0035 4060        RDPCDD - ok

21:19:49.0156 4060        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys

21:19:49.0212 4060        RDPENCDD - ok

21:19:49.0258 4060        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys

21:19:49.0317 4060        RDPREFMP - ok

21:19:49.0377 4060        RDPWD           (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\windows\system32\drivers\RDPWD.sys

21:19:49.0439 4060        RDPWD - ok

21:19:49.0474 4060        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys

21:19:49.0493 4060        rdyboost - ok

21:19:49.0622 4060        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\windows\system32\DRIVERS\rfcomm.sys

21:19:49.0661 4060        RFCOMM - ok

21:19:49.0817 4060        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys

21:19:49.0893 4060        rspndr - ok

21:19:50.0022 4060        RTL8167         (ba3e57c89e6f63808d3f2b11e1a2ad3c) C:\windows\system32\DRIVERS\Rt64win7.sys

21:19:50.0057 4060        RTL8167 - ok

21:19:50.0177 4060        rtsuvc          (73157d4a4f6da18c5148e47cb958af58) C:\windows\system32\DRIVERS\rtsuvc.sys

21:19:50.0210 4060        rtsuvc - ok

21:19:50.0275 4060        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys

21:19:50.0303 4060        sbp2port - ok

21:19:50.0373 4060        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys

21:19:50.0435 4060        scfilter - ok

21:19:50.0568 4060        sdbus           (54e47ad086782d3ae9417c155cdceb9b) C:\windows\system32\DRIVERS\sdbus.sys

21:19:50.0607 4060        sdbus - ok

21:19:50.0742 4060        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys

21:19:50.0800 4060        secdrv - ok

21:19:50.0899 4060        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys

21:19:50.0932 4060        Serenum - ok

21:19:51.0018 4060        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys

21:19:51.0052 4060        Serial - ok

21:19:51.0118 4060        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys

21:19:51.0151 4060        sermouse - ok

21:19:51.0237 4060        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys

21:19:51.0268 4060        sffdisk - ok

21:19:51.0295 4060        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys

21:19:51.0327 4060        sffp_mmc - ok

21:19:51.0350 4060        sffp_sd         (178298f767fe638c9fedcbdef58bb5e4) C:\windows\system32\DRIVERS\sffp_sd.sys

21:19:51.0382 4060        sffp_sd - ok

21:19:51.0397 4060        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys

21:19:51.0415 4060        sfloppy - ok

21:19:51.0457 4060        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys

21:19:51.0473 4060        SiSRaid2 - ok

21:19:51.0493 4060        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys

21:19:51.0510 4060        SiSRaid4 - ok

21:19:51.0555 4060        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys

21:19:51.0598 4060        Smb - ok

21:19:51.0725 4060        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys

21:19:51.0750 4060        spldr - ok

21:19:51.0898 4060        SRTSP           (90ef30c3867bcde4579c01a6d6e75a7a) C:\windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS

21:19:51.0933 4060        SRTSP - ok

21:19:52.0085 4060        SRTSPX          (c513e8a5e7978da49077f5484344ee1b) C:\windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS

21:19:52.0111 4060        SRTSPX - ok

21:19:52.0223 4060        srv             (2408c0366d96bcdf63e8f1c78e4a29c5) C:\windows\system32\DRIVERS\srv.sys

21:19:52.0262 4060        srv - ok

21:19:52.0387 4060        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\windows\system32\DRIVERS\srv2.sys

21:19:52.0426 4060        srv2 - ok

21:19:52.0552 4060        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\windows\system32\DRIVERS\srvnet.sys

21:19:52.0587 4060        srvnet - ok

21:19:52.0719 4060        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys

21:19:52.0747 4060        stexstor - ok

21:19:52.0896 4060        STHDA           (c962f5c90bdbefb6446b5b252c70fe33) C:\windows\system32\DRIVERS\stwrt64.sys

21:19:52.0935 4060        STHDA - ok

21:19:53.0082 4060        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys

21:19:53.0106 4060        swenum - ok

21:19:53.0272 4060        SymDS           (6160145c7a87fc7672e8e3b886888176) C:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS

21:19:53.0308 4060        SymDS - ok

21:19:53.0491 4060        SymEFA          (96aeed40d4d3521568b42027687e69e0) C:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS

21:19:53.0539 4060        SymEFA - ok

21:19:53.0665 4060        SymEvent        (21a1c2d694c3cf962d31f5e873ab3d6f) C:\windows\system32\Drivers\SYMEVENT64x86.SYS

21:19:53.0695 4060        SymEvent - ok

21:19:53.0851 4060        SymIRON         (bd0d711d8cbfcaa19ca123306eaf53a5) C:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS

21:19:53.0880 4060        SymIRON - ok

21:19:53.0974 4060        SymNetS         (a6adb3d83023f8daa0f7b6fda785d83b) C:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS

21:19:54.0009 4060        SymNetS - ok

21:19:54.0149 4060        SynTP           (be2b928de9af2848289db7a54c7e2398) C:\windows\system32\DRIVERS\SynTP.sys

21:19:54.0182 4060        SynTP - ok

21:19:54.0350 4060        Tcpip           (f18f56efc0bfb9c87ba01c37b27f4da5) C:\windows\system32\drivers\tcpip.sys

21:19:54.0406 4060        Tcpip - ok

21:19:54.0550 4060        TCPIP6          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\windows\system32\DRIVERS\tcpip.sys

21:19:54.0610 4060        TCPIP6 - ok

21:19:54.0672 4060        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys

21:19:54.0730 4060        tcpipreg - ok

21:19:54.0753 4060        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys

21:19:54.0794 4060        TDPIPE - ok

21:19:54.0817 4060        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys

21:19:54.0858 4060        TDTCP - ok

21:19:54.0895 4060        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys

21:19:54.0962 4060        tdx - ok

21:19:54.0995 4060        TermDD          (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys

21:19:55.0011 4060        TermDD - ok

21:19:55.0126 4060        TPM             (dbcc20c02e8a3e43b03c304a4e40a84f) C:\windows\system32\drivers\tpm.sys

21:19:55.0154 4060        TPM - ok

21:19:55.0304 4060        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys

21:19:55.0361 4060        tssecsrv - ok

21:19:55.0478 4060        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys

21:19:55.0539 4060        tunnel - ok

21:19:55.0594 4060        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys

21:19:55.0621 4060        uagp35 - ok

21:19:55.0667 4060        udfs            (c06e6f4679ceb8f430b90a51d76d8d3c) C:\windows\system32\DRIVERS\udfs.sys

21:19:55.0703 4060        udfs - ok

21:19:55.0750 4060        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys

21:19:55.0767 4060        uliagpkx - ok

21:19:55.0807 4060        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys

21:19:55.0826 4060        umbus - ok

21:19:55.0858 4060        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys

21:19:55.0877 4060        UmPass - ok

21:19:55.0940 4060        USBAAPL64       (aa33fc47ed58c34e6e9261e4f850b7eb) C:\windows\system32\Drivers\usbaapl64.sys

21:19:55.0969 4060        USBAAPL64 - ok

21:19:56.0006 4060        usbccgp         (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\windows\system32\DRIVERS\usbccgp.sys

21:19:56.0040 4060        usbccgp - ok

21:19:56.0091 4060        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys

21:19:56.0132 4060        usbcir - ok

21:19:56.0165 4060        usbehci         (fbb21ebe49f6d560db37ac25fbc68e66) C:\windows\system32\DRIVERS\usbehci.sys

21:19:56.0198 4060        usbehci - ok

21:19:56.0262 4060        usbhub          (6b7a8a99c4a459e73c286a6763ea24cc) C:\windows\system32\DRIVERS\usbhub.sys

21:19:56.0299 4060        usbhub - ok

21:19:56.0329 4060        usbohci         (8c88aa7617b4cbc2e4bed61d26b33a27) C:\windows\system32\drivers\usbohci.sys

21:19:56.0361 4060        usbohci - ok

21:19:56.0397 4060        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys

21:19:56.0435 4060        usbprint - ok

21:19:56.0475 4060        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys

21:19:56.0512 4060        usbscan - ok

21:19:56.0546 4060        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS

21:19:56.0565 4060        USBSTOR - ok

21:19:56.0589 4060        usbuhci         (0b5b3b2df3fd1709618acfa50b8392b0) C:\windows\system32\DRIVERS\usbuhci.sys

21:19:56.0608 4060        usbuhci - ok

21:19:56.0665 4060        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys

21:19:56.0698 4060        usbvideo - ok

21:19:56.0760 4060        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys

21:19:56.0788 4060        vdrvroot - ok

21:19:56.0831 4060        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys

21:19:56.0870 4060        vga - ok

21:19:56.0897 4060        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys

21:19:56.0953 4060        VgaSave - ok

21:19:56.0997 4060        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys

21:19:57.0029 4060        vhdmp - ok

21:19:57.0054 4060        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys

21:19:57.0070 4060        viaide - ok

21:19:57.0093 4060        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys

21:19:57.0109 4060        volmgr - ok

21:19:57.0149 4060        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys

21:19:57.0170 4060        volmgrx - ok

21:19:57.0206 4060        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys

21:19:57.0237 4060        volsnap - ok

21:19:57.0277 4060        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys

21:19:57.0294 4060        vsmraid - ok

21:19:57.0326 4060        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys

21:19:57.0347 4060        vwifibus - ok

21:19:57.0382 4060        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys

21:19:57.0405 4060        vwififlt - ok

21:19:57.0446 4060        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys

21:19:57.0478 4060        WacomPen - ok

21:19:57.0538 4060        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

21:19:57.0598 4060        WANARP - ok

21:19:57.0616 4060        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

21:19:57.0658 4060        Wanarpv6 - ok

21:19:57.0792 4060        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys

21:19:57.0816 4060        Wd - ok

21:19:57.0886 4060        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys

21:19:57.0926 4060        Wdf01000 - ok

21:19:58.0053 4060        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys

21:19:58.0110 4060        WfpLwf - ok

21:19:58.0147 4060        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys

21:19:58.0163 4060        WIMMount - ok

21:19:58.0330 4060        WinUsb          (817eaff5d38674edd7713b9dfb8e9791) C:\windows\system32\DRIVERS\WinUsb.sys

21:19:58.0368 4060        WinUsb - ok

21:19:58.0489 4060        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys

21:19:58.0522 4060        WmiAcpi - ok

21:19:58.0612 4060        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys

21:19:58.0675 4060        ws2ifsl - ok

21:19:58.0791 4060        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys

21:19:58.0845 4060        WudfPf - ok

21:19:58.0961 4060        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\windows\system32\DRIVERS\WUDFRd.sys

21:19:59.0041 4060        WUDFRd - ok

21:19:59.0114 4060        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

21:19:59.0237 4060        \Device\Harddisk0\DR0 - ok

21:19:59.0242 4060        Boot (0x1200)   (1ee21c7b77ed91c9058aeb55e9ecf476) \Device\Harddisk0\DR0\Partition0

21:19:59.0244 4060        \Device\Harddisk0\DR0\Partition0 - ok

21:19:59.0275 4060        Boot (0x1200)   (8fe53148daf8727d76a884b26cd7fcc9) \Device\Harddisk0\DR0\Partition1

21:19:59.0276 4060        \Device\Harddisk0\DR0\Partition1 - ok

21:19:59.0308 4060        Boot (0x1200)   (06d24fdd054d6596a2e2ce690049e3a2) \Device\Harddisk0\DR0\Partition2

21:19:59.0310 4060        \Device\Harddisk0\DR0\Partition2 - ok

21:19:59.0324 4060        Boot (0x1200)   (3be72d6f14c9e5ab3f9c2cbced562da9) \Device\Harddisk0\DR0\Partition3

21:19:59.0325 4060        \Device\Harddisk0\DR0\Partition3 - ok

21:19:59.0325 4060        ============================================================

21:19:59.0326 4060        Scan finished

21:19:59.0326 4060        ============================================================

21:19:59.0345 5892        Detected object count: 0

21:19:59.0345 5892        Actual detected object count: 0

21:26:41.0153 2316        Deinitialize success