Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Internet Explorer und Mozilla Firefox Dauerabsturz (https://www.trojaner-board.de/110494-internet-explorer-mozilla-firefox-dauerabsturz.html)

Damajer 27.02.2012 02:25

Internet Explorer und Mozilla Firefox Dauerabsturz
 
Hallo!

Von einen Tag auf den anderen hatte ich folgendes Problem:

Nach dem Start von Windows bekomme ich eine Meldung, dass der Internet Explorer nicht mehr funktioniert obwohl ich ihn nichtmal gestartet habe (ich benutze ihn auch nie),
jegliche option dieser fehlermeldung (Programm schließen, online nach Lösung suchen, oder einfach durch das kreuz schließen) führt nur dazu, dass die selbe Fehlermeldung nochmal erscheint. Wenn ich versuche den IE nun wirklich zu starten, stürzt er ebenfals ab.
Auch funktionier mein Mozilla Firefoxnicht mehr... beim start (oder wenn ich einen Link anklicke) stürzt er ab bevor die Startseite überhaupt geladen wird.

Alle programme funktionieren wie üblich, nur die Internet Browser stürzen sofort ab und ich hab dauerhaft die Fehlermeldung vom Internet Explorer im Bildschirm.

Avira hat keinen Virus gefunden und Hijackthis zeigt mir auch nichts schädliches an.

Auch sollte ich sagen, dass der einzige Weg für mich grad das Internet zu browsen, ist meinen PC mit Hijackthis zu scannen und über "analyze this" auf die hijackthis Seite zu kommen, welche komischerweise keinen Absturzt verursacht und jede seite öffnen lässt - amsonsten stürzt Mozilla sofort ab.

Also habe ich die Schritte des Hilfesuchenden-threads ausgeführt und hoffe, dass Ihr mir nun weiterhelfen könnt.

DDS:
Code:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_24
Run by Paul at 1:07:23 on 2012-02-27
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3051.1601 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\taskhost.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\PnkBstrB.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\WerFault.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\Paul\Desktop\Defogger.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ICQ] "c:\program files\icq7.4\ICQ.exe" silent loginmode=4
uRun: [UpgradeChecker] c:\users\paul\appdata\roaming\teamviewer\{8be8b1a4-29d3-4979-8660-7bb6d9ec3e59}\UpgradeChecker.exe
uRun: [Elloamz] c:\users\paul\appdata\roaming\yvels\obqi.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [<NO NAME>]
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\users\paul\appdata\roaming\micros~1\windows\startm~1\programs\startup\my_aut~1.lnk - c:\program files\warkeys\autowarkey\autohotkey\AutoHotkey.exe
StartupFolder: c:\users\paul\appdata\roaming\micros~1\windows\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
StartupFolder: c:\progra~4\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\icq7.4\ICQ.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
TCP: Interfaces\{316A30F0-BB14-4CF5-AB1E-06FE57FE82F5} : DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
TCP: Interfaces\{3D2370FA-33B4-4806-AC94-434E456BD67B} : DhcpNameServer = 7.254.254.254
TCP: Interfaces\{3D505418-D606-4AF5-9EB2-6F297C56DFEB} : DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-10-29 232512]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2011-2-21 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-2-21 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-2-21 66616]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-2-27 652360]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-10-16 2255464]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-8-3 379496]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-2-27 20464]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-12-16 394856]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [2011-2-21 27136]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-10-11 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-10-11 136176]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-7-2 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-2 52224]
S3 TunngleService;TunngleService;c:\program files\tunngle\TnglCtrl.exe [2011-5-15 751464]
.
=============== Created Last 30 ================
.
2012-02-26 23:35:48        --------        d-----w-        c:\users\paul\appdata\roaming\Malwarebytes
2012-02-26 23:35:43        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-02-26 23:35:43        --------        d-----w-        c:\programdata\Malwarebytes
2012-02-26 23:35:42        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-02-26 01:46:15        --------        d-----w-        c:\users\paul\appdata\roaming\Utwara
2012-02-26 01:46:15        --------        d-----w-        c:\users\paul\appdata\roaming\Holie
2012-02-24 15:01:27        6552120        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{2f15929c-4be7-4f1e-8663-4f7491dd1d15}\mpengine.dll
2012-02-24 01:42:53        --------        d-----w-        c:\users\paul\appdata\roaming\TeamViewer
2012-02-16 14:18:11        690688        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-16 14:18:10        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-02-15 03:14:13        --------        d-----w-        c:\windows\system32\wbem\en-US
2012-02-04 17:25:47        --------        d-----w-        c:\program files\1ClickDownload
.
==================== Find3M  ====================
.
2012-01-29 04:10:42        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-12 03:37:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-03 16:23:27        81408        ----a-w-        c:\windows\cadkasdeinst01.exe
2011-12-16 03:21:19        152576        ----a-w-        c:\windows\system32\msclmd.dll
.
============= FINISH:  1:07:43,80 ===============

Die Gmer Datei ließ sich hier nicht als Anhang hochladen (ungültige Datei) also hab ich es hochgeladen:
hxxp://www.file-upload.net/download-4150638/Gmer.7z.html

Vielen Dank schonmal!

Psychotic 27.02.2012 07:20

:hallo:

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld :)

Gruß,
PsYcHoTiC

Psychotic 27.02.2012 14:17

:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scans durchführen zu denen du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.


Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.


Combofix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Damajer 27.02.2012 17:51

Ich habe heute morgen den PC gestartet und hatte immernoch das selbe Problem, dann musste ich Plötzlich für paar Stunden weg und hab ihn sofort wieder runtergefahren.
Als ich dann später den PC wieder gestartet habe, waren alle Probleme beseitigt...
Ich versuchte den PC einige male neuzustarten um zu gucken ob das problem wieder auftritt, aber es scheint nun alles normal zu sein.

Ich habe nichts installiert oder verändert seit ich den pc das letzte mal runtergefahren habe und nun läuft alles einwandfrei... es ist so gegangen wie es auch gekommen ist.

Nun habe ich den Combofix erstmal nicht ausgeführt weil ich ja nicht weiß was man davon halten soll.

Sollte ich es so belassen? Warten bis es wieder Probleme gibt?

Danke für die schnelle Antwort und tut mir Leid wenn ich Eure Zeit mit nem falschen Alarm verschwendet habe.

Psychotic 27.02.2012 18:04

Hallo damajer,

Das hier ist definitiv Malware!

Zitat:

uRun: [Elloamz] c:\users\paul\appdata\roaming\yvels\obqi.exe
Wenn du was dagegen unternehmen willst, führe, wie oben angesprochen, Combofix aus.

Damajer 27.02.2012 20:58

Danke für die schnelle Antwort nochmals!

also ich hab den Combofix nun ausgeführt und hier ist der Log:

Code:

ComboFix 12-02-27.02 - Paul 27.02.2012  20:48:18.1.4 - x86
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3051.2100 [GMT 1:00]
ausgeführt von:: c:\users\Paul\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Mozilla Firefox\components\AskHPRFF.js
c:\users\Paul\AppData\Local\lame_enc.dll
c:\users\Paul\AppData\Local\no23xwrapper.dll
c:\users\Paul\AppData\Local\ogg.dll
c:\users\Paul\AppData\Local\vorbis.dll
c:\users\Paul\AppData\Local\vorbisenc.dll
c:\users\Paul\AppData\Local\vorbisfile.dll
c:\users\Paul\AppData\Roaming\Help\coredb\storage
c:\users\Paul\AppData\Roaming\Identities\{0E25F8FE-2C31-463C-B146-C6A7C50A3931}\LicenseValidator.exe
c:\users\Paul\AppData\Roaming\Utwara
c:\users\Paul\AppData\Roaming\Utwara\awsoy.iqw
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-27 bis 2012-02-27  ))))))))))))))))))))))))))))))
.
.
2012-02-27 19:53 . 2012-02-27 19:54        --------        d-----w-        c:\users\Paul\AppData\Local\temp
2012-02-27 19:53 . 2012-02-27 19:53        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-02-27 19:53 . 2012-02-27 19:53        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-02-27 01:15 . 2012-02-27 01:15        --------        d-----w-        c:\program files\7-Zip
2012-02-26 23:35 . 2012-02-26 23:35        --------        d-----w-        c:\users\Paul\AppData\Roaming\Malwarebytes
2012-02-26 23:35 . 2012-02-26 23:35        --------        d-----w-        c:\programdata\Malwarebytes
2012-02-26 23:35 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-02-26 23:35 . 2012-02-26 23:35        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-02-26 01:46 . 2012-02-26 02:16        --------        d-----w-        c:\users\Paul\AppData\Roaming\Holie
2012-02-24 15:01 . 2012-02-08 06:03        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2F15929C-4BE7-4F1E-8663-4F7491DD1D15}\mpengine.dll
2012-02-24 01:42 . 2012-02-26 23:05        --------        d-----w-        c:\users\Paul\AppData\Roaming\TeamViewer
2012-02-16 14:18 . 2011-12-16 07:52        690688        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-16 14:18 . 2012-01-14 03:35        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-02-15 03:14 . 2012-02-15 03:14        --------        d-----w-        c:\windows\system32\wbem\en-US
2012-02-04 17:25 . 2012-02-04 17:27        --------        d-----w-        c:\program files\1ClickDownload
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-29 04:10 . 2011-02-21 19:11        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-12 03:37 . 2012-01-12 03:37        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-03 16:23 . 2012-01-03 16:23        81408        ----a-w-        c:\windows\cadkasdeinst01.exe
2011-12-16 03:21 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2012-02-19 15:14 . 2011-05-05 20:29        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-03-01 119608]
"UpgradeChecker"="c:\users\Paul\AppData\Roaming\TeamViewer\{8BE8B1A4-29D3-4979-8660-7BB6D9EC3E59}\UpgradeChecker.exe" [2012-02-26 250880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
My_AutoWarkey_Script.lnk - c:\program files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe [2009-5-3 244736]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-29 3450608]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 136176]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\safedrv.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 136176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2011-12-12 751464]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-10-29 232512]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 14:20]
.
2012-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 14:20]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Elloamz - c:\users\Paul\AppData\Roaming\Yvels\obqi.exe
AddRemove-PunkBusterSvc - c:\program files\Origin Games\Battlefield 3-Beta\pbsvc.exe
AddRemove-toolplugin - c:\users\Paul\AppData\Local\Temp\WZSE0.TMP\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-02-27  20:54:55
ComboFix-quarantined-files.txt  2012-02-27 19:54
.
Vor Suchlauf: 9 Verzeichnis(se), 79.835.484.160 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 92.109.467.648 Bytes frei
.
- - End Of File - - 66F5862C65C7938C017AC6ABA9F34E60


Psychotic 27.02.2012 23:55

Schritt 1: MBAM

Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.


Schritt 2: ESET-Onlinescan


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Schritt 3: Neues DDS.log

Starte bitte DDS
  • Wenn der Scan fertig ist, wird DDS 2 Logfiles erstellen. :
    1. DDS.txt
    2. Attach.txt
  • Speichere beide auf deinem Desktop und poste diese bitte hier

Damajer 28.02.2012 03:30

MBAM:
Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.27.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Paul :: PAUL-PC [Administrator]

Schutz: Aktiviert

28.02.2012 02:15:17
mbam-log-2012-02-28 (02-15-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191101
Laufzeit: 4 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

ESET:
Code:

Operating memory        a variant of Win32/Gataka.A trojan
DDS:
Code:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_31
Run by Paul at 3:21:56 on 2012-02-28
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3051.1253 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\PnkBstrB.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ7.4\ICQ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Windows\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ICQ] "c:\program files\icq7.4\ICQ.exe" silent loginmode=4
uRun: [UpgradeChecker] c:\users\paul\appdata\roaming\teamviewer\{8be8b1a4-29d3-4979-8660-7bb6d9ec3e59}\UpgradeChecker.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\users\paul\appdata\roaming\micros~1\windows\startm~1\programs\startup\my_aut~1.lnk - c:\program files\warkeys\autowarkey\autohotkey\AutoHotkey.exe
StartupFolder: c:\users\paul\appdata\roaming\micros~1\windows\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
StartupFolder: c:\progra~4\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\icq7.4\ICQ.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
TCP: Interfaces\{316A30F0-BB14-4CF5-AB1E-06FE57FE82F5} : DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
TCP: Interfaces\{3D2370FA-33B4-4806-AC94-434E456BD67B} : DhcpNameServer = 7.254.254.254
TCP: Interfaces\{3D505418-D606-4AF5-9EB2-6F297C56DFEB} : DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-10-29 232512]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-2-21 66616]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-2-27 20464]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-12-16 394856]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [2011-2-21 27136]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-7-2 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-2 52224]
.
=============== Created Last 30 ================
.
2012-02-28 01:26:27        --------        d-----w-        c:\program files\ESET
2012-02-27 20:00:59        --------        d-sh--w-        C:\$RECYCLE.BIN
2012-02-27 19:54:56        --------        d-----w-        c:\users\paul\appdata\local\temp
2012-02-27 19:45:43        98816        ----a-w-        c:\windows\sed.exe
2012-02-27 19:45:43        518144        ----a-w-        c:\windows\SWREG.exe
2012-02-27 19:45:43        256000        ----a-w-        c:\windows\PEV.exe
2012-02-27 19:45:43        208896        ----a-w-        c:\windows\MBR.exe
2012-02-26 23:35:48        --------        d-----w-        c:\users\paul\appdata\roaming\Malwarebytes
2012-02-26 23:35:43        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-02-26 23:35:43        --------        d-----w-        c:\programdata\Malwarebytes
2012-02-26 23:35:42        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-02-26 01:46:15        --------        d-----w-        c:\users\paul\appdata\roaming\Holie
2012-02-24 15:01:27        6552120        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{2f15929c-4be7-4f1e-8663-4f7491dd1d15}\mpengine.dll
2012-02-24 01:42:53        --------        d-----w-        c:\users\paul\appdata\roaming\TeamViewer
2012-02-16 14:18:11        690688        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-16 14:18:10        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-02-15 03:14:13        --------        d-----w-        c:\windows\system32\wbem\en-US
2012-02-04 17:25:47        --------        d-----w-        c:\program files\1ClickDownload
.
==================== Find3M  ====================
.
2012-02-27 20:08:19        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2012-01-29 04:10:42        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-12 03:37:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-03 16:23:27        81408        ----a-w-        c:\windows\cadkasdeinst01.exe
2011-12-16 03:21:19        152576        ----a-w-        c:\windows\system32\msclmd.dll
.
============= FINISH:  3:23:35,39 ===============

Attach:
Code:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 21.02.2011 19:36:39
System Uptime: 27.02.2012 21:00:27 (6 hours ago)
.
Motherboard: MSI |  | P67A-C43 (MS-7673)
Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz | SOCKET 0 | 1584/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 85,097 GiB free.
E: is FIXED (NTFS) - 466 GiB total, 84,466 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: SM-Bus-Controller
Device ID: PCI\VEN_8086&DEV_1C22&SUBSYS_76731462&REV_05\3&11583659&0&FB
Manufacturer:
Name: SM-Bus-Controller
PNP Device ID: PCI\VEN_8086&DEV_1C22&SUBSYS_76731462&REV_05\3&11583659&0&FB
Service:
.
Class GUID:
Description: USB (Universal Serial Bus)-Controller
Device ID: PCI\VEN_1033&DEV_0194&SUBSYS_76731462&REV_04\4&3083804C&0&00E5
Manufacturer:
Name: USB (Universal Serial Bus)-Controller
PNP Device ID: PCI\VEN_1033&DEV_0194&SUBSYS_76731462&REV_04\4&3083804C&0&00E5
Service:
.
Class GUID:
Description: PCI-Kommunikationscontroller (einfach)
Device ID: PCI\VEN_8086&DEV_1C3A&SUBSYS_76731462&REV_04\3&11583659&0&B0
Manufacturer:
Name: PCI-Kommunikationscontroller (einfach)
PNP Device ID: PCI\VEN_8086&DEV_1C3A&SUBSYS_76731462&REV_04\3&11583659&0&B0
Service:
.
==== System Restore Points ===================
.
RP230: 15.02.2012 03:00:11 - Windows Update
RP231: 17.02.2012 03:00:12 - Windows Update
RP232: 21.02.2012 15:51:56 - Windows Update
RP233: 24.02.2012 16:00:54 - Windows Update
RP234: 27.02.2012 20:45:55 - ComboFix created restore point
RP235: 27.02.2012 21:07:00 - Installed Java(TM) 6 Update 31
.
==== Installed Programs ======================
.
1ClickDownload
32 Bit HP CIO Components Installer
7-Zip 9.20
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.0.1) - Deutsch
AIO_Scan
Ask Toolbar
Avira AntiVir Personal - Free Antivirus
BufferChm
C4200
c4200_Help
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
CDBurnerXP
Copy
DAEMON Tools Lite
Destinations
DeviceDiscovery
DivX-Setup
DocProc
Dota 2
EasyBits GO
ESET Online Scanner v3
Fallout 3
Fallout 3 - Mothership Zeta Addon
Fallout New Vegas
Fraps (remove only)
Free 3GP Video Converter version 4.0.2.727
Free Audio CD Burner version 1.4.7
Free DVD Video Burner version 3.0.1
Free Screen Video Recorder version 2.5.18.718
Free Video Dub version 1.8.12.718
Free YouTube to MP3 Converter version 3.10.6.727
Garena 2010
Google Chrome
Google Update Helper
GPBaseService2
Hellgate
HP Customer Participation Program 13.0
HP Imaging Device Functions 13.0
HP Photosmart C4200 All-In-One Driver Software 13.0 Rel. 1
HP Photosmart Essential 3.5
HP Smart Web Printing 4.51
HP Solution Center 13.0
HP Update
HPPhotoGadget
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
ICQ7.4
Java Auto Updater
Java(TM) 6 Update 31
JDownloader
kikin Plugin (NO23 Edition) 1.11
League of Legends
Lilith The Will of Demon : Battles of Jalavia v1.1
Lilith The Will of Demon : Difficulty Changer v1.1d
Magic: The Gathering — Duels of the Planeswalkers 2012
Malwarebytes Anti-Malware Version 1.60.1.1000
MarketResearch
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Primary Interoperability Assemblies 2005
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Mozilla Firefox 10.0.2 (x86 de)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NCH Toolbox
No23 Recorder
NVIDIA 3D Vision Controller-Treiber 280.19
NVIDIA 3D Vision Controller Driver
NVIDIA 3D Vision Treiber 280.26
NVIDIA Grafiktreiber 280.26
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX-Systemsoftware 9.10.0514
NVIDIA Stereoscopic 3D Driver
NVIDIA Systemsteuerung 280.26
NVIDIA Update 1.4.28
NVIDIA Update Components
OCR Software by I.R.I.S. 13.0
Orcs Must Die!
Pando Media Booster
PDF Editor 3
PitchPerfect Musical Instrument Tuner
PS_AIO_Software_min
Realtek Ethernet Controller Driver
Realtek PCI Fast Ethernet Controller Driver For Vista and Win7
Scan
Shop for HP Supplies
Skype Click to Call
Skype™ 5.5
SmartWebPrinting
SolutionCenter
Status
Steam
System Requirements Lab
TeamSpeak 3 Client
Titan Quest
Titan Quest Immortal Throne
Toolbox
TrayApp
Tunngle beta
Uninstall 1.0.0.1
UnloadSupport
VC80CRTRedist - 8.0.50727.4053
VLC media player 1.1.7
Warcraft III
Warcraft III: All Products
WebReg
WinRAR
World of Warcraft
.
==== End Of File ===========================


Psychotic 28.02.2012 10:58

Schritt 1: aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.


Schritt 2: Scan mit TDSS-Killer

Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.

Damajer 28.02.2012 15:56

aswMBR:
Code:

aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-02-28 15:31:02
-----------------------------
15:31:02.851    OS Version: Windows 6.1.7601 Service Pack 1
15:31:02.851    Number of processors: 4 586 0x2A07
15:31:02.867    ComputerName: PAUL-PC  UserName: Paul
15:31:52.118    Initialize success
15:33:00.435    AVAST engine defs: 12022801
15:36:58.340    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
15:36:58.343    Disk 0 Vendor: ExcelStor_Technology_J8160S P22OABEA Size: 152627MB BusType: 3
15:36:58.357    Disk 0 MBR read successfully
15:36:58.360    Disk 0 MBR scan
15:36:58.380    Disk 0 Windows 7 default MBR code
15:36:58.394    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      152625 MB offset 2048
15:36:58.402    Disk 0 scanning sectors +312579760
15:36:58.453    Disk 0 scanning C:\Windows\system32\drivers
15:37:10.299    Service scanning
15:37:37.259    Modules scanning
15:37:45.403    Disk 0 trace - called modules:
15:37:45.418    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
15:37:45.422    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861fc458]
15:37:45.425    3 CLASSPNP.SYS[8b3a359e] -> nt!IofCallDriver -> [0x85cc4918]
15:37:45.427    5 ACPI.sys[8aec63d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0x85d3a340]
15:37:46.219    AVAST engine scan C:\Windows
15:37:49.994    AVAST engine scan C:\Windows\system32
15:40:33.043    AVAST engine scan C:\Windows\system32\drivers
15:40:45.375    AVAST engine scan C:\Users\Paul
15:44:50.894    AVAST engine scan C:\ProgramData
15:46:21.014    Scan finished successfully
15:53:42.106    Disk 0 MBR has been saved successfully to "C:\Users\Paul\Desktop\MBR.dat"
15:53:42.109    The log file has been saved successfully to "C:\Users\Paul\Desktop\aswMBR.txt"

TDSSKiller:
Code:

15:54:13.0846 4768        TDSS rootkit removing tool 2.7.15.0 Feb 27 2012 12:59:02
15:54:14.0066 4768        ============================================================
15:54:14.0066 4768        Current date / time: 2012/02/28 15:54:14.0066
15:54:14.0066 4768        SystemInfo:
15:54:14.0066 4768       
15:54:14.0066 4768        OS Version: 6.1.7601 ServicePack: 1.0
15:54:14.0066 4768        Product type: Workstation
15:54:14.0066 4768        ComputerName: PAUL-PC
15:54:14.0066 4768        UserName: Paul
15:54:14.0066 4768        Windows directory: C:\Windows
15:54:14.0066 4768        System windows directory: C:\Windows
15:54:14.0066 4768        Processor architecture: Intel x86
15:54:14.0066 4768        Number of processors: 4
15:54:14.0066 4768        Page size: 0x1000
15:54:14.0066 4768        Boot type: Normal boot
15:54:14.0066 4768        ============================================================
15:54:15.0164 4768        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
15:54:15.0178 4768        Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
15:54:21.0785 4768        \Device\Harddisk0\DR0:
15:54:21.0798 4768        MBR used
15:54:21.0798 4768        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x12A18EB0
15:54:21.0798 4768        \Device\Harddisk1\DR1:
15:54:21.0798 4768        MBR used
15:54:21.0799 4768        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
15:54:21.0818 4768        Initialize success
15:54:21.0818 4768        ============================================================
15:54:25.0410 5224        ============================================================
15:54:25.0410 5224        Scan started
15:54:25.0410 5224        Mode: Manual;
15:54:25.0410 5224        ============================================================
15:54:26.0106 5224        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
15:54:26.0108 5224        1394ohci - ok
15:54:26.0165 5224        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
15:54:26.0169 5224        ACPI - ok
15:54:26.0194 5224        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
15:54:26.0195 5224        AcpiPmi - ok
15:54:26.0294 5224        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
15:54:26.0300 5224        adp94xx - ok
15:54:26.0328 5224        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
15:54:26.0333 5224        adpahci - ok
15:54:26.0349 5224        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
15:54:26.0350 5224        adpu320 - ok
15:54:26.0616 5224        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
15:54:26.0635 5224        AFD - ok
15:54:26.0752 5224        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
15:54:26.0753 5224        agp440 - ok
15:54:26.0811 5224        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
15:54:26.0812 5224        aic78xx - ok
15:54:27.0136 5224        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
15:54:27.0136 5224        aliide - ok
15:54:27.0540 5224        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
15:54:27.0541 5224        amdagp - ok
15:54:27.0795 5224        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
15:54:27.0816 5224        amdide - ok
15:54:28.0073 5224        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
15:54:28.0074 5224        AmdK8 - ok
15:54:28.0100 5224        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
15:54:28.0103 5224        AmdPPM - ok
15:54:28.0231 5224        amdsata        (e7f4d42d8076ec60e21715cd11743a0d) C:\Windows\system32\drivers\amdsata.sys
15:54:28.0235 5224        amdsata - ok
15:54:28.0370 5224        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
15:54:28.0376 5224        amdsbs - ok
15:54:28.0513 5224        amdxata        (146459d2b08bfdcbfa856d9947043c81) C:\Windows\system32\drivers\amdxata.sys
15:54:28.0522 5224        amdxata - ok
15:54:28.0764 5224        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
15:54:28.0765 5224        AppID - ok
15:54:29.0189 5224        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
15:54:29.0213 5224        arc - ok
15:54:29.0281 5224        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
15:54:29.0281 5224        arcsas - ok
15:54:29.0326 5224        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
15:54:29.0327 5224        AsyncMac - ok
15:54:29.0366 5224        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
15:54:29.0366 5224        atapi - ok
15:54:29.0500 5224        atikmdag        (712d8a95e45b070114c5309ada7358ff) C:\Windows\system32\drivers\atikmdag.sys
15:54:29.0539 5224        atikmdag - ok
15:54:29.0613 5224        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
15:54:29.0614 5224        avgntflt - ok
15:54:29.0699 5224        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
15:54:29.0700 5224        avipbb - ok
15:54:29.0782 5224        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
15:54:29.0787 5224        b06bdrv - ok
15:54:29.0848 5224        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
15:54:29.0851 5224        b57nd60x - ok
15:54:29.0904 5224        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
15:54:29.0905 5224        Beep - ok
15:54:29.0935 5224        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
15:54:29.0936 5224        blbdrive - ok
15:54:29.0990 5224        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
15:54:29.0992 5224        bowser - ok
15:54:30.0031 5224        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
15:54:30.0032 5224        BrFiltLo - ok
15:54:30.0066 5224        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
15:54:30.0067 5224        BrFiltUp - ok
15:54:30.0154 5224        BridgeMP        (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
15:54:30.0155 5224        BridgeMP - ok
15:54:30.0213 5224        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
15:54:30.0216 5224        Brserid - ok
15:54:30.0233 5224        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
15:54:30.0234 5224        BrSerWdm - ok
15:54:30.0248 5224        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
15:54:30.0249 5224        BrUsbMdm - ok
15:54:30.0299 5224        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
15:54:30.0300 5224        BrUsbSer - ok
15:54:30.0317 5224        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
15:54:30.0318 5224        BTHMODEM - ok
15:54:30.0411 5224        catchme - ok
15:54:30.0493 5224        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
15:54:30.0494 5224        cdfs - ok
15:54:30.0554 5224        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
15:54:30.0556 5224        cdrom - ok
15:54:30.0650 5224        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
15:54:30.0667 5224        circlass - ok
15:54:30.0708 5224        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
15:54:30.0712 5224        CLFS - ok
15:54:30.0827 5224        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
15:54:30.0852 5224        CmBatt - ok
15:54:30.0919 5224        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
15:54:30.0920 5224        cmdide - ok
15:54:31.0006 5224        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
15:54:31.0011 5224        CNG - ok
15:54:31.0064 5224        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
15:54:31.0065 5224        Compbatt - ok
15:54:31.0104 5224        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
15:54:31.0104 5224        CompositeBus - ok
15:54:31.0177 5224        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
15:54:31.0178 5224        crcdisk - ok
15:54:31.0253 5224        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
15:54:31.0259 5224        CSC - ok
15:54:31.0341 5224        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
15:54:31.0342 5224        DfsC - ok
15:54:31.0406 5224        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
15:54:31.0407 5224        discache - ok
15:54:31.0459 5224        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
15:54:31.0460 5224        Disk - ok
15:54:31.0543 5224        Dot4            (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys
15:54:31.0545 5224        Dot4 - ok
15:54:31.0619 5224        Dot4Print      (caefd09b6a6249c53a67d55a9a9fcabf) C:\Windows\system32\drivers\Dot4Prt.sys
15:54:31.0620 5224        Dot4Print - ok
15:54:31.0643 5224        dot4usb        (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys
15:54:31.0644 5224        dot4usb - ok
15:54:31.0706 5224        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
15:54:31.0706 5224        drmkaud - ok
15:54:31.0771 5224        dtsoftbus01    (c0c7ceccb6c85994c2bc92d58e52d3f2) C:\Windows\system32\DRIVERS\dtsoftbus01.sys
15:54:31.0774 5224        dtsoftbus01 - ok
15:54:31.0840 5224        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
15:54:31.0849 5224        DXGKrnl - ok
15:54:31.0985 5224        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
15:54:32.0013 5224        ebdrv - ok
15:54:32.0121 5224        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
15:54:32.0126 5224        elxstor - ok
15:54:32.0177 5224        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
15:54:32.0177 5224        ErrDev - ok
15:54:32.0266 5224        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
15:54:32.0267 5224        exfat - ok
15:54:32.0281 5224        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
15:54:32.0282 5224        fastfat - ok
15:54:32.0309 5224        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
15:54:32.0310 5224        fdc - ok
15:54:32.0342 5224        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
15:54:32.0343 5224        FileInfo - ok
15:54:32.0425 5224        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
15:54:32.0426 5224        Filetrace - ok
15:54:32.0458 5224        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
15:54:32.0458 5224        flpydisk - ok
15:54:32.0473 5224        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
15:54:32.0475 5224        FltMgr - ok
15:54:32.0500 5224        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
15:54:32.0502 5224        FsDepends - ok
15:54:32.0564 5224        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
15:54:32.0565 5224        Fs_Rec - ok
15:54:32.0603 5224        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
15:54:32.0605 5224        fvevol - ok
15:54:32.0665 5224        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
15:54:32.0690 5224        gagp30kx - ok
15:54:32.0740 5224        GGSAFERDriver - ok
15:54:32.0891 5224        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
15:54:32.0916 5224        hcw85cir - ok
15:54:32.0992 5224        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
15:54:32.0996 5224        HdAudAddService - ok
15:54:33.0058 5224        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
15:54:33.0060 5224        HDAudBus - ok
15:54:33.0105 5224        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
15:54:33.0106 5224        HidBatt - ok
15:54:33.0125 5224        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
15:54:33.0126 5224        HidBth - ok
15:54:33.0149 5224        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
15:54:33.0150 5224        HidIr - ok
15:54:33.0230 5224        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
15:54:33.0230 5224        HidUsb - ok
15:54:33.0287 5224        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
15:54:33.0288 5224        HpSAMD - ok
15:54:33.0370 5224        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
15:54:33.0376 5224        HTTP - ok
15:54:33.0413 5224        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
15:54:33.0414 5224        hwpolicy - ok
15:54:33.0477 5224        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
15:54:33.0478 5224        i8042prt - ok
15:54:33.0541 5224        iaStorV        (a3cae5d281db4cff7cff8233507ee5ad) C:\Windows\system32\drivers\iaStorV.sys
15:54:33.0545 5224        iaStorV - ok
15:54:33.0585 5224        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
15:54:33.0586 5224        iirsp - ok
15:54:33.0632 5224        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
15:54:33.0633 5224        intelide - ok
15:54:33.0703 5224        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
15:54:33.0704 5224        intelppm - ok
15:54:33.0721 5224        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:54:33.0722 5224        IpFilterDriver - ok
15:54:33.0781 5224        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
15:54:33.0782 5224        IPMIDRV - ok
15:54:33.0822 5224        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
15:54:33.0824 5224        IPNAT - ok
15:54:33.0869 5224        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
15:54:33.0870 5224        IRENUM - ok
15:54:33.0910 5224        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
15:54:33.0911 5224        isapnp - ok
15:54:33.0942 5224        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
15:54:33.0945 5224        iScsiPrt - ok
15:54:33.0992 5224        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
15:54:33.0993 5224        kbdclass - ok
15:54:34.0044 5224        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
15:54:34.0045 5224        kbdhid - ok
15:54:34.0106 5224        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
15:54:34.0107 5224        KSecDD - ok
15:54:34.0150 5224        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
15:54:34.0152 5224        KSecPkg - ok
15:54:34.0235 5224        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
15:54:34.0253 5224        lltdio - ok
15:54:34.0308 5224        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
15:54:34.0309 5224        LSI_FC - ok
15:54:34.0328 5224        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
15:54:34.0329 5224        LSI_SAS - ok
15:54:34.0371 5224        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
15:54:34.0373 5224        LSI_SAS2 - ok
15:54:34.0409 5224        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
15:54:34.0411 5224        LSI_SCSI - ok
15:54:34.0458 5224        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
15:54:34.0459 5224        luafv - ok
15:54:34.0511 5224        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys
15:54:34.0512 5224        MBAMProtector - ok
15:54:34.0577 5224        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
15:54:34.0578 5224        megasas - ok
15:54:34.0624 5224        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
15:54:34.0627 5224        MegaSR - ok
15:54:34.0666 5224        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
15:54:34.0667 5224        Modem - ok
15:54:34.0724 5224        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
15:54:34.0724 5224        monitor - ok
15:54:34.0774 5224        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
15:54:34.0775 5224        mouclass - ok
15:54:34.0844 5224        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
15:54:34.0845 5224        mouhid - ok
15:54:34.0905 5224        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
15:54:34.0907 5224        mountmgr - ok
15:54:34.0955 5224        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
15:54:34.0956 5224        mpio - ok
15:54:35.0016 5224        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
15:54:35.0017 5224        mpsdrv - ok
15:54:35.0059 5224        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
15:54:35.0060 5224        MRxDAV - ok
15:54:35.0119 5224        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
15:54:35.0120 5224        mrxsmb - ok
15:54:35.0168 5224        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:54:35.0171 5224        mrxsmb10 - ok
15:54:35.0203 5224        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:54:35.0205 5224        mrxsmb20 - ok
15:54:35.0248 5224        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
15:54:35.0249 5224        msahci - ok
15:54:35.0297 5224        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
15:54:35.0298 5224        msdsm - ok
15:54:35.0335 5224        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
15:54:35.0336 5224        Msfs - ok
15:54:35.0368 5224        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
15:54:35.0369 5224        mshidkmdf - ok
15:54:35.0420 5224        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
15:54:35.0420 5224        msisadrv - ok
15:54:35.0474 5224        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
15:54:35.0474 5224        MSKSSRV - ok
15:54:35.0512 5224        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
15:54:35.0513 5224        MSPCLOCK - ok
15:54:35.0548 5224        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
15:54:35.0549 5224        MSPQM - ok
15:54:35.0568 5224        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
15:54:35.0570 5224        MsRPC - ok
15:54:35.0605 5224        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
15:54:35.0606 5224        mssmbios - ok
15:54:35.0670 5224        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
15:54:35.0671 5224        MSTEE - ok
15:54:35.0709 5224        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
15:54:35.0710 5224        MTConfig - ok
15:54:35.0725 5224        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
15:54:35.0727 5224        Mup - ok
15:54:35.0779 5224        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
15:54:35.0783 5224        NativeWifiP - ok
15:54:35.0865 5224        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
15:54:35.0874 5224        NDIS - ok
15:54:35.0930 5224        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
15:54:35.0931 5224        NdisCap - ok
15:54:35.0950 5224        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
15:54:35.0951 5224        NdisTapi - ok
15:54:35.0992 5224        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
15:54:35.0993 5224        Ndisuio - ok
15:54:36.0052 5224        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
15:54:36.0054 5224        NdisWan - ok
15:54:36.0114 5224        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
15:54:36.0115 5224        NDProxy - ok
15:54:36.0196 5224        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
15:54:36.0197 5224        NetBIOS - ok
15:54:36.0240 5224        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
15:54:36.0242 5224        NetBT - ok
15:54:36.0301 5224        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
15:54:36.0302 5224        nfrd960 - ok
15:54:36.0395 5224        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
15:54:36.0397 5224        Npfs - ok
15:54:36.0603 5224        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
15:54:36.0604 5224        nsiproxy - ok
15:54:36.0805 5224        Ntfs            (33c3093d09017cfe2e219f2472bff6eb) C:\Windows\system32\drivers\Ntfs.sys
15:54:36.0820 5224        Ntfs - ok
15:54:36.0872 5224        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
15:54:36.0873 5224        Null - ok
15:54:37.0108 5224        nvlddmkm        (4152708c0c24e30dae7fa87d5afe1d7b) C:\Windows\system32\DRIVERS\nvlddmkm.sys
15:54:37.0286 5224        nvlddmkm - ok
15:54:37.0374 5224        nvraid          (af2eec9580c1d32fb7eaf105d9784061) C:\Windows\system32\drivers\nvraid.sys
15:54:37.0375 5224        nvraid - ok
15:54:37.0391 5224        nvstor          (9283c58ebaa2618f93482eb5dabcec82) C:\Windows\system32\drivers\nvstor.sys
15:54:37.0392 5224        nvstor - ok
15:54:37.0447 5224        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
15:54:37.0448 5224        nv_agp - ok
15:54:37.0499 5224        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
15:54:37.0499 5224        ohci1394 - ok
15:54:37.0545 5224        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
15:54:37.0546 5224        Parport - ok
15:54:37.0582 5224        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
15:54:37.0583 5224        partmgr - ok
15:54:37.0594 5224        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
15:54:37.0594 5224        Parvdm - ok
15:54:37.0635 5224        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
15:54:37.0636 5224        pci - ok
15:54:37.0700 5224        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
15:54:37.0700 5224        pciide - ok
15:54:37.0737 5224        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
15:54:37.0739 5224        pcmcia - ok
15:54:37.0755 5224        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
15:54:37.0757 5224        pcw - ok
15:54:37.0787 5224        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
15:54:37.0795 5224        PEAUTH - ok
15:54:37.0944 5224        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
15:54:37.0945 5224        PptpMiniport - ok
15:54:37.0973 5224        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
15:54:37.0974 5224        Processor - ok
15:54:38.0010 5224        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
15:54:38.0012 5224        Psched - ok
15:54:38.0064 5224        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
15:54:38.0081 5224        ql2300 - ok
15:54:38.0159 5224        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
15:54:38.0161 5224        ql40xx - ok
15:54:38.0183 5224        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
15:54:38.0185 5224        QWAVEdrv - ok
15:54:38.0198 5224        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
15:54:38.0199 5224        RasAcd - ok
15:54:38.0243 5224        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
15:54:38.0244 5224        RasAgileVpn - ok
15:54:38.0266 5224        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
15:54:38.0268 5224        Rasl2tp - ok
15:54:38.0358 5224        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
15:54:38.0360 5224        RasPppoe - ok
15:54:38.0376 5224        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
15:54:38.0378 5224        RasSstp - ok
15:54:38.0413 5224        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
15:54:38.0417 5224        rdbss - ok
15:54:38.0446 5224        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
15:54:38.0447 5224        rdpbus - ok
15:54:38.0530 5224        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
15:54:38.0531 5224        RDPCDD - ok
15:54:38.0579 5224        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
15:54:38.0581 5224        RDPDR - ok
15:54:38.0628 5224        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
15:54:38.0628 5224        RDPENCDD - ok
15:54:38.0639 5224        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
15:54:38.0639 5224        RDPREFMP - ok
15:54:38.0729 5224        RdpVideoMiniport (68a0387f58e226deee23d9715955572a) C:\Windows\system32\drivers\rdpvideominiport.sys
15:54:38.0730 5224        RdpVideoMiniport - ok
15:54:38.0775 5224        RDPWD          (288b06960d78428ff89e811632684e20) C:\Windows\system32\drivers\RDPWD.sys
15:54:38.0778 5224        RDPWD - ok
15:54:38.0817 5224        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
15:54:38.0819 5224        rdyboost - ok
15:54:39.0072 5224        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
15:54:39.0073 5224        rspndr - ok
15:54:39.0206 5224        RTL8167        (5283b9a27ff230f2ff70d92451ff409a) C:\Windows\system32\DRIVERS\Rt86win7.sys
15:54:39.0212 5224        RTL8167 - ok
15:54:39.0457 5224        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
15:54:39.0458 5224        s3cap - ok
15:54:39.0580 5224        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
15:54:39.0581 5224        sbp2port - ok
15:54:39.0625 5224        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
15:54:39.0626 5224        scfilter - ok
15:54:39.0695 5224        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
15:54:39.0697 5224        secdrv - ok
15:54:39.0789 5224        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
15:54:39.0790 5224        Serenum - ok
15:54:39.0849 5224        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
15:54:39.0866 5224        Serial - ok
15:54:39.0920 5224        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
15:54:39.0937 5224        sermouse - ok
15:54:40.0019 5224        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
15:54:40.0028 5224        sffdisk - ok
15:54:40.0080 5224        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
15:54:40.0100 5224        sffp_mmc - ok
15:54:40.0127 5224        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
15:54:40.0128 5224        sffp_sd - ok
15:54:40.0175 5224        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
15:54:40.0175 5224        sfloppy - ok
15:54:40.0272 5224        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
15:54:40.0273 5224        sisagp - ok
15:54:40.0372 5224        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
15:54:40.0378 5224        SiSRaid2 - ok
15:54:40.0414 5224        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
15:54:40.0415 5224        SiSRaid4 - ok
15:54:40.0440 5224        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
15:54:40.0441 5224        Smb - ok
15:54:40.0528 5224        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
15:54:40.0529 5224        spldr - ok
15:54:40.0646 5224        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
15:54:40.0650 5224        srv - ok
15:54:40.0696 5224        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
15:54:40.0710 5224        srv2 - ok
15:54:40.0767 5224        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
15:54:40.0780 5224        srvnet - ok
15:54:40.0822 5224        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
15:54:40.0823 5224        ssmdrv - ok
15:54:40.0982 5224        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
15:54:40.0987 5224        stexstor - ok
15:54:41.0038 5224        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
15:54:41.0039 5224        storflt - ok
15:54:41.0092 5224        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
15:54:41.0092 5224        storvsc - ok
15:54:41.0111 5224        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
15:54:41.0112 5224        swenum - ok
15:54:41.0131 5224        Synth3dVsc - ok
15:54:41.0171 5224        tap0901t        (b7aee68d2e867cbf69b649b18fcedbbb) C:\Windows\system32\DRIVERS\tap0901t.sys
15:54:41.0172 5224        tap0901t - ok
15:54:41.0321 5224        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
15:54:41.0346 5224        Tcpip - ok
15:54:41.0629 5224        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
15:54:41.0634 5224        TCPIP6 - ok
15:54:41.0830 5224        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
15:54:41.0831 5224        tcpipreg - ok
15:54:41.0869 5224        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
15:54:41.0870 5224        TDPIPE - ok
15:54:41.0898 5224        TDTCP          (2c10395baa4847f83042813c515cc289) C:\Windows\system32\drivers\tdtcp.sys
15:54:41.0899 5224        TDTCP - ok
15:54:41.0990 5224        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
15:54:41.0991 5224        tdx - ok
15:54:42.0024 5224        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
15:54:42.0024 5224        TermDD - ok
15:54:42.0066 5224        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
15:54:42.0071 5224        tssecsrv - ok
15:54:42.0135 5224        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
15:54:42.0144 5224        TsUsbFlt - ok
15:54:42.0152 5224        tsusbhub - ok
15:54:42.0214 5224        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
15:54:42.0215 5224        tunnel - ok
15:54:42.0340 5224        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
15:54:42.0354 5224        uagp35 - ok
15:54:42.0395 5224        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
15:54:42.0399 5224        udfs - ok
15:54:42.0511 5224        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
15:54:42.0516 5224        uliagpkx - ok
15:54:42.0560 5224        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
15:54:42.0561 5224        umbus - ok
15:54:42.0601 5224        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
15:54:42.0602 5224        UmPass - ok
15:54:42.0689 5224        usbccgp        (7e72e7d7e0757d59481d530fd2b0bfae) C:\Windows\system32\drivers\usbccgp.sys
15:54:42.0690 5224        usbccgp - ok
15:54:42.0738 5224        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
15:54:42.0742 5224        usbcir - ok
15:54:42.0770 5224        usbehci        (cfbce999c057d78979a181c9c60f208e) C:\Windows\system32\drivers\usbehci.sys
15:54:42.0771 5224        usbehci - ok
15:54:42.0837 5224        usbhub          (9d22aad9ac6a07c691a1113e5f860868) C:\Windows\system32\drivers\usbhub.sys
15:54:42.0841 5224        usbhub - ok
15:54:42.0902 5224        usbohci        (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\drivers\usbohci.sys
15:54:42.0903 5224        usbohci - ok
15:54:42.0957 5224        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
15:54:42.0958 5224        usbprint - ok
15:54:43.0014 5224        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
15:54:43.0025 5224        usbscan - ok
15:54:43.0069 5224        USBSTOR        (bf63ebfc6979fefb2bc03df7989a0c1a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:54:43.0071 5224        USBSTOR - ok
15:54:43.0117 5224        usbuhci        (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\drivers\usbuhci.sys
15:54:43.0118 5224        usbuhci - ok
15:54:43.0205 5224        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
15:54:43.0216 5224        vdrvroot - ok
15:54:43.0291 5224        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
15:54:43.0292 5224        vga - ok
15:54:43.0335 5224        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
15:54:43.0336 5224        VgaSave - ok
15:54:43.0344 5224        VGPU - ok
15:54:43.0396 5224        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
15:54:43.0398 5224        vhdmp - ok
15:54:43.0476 5224        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
15:54:43.0491 5224        viaagp - ok
15:54:43.0616 5224        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
15:54:43.0616 5224        ViaC7 - ok
15:54:43.0739 5224        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
15:54:43.0744 5224        viaide - ok
15:54:43.0878 5224        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
15:54:43.0880 5224        vmbus - ok
15:54:43.0922 5224        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
15:54:43.0923 5224        VMBusHID - ok
15:54:43.0934 5224        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
15:54:43.0935 5224        volmgr - ok
15:54:44.0077 5224        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
15:54:44.0093 5224        volmgrx - ok
15:54:44.0206 5224        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
15:54:44.0208 5224        volsnap - ok
15:54:44.0398 5224        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
15:54:44.0400 5224        vsmraid - ok
15:54:44.0519 5224        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
15:54:44.0535 5224        vwifibus - ok
15:54:44.0722 5224        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
15:54:44.0723 5224        WacomPen - ok
15:54:44.0907 5224        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
15:54:44.0909 5224        WANARP - ok
15:54:44.0921 5224        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
15:54:44.0923 5224        Wanarpv6 - ok
15:54:45.0001 5224        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
15:54:45.0002 5224        Wd - ok
15:54:45.0147 5224        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
15:54:45.0159 5224        Wdf01000 - ok
15:54:45.0355 5224        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
15:54:45.0366 5224        WfpLwf - ok
15:54:45.0453 5224        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
15:54:45.0467 5224        WIMMount - ok
15:54:45.0727 5224        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
15:54:45.0734 5224        WinUsb - ok
15:54:45.0854 5224        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
15:54:45.0862 5224        WmiAcpi - ok
15:54:46.0109 5224        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
15:54:46.0118 5224        ws2ifsl - ok
15:54:46.0228 5224        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
15:54:46.0229 5224        WudfPf - ok
15:54:46.0419 5224        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
15:54:46.0443 5224        WUDFRd - ok
15:54:46.0537 5224        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
15:54:46.0599 5224        \Device\Harddisk0\DR0 - ok
15:54:46.0604 5224        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk1\DR1
15:54:46.0606 5224        \Device\Harddisk1\DR1 - ok
15:54:46.0613 5224        Boot (0x1200)  (5016858881e2abf074c30a44813c1d0d) \Device\Harddisk0\DR0\Partition0
15:54:46.0631 5224        \Device\Harddisk0\DR0\Partition0 - ok
15:54:46.0634 5224        Boot (0x1200)  (7f65601136b724192eef80767c84a3e2) \Device\Harddisk1\DR1\Partition0
15:54:46.0636 5224        \Device\Harddisk1\DR1\Partition0 - ok
15:54:46.0636 5224        ============================================================
15:54:46.0636 5224        Scan finished
15:54:46.0636 5224        ============================================================
15:54:46.0646 3984        Detected object count: 0
15:54:46.0646 3984        Actual detected object count: 0


Psychotic 29.02.2012 09:34

Starte bitte einmal den Rechner neu und erstelle ein neues ESET-Log für mich.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Damajer 29.02.2012 17:20

ESET:
Code:

Operating memory        a variant of Win32/Gataka.A trojan

Psychotic 29.02.2012 23:25

F-Secure Onlinescanner

Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
  • Deaktiviere dein Antivirenprogramm für die Dauer dieses Scans.
  • Rufe den F-Secure Onlinescanner durch Klick auf diesen Link auf.

    Hinweis: Die Seite prüft, welchen Browser du installiert hast und ob deine Java-Version aktuell ist. Gegebenenfalls wirst du aufgefordert, dein Java zu aktualisieren. Führe dies durch.

  • Wähle als Sprache "Deutsch" und akzeptiere die Lizenzvereinbarungen, indem du das Häkchen in der dafür vorgesehenen Box darunter setzt.
  • Klicke auf "Prüfung durchführen".

    Hinweis: Eventuell wird dir nun eine Java-Sicherheitsabfrage (Sicherheitsinformationen) angezeigt. Bestätige diese unbedingt mit "ausführen".

  • Es wird sich ein neues Fenster öffnen.
  • Wähle Mein Scan und klicke auf Optionen anzeigen.
  • In dem sich öffnenden Fenster, wähle unter Dateitypen für Scan auswählen die Option Alle Dateitypen und hake darunter In komprimierten Dateien suchen an.
  • Klicke unten auf OK.
  • Du befindest dich nun wieder im Hauptmenü des Onlinescanners. Klicke auf Start. F-Secure Online Scanner wird nun einige Dateien herunterladen und dein System scannen.
  • Wenn der Scan abgeschlossen ist, klicke auf Bericht anzeigen.
  • Poste den Bericht hier in deinem Thread.

Damajer 01.03.2012 05:21

F-Secure:
Code:

Scanbericht
Donnerstag, März 1, 2012 03:59:53 - 05:19:14

Name des Computers: PAUL-PC
Scantyp: Scansystem für Malware, Spyware und Rootkits
Ziel: C:\ E:\
4 Malware gefunden
TrackingCookie.Tradedoubler (Spyware)

    System (Desinfiziert)

Suspicious:W32/Malware!Gemini (Virus)

    C:\Users\Paul\AppData\Roaming\ICQ\{CE050506-AFAA-4BE0-96CF-C190306B4144}\renovator.exe (Nicht bereinigt & Übermittelt)

Suspicious:W32/Malware!Gemini (Virus)

    C:\Qoobox\Quarantine\C\Users\Paul\AppData\Roaming\Identities\{0E25F8FE-2C31-463C-B146-C6A7C50A3931}\LicenseValidator.exe.vir (Nicht bereinigt & Übermittelt)

Suspicious:W32/Malware!Gemini (Virus)

    C:\Program Files\Warkeys\update\FBZip.exe (Nicht bereinigt & Übermittelt)

Statistik
Gescannt:

    Dateien: 286807
    System: 4387
    Nicht gescannt: 947

Aktionen:

    Desinfiziert: 1
    Umbenannt: 0
    Gelöscht: 0
    Nicht bereinigt: 3
    Übermittelt: 3

Nicht gescannte Dateien:

    C:\HIBERFIL.SYS
    C:\PAGEFILE.SYS
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG1
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG2
    C:\WINDOWS\SYSTEM32\CONFIG\SAM
    C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG1
    C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG2
    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG1
    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG2
    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG1
    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG2
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG1
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG2
    C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
    C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
    C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
    C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
    C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
    C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG
    C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
    C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB
    C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT
    C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT.LOG1
    C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT.LOG2
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\NTUSER.DAT
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\NTUSER.DAT.LOG1
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\NTUSER.DAT.LOG2
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\ROAMING\PEERNETWORKING\3D74FB8C801164D39890F61123011980AD91FFCC.HOMEGROUPCLASSIFIER\4406E2EA6FD8DC199F41F7A6D45B7A67\GROUPING\DB.MDB
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\ROAMING\PEERNETWORKING\3D74FB8C801164D39890F61123011980AD91FFCC.HOMEGROUPCLASSIFIER\4406E2EA6FD8DC199F41F7A6D45B7A67\GROUPING\EDB.LOG
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\ROAMING\PEERNETWORKING\3D74FB8C801164D39890F61123011980AD91FFCC.HOMEGROUPCLASSIFIER\4406E2EA6FD8DC199F41F7A6D45B7A67\GROUPING\TMP.EDB
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\LASTALIVE0.DAT
    C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\LASTALIVE1.DAT
    C:\USERS\UPDATUSUSER\NTUSER.DAT
    C:\USERS\UPDATUSUSER\NTUSER.DAT.LOG1
    C:\USERS\UPDATUSUSER\NTUSER.DAT.LOG2
    C:\USERS\UPDATUSUSER\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT
    C:\USERS\UPDATUSUSER\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG1
    C:\USERS\UPDATUSUSER\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG2
    C:\USERS\PAUL\NTUSER.DAT
    C:\USERS\PAUL\NTUSER.DAT.LOG1
    C:\USERS\PAUL\NTUSER.DAT.LOG2
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\TONYDAMAJER\BISTATS.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\TONYDAMAJER\GRIFFIN.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\TONYDAMAJER\KEYVAL.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\TONYDAMAJER\MAIN.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\SHARED_HTTPFE\QUEUE.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\SKYPE\SHARED_DYNCO\DC.LOCK
    C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XKPW2IQ1.DEFAULT\PARENT.LOCK
    C:\USERS\PAUL\APPDATA\LOCAL\TEMP\HSPERFDATA_PAUL\1032
    C:\USERS\PAUL\APPDATA\LOCAL\TEMP\HSPERFDATA_PAUL\14004
    C:\USERS\PAUL\APPDATA\LOCAL\TEMP\HSPERFDATA_PAUL\5356
    C:\USERS\PAUL\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT
    C:\USERS\PAUL\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG1
    C:\USERS\PAUL\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG2
    C:\SYSTEM VOLUME INFORMATION\SYSCACHE.HVE
    C:\SYSTEM VOLUME INFORMATION\SYSCACHE.HVE.LOG1
    C:\SYSTEM VOLUME INFORMATION\SYSCACHE.HVE.LOG2
    C:\SYSTEM VOLUME INFORMATION\{1DDAE7AF-6218-11E1-B334-8C89A584DAF3}{3808876B-C176-4E48-B7AE-04046E6CC752}
    C:\SYSTEM VOLUME INFORMATION\{B2DA715E-617D-11E1-8E8C-8C89A584DAF3}{3808876B-C176-4E48-B7AE-04046E6CC752}
    C:\SYSTEM VOLUME INFORMATION\{C84403B7-6161-11E1-A036-8C89A584DAF3}{3808876B-C176-4E48-B7AE-04046E6CC752}
    C:\SYSTEM VOLUME INFORMATION\{3808876B-C176-4E48-B7AE-04046E6CC752}
    C:\PROGRAMDATA\MICROSOFT\WINDOWS DEFENDER\IMPSERVICE925A3ACA-C353-458A-AC8D-A7E5EB378092.LOCK
    C:\PROGRAMDATA\MICROSOFT\SEARCH\DATA\APPLICATIONS\WINDOWS\MSS.LOG
    C:\PROGRAMDATA\MICROSOFT\SEARCH\DATA\APPLICATIONS\WINDOWS\MSSTMP.LOG
    C:\PROGRAMDATA\MICROSOFT\SEARCH\DATA\APPLICATIONS\WINDOWS\TMP.EDB
    C:\PROGRAMDATA\MICROSOFT\SEARCH\DATA\APPLICATIONS\WINDOWS\WINDOWS.EDB
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0039577710D3A3DB1BCC0B2E73E146D5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\02446588111DEE16B2BDCF579FE39D62_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\02CA934EB5755F3D47B3EFE3F75DC770_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\03061141587DFFC5E22F6A6E563BD32E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\036AA2DE19619606AE6D558B74DE67E5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\03BC64D7B30BDCDFA9BF22EB2B13ED48_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\04B8749BC1947376C8010E41538B9ADE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0595FD344F88E69AA8D10C341EF72430_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\05AB3C8C4A244060A8B523F1E99BD028_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0654DAF7F8ADDB8BB0405C8914747B31_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\06E9FF1D0720A059EECAB6199208C1AE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\079AD30770503FCD644A80F00F357E62_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\07BB8D8F6FB31678279E7C12954D665A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\08437BB2D2F0B617FCDFA397A6424350_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0924C3454CB4E3B3A6457ECD18F810C4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0A1EC0725E35A0133ACEFD0D2C30BD90_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0AA8C07E7CE46554D31335FB59C42F6B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0AADDF1A18ADDFA75397A0C13B64A663_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0B3BCE6FC3C89A0410D30FB5FF686A93_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0B76687663AADD94F4103C4660C08C97_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0B8D4CE845CBB362A032178ADCCA9DBB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0BF200D79F466AEB30F6D6B645EFE771_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0CECC21237012D410257E365252CD42F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0D72D0BD11591E1861B1F642BA423937_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0EA894D6C17719763144058456166DD5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0D2C2FE7B3253E4959FD7B202FFD4FBC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0F51971DF18C3ACEDEAED51E0263C18E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0F9806A5B9BDB87846246C79E556A712_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\10447E51D2735E1BC87B29B9D5C6ED62_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1072F3A564FA2FEC8975B1070FBA2AD4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\10C114928A0EB7836DA68C261A9EA5D6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\10B02E331E2973294882AA054386153A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1275F4E6C4A1670F4DAA3ACA7DB4D6BC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\12D3202835673E4A0662D96234D5C62D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\12DAE8139977E663724FD550642B2D5E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1349497BD153A99A7BD65B3E30AE1FCC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1386233D0AB9B3A1A836ABD969EDB3A6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\13CAEE31C0124F03309A65A50892CC2D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\144F10B29503AE705D6516985D281FDA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1487A6D0B940AC61A149F1F767C50BCD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\156C63DBABC6BEB0DBCBBC6DD3A14598_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\15D6A866FEAAB58C42523FBE849EE2B6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\15E6B836E9D98D49A597E54B3F3227E9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\160A89F6CB3105EBEC01BB4157C7DA4A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1695A2FC2BA28E2FD95654B64B3784D1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\16BACB4E0848D01A76801A6A5219EB96_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\16BECA108B088AF5695A0F7C88DE678B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1731E75F42631096500A0A6F466741C9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1827521AF711D60E9DED9660007D4C1F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\189CB7449D35AD4B4931CF45AD70A0D3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\18CDE97CAF6A13890D8A5A74C21663D6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\18CFB88A22B77505D92ABDD0785934F4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1944405D56C1366F09A0215773A8D3BD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1A65E05F7B8A7F4D018C5FC3647FBF92_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1B2FE388513B02A560A32B96BEB31409_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1B91CBF7A929F1C2951EDDF08FA1DAC6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1B430AE8D1E947A314D626CF42190535_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1BF523F5BA41CB8DD6B9BCBEF5C1EE5F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1C6F8D5B0844397626F6F8189677AC7E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1CA278F545352010DA08628CA16906B8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1CB71FDB457552073CD01F114BA93062_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1CC7B9662EF42C568E2DE4B5CF1834CE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1D1EADA1A543434C32AB412B1E9355E0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1DAEE95D1E7B80F5F1EEE398E32C5F6F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1E4772A27572BC38D1FB38D22D8C4230_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1E99721DD2866F6CBCBD30E610600908_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\208BD57DC76E7BC008F3301238BB6175_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\20C0EBB619D2867236BB1AD3E4090757_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2279A06FA6278A0DA9A61082FDA1A735_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2211CAA9AB5349525EF0D2D13984274E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\229C056993DC4914848974C4FB744C57_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\237547ED3FACDC6F14A3688CD6623C18_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\23763335C3E598E98AF85D3E4902766D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\23F4EBFF2AF932A8FC4DFF7FFB99997E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\23D95541B10463C838047FACD4917C13_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\23C06E3D6D4A30EA0356187232ABA5C0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2448A159E3326507C4294B31B072807A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2468014E7F8A57A0392A86DC4240184E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\26351E8C6C6E4A21DA26E4BBA92A7FDE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2654A242D3C837F734EEB092053B83B1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\273DE186404086E8B9705503C66F73D5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\27414157F738F72236397CAEC5302453_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2789E3F657813EE394297A0E7693C505_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\27989A47E004B5AF7676260FBC6F3C5B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\28E043D9DBABB2C9362257D5D804A84B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\277E38F427E82A18B2A399286B55ABD3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\27960F4830164F672CDDC5DCF085D0C2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\28E9C2F979C535C4CECAD47F0FD34190_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\28F1BC9156E038675470D2DD74F68B1F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\295D61F77194BC2CF49DBD873EF67E7E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\298139EF134D785A96CF86F38F67C659_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2AA69CAC20E9FDAC09DBF0305D47A71E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2AC81C409E42AA52D4C3DB1F2EB4557E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2BB38CC42399A69ECF13B432336CD303_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2DE1085ADAF1E61F217BF3AE6ECC3B0C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2DFB69C9854CC85051D4164139B3F0AA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2E733CA9E4C0BE6B792521AE917E7BE5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2F2C816F2B4D24F7A12CF46291A803F1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2EB9F45188C6DC6B20F644FBE776552C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2F619F1B615214F4C49CCE16997DEC03_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2F992C245E12477D7C55FD9B9112B406_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\32227AE21D4AB63F597BFB314ED5B53D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3240778F6C1E2773CC7724954CFE07EA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\326A4B4D06411AC2BEC1245AB48CCDE6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\32BF8176714FE5D2DCC5A1B51B091447_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\32DB9742C6DB0AF4B731D58C1FE6DED9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3239F8E6AFD33AAA2B9F0963A7DB8B2C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\32CC0F5AE8A75F0F5D2F7C43696651C6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\32F4C8D055CE1CFFE66D4E056BDB3E50_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\33496E44028793911FF6349AEFAE740D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\332ABCC4ED681471EB2350D10D1AEF3C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\33823031F286C9DBFE4052E515854F30_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\338C1D839C202F7DDF382AFD1DF92254_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\33E7630842542FE63167EC1ACD6CC380_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\358A9F070D8ECDFA84BF70B3CC82446B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\36172CD7087747CCA86F0D77F4BC14E0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3661850E1378E29EF83B583F0B8E29AF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\37DE9CA72E0D53E6315A394F3C571A20_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\37E5FCB75A1895A49541FB8F0DFA3CE1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3698F2A373685E7BD2693F08D8EFD41E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3748B4CFE417708C19E81E410E0F6A1C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\385DB2BA9A9F0218E7D166B32A6B72BE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\38DF768172902A4A8855B36B9C905797_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\392674FFBCFEE6D965090FF7E6B48574_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\38E852C86ABE32C0CAC5292FDFD1652D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\392AF57F12FAD6AC3AD41017DE521658_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3A30A3BC83F158D5EECEA250B3D67578_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3AEDFA9CEF9B8399370FA81FDCB1DD06_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3D1C0189510E8EEAEAE0BA1ADA902237_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3BDDD9E9E23953D3598B72F5314119B2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3D90C5CA4B0A251260A712CE0B7A621E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3D94908C7E88133445A7E7F47DA0568B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3DAA245D49C33C10C02A66E4BC52F147_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3DB8FED25A1CD94544E26440FA956459_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3E0B619D7F7B1246B99284DE10B0673F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3EDAACDB64D658BFA923918945195C89_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3F0A95161F2DA003138BA803B5CAFD26_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3FA522AFB16C866C6589540E0047B53D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\40094E2696797C6D7E6167C1EB8289D8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\40983D5C315B9EC9C060FB6ED711396C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\414B2E21F30B5DF5FAF403AE30A1EDFE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4157330919F3FD840A920EBDF9D2BDD6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\420410171DF26AB5094D605454E000EE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\424893D5068492C31123B785D8C79037_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\42C186431F1CA5EB08DC53A039218B6C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\434D23B1906B2B9A08108A822C867761_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\43665D7F18591DE396EB4723533040BA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\43CEABD60F892A4A4A765470D4B52793_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\44C20EE7313F5D1F1B24976D68BB07A6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4500091DD4B332831489871A3084D7C1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\45603FAEF5840C644B0AD9CB4EF151D3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\45022ADAB5B69E4A5AC47859118694D2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\46345AD8116A08481C6830138B28B9B7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\470C45E3BD52FC5976462741686C8D58_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4731B83026F13711F7EA3A917B5BF012_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4762F5BF6AE37DCDB61102EDE4076E57_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\48A0B6D42458400C2FBBF4B28D4712DE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\48A0EF800E146B752631E35E537FF1FD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\49BF1C57DCB6D61B75508915BDA8C237_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4A22EFEECD60AC824962A2DC47670ACD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4A236B4BF1841FFCD8FF35636B72565D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4A4F81E39999B01B04CEBAFCDD433A77_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4B3F468F07527458C629FD60D32E7F46_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4B692D45E65DE81BD9E09B0DD9F251CE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4B8440EE90B430AF79DA9CE688154A01_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4C5BA3549CD2217D6F7A3FE5AAF25FD5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4C8500C497C2C6CD8506D5E1A17FEEBC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4CE0C63C69F4C340952EAD0BA0F65F9D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4E2CF369BF179755368110A7D629FC27_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4E7FF2CE03E5DCCAEE69ADBBAC761BB1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4EACB75EBCF9321199DEE9EB48D51226_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4FA4D87FA536702AD53F51575B9179FF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4F8EEDEB31765BE9765BCA5C09DC7D5E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\503E9F0C13463AF2A0A44BED96484204_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\50B1E23A5F5ACB187DA8087F20F0705D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\51867CE051F5596EC95570F04A844F31_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\51B889ECC54D9E2DA98B9A6F47A05CBA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\52408B91B4036ADCFC6817002476F3BD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\526BB3EED75A0FF5017B5253D967C31B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5454AED9F8EF6BC102189D90CBC2B1C7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5279F21F8C7F80EB1C3D92E1DCC39D09_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5455E0D60DD2A30D438AC6A7213A77CF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\545FB925A8548695964D5D50FF282441_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\54BF4FFEBB4403559E0D1A62AEAF9DF5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\560A7F6061692D98FFEA6447E4A0D645_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5671D48497A94FD6D506839D612B6AD5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\56D021663CF67DC1A9CF170726985653_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\574553A42FB98FB7043143681A80BBBA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\56FFE84B9ABF4904D4FEB1E99C2F219D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\589B22A837F943CB22A6386CFDBBF12D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\59106D55035D9A77B55BD547974CBD6B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\591B39E17E52AEB071C062E32F294255_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\59A31FBB26FA8886460611CB471388CF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\59AC2C508F872E40ED9021DD639677C8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\59E4E2F6C3416C8589F618C27BC40CBE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5B2E7555EBF8E4FCF6D7A8857FF887EE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5C37F6E0D5774CCBEC7915C8357F1A33_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5D4AC9A203746D9C1FDC027B97E3AA39_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5E3B053EC3629CFB3C5B8225BA536718_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5C8FE4FA1174FED058777BBD42101D06_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6218224073EA47754F9E433FC2C06F6C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\633411F817AAB3EA4ED708FDB02ADCB2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6346023E3CCDA48CB94DF3A1DC52E7B9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\63CB83ABAE3EA21604E60940E97BCB65_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\641F0EFF0F08EFFEC1337BA71828E961_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\64C18A2BD6C71C1DB390B78FE70CE7D3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\64A05E3A4D63535AD2D53515F12F33C0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\64E20AF55F5DC90F0004F0A61AF66B81_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\64F3847D8E56F54962CAA323861935D9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\651859F37AD2DB0258477487C6049CB1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\670B8025B411D9601A1C1152831C2D44_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\67CBB8896DE65758536F72709E94E71B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\67703BBD16877CA453FB0551CF41C349_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6824C2E6374E131FCFB7E70BB09A05EA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\68060C7F3BF733084D45985014DF7625_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\69086EA937012BF2482455291046F0D4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6930DFF4E5B99D736C1DCDD83B917BCA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\69629C0CC5F890E314BDA2D20653B8D5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6993B99D03EBAB103C68B70873A40731_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6B5EA9CA8544E4BF422A529F15AF72B1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6B1D6AFF5B1FB34C8E2C4DD8EF791C8D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6B88A10635ED62C6176633F2E708B821_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6BCC7F023CB98436D4546A2DA13280FA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C0D1FF25B1166296DB5B25C677109CB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C162440685203CF69322B8984A66161_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C3EDEC8F488336417B8DBF4A28AB267_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C4ACD71E996DABF691BA84F707409A5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C649CAC63F3A077CE5EB06DBAE9E45D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C6DE94872FAB9366A56CF2B04DE2BE1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6D2EA777A129FAD40EBA6AA5FBDAFC03_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6E0E4540B99CF1FA49FAE12F5823936A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6F066DDFB0B86E31AB2E6672D2465EA0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6F628EAFDED9D8D41E53A64E5C4E01CB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6F7B624A7529324E95363D2267490AFF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6FBEB2D5FC359B66FD43D868D4D64AF3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6FEEE3A4521FC740829EF025938CF56C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7016D36290055EF2498F7435C30F1E3D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\714233A886F8D4386098187CD95EF34D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\71428C6E87ABF341D5257A112C9FF910_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\716505297173C801EA8C7360B68AD53D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\71C5784F4C223F9487555F7C7278EEB8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\729409AE9DD7106EEAE3F39A0283A556_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\731C1DDA312187C319F585BDF46E5898_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\738A4D49157F967FADE12BE5E462E121_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7395B6DB7DB3F01316F1241E9900770C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\732D631AA3FD9A36BEEF22F656E876A9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\743F4D311B3FEF5DCBF02196BA4B1992_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\74AD8C61095B236150A896D0203BDBB8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\752CD256EBC71BD4D61EBF98BC3E0D5E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\75F6649AFAFA2D703C4EA775ED1C0AB9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7613990978AEC1432F063818D437FF5C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\777EF4BC4D1540F1605CB7B4BE28841A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\76DB48E81D5AAD2507E9EDEA7CA48A7D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\782E91B2642AA32464D7D5513E5D7DA3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\78345E7D2292268BCAA0319B85B53478_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7916FCFD7C3AABD46A6FB504D47DA2D4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\793C0D1A0A9D26D5091EB2AD8FAAE361_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7AA810E7030458D189D540FF0EE1FFC7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7BB471EB5F41376FC9563017333F2EB4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7C004B9785DBF06B2C1FA30440B70B8D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7C0EB491CD71515ABD7C317E3BD44069_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7C1673AE9F47636E8098C16E48410BC4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7C9840763388D646B3389D8A5355AD67_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7D4245DD9DABD9B7E30825C78F156C5D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7D813D988231EEDCFA625D9836DC07CC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7E318353F244882E0BFD168BE8371572_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7EB80EAB2A0A5EDBD1C17220806C8360_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7EF53FE5448E7999B09B2B976DBEC891_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8068F9E523A67DA4E755B56677253E10_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\80C4ECEE2E43352BF5921499D623DB09_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\80E04D4DEDE75C9876B88F29B7C187AB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\81F0DB3B306CC3769904D519CFBC7FFF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\82092EB4A5A54857B207E258F1D241CA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\81C526A4660F07801C5624D80C19EA4F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8263F4AF4D92B4C22C4861378AAAC581_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\83CFD4493D05843C8D4DC88B74A42395_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\83FD1ADB7552750168A6E2393C3064E3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8553968EC83D93AFA270546F44049901_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8563A5216795E3D5BB604F0413E75EF9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\858EAA4A02D541AE72C8DBDB2D201230_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\860269AB1D185204B33B7FB51F52444C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8634AD9567A61596E02C2AD6CF3DF22F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\869D672E4906B4E9D6F073FD216E664C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8707B239E15B4EC69289706EECF34302_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\883971A2231CCFB75335D9FF0319208A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\88407D646C24EA8C51C74995A069F2C3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8842BAC6BC053975B94DEC63F5484DA0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\89C81614C70A7AE4EF437BDAB2A70EB3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8A3F50A705B038A6EE5280740273C9BF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\893685C446BC8DB281BC11B4E932D986_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8A8F38031686C0844F8424970E47E6AE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8ACDA6915FC61328E0DCF1D7D01E4F32_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8B140ED5ACF6A053AA6722B6CA9C0BF6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8B96D75FFC89A6B1BE9EE7622A35C357_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8BCFF8B64DDFD0AFAAB5DB54A881F667_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8C95C6E930DFFA99F9D53D145ED2CB7B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8CEA356F0FFD584C2BA2D251621EC6C3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8E107A0B1E0C17533E5ED6A8E304DB42_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8D4DA72A5A71388585A0CB1B3EC263DE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8DC498509CFA7114A3EE3920E7FCF990_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8DB9A2ADCD0132C6A0C7F8C38C5CF4A2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8ED5D02229FB9CC98D01D2572A4F987A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8E98F37602F86791F54218228624CE31_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8F0AFBFE2982B3DE12CAFFD3667B47AD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8EFA8E5A492D4478612A984BBCB8A977_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8F5875821D5E0FEBC63A0FD6A46DA1CD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8F2980769EF13DAC6DAC81832BBCCA28_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8F5C585C3926B278C209C34110FB66CF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\903B839EC64DFE1FA214334D645D5EE2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8F68001A094151C19CA7CC81CA0B776E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\906ECEAEB986C6776260698E1263718A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\912F71568A4A65D7AE43F9C460D15EC4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\91E0FB1BD6D64A10C0E6C0F57A95313C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\92E08E5E80BC0A5782193E52FEF0F456_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\93816A2C78ECBA462D307F00634799AF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9281DC555311F018E75ED02D776DE459_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9394DFA0CA2A56214239D379719ACB67_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\940A72245184E92EEBDF09C94A92AB80_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\95AB4812EF2BD35E3E05C9A3CCD0F5AB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9657BC7EBF2550D72891BE7D45A91DEA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9469765BFD153B37CDDD5E363C8FD550_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\96894057D36B2B5FF09470A42B6371A4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\96E986CF4B5E4AB498E54079882B3A53_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\97E131AE108796D5DFF724048DDBC474_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\97E5E398D9838F0D9CA6843447AAE6C0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\98200856C8C723D9CE520FB826925E4C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\97224F934CB0B07018522AD9A9DA0ED0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\98C4E5FF93ACD1BFE09123311C730E89_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9A20291F6B91E4EB9F75010F05D9A688_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\98D761E1AE07632D7CD63EDDB9E8AEFF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9A51EDCCAB80982D142901270159B818_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9B11050CE3A7025BC76499CAC3A3D9EB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9B816F7AB007442373E405E9F9D50275_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9C59E53AE78BF34040E355C9649C524C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9C7A170B81D58BE2AE80CE353CFF021C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9D3D024D7759EF30913D3A2AF92EBD22_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9DBDE4FA26EE19494EDBF0B215BFDF90_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9CEB087BE1EE54B4EFFA1224775B220A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9DCC9BEAF5476A1A0DA5E0EC2FBD8D28_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9F858BAAD65FE584D4235735CAF31501_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A0E3CCCDA4A083DF5865D6B5668A1994_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A14C6837F7101114FCF6DE2A13C5B6EA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A16D7515580B5AC1D76A9636F77354B2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A1D24A3220E9B36B6AD8AD96732974E8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A236A4A0E9246669760D9D04D8F16A44_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A1ECA236B97AC5B96F087B4654112B0D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A2621947DA2DFEAC9DF0CAE8EC4229F1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A2BE8742C08195AE854BAB86E5C8BE20_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A2A53BF0AF94EB9A3329B9668A588113_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A398AEFC78F7BC5FDF58469E686B13CB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A5D99A91FDFAADD53D118EEB647D6F1D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A6095D1538163A471064EFE3D55850A6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A651B5638732EFBF37B7B3F82753136B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A617F108F6AC0A7FDB27340D717F22FD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A681D056675F0E4A81AF9D6C165A699D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A71B3E34D4EC29D8959C70F79DDABF9D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A6F4BC6FE7CE013E7824BE7780A327A6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A89E3DC364ABDB6C454258AC2A25CAC5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A7EF06D0C77943A2A987379E90195EAE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A8C22AFC6F2E5DCC4EB72945D28CBDDD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A921CEECB3EF7149555D5B39FD03888D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A9423E4B5FF724C9591D86944878AEC1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A8CCA1D11A4003148628FF6007FEDDBF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A94FAA6F141728DED6CA41CF9C13CD4F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A984508BAC223019AB0DAD8E80F161D1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AAAA010C3C6E1E5D711B7167BFD8DAC2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AAB4E0508F9F676AC9E553A99C379A7A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AA8B01A9DB69DED391397AB467F91160_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ABCD1C43E7CFEA4837557E756F4A1915_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AC076E6D12440463F8B0E4884CBA6BE2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ADA1A2535672D57B06BF536A48716A2A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AEAE4BCF646A65466AE8100E69C22C01_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AF68FD9311716941DD4D77785CFAA1AE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B068B66BC8B23E4CEE9E2D83E5742FBA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B02B333C2B9F916838603ABAD6AE493B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B0D3E94A263D57F6A6E3C6F8DA3C3FCE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B1C03DD3F3FE6C49022421EA455ACE01_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B0DBB4C99C987DED10ED75013A78CBFE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B1A9488131E6A9E6EACDE102B9B65B0F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B3BEB59451008263015450AC7BEC35A1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B3E2CA0B8A276D5130C67250A646542A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B3ADAAA85E62062B8FDEAC32EBEE381F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B4D9555AE6E21E3D120A30DAF4044E06_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B4930ED5F3EEA19389C7E3C9369B2CA4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B4DD4B29A916C1A53288A0455F4A4354_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B54A8D197A575404206CF636CD0E6DBD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B545B4D4752238E5A933C0C0FD9D9660_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B4E4B35CA0DDA371CAF02B879ABEF274_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B5D84E85E15F0EC8FEC7AECB0EC56F81_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B71FF818366A03A525F70E3D8901C3B1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B7497DA252764B2BAFC46D5BBB99C2B4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B82EA66F7FB730533B5B397B518BF3DF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B81100B1152EFD1F12C099922D34B07E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B87E97DC026EEBC726A1F3303E5453A0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B781FF56EDACED23640F3FBB0B5EB8FC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B8C065E2F20497841EAB68D43F2FEC61_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B8F71762B4B5231C028DB8AF8C84D447_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B97576634A6931A9197E52BD942A5792_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BA43C8285C985D4A279B3289CB79909C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BB48793925FDF7637AD614CAF262471D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BB5B68E018976BC93C06DBB2BEA85E11_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BCD6B36841468C5C7F62A62429762143_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BC84F223598E0C82883AFDF2AF878AF9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BD72B5F81B1A7A625F954055F3156705_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BC554C8EEA5EB1DB55B374E6B6DD2FA7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BE31168A5576519C874BF8D84B33CB63_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BFA6523872F4BA98AD1B7F057D7FFEE6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BDE2C460297BCDB1FC844385CBD4DE72_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C0F37CB88BFEF7B5335A3BC5101F3A1C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C15E2CBA272AF4574CB7F45E870FF873_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C18AA4F49175F6D62D2B581CF7613DD4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C2A1B227BA1FBB83CD42FC97839F084F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C20E4A20A76AADFF9851720769C88145_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C34B4604B5EE915DE4D9AE0F875B3D9A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C2070F013558D69D9307108B5F525CC5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C3BE551F68075767B6DC4B928093E496_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C4413A2687835618B8F4004E7884ED88_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C37E53C29335E51EFA10352C16657851_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C4C9D80756E347CE40E366CC408345FB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C60593840954F8B7E7BD588C61EED478_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C6E6D7474DBB2AA22FCAA4C6CA03014D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C8409C33FBFE82D9B4026FA5D4AD751D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C7E5C16D49E3ADE8B4E484B2196D98D1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C8AD97367ABF3360CF4E4218AB113FEE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C73EFCDDAA379D4206B6D8A806DAE54B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C8C76FC6B306A6862D2FAFC58F989E0A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C8891D8B9FBB1B19C416E6AB0DD4E140_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C928DA2FAF324F1DFA509F26593F3542_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CB0E93CC1CE2E9ACC0A4EC89A8E0702D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CBD1AD2AC779C236CA7BF26A7561D735_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CBEDE3D5563FE252B3C0477F957CA386_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CB4F0D025D730DFF2A89B683876817D7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CCD49E0537D7269169DF81D485BB6591_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CD8A498C1502FE2ED1607F83B78E0CC7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CEB04E4F3F5B68C11CA2B6427336AC98_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CFA2850C3F01F3F176A3D98ED295D784_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CD023EC5B2FCEA49B96490F72674C03B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D17A09872A81DA1EC2E126DA0DE23FBE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D30D3CC3F8275EC06DEC75BF302E4790_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D393774F8F6EEE401DAD780EE0255230_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D3588C84C8D977DEE95277B7075C5CF4_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D3948163D61F73D0AD623E4C70F338FC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D3440F8BF68AC8982439A3284172A4B1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D3CFCA7F3E535F9D5F1E0E85A0F83194_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D488F7F603BFCACD8EE0E66D4FF2A405_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D5A533B0196F2BC1406321AAFA8512E3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D5ABC901FAF60E02CB9FABA3DA62C187_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D692CC7BD02660CE943BAC9D3FE9F023_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D81D3FA74C39E0E3DFF7680CEBB638FE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D9527AE899F2D7EB5C7DF15054EB1CA7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D75E51F2CB5CD2F44931D4E9363D5FC3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D8FBCC861974F5A93981B1A38B0202D1_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D8F5FFB00E08C3CAF29C73E47748FA3C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DAB66524E43D32F7EF07643DD4C59436_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DB6F08CAC8CF8D54509DD2164DE57845_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DBC8606A96D3B2ADA34DCCD0C15A1C68_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DCC037FB5B2B5589E79CE052E6B865A0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DCC4178F2FE5ED4665754C500254747D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DD7D0A368A896843974B03850FB3C160_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DF79D095ECF589F536FCB2979CCF2C9C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DF84E1F4CF769C11C219801784ABDE96_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DF8BA190E6E1362911542C35194EF800_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DF937C2F658EBA01E361662ED980626A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E0C3DDC2BD4342998229354C3621951C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E10776894C490F10C27315288BE73F1C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E0C7F2A82220FB8F6313E749D5D8EC79_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E18488FFC9417B3E910F82750B712CEB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DFE9E4AB77E4EBC02175AF8E33A6E014_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E1D5024169F092AC35A63077033DE05F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E19AF0F305CA1314E37A1E2FABFD6650_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E4666695567657C167F0603E01BC0FB0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E434DA19B83DAB78ADC8990926C1B52F_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E33DC19D44864E74D4EEA5DBFE0376C5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E393D2CB3959AEB227B606C37A3169F7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E4F39882F1929C8FBAD481A3CFE8207B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E5306C20C01FE499C9175E86B3346F15_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E5CFEB27F90A94A8E73DB489A64F0B29_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E62C59A577D0F8AA267ABA78555FAE98_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E7603F9323916F9607CD98E029691C40_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E847417B1B93C6E27115A6C1C88812DF_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E6CC82E32661D09E4C9D81AF567B8453_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E90579FD8B35D97B1F43FB675F22B1E7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ED21B1199BF71AA7B62DA62AB70B5F07_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EB93D39BCDD759054F6EA24B04A323A7_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ED2AA48655DAF774DCCA5C4229E9FBD6_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EA70ADDBF59FF5553E31126027814727_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ED42DCA8800EA3A078C4CB3FE6C0BD26_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ED6CC32153D2B930028E782728D158C8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EE1A505E162E5BAFC1A6C921535778F3_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EE24A16402739AEA595F133772979C57_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EE3E6EC192F8716CAE7AC16147363708_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EFFAD71559CB6ACBE50C1A2CB9531BDA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F07B2DB2B692C06E04EB772481C62252_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F075FC7F70B43B361AB2FC7EC64DE5A0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F0EF5B685570563DF8F17904305FE3DE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EFFD45CF980493037661C4A5B89F24EB_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F1663E674E5EA5D67603A0149A1C2907_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F17D7382C7B061BEE692A22AD0FF351B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F241905F242E35A777FF459397722299_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F28EA38A16F871AD9941FF794C6C2294_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F29512836D50D5EFECFD76E0405456FE_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F3AFC415B9DF76BF60302A810C97C345_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F48EB8FCF2181FAED00CBC1AA9F277B9_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F29832DF98FA95B184710B11C5564BFD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F48F5D0AAB69D955A9EDF8C4D11979DC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F4DF82463C590EECDA36E6475BA5758E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F57FDECB441F812C96624AE2DBA2B82E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F6E6093B0C5385B42688E2D572EB5689_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F53FB67205A289EBD8D642ABDEF46C41_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F727CC75AE07B13A5DE62EA153B2F62B_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F6B48ECD22EA9F4D19A5C6828589AB04_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F7407B02BD6D5417209D67282F25C53D_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F7B75CE52ADF5BEEA5FF6DF40AA5221E_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F7D479360C295D2A839120FB4F05DBB8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F84F6E450151C73C609E1BCCD51454ED_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F90FAA77B37895FC74565A8C144FAE58_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FA8901DB8B9F71B4B8D901CFD862D570_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FAA225344E64B090DAE498C379F2C6C2_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FCCAC9AC59430D479714A87895479C3C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FDA482DA2884BB57DA6678379B72BF47_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FB66E410174933173163ECADFE4DB292_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FCDCECB28B535C17A985B8D26875B39C_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FD8C509B603BEC5B192317679F49A9A8_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FE9C3BBAEC7F8CB9E615DC37A5C149EC_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FCCBF2E0C01013F298C75DD4AAF1BB51_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FE0C728DB22C2DC7129534099C34E2F0_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FB63C62ABAE2601954886E5C54772D91_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FEBF8859E8B0AFC9E24EE1A472B13DAA_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FEFCD799B73248C6B0E5FC6F91B23925_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FF3A242036A823BD5A4336C29685DA9A_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FFC826A1D9AAB59A763703DDAC5A86B5_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FFC93C8115B0696A0780F507D367BECD_361F77E7-67B7-4E1F-B628-A5B05DECB0EE
    C:\Program Files\Garena\newgame.ggz\newgame.xml
    C:\Program Files\Garena\onlinegame.ggz\onlinegame.xml
    C:\Program Files\Garena\mdata.ggz\mh.xml
    C:\Program Files\Garena\slotmachine.ggz\slotmachine.xml
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\rateempty.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ratefull.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\Tab.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\TabBg.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ui.xml
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\Window.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\garenatv.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\garenatvlogo.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVBtnOff.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVBtnOn.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVDetailsBG.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVHighlight.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVLVIcons.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\GTVPanel.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\Header.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\logineditbg2.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\logineditbg.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\logineditborder.png
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\menu.bmp
    C:\Program Files\Garena\SkinBlack\garenatv.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\1-01.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\1-02.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\1-03.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\AdButton.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\black_thumbnail.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\black_thumbnail_select.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Chat.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\clan.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Gameicons.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\GameIconsBig.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\gokart_hover.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\gokart_normal.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\gokart_pressed.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\gold.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Header.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\HON.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\hon_hover.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\hon_normal.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\hon_pressed.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\loading.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Lobby.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Login.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\menu.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Messenger.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Mode.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\msango.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\profile.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Room.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Shop.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\shopandtopup.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\shop_gm.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\shop_gm_type.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\shop_magic_item.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Sidebar.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\sidebar_1.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\sidebar_2.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\sidebar_3.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\skinmsn.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Tab.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\TabBg.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Todaystar.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\UserStatusIcon.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\Warning.bmp
    C:\Program Files\Garena\SkinBlack\Skin.ggz\games.xml
    C:\Program Files\Garena\SkinBlack\Skin.ggz\images.xml
    C:\Program Files\Garena\SkinBlack\Skin.ggz\ui.xml
    C:\Program Files\Garena\Skin\garenatv.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\rateempty.png
    C:\Program Files\Garena\Skin\garenatv.ggz\ratefull.png
    C:\Program Files\Garena\Skin\garenatv.ggz\Tab.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\TabBg.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\ui.xml
    C:\Program Files\Garena\Skin\garenatv.ggz\Window.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\garenatv.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\garenatvlogo.png
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVBtnOff.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVBtnOn.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVDetailsBG.png
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVHighlight.png
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVLVIcons.png
    C:\Program Files\Garena\Skin\garenatv.ggz\GTVPanel.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\Header.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\logineditbg2.png
    C:\Program Files\Garena\Skin\garenatv.ggz\logineditbg.png
    C:\Program Files\Garena\Skin\garenatv.ggz\logineditborder.png
    C:\Program Files\Garena\Skin\garenatv.ggz\menu.bmp
    C:\Program Files\Garena\Skin\garenatv.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\1-01.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\1-02.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\1-03.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\AdButton.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Chat.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\clan.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Gameicons.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\GameIconsBig.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\gokart_hover.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\gokart_normal.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\gokart_pressed.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\gold.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Header.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\HON.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\hon_hover.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\hon_normal.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\hon_pressed.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\loading.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Lobby.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Login.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\menu.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Messenger.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Mode.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\msango.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Profile.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\red_thumbnail.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\red_thumbnail_select.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Room.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Shop.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\shopandtopup.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\shop_gm.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\shop_gm_type.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\shop_magic_item.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Sidebar.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\sidebar_1.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\sidebar_2.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\sidebar_3.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\skinmsn.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Tab.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\TabBg.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Todaystar.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\UserStatusIcon.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\Warning.bmp
    C:\Program Files\Garena\Skin\Skin.ggz\games.xml
    C:\Program Files\Garena\Skin\Skin.ggz\images.xml
    C:\Program Files\Garena\Skin\Skin.ggz\ui.xml
    C:\Program Files\Garena\Languages\FPSGame.dll.cn\lang.xml
    C:\Program Files\Garena\Languages\FPSGame.dll.en\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.en\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.id\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.en\server.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.id\server.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.cn\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.cn\server.xml
    C:\Program Files\Garena\Languages\FPSGame.dll.tw\lang.xml
    C:\Program Files\Garena\Languages\OLGame.dll.en\lang.xml
    C:\Program Files\Garena\Languages\OLGame.dll.vn\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.tw\lang.xml
    C:\Program Files\Garena\Languages\GarenaTV_UI.dll.tw\server.xml
    C:\Program Files\Garena\Languages\update.exe.tw\update.exe.tw.xml
    C:\Program Files\Garena\Languages\update.exe.cn\update.exe.cn.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.br\lang.xml
    C:\Program Files\Garena\Languages\update2.exe.tw\update2.exe.tw.xml
    C:\Program Files\Garena\Languages\update2.exe.cn\update2.exe.cn.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.cn\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.en\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.kr\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.kz\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.ru\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.sp\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.tw\lang.xml
    C:\Program Files\Garena\Languages\WC3Ass.dll.vn\lang.xml
    C:\Program Files\Garena\Languages\WC3Ladder.dll.en\lang.xml
    C:\Program Files\Garena\Languages\WC3Ladder.dll.tw\lang.xml
    C:\Program Files\Garena\Languages\WC3Ladder.dll.cn\lang.xml
    C:\Program Files\Garena\GarenaTV\en_s.ggz\lang.xml
    C:\Program Files\Garena\GarenaTV\en_s.ggz\server.xml
    C:\Program Files\Garena\GarenaTV\id_s.ggz\server.xml
    C:\Program Files\Garena\GarenaTV\en.ggz\default.xml
    C:\Program Files\Garena\GarenaTV\en.ggz\dota657b.xml
    C:\Program Files\Garena\GarenaTV\en.ggz\dota659.xml
    C:\Program Files\Garena\GarenaTV\cn_s.ggz\lang.xml
    C:\Program Files\Garena\GarenaTV\cn_s.ggz\server.xml
    C:\Program Files\Garena\GarenaTV\cn.ggz\default_cn.xml
    C:\Program Files\Garena\GarenaTV\cn.ggz\dota657b_cn.xml
    C:\Program Files\Garena\GarenaTV\cn.ggz\dota659_cn.xml
    C:\Program Files\Garena\GarenaTV\tw.ggz\default_tw.xml
    C:\Program Files\Garena\GarenaTV\tw.ggz\dota657b_tw.xml
    C:\Program Files\Garena\GarenaTV\tw.ggz\dota659_tw.xml
    C:\Program Files\Garena\GarenaTV\tw_s.ggz\lang.xml
    C:\Program Files\Garena\GarenaTV\tw_s.ggz\server.xml
    C:\Program Files\Garena\Crystal\garenatv.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\rateempty.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\ratefull.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\Tab.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\TabBg.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\ui.xml
    C:\Program Files\Garena\Crystal\garenatv.ggz\Window.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\garenatv.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\garenatvlogo.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVBtnOff.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVBtnOn.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVDetailsBG.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVHighlight.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVLVIcons.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\GTVPanel.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\Header.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\logineditbg2.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\logineditbg.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\logineditborder.png
    C:\Program Files\Garena\Crystal\garenatv.ggz\menu.bmp
    C:\Program Files\Garena\Crystal\garenatv.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\1-01.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\1-02.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\1-03.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\AdButton.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Chat.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\clan.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\crystal_thumbnail.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\crystal_thumbnail_select.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Gameicons.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\GameIconsBig.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\gokart_hover.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\gokart_normal.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\gokart_pressed.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\gold.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Header.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\HON.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\hon_hover.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\hon_normal.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\hon_pressed.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\loading.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Lobby.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Login.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\menu.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Messenger.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Mode.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\msango.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Profile.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Room.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Shop.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\shopandtopup.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\shop_gm.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\shop_gm_type.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\shop_magic_item.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Sidebar.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\sidebar_1.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\sidebar_2.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\sidebar_3.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\skinmsn.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\skinselect_thumbnail_bg.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Tab.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\TabBg.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Todaystar.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\UserStatusIcon.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\Warning.bmp
    C:\Program Files\Garena\Crystal\Skin.ggz\games.xml
    C:\Program Files\Garena\Crystal\Skin.ggz\images.xml
    C:\Program Files\Garena\Crystal\Skin.ggz\ui.xml
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\rateempty.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ratefull.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\Tab.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\TabBg.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ui.xml
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\Window.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\garenatv.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\garenatvlogo.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVBtnOff.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVBtnOn.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVDetailsBG.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVHighlight.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVLVIcons.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\GTVPanel.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\Header.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\logineditbg2.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\logineditbg.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\logineditborder.png
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\menu.bmp
    C:\Program Files\Garena\ArmyGreen\garenatv.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\1-01.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\1-02.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\1-03.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\AdButton.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\armygreen_thumbnail.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\armygreen_thumbnail_select.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Chat.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\clan.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Gameicons.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\GameIconsBig.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\gokart_hover.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\gokart_normal.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\gokart_pressed.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\gold.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Header.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\HON.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\hon_hover.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\hon_normal.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\hon_pressed.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\loading.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Lobby.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Login.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\menu.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Messenger.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Mode.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\msango.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Profile.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\ProgressBarBgH.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\ProgressBarBgV.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\ProgressBarH.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\ProgressBarV.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Room.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Shop.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\shopandtopup.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\shop_gm.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\shop_gm_type.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\shop_magic_item.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Sidebar.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\sidebar_1.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\sidebar_2.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\sidebar_3.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\skinmsn.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\skinselect_thumbnail_bg.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Tab.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\TabBg.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Todaystar.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\UserStatusIcon.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\Warning.bmp
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\games.xml
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\images.xml
    C:\Program Files\Garena\ArmyGreen\Skin.ggz\ui.xml
    C:\BOOT\BCD
    C:\BOOT\BCD.LOG


Psychotic 01.03.2012 08:57

Prüfung über Virustotal



Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
  • Klicke auf Durchsuchen
  • Kopiere nun folgendes in die Suchleiste.
    Code:

    C:\Users\Paul\AppData\Roaming\ICQ\{CE050506-AFAA-4BE0-96CF-C190306B4144}\renovator.exe
  • und klicke auf Öffnen.
  • Klicke auf Send File.
Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen. klicke auf Reanalyse. Warte bis unter Current status: Finished steht. Kopiere den Link aus deiner Adresszeile und poste ihn hier. Wiederhole die selben Schritte mit folgenden Dateien.
Code:

C:\Program Files\Warkeys\update\FBZip.exe


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:08 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129