Trojaner-Board - Malwarebytes findet PUP.funmoods in Registry

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Malwarebytes findet PUP.funmoods in Registry (https://www.trojaner-board.de/114028-malwarebytes-findet-pup-funmoods-registry.html)

Malwarebytes findet PUP.funmoods in Registry

Guten Abend,

ich habe heute mein System mit Malwarebytes Anti-Malware durchsucht und es hat gleich vier infizierte Objekte in der Registry gefunden, alle mit der Bezeichnung "PUP.funmoods". Ich habe natürlich diese Einträge gleich mit Malwarebytes gelöscht, jedoch würde ich gerne wissen, ob das echte Schädlinge sind oder nur Adware (bzw. das Programm dahinter)? Sollte ich noch etwas unternehmen, damit mein PC wieder 100% clean wird (wie er vorher war)?
Für jede Antwort bin ich dankbar.

Mein System:

Win7 64 Bit
Virenschutz: Avast Free Anti-Virus 7

Im Anhang sind die Logfiles von DDS und Malwarebytes.

Grüße,

flaaghuhn

Zitat:

Malwarebytes findet PUP.funmoods in Registry

Das kommt, wenn man Funmoods installiert, eine sinnfreie bis schädliche Browsererweiterung nur um ein paar Smilies mehr in Facebook zu haben

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Na ja, solche Dinger habe ich halt nie willentlich installiert^^.

Ich habe recht viele Logs von Malwarebytes, weil ich damit immer wieder meinen PC scanne - soll ich wirklich alle posten? Gefunden wurde sonst nie etwas.

Grüße,

flaaghuhn

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Okay, nach 4,5 Stunden ist der Scan endlich mal fertig - ist das normal, dass es so extrem lange gedauert hat? Na ja, gefunden hat es nichts.

Grüße,

flaaghuhn

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=f60571956ad2ec48aeb0ba232b53dcae

# end=stopped

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-25 05:10:17

# local_time=2012-04-25 07:10:17 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776573 100 94 256 87003663 0 0

# compatibility_mode=8192 67108863 100 0 509 509 0 0

# scanned=664

# found=0

# cleaned=0

# scan_time=4

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=f60571956ad2ec48aeb0ba232b53dcae

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-25 09:39:16

# local_time=2012-04-25 11:39:16 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=5893 16776573 100 94 3932 87003739 0 0

# compatibility_mode=8192 67108863 100 0 585 585 0 0

# scanned=268311

# found=0

# cleaned=0

# scan_time=16066

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

1.)
Windows funktioniert im normalen Modus eigentlich so, wie es sein sollte.

Seit dem ich aber die neue LibreOffice Version installiert habe, kann ich auf meine Dokumente nicht mehr per Doppelklick aufs Icon öffnen, da kommt eine Fehlermeldung ("Der angeforderte Vorgang erfordert erhöhte Rechte"), aber ich denke kaum, dass es von Malware verursacht wird (Wenn ich z.B. Wordpad befehle, .odt Dateien zu öffnen, dann klappt es auch per Doppelklick, und in LibreOffice lassen sich die Dateien auch normal öffnen, nur geht halt der Doppelklick aufs Icon nicht -> Fehlermeldung). Dabei bin ich aber als Administrator eingeloggt.

2.)
Im Startmenü vermisse ich nichts, unter "Alle Programme" gibt es nur zwei leere Ordner: "Autostart" und "Freemake".

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Okay, habe ich gemacht. Die Logfiles muss ich wohl in verschiedenen Beiträgen posten, da ich jetzt keine Dateien mehr anhängen kann.

Logfile vom normalen Scan:
OTL Logfile:

Code:

OTL logfile created on: 26.04.2012 18:07:42 - Run 2

OTL by OldTimer - Version 3.2.42.1     Folder = C:\Users\***\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,99 Gb Total Physical Memory | 2,11 Gb Available Physical Memory | 52,89% Memory free

7,98 Gb Paging File | 5,37 Gb Available in Paging File | 67,31% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 905,41 Gb Total Space | 681,30 Gb Free Space | 75,25% Space Free | Partition Type: NTFS

Drive D: | 25,00 Gb Total Space | 19,26 Gb Free Space | 77,02% Space Free | Partition Type: NTFS

Drive E: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: RH-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.26 17:25:32 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

PRC - [2012.04.21 03:16:21 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2012.04.20 19:16:51 | 000,489,256 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.03.07 02:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe

PRC - [2012.03.07 02:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe

PRC - [2012.02.14 17:37:59 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe

PRC - [2012.01.15 01:22:28 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.08.15 17:18:14 | 001,955,208 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

PRC - [2011.03.31 05:37:10 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.21 03:16:53 | 001,952,696 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

MOD - [2012.04.20 19:16:48 | 020,297,512 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll

MOD - [2012.04.20 19:16:46 | 000,907,048 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL

MOD - [2012.04.20 19:16:44 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll

MOD - [2012.04.20 19:16:42 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll

MOD - [2012.04.20 19:16:40 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll

MOD - [2011.03.31 05:37:10 | 000,491,520 | ---- | M] () -- C:\Windows\system\cmau106.dll

MOD - [2011.03.31 05:37:10 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.12.06 05:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.04.20 19:16:51 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.04.13 22:32:27 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.04.05 15:50:08 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Paused] -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.03.07 02:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.14 17:37:59 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.08.15 17:18:12 | 002,329,480 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.07 02:04:06 | 000,819,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)

DRV:64bit: - [2012.03.07 02:04:04 | 000,337,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)

DRV:64bit: - [2012.03.07 02:02:20 | 000,053,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)

DRV:64bit: - [2012.03.07 02:01:57 | 000,059,224 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)

DRV:64bit: - [2012.03.07 02:01:52 | 000,069,976 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV:64bit: - [2012.03.07 02:01:32 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.12.06 05:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2011.12.06 04:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2011.10.17 19:40:50 | 000,093,712 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.31 05:37:23 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.03.18 18:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2005.03.09 21:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\libusb0.sys -- (libusb0)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://eu.ask.com/web?l=dis&o=16552&gct=hp&apn_dtid=^YYYYYY^YY^DE&apn_ptnrs=^A9T&apn_uid=2491552175464200&p2=^A9T^YYYYYY^YY^DE

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A9 11 16 23 F6 E7 CC 01  [binary data]

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes,DefaultScope = {8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}: "URL" = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}: "URL" = hxxp://eu.ask.com/web?l=dis&o=16552&gct=sb&qsrc=2869&apn_dtid=^YYYYYY^YY^DE&apn_ptnrs=^A9T&apn_uid=2491552175464200&p2=^A9T^YYYYYY^YY^DE&q={searchTerms}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{C346F459-10D6-4C3F-84C9-08F57493FBF2}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.03.24 12:28:36 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.21 23:25:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.01.14 23:51:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2012.04.25 17:42:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions

[2012.01.16 19:44:58 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.02.21 00:01:05 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com

[2012.02.21 00:01:04 | 000,001,798 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\searchplugins\funmoods.xml

[2012.04.21 23:25:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.03.24 12:28:36 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\EXTENSIONS\GROOVESHARKUNLOCKER@OVERLORD1337.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI

[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.16 14:53:20 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\ask.xml

[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll

CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll

CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\

CHR - Extension: avast! WebRep = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\

CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O3 - HKLM\..\Toolbar: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)

O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{42847496-B284-445A-B872-6729C5DB2D9E}: NameServer = 82.145.9.8 89.246.64.8

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 0

O32 - AutoRun File - [2007.10.25 01:29:17 | 000,000,000 | ---D | M] - E:\autorun -- [ CDFS ]

O32 - AutoRun File - [2007.07.19 16:53:44 | 000,000,058 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2007.10.25 00:11:40 | 004,318,432 | R--- | M] (Crytek) - E:\AutoRunCD.exe -- [ CDFS ]

O33 - MountPoints2\{b9805b12-3ef5-11e1-96ad-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b9805b12-3ef5-11e1-96ad-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRunCD.exe -- [2007.10.25 00:11:40 | 004,318,432 | R--- | M] (Crytek)

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.26 17:25:23 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.26 15:53:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B8503599-2A33-4B31-9B97-526F2CBB2CDD}

[2012.04.26 15:51:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6227BB1E-88CE-414B-875C-57B4A6C2C652}

[2012.04.26 15:32:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5EBE63F6-A160-44E2-BC70-5B23AFB37059}

[2012.04.26 15:32:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{060B7087-E2F7-4A00-B25E-26159C3A3EB9}

[2012.04.26 15:16:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps

[2012.04.26 15:16:40 | 000,000,000 | ---D | C] -- C:\Fraps

[2012.04.26 13:47:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.04.26 13:45:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 3.5

[2012.04.26 13:43:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LibreOffice 3.5

[2012.04.25 19:01:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.04.25 17:48:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.04.25 17:48:03 | 000,637,848 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll

[2012.04.25 17:48:03 | 000,224,136 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe

[2012.04.25 17:48:03 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe

[2012.04.25 17:48:03 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe

[2012.04.25 17:47:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2012.04.25 17:46:44 | 000,264,584 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe

[2012.04.25 17:46:44 | 000,188,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe

[2012.04.25 17:46:44 | 000,188,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe

[2012.04.25 17:46:33 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2012.04.21 23:25:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2012.04.21 23:25:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.04.20 21:34:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Chromium

[2012.04.20 19:20:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios

[2012.04.20 19:20:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Hi-Rez Studios

[2012.04.20 19:20:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hi-Rez Studios

[2012.04.20 18:44:24 | 000,000,000 | RH-D | C] -- C:\Users\***\AppData\Roaming\SecuROM

[2012.04.20 18:18:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\URTTEMP

[2012.04.20 18:15:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts

[2012.04.14 02:57:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Resource Hacker

[2012.04.14 02:57:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Resource Hacker

[2012.04.13 03:03:24 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\IsolatedStorage

[2012.04.12 15:17:22 | 000,000,000 | ---D | C] -- C:\ProgramData\TrackMania

[2012.04.12 03:03:37 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2012.04.12 03:03:36 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2012.04.12 03:03:35 | 002,311,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2012.04.12 03:03:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2012.04.12 03:03:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2012.04.12 03:03:34 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2012.04.12 03:03:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2012.04.12 03:03:33 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.04.12 03:03:33 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2012.04.12 03:03:32 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2012.04.12 03:03:31 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2012.04.12 03:03:13 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.04.12 03:03:13 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.04.12 03:03:12 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.04.12 03:00:56 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys

[2012.04.12 03:00:55 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2012.04.12 03:00:50 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2012.04.11 23:35:33 | 000,000,000 | ---D | C] -- C:\Users\***\riotsGamesLogs

[2012.04.11 18:35:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.04.11 18:35:07 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.04.11 15:16:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TmNationsForever

[2012.04.11 15:15:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TmNationsForever

[2012.04.09 02:38:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LolClient

[2012.04.08 22:54:19 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll

[2012.04.08 22:54:19 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll

[2012.04.08 22:54:18 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll

[2012.04.08 22:40:06 | 000,000,000 | ---D | C] -- C:\Riot Games

[2012.04.08 22:40:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games

[2012.04.08 21:10:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks

[2012.04.04 19:35:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\My Games

[2012.04.04 19:16:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\2K Games

[2012.04.04 19:14:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\InstallShield

[2012.04.02 12:32:19 | 008,741,536 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe

[2012.04.02 12:24:18 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.01 19:01:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bloodshed Dev-C++

[2012.04.01 18:38:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\codeblocks

[2012.04.01 18:38:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeBlocks

[2012.04.01 18:09:19 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dev-Cpp

[2012.04.01 18:08:56 | 000,000,000 | ---D | C] -- C:\Dev-Cpp

[2012.04.01 18:03:05 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++

[2012.04.01 18:03:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++

[2012.04.01 18:03:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Notepad++

[2012.04.01 18:03:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++

[2012.03.30 19:45:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2012.03.30 19:45:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.26 17:56:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.04.26 17:32:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.26 17:25:32 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.26 16:20:11 | 000,010,818 | ---- | M] () -- C:\Users\***\Documents\Mein Film.wlmp

[2012.04.26 16:09:49 | 077,702,368 | ---- | M] () -- C:\Users\***\Desktop\Blops Skillshooting.wmv

[2012.04.26 15:16:45 | 000,000,572 | ---- | M] () -- C:\Users\***\Desktop\Fraps.lnk

[2012.04.26 14:56:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.04.26 13:51:23 | 000,011,324 | ---- | M] () -- C:\Users\***\Documents\Blog 01 12.03.12.odt

[2012.04.26 13:45:35 | 000,001,110 | ---- | M] () -- C:\Users\Public\Desktop\LibreOffice 3.5.lnk

[2012.04.26 13:25:59 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.26 13:25:59 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.26 13:18:25 | 000,307,984 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.04.26 13:18:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.26 13:18:08 | 3214,233,600 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.25 17:47:51 | 000,224,136 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe

[2012.04.25 17:47:51 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe

[2012.04.25 17:47:51 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe

[2012.04.25 17:47:50 | 000,637,848 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll

[2012.04.25 17:47:50 | 000,567,696 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll

[2012.04.25 17:46:36 | 000,264,584 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe

[2012.04.25 17:46:36 | 000,188,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe

[2012.04.25 17:46:36 | 000,188,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe

[2012.04.25 17:46:35 | 000,750,488 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npdeployJava1.dll

[2012.04.25 17:46:35 | 000,660,368 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll

[2012.04.23 18:13:28 | 000,012,685 | ---- | M] () -- C:\Users\***\Documents\Drehbuch - Letzer Ausweg Religion.odt

[2012.04.23 00:21:24 | 000,000,173 | ---- | M] () -- C:\Users\***\AppData\Local\msmathematics.qat.***

[2012.04.21 23:25:55 | 000,001,053 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.04.20 18:18:58 | 001,561,054 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.04.20 18:18:58 | 000,667,012 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.20 18:18:58 | 000,627,194 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.20 18:18:58 | 000,135,778 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.20 18:18:58 | 000,111,430 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.20 18:17:18 | 000,103,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2012.04.20 18:17:14 | 000,103,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0

[2012.04.20 18:17:10 | 000,669,184 | ---- | M] () -- C:\Windows\SysWow64\pbsvc.exe

[2012.04.17 15:37:49 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr

[2012.04.14 19:58:42 | 000,002,268 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2012.04.13 22:32:27 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.13 22:32:27 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.04.13 22:32:20 | 008,741,536 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe

[2012.04.12 03:06:00 | 001,526,806 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.08 22:19:32 | 000,019,665 | ---- | M] () -- C:\Users\***\Documents\Blog 03 08.04.2012.odt

[2012.04.08 19:50:34 | 000,011,709 | ---- | M] () -- C:\Users\***\Documents\Blog 03 25.03.12.odt

[2012.04.05 02:09:19 | 000,027,495 | ---- | M] () -- C:\Users\***\Documents\Verfassung.graphml

[2012.04.04 16:17:23 | 000,000,180 | ---- | M] () -- C:\Users\***\cinderella2-user.properties

[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.03.31 22:44:47 | 000,025,500 | ---- | M] () -- C:\Users\***\Documents\Drehbuch - Die Jugend am Abgrund.odt

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.04.26 16:09:00 | 077,702,368 | ---- | C] () -- C:\Users\***\Desktop\Blops Skillshooting.wmv

[2012.04.26 15:49:42 | 000,010,818 | ---- | C] () -- C:\Users\***\Documents\Mein Film.wlmp

[2012.04.26 15:16:45 | 000,000,572 | ---- | C] () -- C:\Users\***\Desktop\Fraps.lnk

[2012.04.26 13:45:35 | 000,001,110 | ---- | C] () -- C:\Users\Public\Desktop\LibreOffice 3.5.lnk

[2012.04.23 18:13:27 | 000,012,685 | ---- | C] () -- C:\Users\***\Documents\Drehbuch - Letzer Ausweg Religion.odt

[2012.04.20 18:17:10 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe

[2012.04.08 22:19:30 | 000,019,665 | ---- | C] () -- C:\Users\***\Documents\Blog 03 08.04.2012.odt

[2012.04.05 02:09:19 | 000,027,495 | ---- | C] () -- C:\Users\***\Documents\Verfassung.graphml

[2012.04.02 12:24:24 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.03.24 14:05:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2012.03.23 23:03:58 | 000,000,412 | ---- | C] () -- C:\Users\***\AppData\Roaming\All CPU Meter_Settings.ini

[2012.03.06 19:14:04 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat

[2012.03.02 23:56:52 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll

[2012.03.02 23:56:42 | 000,001,210 | ---- | C] () -- C:\Windows\Cm106.ini.cfl

[2012.03.02 23:56:32 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg

[2012.03.02 23:56:32 | 000,001,085 | ---- | C] () -- C:\Windows\Cm106.ini.imi

[2012.02.24 18:30:15 | 000,033,792 | ---- | C] () -- C:\Windows\SysWow64\drivers\libusb0.sys

[2012.02.11 20:18:49 | 000,006,656 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.01.20 20:27:56 | 000,001,476 | ---- | C] () -- C:\Users\***\AppData\Local\RecConfig.xml

[2012.01.15 20:35:22 | 000,000,173 | ---- | C] () -- C:\Users\***\AppData\Local\msmathematics.qat.***

[2012.01.15 15:04:27 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2012.01.15 15:04:24 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2012.01.14 23:43:44 | 000,042,672 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys

[2012.01.14 23:39:57 | 000,019,488 | ---- | C] () -- C:\Windows\prodsett_copy.ini

[2012.01.14 23:39:56 | 001,561,054 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.12.06 04:35:10 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2011.12.06 04:35:10 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2011.09.13 01:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.03.31 05:37:10 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini

 
 ========== LOP Check ==========

 

[2012.04.21 19:47:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.minecraft

[2012.02.07 21:44:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Auslogics

[2012.04.01 19:08:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dev-Cpp

[2012.04.20 13:23:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox

[2012.02.13 20:06:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft

[2012.02.13 20:06:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.04.11 23:31:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GameMaker

[2012.02.01 21:22:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView

[2012.04.26 13:47:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.04.09 02:38:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient

[2012.04.01 18:17:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++

[2012.02.10 15:32:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera

[2012.01.15 14:12:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin

[2012.02.10 17:23:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\pdfforge

[2012.02.23 13:58:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\pokerth

[2012.03.03 00:17:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RotMG.Production

[2012.02.11 20:23:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Solveig Multimedia

[2012.04.11 18:58:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client

[2012.02.21 00:07:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XMedia Recode

[2012.03.23 15:37:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\yWorks

[2012.04.11 20:02:22 | 000,000,000 | ---D | M] -- C:\Users\***H\AppData\Roaming\.minecraft

[2012.04.06 13:17:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

Extras:
OTL Logfile:

Code:

OTL Extras logfile created on: 26.04.2012 18:07:42 - Run 2

OTL by OldTimer - Version 3.2.42.1     Folder = C:\Users\***\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,99 Gb Total Physical Memory | 2,11 Gb Available Physical Memory | 52,89% Memory free

7,98 Gb Paging File | 5,37 Gb Available in Paging File | 67,31% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 905,41 Gb Total Space | 681,30 Gb Free Space | 75,25% Space Free | Partition Type: NTFS

Drive D: | 25,00 Gb Total Space | 19,26 Gb Free Space | 77,02% Space Free | Partition Type: NTFS

Drive E: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: *** | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

[HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{153C0FD7-E670-4572-8C71-4FC9ACFD4A1A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{21483B2D-4E69-41F2-9187-27298DA69C87}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{3D0F76DE-4557-43D1-A899-F8B0500ED51F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{515CDD51-7955-4BD6-A25F-F7C217D48960}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6C3B9F5C-8380-4133-9C9D-376BDE9E7D61}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{6FFAE0A0-55DB-4A4A-A5CC-D5AA053C2638}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{7DBAA3C1-D6C5-4B37-9856-3BD1BC386612}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{7E414E29-2FE5-4364-AF8E-F158E99914D2}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{83D87029-BA02-407D-8D78-145B32FDE385}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{B49659FF-9865-41C5-A68E-8C6BD8486F4A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{BAC2E2FE-B3BA-4FC8-923E-90DC5589185E}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{EAD73776-F520-4C49-8199-3971AC4FDA21}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{FB667122-6E7E-41C2-A27E-61B9323F27F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{005CCA91-7C4E-453B-86E6-60986E4DBA1B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{0168A664-9DB3-4B27-B714-32B35CD66BDF}" = protocol=6 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 

"{0521559D-97F5-4B6F-9926-69E27361E45C}" = protocol=6 | dir=out | app=system | 

"{08F2B64B-F71E-454F-A318-B325D2779023}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{1166DD5A-ECFE-4FDB-A954-840C82B1E8BE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{12CE71E3-6222-4AF9-87C5-01408025C9C5}" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | 

"{1319BF58-1B26-407F-A422-76E59F1AC015}" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe | 

"{14DE6E41-91CE-46E4-A89A-10DA75F86A41}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{172ECA33-00E9-4021-A95B-060143B9C314}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 

"{2AF09565-5102-4410-9009-20C7036729A9}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe | 

"{2CD00C56-A80D-44C1-B713-FF19173393FE}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{2DAD5CE0-A99E-4853-B734-A1588CAC56BF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war gold\w40kwa.exe | 

"{320B0550-02DC-4F66-BE42-54660DE655FC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe | 

"{369BE4FC-1604-4592-A46A-80143A8D5C3D}" = protocol=17 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 

"{36F2B22D-AEE5-4630-91CC-D3B7D7CC564C}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 

"{398357D0-B56A-4D9C-8173-E29C0B6D3EE2}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{3A9D4838-EA54-4CE8-851C-95B9BBDFA496}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{3AFF7186-3227-4A1A-BD5A-A14A0F760789}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe | 

"{439A3D7B-6D5C-463C-A8CE-CD72A6F9878F}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | 

"{4653E739-B9D6-4BE3-A274-50981C9D44EB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{47615818-8182-48D0-8E98-FC02811FB7FC}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | 

"{482B21C2-C1A9-4DA6-9FAA-95D031B41C68}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\defcon\defcon.exe | 

"{48CA08A0-E598-4854-99E8-D7CF1A3341BA}" = protocol=17 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 

"{499EFEB2-D82E-4EE2-8227-4C71264E0886}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\super meat boy\supermeatboy.exe | 

"{4C2CD035-59BA-4894-BD79-B7FE553615BA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 

"{4CB19721-A2DE-4BCE-BCF1-E0AF8960747E}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{5143AB4D-0D93-4089-8226-59B090DD4224}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 

"{51934C45-23F2-4686-83CE-5CCEAB29F126}" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 

"{51BC32CF-A7F9-4AE7-8F8B-ABC2EE474BF7}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 

"{531BADBE-1C9F-4A77-8CD5-0BCF1958C24C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{53BBB79B-3F0F-435C-A74D-C891F082F00A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war 2\dow2.exe | 

"{55192D7F-A00C-4EE1-B1A1-6EF0BDD5C351}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war dark crusade\darkcrusade.exe | 

"{5C1FA738-396E-43AD-BC8B-5FF59946FA55}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{6621F89A-E01C-4961-B295-EF23F78D55F3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm | 

"{66C50222-2AA5-4EF6-A19D-3E8E5C5BB889}" = protocol=6 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 

"{67E5D43C-20A5-43C2-9863-BFE46E1E002E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\wormsxhd\launcher.exe | 

"{6826EFF8-9BFD-4736-87F0-B2FFDDDD07FE}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{6E3B2B2B-A176-4A42-96A2-9060ED78C104}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe | 

"{71602CB9-18FC-4195-A884-E3E50B82DF3F}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 

"{728D45CF-500A-4346-B3CC-820FF336F5ED}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm | 

"{7474C726-9EED-486A-B797-82B590E30B11}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war 2\dow2.exe | 

"{74EBD407-6084-415F-B6BD-AD88CCC125AC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{79AB43D3-69A6-4A91-AD28-35F7565A7559}" = protocol=17 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 

"{7BCC43BC-D4B7-4FEE-98B9-0B2E6B124B70}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 

"{7BF8C8F9-4C6C-4197-A2A8-4401178C8D66}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{7DE6A1D9-0691-4283-8269-5DB4E8B073D6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dead space\dead space.exe | 

"{7E205046-3A9D-47D7-AC44-758B0CD1C2C4}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 

"{82795455-07AB-4EF0-B9AC-4CAC8C4CB5A1}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{832E8F3E-3676-49AF-B11D-B87BD12F9325}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{8596C370-1201-4020-8766-046A2FA8C7AD}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 

"{85BD09A3-B85F-44C9-98BF-7522C47F115C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{85C26BEC-DC45-4D63-B552-E7836AB91231}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{85EBF4E5-91C9-45BB-BF9A-C03FD87B34AA}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 

"{8B01D029-48E2-446E-A866-849037F378D3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{8BD9730E-EE8E-44B0-B91B-0481B3A9E194}" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe | 

"{901DA16E-AF62-4E72-AC83-0A35B54FD5E3}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe | 

"{91E3B3AD-52D9-4BDD-A96D-73C7A3290F5E}" = protocol=6 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 

"{94F4CFFC-43E0-47A9-8A3D-6A8862C9467C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe | 

"{9742CCB8-5A45-4A7A-8C20-A94689FCA9A6}" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe | 

"{9AF7EDE5-1072-4604-9484-C72DFF40B3C7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\wormsxhd\launcher.exe | 

"{9E7FEE9B-832F-4769-83E7-A6D615E42809}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | 

"{A27023B1-E0CD-4F58-9B34-107F436DC16F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{A339A3A7-2D31-400B-AA25-9EB6274D899C}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 

"{A34249F8-26AC-46BE-822E-793A1094F98A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{A3A0D55A-D4E1-4F5A-B94E-D07962CF9770}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 

"{A581A37C-FEC6-4470-BE5B-9B202B41F5AF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 

"{AB5E2B5B-6727-42F6-98D7-4BD51A5D9D6A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{AD8CB3F5-08F4-400C-9848-8F194412C2CD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war gold\w40kwa.exe | 

"{AEE3AE9F-4C7D-4ABD-B044-0E162756BF45}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 

"{B16B187A-04AA-4DC3-A315-6A6226DE8254}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | 

"{B32556B4-5227-48D0-972B-056224C1F97F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe | 

"{B398EC8D-16D0-4FB3-89B6-E3B33992C55E}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{B73B1B58-58BA-4010-9382-FA5E84772EC4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{BA21E153-DC04-4160-80DD-93EE12AD02F3}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | 

"{BBEF4AEB-0353-44E3-AA03-4ECC3BC518B3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{BD65B859-31FB-44D0-A5BE-50E7C4729A48}" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | 

"{BD6DDD12-157B-4526-95A4-22EC9A31660C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 

"{C091F68E-BDC1-476F-9D01-BE227EC78B66}" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 

"{C49B1053-C4A7-4433-914A-955DF211D41C}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe | 

"{CD96534D-6434-4651-BF0B-0CC4CEAB12D0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war gold\w40k.exe | 

"{CE5474B8-EA1F-4B29-B9DC-6D7C20C47C96}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{CEA3BAA9-2C0C-4E3C-AB6E-55BCAC6275E8}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{D2EE11F2-0499-43AF-A2C9-D4341928C84D}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | 

"{D4A2006A-8294-493B-8767-3B1AEB782FAA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe | 

"{D6994DAE-D364-4BFB-B6EC-B1789ACA879B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 

"{D7149CF0-F70C-463D-9B82-64DA3943488D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\defcon\defcon.exe | 

"{E07232B4-516A-4E90-AC13-CD0D1EFCA40F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\super meat boy\supermeatboy.exe | 

"{E24D50CB-37D9-4A14-8718-0875022EFDD6}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{E4B511FC-7F14-4025-9A3D-3FC3E8093844}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 

"{ED5586C6-2F24-4DDD-8E5B-71BFDC7FEC00}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{EE1D54C2-3D19-48E3-9297-487597CD1FDC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dead space\dead space.exe | 

"{EF4AC209-76C9-4EA5-8713-F96FFA89F13A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe | 

"{F0691CD9-EBDA-4F04-811C-65F0D98D078E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war gold\w40k.exe | 

"{F124B8FB-23AD-4D79-A26F-69D818CC04F0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{F3882A5F-3951-44FD-99AB-F577B4D25A0B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 

"{FAED8E1E-9AB2-4861-92B1-BE5479244B69}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dawn of war dark crusade\darkcrusade.exe | 

"{FE9D5C68-E0C2-4FA2-B2A4-1E17A62BF723}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{FFE9EE51-1D39-468D-B282-2ACCAB75549C}" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe | 

"TCP Query User{10D2D198-A362-4D3E-BDBA-6DCD1EEED914}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 

"TCP Query User{46198B5E-0ABC-4AC7-B06E-0F7B6CF6888C}C:\program files (x86)\yworks\yed\yed.exe" = protocol=6 | dir=in | app=c:\program files (x86)\yworks\yed\yed.exe | 

"TCP Query User{465C7D16-4B80-4F0C-ABCF-F53C53E7B36D}C:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe | 

"TCP Query User{46C0469E-2FC0-4C79-A0C8-CF2E19E50584}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe | 

"TCP Query User{5A80683F-3A9C-4B4B-8833-168BD7B146E8}C:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe | 

"TCP Query User{800FAE8F-8B4E-4B52-A9E7-A13963504AC4}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe | 

"TCP Query User{94BF903E-9F96-4385-8A1A-F2D69A7C5054}C:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe | 

"TCP Query User{D1B709E8-1F30-4DCD-86B2-80FD40D8EB93}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 

"TCP Query User{E1D58AC8-07C5-4967-B41B-747EC148BCCE}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 

"TCP Query User{E61EFB94-1C7E-4AFD-AC1D-3BA3B5BF5095}C:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | 

"TCP Query User{ED5F1EB5-34D1-46E7-8B9C-961C258DA34C}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 

"UDP Query User{076EF715-59BF-4097-9676-BD2C9AC05E1C}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 

"UDP Query User{1F9BB946-C354-48C5-920D-39785B8ABAFA}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 

"UDP Query User{6EE4F3F3-AA22-433F-BF93-7B14D2D39AFF}C:\program files (x86)\yworks\yed\yed.exe" = protocol=17 | dir=in | app=c:\program files (x86)\yworks\yed\yed.exe | 

"UDP Query User{6F0F2220-0830-4746-B0F5-CEDA81A37584}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe | 

"UDP Query User{8222B271-ED12-4ED7-9AF0-E0FB52D33BDC}C:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe | 

"UDP Query User{8AA0C72E-6E3B-47F0-AA3A-005304D9251A}C:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | 

"UDP Query User{BF6F8719-64BA-4140-AA0E-602E6A37946C}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 

"UDP Query User{C64766B3-109E-4D35-8EC1-639F77729B9F}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 

"UDP Query User{C7EA0B11-4D30-42FA-BF1B-9BBB3361E799}C:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\king_of_the_dark\counter-strike source\hl2.exe | 

"UDP Query User{D7EAB46B-74D0-4770-90E7-65F1689CD55D}C:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's civilization 4 complete\beyond the sword\civ4beyondsword.exe | 

"UDP Query User{FE9E88EB-E4E6-46D6-B47E-B20E65ECF406}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC3

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector

"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant

"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)

"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)

"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10

"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9E3B2120-0BD8-9865-0387-E9BAC2A53AD3}" = ccc-utility64

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{BE882A12-5A45-3DFF-9FD0-306DE65EB8A5}" = AMD Catalyst Install Manager

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}" = Microsoft Mathematics (64-bit)

"{EF393943-0CCE-9CD9-6181-96DF4E4428EF}" = AMD Media Foundation Decoders

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"C-Media CM106 Like Sound Driver" = MEDUSA NX USB 5.1 Gaming Headset

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"TeamSpeak 3 Client" = TeamSpeak 3 Client

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{09D72100-CAC9-42BF-AD52-47F784C92DB6}" = LibreOffice 3.5

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0D97F8D1-2102-53D2-5633-C992D6086801}" = CCC Help Chinese Traditional

"{0EA00EA7-42C0-ED9C-9110-2C04B8EDBA66}" = CCC Help Italian

"{0EB86B70-91FF-39BF-633C-785DF2218CC6}" = CCC Help French

"{15F52B39-04CB-4EDB-9A8C-496C4A5588E2}" = Rayman 3

"{1686C07D-C2BB-A8B2-C5ED-32C4EE1A3E62}" = CCC Help Spanish

"{18B6A9F8-25BC-5978-6B42-A50FA2CABC18}" = CCC Help English

"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1

"{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}" = Morrowind

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder

"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3

"{298C6691-46B2-2065-0DD7-1E7B3B669A47}" = CCC Help Finnish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete

"{32E4F0D2-C135-475E-A841-1D59A0D22989}" = Sid Meier's Civilization 4 - Beyond the Sword

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend

"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service

"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe

"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX

"{400C5445-1AE8-1A41-CAC6-AB114341F65D}" = CCC Help Swedish

"{448B1C6D-02C2-7681-66B2-624E58B25375}" = CCC Help Turkish

"{46EB9D45-FC1A-2635-1693-176E6FA1C672}" = CCC Help Portuguese

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0

"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2

"{651F43AA-3F06-9277-6F1B-8E8155017463}" = CCC Help Polish

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{68DE32E1-292B-6A02-6A53-935BFAE70C99}" = CCC Help Chinese Standard

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™

"{818212BA-7F8C-DDF9-64BE-F6D0B6F46D29}" = CCC Help German

"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{84F4542C-ED64-28AC-49B3-1A9BAB395AB4}" = CCC Help Hungarian

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BBB5E4C-3F5E-4C07-BFBE-33B34600783A}" = LogMeIn Hamachi

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9C41195F-11B3-8EEC-6634-7183BE6CB1B1}" = CCC Help Japanese

"{A33A89D0-2F48-FD1C-A243-9073EE0592E0}" = Catalyst Control Center InstallProxy

"{A66FB6C7-B689-AFD5-21BA-7CAF8E44E6E6}" = Catalyst Control Center Graphics Previews Common

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch

"{AE136F7F-7DC6-600F-9DF9-BFA0DF516135}" = Catalyst Control Center Localization All

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B4CF00AE-2622-7BC6-24EC-4E5A0A8C9135}" = CCC Help Czech

"{BAE1C0A8-634D-CFF1-0E0C-893092427D34}" = CCC Help Danish

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C2DEC505-79A9-E952-32B0-31B67B83E231}" = CCC Help Korean

"{C2FB14FB-DF6B-287D-BDC3-C7BEC86F539E}" = Catalyst Control Center

"{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}" = Oblivion

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CCEFAE22-4D01-0084-D1CA-AC14AA743A97}" = CCC Help Greek

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{DE460826-5E72-2357-154F-E376F9926008}" = CCC Help Norwegian

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E21FFD29-D231-3BD3-6941-15710E44BED4}" = CCC Help Dutch

"{E3E313C7-0AE2-7F44-52E8-528D4EDC74B2}" = CCC Help Thai

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F112F66E-25CA-42DD-983C-6118EB38F606}" = Microsoft Games for Windows - LIVE

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{F9929777-7B6E-F53D-3105-1C06E5120CA1}" = CCC Help Russian

"2385-9868-7018-1536" = Cinderella2 2.6

"3309-7404-0599-8908" = yEd Graph Editor 3.9

"Audacity_is1" = Audacity 1.2.6

"avast" = avast! Free Antivirus

"Battlelog Web Plugins" = Battlelog Web Plugins

"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)

"ESET Online Scanner" = ESET Online Scanner v3

"ESN Sonar-0.70.4" = ESN Sonar

"Fraps" = Fraps

"Free YouTube Download_is1" = Free YouTube Download version 3.0.20.1228

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228

"GeoGebra" = GeoGebra

"Google Chrome" = Google Chrome

"IrfanView" = IrfanView (remove only)

"LogMeIn Hamachi" = LogMeIn Hamachi

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Notepad++" = Notepad++

"Opera 11.61.1250" = Opera 11.61

"Origin" = Origin

"PunkBusterSvc" = PunkBuster Services

"ResourceHacker_is1" = Resource Hacker Version 3.6.0

"Revo Uninstaller" = Revo Uninstaller 1.93

"StarCraft II" = StarCraft II

"Steam App 113200" = The Binding Of Isaac

"Steam App 1250" = Killing Floor

"Steam App 1522" = DEFCON Demo

"Steam App 15620" = Warhammer® 40,000™: Dawn of War® II

"Steam App 17470" = Dead Space

"Steam App 20540" = Company of Heroes: Tales of Valor

"Steam App 211" = Source SDK

"Steam App 218" = Source SDK Base 2007

"Steam App 22600" = Worms Reloaded

"Steam App 240" = Counter-Strike: Source

"Steam App 3590" = Plants vs. Zombies: Game of the Year

"Steam App 40800" = Super Meat Boy

"Steam App 40810" = Super Meat Boy Editor

"Steam App 42710" = Call of Duty: Black Ops - Multiplayer

"Steam App 42910" = Magicka

"Steam App 4560" = Company of Heroes

"Steam App 4570" = Warhammer 40,000: Dawn of War Gold Edition

"Steam App 4580" = Warhammer 40,000: Dawn of War – Dark Crusade

"Steam App 550" = Left 4 Dead 2

"Steam App 70600" = Worms Ultimate Mayhem

"Steam App 72850" = The Elder Scrolls V: Skyrim

"Steam App 9310" = Warhammer 40,000: Dawn of War – Winter Assault

"TmNationsForever_is1" = TmNationsForever

"VLC media player" = VLC media player 2.0.0

"Warcraft III" = Warcraft III

"WinLiveSuite" = Windows Live Essentials

"World of Warcraft" = World of Warcraft

"XMedia Recode" = XMedia Recode 3.0.8.0

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"GameMaker81" = GameMaker 8.1

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 25.04.2012 13:01:42 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:25 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:25 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:30 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:35 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:35 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:39 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 25.04.2012 13:10:39 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.04.2012 07:42:14 | Computer Name = *** | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\***\Downloads\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.04.2012 09:50:36 | Computer Name = *** | Source = Application Hang | ID = 1002

Description = Programm MovieMaker.exe, Version 15.4.3538.513 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: dc0    Startzeit: 01cd23b0e774fb90    Endzeit: 93    Anwendungspfad: 

C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe    Berichts-ID: c9f16ee8-8fa6-11e1-ae98-4061868d1dba
 

 

[ System Events ]

Error - 20.04.2012 14:12:08 | Computer Name = *** | Source = bowser | ID = 8003

Description = 

 

Error - 20.04.2012 16:27:45 | Computer Name = *** | Source = bowser | ID = 8003

Description = 

 

Error - 20.04.2012 18:44:37 | Computer Name = *** | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Steam Client Service erreicht.

 

Error - 20.04.2012 18:44:37 | Computer Name = *** | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%1053

 

Error - 21.04.2012 07:39:16 | Computer Name = *** | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 PnkBstrB erreicht.

 

Error - 21.04.2012 07:39:16 | Computer Name = *** | Source = Service Control Manager | ID = 7000

Description = Der Dienst "PnkBstrB" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1053

 

Error - 21.04.2012 11:23:39 | Computer Name = *** | Source = bowser | ID = 8003

Description = 

 

Error - 22.04.2012 09:58:44 | Computer Name = *** | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Hi-Rez Studios Authenticate and Update Service erreicht.

 

Error - 25.04.2012 09:42:58 | Computer Name = *** | Source = bowser | ID = 8003

Description = 

 

Error - 25.04.2012 14:39:31 | Computer Name = *** | Source = bowser | ID = 8003

Description = 

 

 

< End of report >

--- --- ---

Es geht wohl doch. Entschuldige bitte das Doppelposting, aber ich denke, wenn ich es hochlade ist es wohl schöner für den Thread. Die Files mit der "2" nach dem Namen stehen für die Files des Custom Scans.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com/web?l=dis&o=16552&gct=hp&apn_dtid=^YYYYYY^YY^DE&apn_ptnrs=^A9T&apn_uid=2491552175464200&p2=^A9T^YYYYYY^YY^DE

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A9 11 16 23 F6 E7 CC 01  [binary data]

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes,DefaultScope = {8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}: "URL" = http://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}: "URL" = http://eu.ask.com/web?l=dis&o=16552&gct=sb&qsrc=2869&apn_dtid=^YYYYYY^YY^DE&apn_ptnrs=^A9T&apn_uid=2491552175464200&p2=^A9T^YYYYYY^YY^DE&q={searchTerms}

IE - HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\..\SearchScopes\{C346F459-10D6-4C3F-84C9-08F57493FBF2}: "URL" = http://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

[2012.02.21 00:01:05 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com

[2012.02.21 00:01:04 | 000,001,798 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\searchplugins\funmoods.xml

[2012.04.16 14:53:20 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\ask.xml

O3 - HKLM\..\Toolbar: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.

O4 - HKLM..\Run: []  File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

So, wurde durchgeführt. Ich habe jedoch leider vergessen, das Ausgesternte bei den Pfaden zu ersetzen (war halt nunmal recht spät, habe die Commands eingefügt und leider gleich auf den "Fix"-Button gedrückt, obwohl ich noch das Ausgesternte ersetzen wollte -.-). Ist das arg schlimm?^^

Ansonsten hier der Log:

Code:

All processes killed

========== OTL ==========

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C346F459-10D6-4C3F-84C9-08F57493FBF2}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C346F459-10D6-4C3F-84C9-08F57493FBF2}\ not found.

Folder C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com\ not found.

File C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\searchplugins\funmoods.xml not found.

C:\Program Files (x86)\mozilla firefox\searchplugins\ask.xml moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: ***

->Temp folder emptied: 80276366 bytes

->Temporary Internet Files folder emptied: 10462124 bytes

->Java cache emptied: 309125 bytes

->FireFox cache emptied: 1125662584 bytes

->Google Chrome cache emptied: 7505415 bytes

->Opera cache emptied: 14455840 bytes

->Flash cache emptied: 10451 bytes

 

User: ****

->Temp folder emptied: 34721 bytes

->Temporary Internet Files folder emptied: 1145968 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 49073 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50568 bytes

%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 558 bytes

RecycleBin emptied: 257714 bytes

 

Total Files Cleaned = 1.183,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Public

 

User: ***

->Flash cache emptied: 0 bytes

 

User: ***H

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.42.1 log created on 04262012_211823
 

Files\Folders moved on Reboot...

C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Ja den Fix musst du wiederholen, die Sternchen zurückeditieren

So, den habe ich wiederholt.

Log:

Code:

All processes killed

========== OTL ==========

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!

HKU\S-1-5-21-2842318390-2146100648-1265770860-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{B922D405-6D13-4A2B-AE89-08A030DA4402} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F6E9A62-677B-4386-BBA9-DCCFAE0FA647}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ not found.

Registry key HKEY_USERS\S-1-5-21-2842318390-2146100648-1265770860-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C346F459-10D6-4C3F-84C9-08F57493FBF2}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C346F459-10D6-4C3F-84C9-08F57493FBF2}\ not found.

C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs folder moved successfully.

C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com\content\imgs folder moved successfully.

C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com\content folder moved successfully.

C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\yf79f88y.default\extensions\ffxtlbr@funmoods.com folder moved successfully.

C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\searchplugins\funmoods.xml moved successfully.

File C:\Program Files (x86)\mozilla firefox\searchplugins\ask.xml not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: ***

->Temp folder emptied: 7010 bytes

->Temporary Internet Files folder emptied: 1957620 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 62306479 bytes

->Google Chrome cache emptied: 0 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 901 bytes

 

User: ***H

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 3994 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes

%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes

RecycleBin emptied: 439260 bytes

 

Total Files Cleaned = 62,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Public

 

User: ***

->Flash cache emptied: 0 bytes

 

User: ****

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.42.1 log created on 04272012_130023
 

Files\Folders moved on Reboot...

C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Habe ich gemacht, hat sogar etwas gefunden, ich nehme aber an, dass die HP Netdrivers etc. von meinem alten HP-Drucker stammten...

Code:

17:36:02.0935 5280        TDSS rootkit removing tool 2.7.33.0 Apr 24 2012 18:43:43

17:36:03.0172 5280        ============================================================

17:36:03.0172 5280        Current date / time: 2012/04/27 17:36:03.0172

17:36:03.0172 5280        SystemInfo:

17:36:03.0172 5280        

17:36:03.0172 5280        OS Version: 6.1.7601 ServicePack: 1.0

17:36:03.0172 5280        Product type: Workstation

17:36:03.0172 5280        ComputerName: RH-PC

17:36:03.0172 5280        UserName: Redjep

17:36:03.0172 5280        Windows directory: C:\Windows

17:36:03.0172 5280        System windows directory: C:\Windows

17:36:03.0172 5280        Running under WOW64

17:36:03.0172 5280        Processor architecture: Intel x64

17:36:03.0172 5280        Number of processors: 8

17:36:03.0172 5280        Page size: 0x1000

17:36:03.0172 5280        Boot type: Normal boot

17:36:03.0172 5280        ============================================================

17:36:04.0731 5280        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

17:36:04.0796 5280        ============================================================

17:36:04.0796 5280        \Device\Harddisk0\DR0:

17:36:04.0796 5280        MBR partitions:

17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x712D3000

17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x71305800, BlocksNum 0x3200000

17:36:04.0796 5280        ============================================================

17:36:04.0850 5280        C: <-> \Device\Harddisk0\DR0\Partition1

17:36:04.0909 5280        D: <-> \Device\Harddisk0\DR0\Partition2

17:36:04.0941 5280        ============================================================

17:36:04.0941 5280        Initialize success

17:36:04.0941 5280        ============================================================

17:36:47.0503 5188        ============================================================

17:36:47.0503 5188        Scan started

17:36:47.0503 5188        Mode: Manual; SigCheck; TDLFS; 

17:36:47.0503 5188        ============================================================

17:36:50.0427 5188        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

17:36:50.0677 5188        1394ohci - ok

17:36:50.0732 5188        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

17:36:50.0773 5188        ACPI - ok

17:36:50.0786 5188        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

17:36:50.0874 5188        AcpiPmi - ok

17:36:50.0956 5188        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

17:36:50.0974 5188        AdobeARMservice - ok

17:36:51.0109 5188        AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

17:36:51.0133 5188        AdobeFlashPlayerUpdateSvc - ok

17:36:51.0207 5188        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

17:36:51.0252 5188        adp94xx - ok

17:36:51.0284 5188        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

17:36:51.0309 5188        adpahci - ok

17:36:51.0337 5188        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

17:36:51.0357 5188        adpu320 - ok

17:36:51.0381 5188        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

17:36:51.0541 5188        AeLookupSvc - ok

17:36:51.0596 5188        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

17:36:51.0716 5188        AFD - ok

17:36:51.0739 5188        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

17:36:51.0762 5188        agp440 - ok

17:36:51.0772 5188        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

17:36:51.0836 5188        ALG - ok

17:36:51.0847 5188        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

17:36:51.0869 5188        aliide - ok

17:36:51.0944 5188        ALSysIO - ok

17:36:52.0004 5188        AMD External Events Utility (b5e2434fc851698c1f119cf1c3935a50) C:\Windows\system32\atiesrxx.exe

17:36:52.0133 5188        AMD External Events Utility - ok

17:36:52.0151 5188        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

17:36:52.0173 5188        amdide - ok

17:36:52.0194 5188        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

17:36:52.0251 5188        AmdK8 - ok

17:36:52.0727 5188        amdkmdag        (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys

17:36:52.0959 5188        amdkmdag - ok

17:36:53.0087 5188        amdkmdap        (b9e1c7b7f1865f99b16ff2e1bb94edb6) C:\Windows\system32\DRIVERS\atikmpag.sys

17:36:53.0158 5188        amdkmdap - ok

17:36:53.0166 5188        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

17:36:53.0192 5188        AmdPPM - ok

17:36:53.0231 5188        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

17:36:53.0256 5188        amdsata - ok

17:36:53.0281 5188        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

17:36:53.0294 5188        amdsbs - ok

17:36:53.0311 5188        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

17:36:53.0322 5188        amdxata - ok

17:36:53.0351 5188        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

17:36:53.0508 5188        AppID - ok

17:36:53.0524 5188        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

17:36:53.0582 5188        AppIDSvc - ok

17:36:53.0614 5188        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

17:36:53.0667 5188        Appinfo - ok

17:36:53.0684 5188        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

17:36:53.0696 5188        arc - ok

17:36:53.0709 5188        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

17:36:53.0727 5188        arcsas - ok

17:36:53.0761 5188        aswFsBlk        (b9da213b5271db5fce962d827e6d620d) C:\Windows\system32\drivers\aswFsBlk.sys

17:36:53.0843 5188        aswFsBlk - ok

17:36:53.0888 5188        aswMonFlt       (21c9835d0e5ad2ff0f16134bcb32cc71) C:\Windows\system32\drivers\aswMonFlt.sys

17:36:53.0908 5188        aswMonFlt - ok

17:36:53.0942 5188        aswRdr          (1b96a5867abd4fa6135d8298fcccf9c6) C:\Windows\System32\Drivers\aswrdr2.sys

17:36:53.0954 5188        aswRdr - ok

17:36:54.0041 5188        aswSnx          (6e98bb288696777a3a8a07a52b0eaee9) C:\Windows\system32\drivers\aswSnx.sys

17:36:54.0077 5188        aswSnx - ok

17:36:54.0126 5188        aswSP           (d9fb49f16e4eb02efecae8cbfe4bcb4c) C:\Windows\system32\drivers\aswSP.sys

17:36:54.0161 5188        aswSP - ok

17:36:54.0194 5188        aswTdi          (7352bb9a564b94bbd7c9cbf165f55006) C:\Windows\system32\drivers\aswTdi.sys

17:36:54.0214 5188        aswTdi - ok

17:36:54.0237 5188        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

17:36:54.0301 5188        AsyncMac - ok

17:36:54.0327 5188        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

17:36:54.0337 5188        atapi - ok

17:36:54.0376 5188        AtiHDAudioService (230cf51113cd4b830b3bfd09b0d4c066) C:\Windows\system32\drivers\AtihdW76.sys

17:36:54.0394 5188        AtiHDAudioService - ok

17:36:54.0456 5188        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

17:36:54.0551 5188        AudioEndpointBuilder - ok

17:36:54.0554 5188        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

17:36:54.0586 5188        AudioSrv - ok

17:36:54.0649 5188        avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

17:36:54.0668 5188        avast! Antivirus - ok

17:36:54.0702 5188        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

17:36:54.0827 5188        AxInstSV - ok

17:36:54.0866 5188        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

17:36:54.0944 5188        b06bdrv - ok

17:36:54.0973 5188        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

17:36:55.0021 5188        b57nd60a - ok

17:36:55.0081 5188        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

17:36:55.0137 5188        BDESVC - ok

17:36:55.0154 5188        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

17:36:55.0191 5188        Beep - ok

17:36:55.0271 5188        BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll

17:36:55.0377 5188        BFE - ok

17:36:55.0452 5188        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

17:36:55.0564 5188        BITS - ok

17:36:55.0617 5188        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

17:36:55.0653 5188        blbdrive - ok

17:36:55.0679 5188        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

17:36:55.0734 5188        bowser - ok

17:36:55.0747 5188        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

17:36:55.0813 5188        BrFiltLo - ok

17:36:55.0818 5188        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

17:36:55.0842 5188        BrFiltUp - ok

17:36:55.0872 5188        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

17:36:55.0933 5188        Browser - ok

17:36:55.0949 5188        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

17:36:56.0026 5188        Brserid - ok

17:36:56.0032 5188        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

17:36:56.0057 5188        BrSerWdm - ok

17:36:56.0061 5188        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

17:36:56.0088 5188        BrUsbMdm - ok

17:36:56.0092 5188        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

17:36:56.0107 5188        BrUsbSer - ok

17:36:56.0127 5188        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

17:36:56.0162 5188        BTHMODEM - ok

17:36:56.0174 5188        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

17:36:56.0221 5188        bthserv - ok

17:36:56.0274 5188        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

17:36:56.0328 5188        cdfs - ok

17:36:56.0368 5188        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

17:36:56.0399 5188        cdrom - ok

17:36:56.0418 5188        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

17:36:56.0452 5188        CertPropSvc - ok

17:36:56.0471 5188        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

17:36:56.0486 5188        circlass - ok

17:36:56.0508 5188        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

17:36:56.0524 5188        CLFS - ok

17:36:56.0586 5188        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

17:36:56.0607 5188        clr_optimization_v2.0.50727_32 - ok

17:36:56.0646 5188        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

17:36:56.0659 5188        clr_optimization_v2.0.50727_64 - ok

17:36:56.0718 5188        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

17:36:56.0772 5188        clr_optimization_v4.0.30319_32 - ok

17:36:56.0806 5188        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

17:36:56.0827 5188        clr_optimization_v4.0.30319_64 - ok

17:36:56.0832 5188        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

17:36:56.0854 5188        CmBatt - ok

17:36:56.0864 5188        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

17:36:56.0877 5188        cmdide - ok

17:36:56.0928 5188        CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

17:36:56.0982 5188        CNG - ok

17:36:56.0991 5188        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

17:36:57.0004 5188        Compbatt - ok

17:36:57.0037 5188        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

17:36:57.0066 5188        CompositeBus - ok

17:36:57.0081 5188        COMSysApp - ok

17:36:57.0084 5188        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

17:36:57.0096 5188        crcdisk - ok

17:36:57.0133 5188        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll

17:36:57.0222 5188        CryptSvc - ok

17:36:57.0274 5188        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

17:36:57.0369 5188        DcomLaunch - ok

17:36:57.0409 5188        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

17:36:57.0493 5188        defragsvc - ok

17:36:57.0538 5188        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

17:36:57.0597 5188        DfsC - ok

17:36:57.0638 5188        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

17:36:57.0679 5188        Dhcp - ok

17:36:57.0712 5188        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

17:36:57.0743 5188        discache - ok

17:36:57.0763 5188        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

17:36:57.0776 5188        Disk - ok

17:36:57.0806 5188        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

17:36:57.0867 5188        Dnscache - ok

17:36:57.0901 5188        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

17:36:57.0948 5188        dot3svc - ok

17:36:58.0002 5188        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys

17:36:58.0044 5188        Dot4 - ok

17:36:58.0064 5188        Dot4Print       (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys

17:36:58.0092 5188        Dot4Print - ok

17:36:58.0111 5188        dot4usb         (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys

17:36:58.0129 5188        dot4usb - ok

17:36:58.0163 5188        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

17:36:58.0229 5188        DPS - ok

17:36:58.0268 5188        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

17:36:58.0311 5188        drmkaud - ok

17:36:58.0382 5188        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

17:36:58.0424 5188        DXGKrnl - ok

17:36:58.0442 5188        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

17:36:58.0472 5188        EapHost - ok

17:36:58.0657 5188        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

17:36:58.0781 5188        ebdrv - ok

17:36:58.0884 5188        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

17:36:58.0933 5188        EFS - ok

17:36:59.0026 5188        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

17:36:59.0149 5188        ehRecvr - ok

17:36:59.0187 5188        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

17:36:59.0236 5188        ehSched - ok

17:36:59.0314 5188        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

17:36:59.0371 5188        elxstor - ok

17:36:59.0396 5188        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

17:36:59.0429 5188        ErrDev - ok

17:36:59.0478 5188        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

17:36:59.0563 5188        EventSystem - ok

17:36:59.0606 5188        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

17:36:59.0653 5188        exfat - ok

17:36:59.0674 5188        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

17:36:59.0711 5188        fastfat - ok

17:36:59.0784 5188        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

17:36:59.0847 5188        Fax - ok

17:36:59.0853 5188        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

17:36:59.0871 5188        fdc - ok

17:36:59.0887 5188        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

17:36:59.0947 5188        fdPHost - ok

17:36:59.0962 5188        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

17:37:00.0019 5188        FDResPub - ok

17:37:00.0034 5188        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

17:37:00.0044 5188        FileInfo - ok

17:37:00.0062 5188        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

17:37:00.0089 5188        Filetrace - ok

17:37:00.0093 5188        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

17:37:00.0104 5188        flpydisk - ok

17:37:00.0143 5188        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

17:37:00.0156 5188        FltMgr - ok

17:37:00.0238 5188        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

17:37:00.0372 5188        FontCache - ok

17:37:00.0574 5188        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

17:37:00.0592 5188        FontCache3.0.0.0 - ok

17:37:00.0614 5188        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

17:37:00.0637 5188        FsDepends - ok

17:37:00.0646 5188        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

17:37:00.0658 5188        Fs_Rec - ok

17:37:00.0703 5188        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

17:37:00.0736 5188        fvevol - ok

17:37:00.0754 5188        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

17:37:00.0773 5188        gagp30kx - ok

17:37:00.0828 5188        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

17:37:00.0891 5188        gpsvc - ok

17:37:00.0966 5188        gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

17:37:00.0984 5188        gupdate - ok

17:37:00.0989 5188        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

17:37:01.0004 5188        gupdatem - ok

17:37:01.0027 5188        hamachi         (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys

17:37:01.0037 5188        hamachi - ok

17:37:01.0203 5188        Hamachi2Svc     (ce77bc37bdd36c9dc50c3591ebac3fa3) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

17:37:01.0272 5188        Hamachi2Svc - ok

17:37:01.0344 5188        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

17:37:01.0418 5188        hcw85cir - ok

17:37:01.0477 5188        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

17:37:01.0529 5188        HdAudAddService - ok

17:37:01.0566 5188        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

17:37:01.0612 5188        HDAudBus - ok

17:37:01.0617 5188        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

17:37:01.0643 5188        HidBatt - ok

17:37:01.0652 5188        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

17:37:01.0671 5188        HidBth - ok

17:37:01.0676 5188        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

17:37:01.0698 5188        HidIr - ok

17:37:01.0723 5188        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

17:37:01.0768 5188        hidserv - ok

17:37:01.0794 5188        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

17:37:01.0807 5188        HidUsb - ok

17:37:01.0858 5188        HiPatchService  (5a457c3d00c1c701230a12aa1580114d) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

17:37:01.0872 5188        HiPatchService ( UnsignedFile.Multi.Generic ) - warning

17:37:01.0872 5188        HiPatchService - detected UnsignedFile.Multi.Generic (1)

17:37:01.0907 5188        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

17:37:01.0969 5188        hkmsvc - ok

17:37:02.0008 5188        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

17:37:02.0049 5188        HomeGroupListener - ok

17:37:02.0086 5188        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

17:37:02.0132 5188        HomeGroupProvider - ok

17:37:02.0171 5188        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

17:37:02.0194 5188        HpSAMD - ok

17:37:02.0256 5188        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

17:37:02.0334 5188        HTTP - ok

17:37:02.0362 5188        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

17:37:02.0374 5188        hwpolicy - ok

17:37:02.0394 5188        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

17:37:02.0409 5188        i8042prt - ok

17:37:02.0454 5188        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

17:37:02.0484 5188        iaStorV - ok

17:37:02.0581 5188        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

17:37:02.0619 5188        idsvc - ok

17:37:02.0636 5188        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

17:37:02.0648 5188        iirsp - ok

17:37:02.0712 5188        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

17:37:02.0781 5188        IKEEXT - ok

17:37:03.0042 5188        IntcAzAudAddService (150ac23f21dbdbf8488408ba944b0d65) C:\Windows\system32\drivers\RTKVHD64.sys

17:37:03.0163 5188        IntcAzAudAddService - ok

17:37:03.0263 5188        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

17:37:03.0286 5188        intelide - ok

17:37:03.0312 5188        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

17:37:03.0337 5188        intelppm - ok

17:37:03.0363 5188        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

17:37:03.0412 5188        IPBusEnum - ok

17:37:03.0433 5188        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

17:37:03.0466 5188        IpFilterDriver - ok

17:37:03.0514 5188        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll

17:37:03.0578 5188        iphlpsvc - ok

17:37:03.0602 5188        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

17:37:03.0616 5188        IPMIDRV - ok

17:37:03.0633 5188        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

17:37:03.0686 5188        IPNAT - ok

17:37:03.0707 5188        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

17:37:03.0786 5188        IRENUM - ok

17:37:03.0800 5188        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

17:37:03.0821 5188        isapnp - ok

17:37:03.0855 5188        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

17:37:03.0895 5188        iScsiPrt - ok

17:37:03.0926 5188        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

17:37:03.0941 5188        kbdclass - ok

17:37:03.0958 5188        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys

17:37:03.0992 5188        kbdhid - ok

17:37:04.0030 5188        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:37:04.0050 5188        KeyIso - ok

17:37:04.0072 5188        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

17:37:04.0085 5188        KSecDD - ok

17:37:04.0105 5188        KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

17:37:04.0118 5188        KSecPkg - ok

17:37:04.0126 5188        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

17:37:04.0157 5188        ksthunk - ok

17:37:04.0190 5188        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

17:37:04.0233 5188        KtmRm - ok

17:37:04.0276 5188        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

17:37:04.0342 5188        LanmanServer - ok

17:37:04.0371 5188        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

17:37:04.0422 5188        LanmanWorkstation - ok

17:37:04.0433 5188        libusb0 - ok

17:37:04.0456 5188        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

17:37:04.0521 5188        lltdio - ok

17:37:04.0557 5188        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

17:37:04.0633 5188        lltdsvc - ok

17:37:04.0655 5188        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

17:37:04.0682 5188        lmhosts - ok

17:37:04.0708 5188        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

17:37:04.0721 5188        LSI_FC - ok

17:37:04.0737 5188        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

17:37:04.0748 5188        LSI_SAS - ok

17:37:04.0758 5188        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

17:37:04.0770 5188        LSI_SAS2 - ok

17:37:04.0790 5188        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

17:37:04.0801 5188        LSI_SCSI - ok

17:37:04.0822 5188        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

17:37:04.0850 5188        luafv - ok

17:37:04.0878 5188        MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys

17:37:04.0890 5188        MBAMProtector - ok

17:37:04.0983 5188        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

17:37:05.0020 5188        MBAMService - ok

17:37:05.0050 5188        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

17:37:05.0088 5188        Mcx2Svc - ok

17:37:05.0103 5188        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

17:37:05.0120 5188        megasas - ok

17:37:05.0151 5188        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

17:37:05.0173 5188        MegaSR - ok

17:37:05.0180 5188        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

17:37:05.0231 5188        MMCSS - ok

17:37:05.0245 5188        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

17:37:05.0298 5188        Modem - ok

17:37:05.0315 5188        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

17:37:05.0330 5188        monitor - ok

17:37:05.0371 5188        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

17:37:05.0381 5188        mouclass - ok

17:37:05.0398 5188        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

17:37:05.0431 5188        mouhid - ok

17:37:05.0477 5188        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

17:37:05.0501 5188        mountmgr - ok

17:37:05.0560 5188        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

17:37:05.0580 5188        MozillaMaintenance - ok

17:37:05.0606 5188        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

17:37:05.0621 5188        mpio - ok

17:37:05.0641 5188        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

17:37:05.0687 5188        mpsdrv - ok

17:37:05.0753 5188        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll

17:37:05.0807 5188        MpsSvc - ok

17:37:05.0842 5188        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

17:37:05.0863 5188        MRxDAV - ok

17:37:05.0895 5188        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

17:37:05.0928 5188        mrxsmb - ok

17:37:05.0955 5188        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

17:37:06.0003 5188        mrxsmb10 - ok

17:37:06.0038 5188        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

17:37:06.0062 5188        mrxsmb20 - ok

17:37:06.0068 5188        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

17:37:06.0080 5188        msahci - ok

17:37:06.0120 5188        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

17:37:06.0132 5188        msdsm - ok

17:37:06.0171 5188        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

17:37:06.0211 5188        MSDTC - ok

17:37:06.0252 5188        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

17:37:06.0297 5188        Msfs - ok

17:37:06.0322 5188        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

17:37:06.0385 5188        mshidkmdf - ok

17:37:06.0395 5188        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

17:37:06.0406 5188        msisadrv - ok

17:37:06.0426 5188        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

17:37:06.0472 5188        MSiSCSI - ok

17:37:06.0475 5188        msiserver - ok

17:37:06.0500 5188        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

17:37:06.0531 5188        MSKSSRV - ok

17:37:06.0538 5188        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

17:37:06.0566 5188        MSPCLOCK - ok

17:37:06.0570 5188        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

17:37:06.0613 5188        MSPQM - ok

17:37:06.0671 5188        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

17:37:06.0712 5188        MsRPC - ok

17:37:06.0731 5188        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

17:37:06.0750 5188        mssmbios - ok

17:37:06.0755 5188        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

17:37:06.0798 5188        MSTEE - ok

17:37:06.0801 5188        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

17:37:06.0813 5188        MTConfig - ok

17:37:06.0828 5188        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

17:37:06.0838 5188        Mup - ok

17:37:06.0892 5188        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

17:37:06.0953 5188        napagent - ok

17:37:07.0001 5188        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

17:37:07.0061 5188        NativeWifiP - ok

17:37:07.0140 5188        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

17:37:07.0183 5188        NDIS - ok

17:37:07.0192 5188        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

17:37:07.0237 5188        NdisCap - ok

17:37:07.0266 5188        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

17:37:07.0311 5188        NdisTapi - ok

17:37:07.0335 5188        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

17:37:07.0361 5188        Ndisuio - ok

17:37:07.0382 5188        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

17:37:07.0413 5188        NdisWan - ok

17:37:07.0432 5188        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

17:37:07.0458 5188        NDProxy - ok

17:37:07.0526 5188        Net Driver HPZ12 (d5ac41ae382738483faffbd7e373d49a) C:\Windows\system32\HPZinw12.dll

17:37:07.0536 5188        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

17:37:07.0536 5188        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

17:37:07.0550 5188        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

17:37:07.0596 5188        NetBIOS - ok

17:37:07.0641 5188        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

17:37:07.0717 5188        NetBT - ok

17:37:07.0740 5188        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:37:07.0752 5188        Netlogon - ok

17:37:07.0796 5188        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

17:37:07.0851 5188        Netman - ok

17:37:07.0892 5188        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

17:37:07.0941 5188        netprofm - ok

17:37:07.0992 5188        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

17:37:08.0013 5188        NetTcpPortSharing - ok

17:37:08.0042 5188        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

17:37:08.0058 5188        nfrd960 - ok

17:37:08.0098 5188        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

17:37:08.0148 5188        NlaSvc - ok

17:37:08.0163 5188        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

17:37:08.0190 5188        Npfs - ok

17:37:08.0210 5188        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

17:37:08.0238 5188        nsi - ok

17:37:08.0255 5188        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

17:37:08.0296 5188        nsiproxy - ok

17:37:08.0423 5188        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

17:37:08.0478 5188        Ntfs - ok

17:37:08.0580 5188        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

17:37:08.0653 5188        Null - ok

17:37:08.0695 5188        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

17:37:08.0720 5188        nvraid - ok

17:37:08.0753 5188        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

17:37:08.0776 5188        nvstor - ok

17:37:08.0792 5188        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

17:37:08.0807 5188        nv_agp - ok

17:37:08.0830 5188        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

17:37:08.0847 5188        ohci1394 - ok

17:37:08.0878 5188        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

17:37:08.0948 5188        p2pimsvc - ok

17:37:08.0977 5188        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

17:37:09.0002 5188        p2psvc - ok

17:37:09.0026 5188        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

17:37:09.0038 5188        Parport - ok

17:37:09.0058 5188        partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

17:37:09.0113 5188        partmgr - ok

17:37:09.0137 5188        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

17:37:09.0192 5188        PcaSvc - ok

17:37:09.0221 5188        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

17:37:09.0247 5188        pci - ok

17:37:09.0265 5188        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

17:37:09.0286 5188        pciide - ok

17:37:09.0301 5188        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

17:37:09.0320 5188        pcmcia - ok

17:37:09.0326 5188        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

17:37:09.0340 5188        pcw - ok

17:37:09.0392 5188        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

17:37:09.0456 5188        PEAUTH - ok

17:37:09.0531 5188        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

17:37:09.0567 5188        PerfHost - ok

17:37:09.0721 5188        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

17:37:09.0830 5188        pla - ok

17:37:09.0900 5188        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

17:37:09.0945 5188        PlugPlay - ok

17:37:10.0016 5188        Pml Driver HPZ12 (37f6046cdc630442d7dc087501ff6fc6) C:\Windows\system32\HPZipm12.dll

17:37:10.0027 5188        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

17:37:10.0027 5188        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

17:37:10.0045 5188        PnkBstrA - ok

17:37:10.0057 5188        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

17:37:10.0096 5188        PNRPAutoReg - ok

17:37:10.0118 5188        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

17:37:10.0150 5188        PNRPsvc - ok

17:37:10.0203 5188        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

17:37:10.0283 5188        PolicyAgent - ok

17:37:10.0313 5188        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

17:37:10.0362 5188        Power - ok

17:37:10.0415 5188        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

17:37:10.0456 5188        PptpMiniport - ok

17:37:10.0462 5188        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

17:37:10.0490 5188        Processor - ok

17:37:10.0536 5188        ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll

17:37:10.0607 5188        ProfSvc - ok

17:37:10.0640 5188        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:37:10.0653 5188        ProtectedStorage - ok

17:37:10.0688 5188        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

17:37:10.0732 5188        Psched - ok

17:37:10.0841 5188        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

17:37:10.0907 5188        ql2300 - ok

17:37:11.0000 5188        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

17:37:11.0023 5188        ql40xx - ok

17:37:11.0065 5188        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

17:37:11.0093 5188        QWAVE - ok

17:37:11.0107 5188        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

17:37:11.0127 5188        QWAVEdrv - ok

17:37:11.0145 5188        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

17:37:11.0172 5188        RasAcd - ok

17:37:11.0212 5188        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

17:37:11.0265 5188        RasAgileVpn - ok

17:37:11.0272 5188        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

17:37:11.0312 5188        RasAuto - ok

17:37:11.0337 5188        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

17:37:11.0397 5188        Rasl2tp - ok

17:37:11.0453 5188        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

17:37:11.0512 5188        RasMan - ok

17:37:11.0533 5188        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

17:37:11.0566 5188        RasPppoe - ok

17:37:11.0572 5188        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

17:37:11.0600 5188        RasSstp - ok

17:37:11.0631 5188        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

17:37:11.0685 5188        rdbss - ok

17:37:11.0688 5188        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

17:37:11.0702 5188        rdpbus - ok

17:37:11.0721 5188        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

17:37:11.0748 5188        RDPCDD - ok

17:37:11.0775 5188        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

17:37:11.0802 5188        RDPENCDD - ok

17:37:11.0808 5188        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

17:37:11.0836 5188        RDPREFMP - ok

17:37:11.0880 5188        RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys

17:37:11.0918 5188        RDPWD - ok

17:37:11.0950 5188        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

17:37:11.0977 5188        rdyboost - ok

17:37:12.0006 5188        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

17:37:12.0065 5188        RemoteAccess - ok

17:37:12.0076 5188        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

17:37:12.0128 5188        RemoteRegistry - ok

17:37:12.0135 5188        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

17:37:12.0165 5188        RpcEptMapper - ok

17:37:12.0198 5188        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

17:37:12.0213 5188        RpcLocator - ok

17:37:12.0266 5188        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

17:37:12.0313 5188        RpcSs - ok

17:37:12.0320 5188        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

17:37:12.0347 5188        rspndr - ok

17:37:12.0397 5188        RTL8167         (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys

17:37:12.0423 5188        RTL8167 - ok

17:37:12.0452 5188        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:37:12.0468 5188        SamSs - ok

17:37:12.0493 5188        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

17:37:12.0518 5188        sbp2port - ok

17:37:12.0552 5188        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

17:37:12.0620 5188        SCardSvr - ok

17:37:12.0623 5188        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

17:37:12.0653 5188        scfilter - ok

17:37:12.0735 5188        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

17:37:12.0800 5188        Schedule - ok

17:37:12.0826 5188        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

17:37:12.0850 5188        SCPolicySvc - ok

17:37:12.0876 5188        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

17:37:12.0947 5188        SDRSVC - ok

17:37:12.0977 5188        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

17:37:13.0022 5188        secdrv - ok

17:37:13.0038 5188        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

17:37:13.0077 5188        seclogon - ok

17:37:13.0102 5188        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

17:37:13.0156 5188        SENS - ok

17:37:13.0172 5188        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

17:37:13.0222 5188        SensrSvc - ok

17:37:13.0238 5188        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

17:37:13.0275 5188        Serenum - ok

17:37:13.0310 5188        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

17:37:13.0336 5188        Serial - ok

17:37:13.0362 5188        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

17:37:13.0387 5188        sermouse - ok

17:37:13.0423 5188        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

17:37:13.0486 5188        SessionEnv - ok

17:37:13.0502 5188        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

17:37:13.0526 5188        sffdisk - ok

17:37:13.0541 5188        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

17:37:13.0555 5188        sffp_mmc - ok

17:37:13.0563 5188        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

17:37:13.0578 5188        sffp_sd - ok

17:37:13.0582 5188        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

17:37:13.0595 5188        sfloppy - ok

17:37:13.0640 5188        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

17:37:13.0712 5188        SharedAccess - ok

17:37:13.0762 5188        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

17:37:13.0840 5188        ShellHWDetection - ok

17:37:13.0867 5188        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

17:37:13.0878 5188        SiSRaid2 - ok

17:37:13.0890 5188        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

17:37:13.0901 5188        SiSRaid4 - ok

17:37:13.0956 5188        SkypeUpdate     (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe

17:37:13.0977 5188        SkypeUpdate - ok

17:37:13.0997 5188        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

17:37:14.0045 5188        Smb - ok

17:37:14.0056 5188        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

17:37:14.0080 5188        SNMPTRAP - ok

17:37:14.0083 5188        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

17:37:14.0093 5188        spldr - ok

17:37:14.0157 5188        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

17:37:14.0233 5188        Spooler - ok

17:37:14.0442 5188        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

17:37:14.0573 5188        sppsvc - ok

17:37:14.0667 5188        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

17:37:14.0721 5188        sppuinotify - ok

17:37:14.0795 5188        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

17:37:14.0862 5188        srv - ok

17:37:14.0903 5188        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

17:37:14.0963 5188        srv2 - ok

17:37:14.0995 5188        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

17:37:15.0027 5188        srvnet - ok

17:37:15.0068 5188        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

17:37:15.0135 5188        SSDPSRV - ok

17:37:15.0165 5188        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

17:37:15.0195 5188        SstpSvc - ok

17:37:15.0216 5188        Steam Client Service - ok

17:37:15.0221 5188        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

17:37:15.0232 5188        stexstor - ok

17:37:15.0301 5188        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

17:37:15.0345 5188        stisvc - ok

17:37:15.0371 5188        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

17:37:15.0382 5188        swenum - ok

17:37:15.0425 5188        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

17:37:15.0470 5188        swprv - ok

17:37:15.0593 5188        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

17:37:15.0655 5188        SysMain - ok

17:37:15.0730 5188        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

17:37:15.0791 5188        TabletInputService - ok

17:37:15.0831 5188        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

17:37:15.0905 5188        TapiSrv - ok

17:37:15.0921 5188        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

17:37:15.0951 5188        TBS - ok

17:37:16.0098 5188        Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

17:37:16.0152 5188        Tcpip - ok

17:37:16.0310 5188        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

17:37:16.0351 5188        TCPIP6 - ok

17:37:16.0408 5188        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

17:37:16.0470 5188        tcpipreg - ok

17:37:16.0498 5188        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

17:37:16.0548 5188        TDPIPE - ok

17:37:16.0568 5188        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

17:37:16.0592 5188        TDTCP - ok

17:37:16.0623 5188        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

17:37:16.0662 5188        tdx - ok

17:37:16.0678 5188        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

17:37:16.0690 5188        TermDD - ok

17:37:16.0755 5188        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

17:37:16.0815 5188        TermService - ok

17:37:16.0826 5188        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

17:37:16.0856 5188        Themes - ok

17:37:16.0893 5188        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

17:37:16.0922 5188        THREADORDER - ok

17:37:16.0940 5188        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

17:37:16.0998 5188        TrkWks - ok

17:37:17.0026 5188        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

17:37:17.0083 5188        TrustedInstaller - ok

17:37:17.0101 5188        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

17:37:17.0130 5188        tssecsrv - ok

17:37:17.0163 5188        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

17:37:17.0193 5188        TsUsbFlt - ok

17:37:17.0228 5188        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

17:37:17.0298 5188        tunnel - ok

17:37:17.0313 5188        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

17:37:17.0325 5188        uagp35 - ok

17:37:17.0353 5188        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

17:37:17.0391 5188        udfs - ok

17:37:17.0408 5188        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

17:37:17.0436 5188        UI0Detect - ok

17:37:17.0456 5188        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

17:37:17.0467 5188        uliagpkx - ok

17:37:17.0487 5188        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

17:37:17.0527 5188        umbus - ok

17:37:17.0542 5188        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

17:37:17.0566 5188        UmPass - ok

17:37:17.0611 5188        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

17:37:17.0668 5188        upnphost - ok

17:37:17.0688 5188        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

17:37:17.0703 5188        usbaudio - ok

17:37:17.0737 5188        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

17:37:17.0772 5188        usbccgp - ok

17:37:17.0787 5188        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

17:37:17.0808 5188        usbcir - ok

17:37:17.0816 5188        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys

17:37:17.0833 5188        usbehci - ok

17:37:17.0863 5188        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

17:37:17.0897 5188        usbhub - ok

17:37:18.0025 5188        USBMULCD        (f9b3054339a71f16430f6585ebc8be96) C:\Windows\system32\drivers\CM10664.sys

17:37:18.0138 5188        USBMULCD - ok

17:37:18.0161 5188        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

17:37:18.0195 5188        usbohci - ok

17:37:18.0225 5188        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

17:37:18.0265 5188        usbprint - ok

17:37:18.0328 5188        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

17:37:18.0358 5188        usbscan - ok

17:37:18.0375 5188        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

17:37:18.0423 5188        USBSTOR - ok

17:37:18.0440 5188        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

17:37:18.0478 5188        usbuhci - ok

17:37:18.0501 5188        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

17:37:18.0557 5188        UxSms - ok

17:37:18.0573 5188        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:37:18.0586 5188        VaultSvc - ok

17:37:18.0613 5188        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

17:37:18.0623 5188        vdrvroot - ok

17:37:18.0681 5188        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

17:37:18.0762 5188        vds - ok

17:37:18.0780 5188        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

17:37:18.0795 5188        vga - ok

17:37:18.0807 5188        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

17:37:18.0840 5188        VgaSave - ok

17:37:18.0863 5188        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

17:37:18.0876 5188        vhdmp - ok

17:37:18.0885 5188        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

17:37:18.0895 5188        viaide - ok

17:37:18.0902 5188        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

17:37:18.0912 5188        volmgr - ok

17:37:18.0957 5188        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

17:37:18.0988 5188        volmgrx - ok

17:37:19.0018 5188        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

17:37:19.0040 5188        volsnap - ok

17:37:19.0066 5188        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

17:37:19.0085 5188        vsmraid - ok

17:37:19.0198 5188        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

17:37:19.0280 5188        VSS - ok

17:37:19.0385 5188        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

17:37:19.0422 5188        vwifibus - ok

17:37:19.0472 5188        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

17:37:19.0520 5188        W32Time - ok

17:37:19.0537 5188        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

17:37:19.0550 5188        WacomPen - ok

17:37:19.0572 5188        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

17:37:19.0602 5188        WANARP - ok

17:37:19.0605 5188        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

17:37:19.0630 5188        Wanarpv6 - ok

17:37:19.0742 5188        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

17:37:19.0827 5188        wbengine - ok

17:37:19.0892 5188        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

17:37:19.0932 5188        WbioSrvc - ok

17:37:19.0986 5188        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

17:37:20.0015 5188        wcncsvc - ok

17:37:20.0027 5188        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

17:37:20.0075 5188        WcsPlugInService - ok

17:37:20.0095 5188        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

17:37:20.0110 5188        Wd - ok

17:37:20.0159 5188        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

17:37:20.0196 5188        Wdf01000 - ok

17:37:20.0205 5188        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

17:37:20.0302 5188        WdiServiceHost - ok

17:37:20.0307 5188        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

17:37:20.0344 5188        WdiSystemHost - ok

17:37:20.0371 5188        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

17:37:20.0395 5188        WebClient - ok

17:37:20.0412 5188        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

17:37:20.0461 5188        Wecsvc - ok

17:37:20.0485 5188        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

17:37:20.0515 5188        wercplsupport - ok

17:37:20.0546 5188        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

17:37:20.0592 5188        WerSvc - ok

17:37:20.0610 5188        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

17:37:20.0636 5188        WfpLwf - ok

17:37:20.0641 5188        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

17:37:20.0652 5188        WIMMount - ok

17:37:20.0676 5188        WinDefend - ok

17:37:20.0679 5188        WinHttpAutoProxySvc - ok

17:37:20.0739 5188        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

17:37:20.0794 5188        Winmgmt - ok

17:37:20.0924 5188        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

17:37:20.0979 5188        WinRM - ok

17:37:21.0092 5188        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

17:37:21.0145 5188        Wlansvc - ok

17:37:21.0331 5188        wlidsvc         (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

17:37:21.0405 5188        wlidsvc - ok

17:37:21.0464 5188        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

17:37:21.0497 5188        WmiAcpi - ok

17:37:21.0534 5188        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

17:37:21.0557 5188        wmiApSrv - ok

17:37:21.0561 5188        WMPNetworkSvc - ok

17:37:21.0579 5188        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

17:37:21.0634 5188        WPCSvc - ok

17:37:21.0661 5188        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

17:37:21.0709 5188        WPDBusEnum - ok

17:37:21.0722 5188        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

17:37:21.0775 5188        ws2ifsl - ok

17:37:21.0784 5188        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

17:37:21.0804 5188        wscsvc - ok

17:37:21.0806 5188        WSearch - ok

17:37:21.0956 5188        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll

17:37:22.0061 5188        wuauserv - ok

17:37:22.0130 5188        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

17:37:22.0176 5188        WudfPf - ok

17:37:22.0201 5188        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

17:37:22.0257 5188        WUDFRd - ok

17:37:22.0277 5188        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

17:37:22.0305 5188        wudfsvc - ok

17:37:22.0337 5188        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

17:37:22.0414 5188        WwanSvc - ok

17:37:22.0471 5188        xusb21          (2ee48cfce7ca8e0db4c44c7476c0943b) C:\Windows\system32\DRIVERS\xusb21.sys

17:37:22.0509 5188        xusb21 - ok

17:37:22.0542 5188        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

17:37:22.0675 5188        \Device\Harddisk0\DR0 - ok

17:37:22.0680 5188        Boot (0x1200)   (ec75946d32d26f3ac578640b588acd3e) \Device\Harddisk0\DR0\Partition0

17:37:22.0681 5188        \Device\Harddisk0\DR0\Partition0 - ok

17:37:22.0711 5188        Boot (0x1200)   (ffa36dfd2d58b8b3fa5e83b41ea63b89) \Device\Harddisk0\DR0\Partition1

17:37:22.0712 5188        \Device\Harddisk0\DR0\Partition1 - ok

17:37:22.0742 5188        Boot (0x1200)   (f3d76b6a3a49adcc04067347b24837bb) \Device\Harddisk0\DR0\Partition2

17:37:22.0745 5188        \Device\Harddisk0\DR0\Partition2 - ok

17:37:22.0745 5188        ============================================================

17:37:22.0745 5188        Scan finished

17:37:22.0745 5188        ============================================================

17:37:22.0761 2552        Detected object count: 3

17:37:22.0761 2552        Actual detected object count: 3

17:39:02.0910 2552        HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user

17:39:02.0910 2552        HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:39:02.0913 2552        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

17:39:02.0913 2552        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:39:02.0914 2552        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

17:39:02.0914 2552        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Dies habe ich auch gemacht. Und es hat meinem PC irgendwie zu schaffen gemacht^^. Nach dem ersten Restart kam die von dir angesprochene Fehlermeldung, nach dem zweiten gab es einen Freeze (-> hard reset), jetzt geht es aber. Ich hoffe doch, durch Combofix ist nichts Wichtiges kaputt gegangen?

Log:
Combofix Logfile:

Code:

ComboFix 12-04-27.02 - *** 27.04.2012  20:09:43.1.8 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4087.3051 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\users\***\AppData\Local\lame_enc.dll

c:\users\***\AppData\Local\no23xwrapper.dll

c:\users\***\AppData\Local\ogg.dll

c:\users\***\AppData\Local\vorbis.dll

c:\users\***\AppData\Local\vorbisenc.dll

c:\users\***\AppData\Local\vorbisfile.dll

c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\weave\toFetch

c:\windows\SysWow64\urttemp

c:\windows\SysWow64\urttemp\regtlib.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-27 bis 2012-04-27  ))))))))))))))))))))))))))))))

.

.

2012-04-27 18:16 . 2012-04-27 18:16        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-27 18:15 . 2012-04-27 18:15        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F88D5816-404A-4D95-B372-62A5D39BAF7A}\offreg.dll

2012-04-27 10:20 . 2012-04-13 08:46        8917360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F88D5816-404A-4D95-B372-62A5D39BAF7A}\mpengine.dll

2012-04-26 19:18 . 2012-04-26 19:18        --------        d-----w-        C:\_OTL

2012-04-26 13:16 . 2012-04-26 13:19        --------        d-----w-        C:\Fraps

2012-04-26 11:47 . 2012-04-26 11:47        --------        d-----w-        c:\users\***\AppData\Roaming\LibreOffice

2012-04-26 11:43 . 2012-04-26 11:45        --------        d-----w-        c:\program files (x86)\LibreOffice 3.5

2012-04-25 17:01 . 2012-04-25 17:01        --------        d-----w-        c:\program files (x86)\ESET

2012-04-25 15:48 . 2012-04-25 15:48        --------        d-----w-        c:\program files (x86)\Common Files\Java

2012-04-25 15:48 . 2012-04-25 15:47        637848        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-04-25 15:47 . 2012-04-25 15:47        --------        d-----w-        c:\program files (x86)\Java

2012-04-25 15:46 . 2012-04-25 15:46        --------        d-----w-        c:\program files\Java

2012-04-21 21:25 . 2012-04-21 21:25        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2012-04-21 21:25 . 2012-04-21 01:18        97208        ----a-w-        c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-04-21 21:25 . 2012-04-21 01:16        157352        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe

2012-04-21 21:25 . 2012-04-21 01:16        129976        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe

2012-04-20 19:34 . 2012-04-20 19:34        --------        d-----w-        c:\users\***\AppData\Local\Chromium

2012-04-20 17:20 . 2012-04-20 19:34        --------        d-----w-        c:\programdata\Hi-Rez Studios

2012-04-20 17:20 . 2012-04-20 17:20        --------        d-----w-        c:\program files (x86)\Hi-Rez Studios

2012-04-20 16:44 . 2012-04-20 16:44        --------        d--h--r-        c:\users\***\AppData\Roaming\SecuROM

2012-04-20 16:17 . 2012-04-20 16:17        669184        ----a-w-        c:\windows\SysWow64\pbsvc.exe

2012-04-14 00:57 . 2012-04-14 01:15        --------        d-----w-        c:\program files (x86)\Resource Hacker

2012-04-13 01:03 . 2012-04-13 01:03        --------        d-----w-        c:\users\***\AppData\Local\IsolatedStorage

2012-04-12 13:17 . 2012-04-12 13:17        --------        d-----w-        c:\programdata\TrackMania

2012-04-12 01:00 . 2012-03-01 06:46        23408        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-04-12 01:00 . 2012-03-01 06:33        81408        ----a-w-        c:\windows\system32\imagehlp.dll

2012-04-12 01:00 . 2012-03-01 05:33        159232        ----a-w-        c:\windows\SysWow64\imagehlp.dll

2012-04-12 01:00 . 2012-03-01 05:37        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll

2012-04-12 01:00 . 2012-03-01 06:38        220672        ----a-w-        c:\windows\system32\wintrust.dll

2012-04-12 01:00 . 2012-03-01 06:28        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-04-12 01:00 . 2012-03-01 05:29        5120        ----a-w-        c:\windows\SysWow64\wmi.dll

2012-04-11 21:35 . 2012-04-20 18:09        --------        d-----w-        c:\users\***\riotsGamesLogs

2012-04-11 17:48 . 2012-04-11 17:48        --------        d-----w-        c:\users\***H

2012-04-11 16:35 . 2012-04-11 16:52        --------        d-----w-        c:\program files\7-Zip

2012-04-11 13:15 . 2012-04-11 13:16        --------        d-----w-        c:\program files (x86)\TmNationsForever

2012-04-09 00:38 . 2012-04-09 00:38        --------        d-----w-        c:\users\***\AppData\Roaming\LolClient

2012-04-08 20:54 . 2008-07-12 06:18        467984        ----a-w-        c:\windows\SysWow64\d3dx10_39.dll

2012-04-08 20:54 . 2008-07-12 06:18        1493528        ----a-w-        c:\windows\SysWow64\D3DCompiler_39.dll

2012-04-08 20:54 . 2008-07-12 06:18        3851784        ----a-w-        c:\windows\SysWow64\D3DX9_39.dll

2012-04-08 20:40 . 2012-04-08 20:40        --------        d-----w-        C:\Riot Games

2012-04-08 19:10 . 2012-04-08 19:10        --------        d-----w-        c:\program files (x86)\Pando Networks

2012-04-04 17:35 . 2012-04-04 17:50        --------        d-----w-        c:\users\***\AppData\Local\My Games

2012-04-04 17:16 . 2012-04-04 17:16        --------        d-----w-        c:\program files (x86)\2K Games

2012-04-04 17:14 . 2012-04-04 17:14        --------        d-----w-        c:\users\***\AppData\Roaming\InstallShield

2012-04-02 10:32 . 2012-04-13 20:32        8741536        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-04-02 10:24 . 2012-04-13 20:32        418464        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-04-01 16:38 . 2012-04-01 17:00        --------        d-----w-        c:\users\***\AppData\Roaming\codeblocks

2012-04-01 16:09 . 2012-04-01 17:08        --------        d-----w-        c:\users\***\AppData\Roaming\Dev-Cpp

2012-04-01 16:08 . 2012-04-01 17:01        --------        d-----w-        C:\Dev-Cpp

2012-04-01 16:03 . 2012-04-01 16:17        --------        d-----w-        c:\users\***\AppData\Roaming\Notepad++

2012-04-01 16:03 . 2012-04-01 16:03        --------        d-----w-        c:\program files (x86)\Notepad++

2012-03-30 17:45 . 2012-03-30 17:45        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-25 15:47 . 2012-03-21 21:04        567696        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-04-25 15:46 . 2012-01-15 12:36        750488        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-04-25 15:46 . 2012-01-15 12:36        660368        ----a-w-        c:\windows\system32\deployJava1.dll

2012-04-20 16:17 . 2012-01-15 13:04        103736        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2012-04-20 16:17 . 2012-01-15 13:04        103736        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2012-04-17 13:37 . 2012-01-15 18:01        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2012-04-13 20:32 . 2012-01-14 21:35        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-04-04 13:56 . 2012-02-10 18:00        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-07 00:15 . 2012-02-14 13:04        41184        ----a-w-        c:\windows\avastSS.scr

2012-03-07 00:15 . 2012-02-14 13:04        201352        ----a-w-        c:\windows\SysWow64\aswBoot.exe

2012-03-07 00:15 . 2012-02-14 13:05        258520        ----a-w-        c:\windows\system32\aswBoot.exe

2012-03-07 00:04 . 2012-02-14 13:05        819032        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2012-03-07 00:04 . 2012-02-14 13:05        337240        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2012-03-07 00:02 . 2012-02-26 18:38        53080        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2012-03-07 00:01 . 2012-02-14 13:05        59224        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2012-03-07 00:01 . 2012-02-14 13:05        69976        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2012-03-07 00:01 . 2012-02-14 13:05        24408        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2012-02-23 08:18 . 2012-01-14 22:01        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-17 06:38 . 2012-03-14 15:07        1031680        ----a-w-        c:\windows\system32\rdpcore.dll

2012-02-17 05:34 . 2012-03-14 15:07        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll

2012-02-17 04:58 . 2012-03-14 15:07        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-02-17 04:57 . 2012-03-14 15:07        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-02-14 21:05 . 2012-02-14 21:05        69632        ----a-w-        c:\windows\system32\OpenVideo64.dll

2012-02-14 21:05 . 2012-02-14 21:05        59904        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2012-02-14 21:05 . 2012-02-14 21:05        16507904        ----a-w-        c:\windows\system32\amdocl64.dll

2012-02-14 21:04 . 2012-02-14 21:04        13238272        ----a-w-        c:\windows\SysWow64\amdocl.dll

2012-02-14 21:03 . 2012-02-14 21:03        54272        ----a-w-        c:\windows\system32\OpenCL.dll

2012-02-14 21:03 . 2012-02-14 21:03        48128        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-02-14 15:37 . 2012-01-15 13:04        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe

2012-02-11 19:00 . 2012-02-11 19:00        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-02-10 06:36 . 2012-03-14 17:47        1544192        ----a-w-        c:\windows\system32\DWrite.dll

2012-02-10 05:38 . 2012-03-14 17:47        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll

2012-02-03 04:34 . 2012-03-14 17:47        3145728        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-15 1955208]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 253088]

R3 ALSysIO;ALSysIO;c:\users\***\AppData\Local\Temp\ALSysIO64.sys [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:32]

.

2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 18:41]

.

2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 18:41]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-03-07 00:15        135408        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]

"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2011-03-31 8151040]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = 

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: Interfaces\{42847496-B284-445A-B872-6729C5DB2D9E}: NameServer = 82.145.9.8 89.246.64.8

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.funmoods_i.hmpg, true

FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=make

FF - user.js: extensions.funmoods_i.dfltSrch - true

FF - user.js: extensions.funmoods_i.srchPrvdr - Search

FF - user.js: extensions.funmoods_i.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=make

FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=make&q=

FF - user.js: extensions.funmoods_i.id - da79ef66000000000000000000000000

FF - user.js: extensions.funmoods_i.instlDay - 15390

FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16

FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.1623:01

FF - user.js: extensions.funmoods_i.prtnrId - funmoods

FF - user.js: extensions.funmoods_i.prdct - funmoods

FF - user.js: extensions.funmoods_i.aflt - make

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods_i.tlbrId - base

FF - user.js: extensions.funmoods_i.instlRef - 

FF - user.js: extensions.funmoods_i.dfltLng - 

FF - user.js: extensions.funmoods_i.excTlbr - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\AVAST Software\Avast\AvastSvc.exe

c:\windows\SysWOW64\PnkBstrA.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-04-27  20:41:25 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-04-27 18:41

.

Vor Suchlauf: 12 Verzeichnis(se), 730.638.594.048 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 730.571.755.520 Bytes frei

.

- - End Of File - - A9E6DC71632503CAA494C40A0BE6A7E8

--- --- ---

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Und der nächste Log^^.

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-04-27 23:50:03

-----------------------------

23:50:03.712    OS Version: Windows x64 6.1.7601 Service Pack 1

23:50:03.712    Number of processors: 8 586 0x1E05

23:50:03.713    ComputerName: ***  UserName: 

23:50:05.722    Initialize success

23:50:06.148    AVAST engine defs: 12042701

23:50:47.009    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

23:50:47.014    Disk 0 Vendor: WDC_WD10EARS-00Y5B1 80.00A80 Size: 953869MB BusType: 11

23:50:47.029    Disk 0 MBR read successfully

23:50:47.034    Disk 0 MBR scan

23:50:47.040    Disk 0 Windows 7 default MBR code

23:50:47.047    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

23:50:47.073    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       927142 MB offset 206848

23:50:47.103    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        25600 MB offset 1898993664

23:50:47.125    Disk 0 Partition 4 00     12  Compaq diag NTFS         1025 MB offset 1951422464

23:50:47.170    Disk 0 scanning C:\Windows\system32\drivers

23:50:54.588    Service scanning

23:51:05.837    Modules scanning

23:51:05.852    Disk 0 trace - called modules:

23:51:05.871    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 

23:51:05.882    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d58790]

23:51:05.891    3 CLASSPNP.SYS[fffff8800196243f] -> nt!IofCallDriver -> [0xfffffa8004acb1e0]

23:51:05.899    5 ACPI.sys[fffff88000fb37a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004aeb060]

23:51:07.133    AVAST engine scan C:\Windows

23:51:10.467    AVAST engine scan C:\Windows\system32

23:52:35.258    AVAST engine scan C:\Windows\system32\drivers

23:52:41.681    AVAST engine scan C:\Users\***

23:54:44.174    AVAST engine scan C:\ProgramData

23:56:19.359    Scan finished successfully

00:24:28.199    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"

00:24:28.209    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBRlog.txt"

Grüße,
flaaghuhn

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes findet nichts.

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.04.24.04
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

*** :: *** [Administrator]
 

24.04.2012 17:12:36

mbam-log-2012-04-24 (18-26-13).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 472548

Laufzeit: 1 Stunde(n), 6 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 2

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Daten:  -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Daten: Funmoods Toolbar -> Keine Aktion durchgeführt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

SUPERAntiSpyware findet eine Menge Tracking-Cookies, sonst aber nichts.

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/28/2012 at 07:09 PM
 

Application Version : 5.0.1148
 

Core Rules Database Version : 8528

Trace Rules Database Version: 6340
 

Scan type       : Complete Scan

Total Scan Time : 02:09:44
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 744

Memory threats detected   : 0

Registry items scanned    : 65215

Registry threats detected : 0

File items scanned        : 286753

File threats detected     : 87
 

Adware.Tracking Cookie

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\MFPEKUSB.txt [ /track.adform.net ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\XOGEDFUL.txt [ /fastclick.net ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EKS3HILZ.txt [ /doubleclick.net ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\I234PUW1.txt [ /adform.net ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\T9870YS7.txt [ /ad.yieldmanager.com ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\AOAQGPOR.txt [ /serving-sys.com ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\QEZ9R29C.txt [ /atdmt.com ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\41339EK3.txt [ /c.atdmt.com ]

        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\D6T8SQGK.txt [ /bs.serving-sys.com ]

        C:\USERS\***\Cookies\MFPEKUSB.txt [ Cookie:***@track.adform.net/ ]

        C:\USERS\***\Cookies\EKS3HILZ.txt [ Cookie:***@doubleclick.net/ ]

        C:\USERS\***\Cookies\I234PUW1.txt [ Cookie:***@adform.net/ ]

        C:\USERS\***\Cookies\T9870YS7.txt [ Cookie:***@ad.yieldmanager.com/ ]

        C:\USERS\***\Cookies\QEZ9R29C.txt [ Cookie:***@atdmt.com/ ]

        C:\USERS\***\Cookies\41339EK3.txt [ Cookie:***@c.atdmt.com/ ]

        C:\USERS\***\Cookies\D6T8SQGK.txt [ Cookie:***@bs.serving-sys.com/ ]

        C:\USERS\****\AppData\Roaming\Microsoft\Windows\Cookies\0MUFQ0A7.txt [ Cookie:****@c.atdmt.com/ ]

        C:\USERS\****\AppData\Roaming\Microsoft\Windows\Cookies\WM44MKBX.txt [ Cookie:****@atdmt.com/ ]

        C:\USERS\****\Cookies\0MUFQ0A7.txt [ Cookie:****@c.atdmt.com/ ]

        C:\USERS\****\Cookies\WM44MKBX.txt [ Cookie:****@atdmt.com/ ]

        .amazon-adsystem.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .amazon-adsystem.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad2.adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .eaeacom.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.multimediaxis.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.multimediaxis.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.counter-go.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        stats.computecmedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .countomat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        stats.computecmedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        uk.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        uk.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]

Habe/hatte ich eigentlich Trojaner/Viren auf dem PC gehabt oder hat irgendein Programm diese "funmoods" installiert?

Zitat:

Keine Aktion durchgeführt.
-> No action taken.

Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

Öhm, ich merke grad, das Log von Malwarebytes, das ich gepostet habe, ist das Log, welches ich im ersten Beitrag drangehängt habe *peinlich*^^. Habe wohl irgendwo verklickt.
Das richtige Log:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.04.28.04
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

*** :: *** [Administrator]
 

28.04.2012 15:22:15

mbam-log-2012-04-28 (15-22-15).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 470344

Laufzeit: 1 Stunde(n), 6 Minute(n), 51 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Es ändert aber nichts daran, dass die Funde beim ersten Scan nicht gelöscht wurden (warum auch immer). Habe sie jetzt aus der Quarantäne gelöscht.

Zitat:

Es ändert aber nichts daran, dass die Funde beim ersten Scan nicht gelöscht wurden (warum auch immer)

Weil du die nicht entfernt hast :pfeiff:

Sieht ok aus, da wurden ansonsten nur Cookies gefunden. Kannst du mit SASW löschen.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Mit meinem System habe ich keine Probleme und andere Funde habe ich (noch^^) nicht.

Ist denn alles wieder "clean"?

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Die benutzen Tools habe ich erfolgreich von der Platte geschmissen.
Aber eine kleine Frage hätte ich noch: Was für Malware war den auf meinem Rechner?

Jedenfalls ein sehr großes Dankeschön an dich für deine Hilfe, und auch großes Lob an dieses Forum :).

Grüße,

flaaghuhn

Öhm, entschuldige wieder das Doppelposting, aber so normal verhält sich mein PC doch nicht.

Beim Booten, bevor Windows geladen wird, kommt normalerweise eine Sequenz, in der der Bildschirm schwarz ist und ein weißer "Unterstrich" kurz blinkt (dauert normalerweiser weniger als eine Sekunde). Seit kurzem dauert diese Sequenz aber ewig lange (ca 10s). Und auch den Willkommensbildschirm darf ich nach dem Einloggen ziemlich lange sehen...

Ist da irgendetwas "faul"?

Zitat:

Aber eine kleine Frage hätte ich noch: Was für Malware war den auf meinem Rechner?

Siehst du doch in den Logs der Virenscanner und anderen Tools :wtf: wieso muss ich das alles nochmal wiederholen

Zitat:

Ist da irgendetwas "faul"?

War das direkt nach den Updates?

Meinst du die von dir vorgeschlagenen Updates? Nein, früher.

Also kannst du es auch nicht eingrenzen wann ungefähr

Wann genau es angefangen hat, weiß ich nicht, aber in den letzten Tagen habe ich es bemerkt.