Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Startfester.com nach Installieren von Vlc.media player? (https://www.trojaner-board.de/129215-startfester-com-installieren-vlc-media-player.html)

Devilspearl 09.01.2013 09:54
Startfester.com nach Installieren von Vlc.media player?
 
Hallo ich benötige etwas Hilfe von euch, dafür schon mal im voraus Danke.

Meine Frau hat sich den Mediaplayer von Vcl aus dem Netz gezogen und installiert, so wie es aussieht war der von Vlc.de, nun hat sich startfenster .com vor google geschoben wenn sie ins netz gehen wollte!

Leider hat sie mich erst dann geholt als schon alles passiert war!!!!:rolleyes:

Ich habe einige Threads gelesen und Vlc wieder deinstalliert , google wieder als Startseite (startbrowser) festgelegt startfenster.com vom rechner und der schnellstartleiste entfernt und sämtlichen Browserverlauf gelöscht!

Da es sich ja um ein Trojaner handeln soll weiß ich nicht ob dies ausreicht.....

habe deefoger otl gmser und co schon heruntergeladen und scanen lassen....
allerdings hat otl keine Extras.txt erstellt warum weiß ich nicht...:pfeiff:
anhänge anbei!!!!
wäre net wenn ihr mal drüberschauen könntet
Danke

cosinus 09.01.2013 12:40
Hallo und :hallo:

Die Heimatseite vom VLC-Player ist videolan.org und nicht vlc.de!

Software lädt man sich mit oberster Priorität direkt vom Hersteller oder von Filepony - nicht von Fakeseiten oder gar Toolbarklitschen wie zB Softonic


Mal eine kurze Frage, das ist jetzt nichts speziell gegen dich, ich hätte auch jeden anderen fragen können der die Logs so postet - wo bitte steht, dass die Logs in den Anhang gelegt werden sollen bzw. wo genau hast du das herausgelesen?

Logfiles im Anhang erschweren die Auswertung massivst

Bitte um Erläuterung damit man die Textstelle in der Anleitung für alle Neulinge mal gezielt ändern/verbessern kann. Danke.
Zitat:
Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Devilspearl 09.01.2013 12:59
Hallo und danke für die Kontaktaufnahme,
der Fehler liegt bei mir, wie bei sicher vielen Laien!!!
bei eurer Cheklist für alle Hilfesuchenden steht unter punkt 3 oder 4 das


Erstelle ein neues Thema und poste den Inhalt von
OTL.txt
EXTRAS.txt
Gmer.txt

fälschlicherweise nahm ich an das man mit posten meint das man die Dateien anhängen soll

Zu dem Doppelbeitrag sorry ich wollte einen löschen wußte aber nicht wo genau, und bevor ich gar keine Antwort erhalte hab ich beide gelassen( sorry für den datenmüll)

cosinus 09.01.2013 13:04
Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner?
Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Devilspearl 09.01.2013 13:31
meine eigene Vierensoftware GData Totalprotection hatte nix gefunden daher auch nur das
Code:
Virenprüfung mit G Data TotalProtection 2013
Version 23.0.5.9 (17.09.2012)
Virensignaturen vom 09.01.2013
Startzeit: 09.01.2013 10:18:32
Engine(s): Engine A (AVA 22.7364), Engine B (AVL 22.1454)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein

Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 09.01.2013 12:11:07
    224355 Dateien überprüft
    0 infizierte Dateien gefunden
    0 verdächtige Dateien gefunden


–Der Zugriff auf die folgenden Dateien wurde verweigert:
C:\System Volume Information\MountPointManagerRemoteDatabase
C:\System Volume Information\Syscache.hve
C:\System Volume Information\Syscache.hve.LOG1
C:\System Volume Information\Syscache.hve.LOG2

–Die folgenden Dateien sind Passwortgeschützt:
C:\Windows.old.001\Users\Roberto\Downloads\20120324040822483448936138.zip
C:\Windows.old.001\Users\Roberto\Downloads\Manager_11_Update_1.exe
C:\Windows.old.001\Users\Roberto\Downloads\Manager_11_Update_2 824.exe
soll ich die alten logs auch noch mal posten??
ich mache es einfach
Code:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.08.13

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anne :: ANNE-PC [Administrator]

Schutz: Aktiviert

09.01.2013 08:37:09
mbam-log-2013-01-09 (08-37-09).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 187586
Laufzeit: 5 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-09 09:33:49
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHZ2320BH_G2 rev.00000009 298,09GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\Anne\AppData\Local\Temp\kwtdrpow.sys


---- Kernel code sections - GMER 2.0 ----

.text  C:\Windows\system32\DRIVERS\nvlddmkm.sys  section is writeable [0x8CE0A340, 0x3D7A87, 0xE8000020]

---- EOF - GMER 2.0 ----
Code:
OTL logfile created on: 09.01.2013 08:44:50 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Anne\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,49 Gb Total Physical Memory | 1,50 Gb Available Physical Memory | 60,02% Memory free
5,20 Gb Paging File | 3,92 Gb Available in Paging File | 75,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 144,97 Gb Free Space | 48,63% Space Free | Partition Type: NTFS
 
Computer Name: ANNE-PC | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.09 00:53:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Anne\Desktop\OTL.exe
PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.17 04:24:09 | 000,995,352 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\AVKTray\AVKTray.exe
PRC - [2012.09.11 04:04:03 | 001,617,432 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
PRC - [2012.08.30 04:05:55 | 001,584,112 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\AVK\AVKWCtl.exe
PRC - [2012.08.23 14:46:06 | 001,542,680 | ---- | M] (G Data Software AG) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe
PRC - [2012.06.04 10:49:40 | 001,899,816 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\Firewall\GDFwSvc.exe
PRC - [2012.05.24 11:19:14 | 000,306,216 | ---- | M] (G Data Software) -- C:\Programme\G Data\TotalProtection\TSNxG\TSNxGService.exe
PRC - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe
PRC - [2012.01.27 05:13:02 | 001,470,968 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\Firewall\GDFirewallTray.exe
PRC - [2012.01.27 04:43:34 | 000,468,472 | ---- | M] (G Data Software AG) -- C:\Programme\G Data\TotalProtection\AVK\AVKService.exe
PRC - [2011.12.13 09:34:54 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.12.13 09:32:32 | 001,527,104 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.10.24 17:53:14 | 000,870,672 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe
PRC - [2011.10.24 17:34:56 | 000,481,552 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.06.10 10:56:24 | 000,036,864 | ---- | M] () -- C:\Programme\Hotkey\PowerBiosServer.exe
PRC - [2008.04.16 21:50:00 | 006,111,232 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.09.11 04:04:03 | 001,617,432 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\G Data\TotalProtection\AVKBackup\AVKBackupService.exe -- (GDBackupSvc)
SRV - [2012.08.30 04:05:55 | 001,584,112 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\G Data\TotalProtection\AVK\AVKWCtl.exe -- (AVKWCtl)
SRV - [2012.08.23 14:46:06 | 001,542,680 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2012.06.04 10:49:40 | 001,899,816 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Programme\G Data\TotalProtection\Firewall\GDFwSvc.exe -- (GDFwSvc)
SRV - [2012.05.24 11:19:14 | 000,306,216 | ---- | M] (G Data Software) [Auto | Running] -- C:\Programme\G Data\TotalProtection\TSNxG\TSNxGService.exe -- (TSNxGService)
SRV - [2012.05.14 04:26:47 | 001,218,552 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Programme\G Data\TotalProtection\AVKTuner\AVKTunerService.exe -- (GDTunerSvc)
SRV - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2012.01.27 04:43:34 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Programme\G Data\TotalProtection\AVK\AVKService.exe -- (AVKService)
SRV - [2011.12.13 09:32:32 | 001,527,104 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.12.13 09:29:16 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.10.24 17:53:14 | 000,870,672 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2011.10.24 17:34:56 | 000,481,552 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008.06.10 10:56:24 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\Programme\Hotkey\PowerBiosServer.exe -- (PowerBiosServer)
SRV - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | System | Stopped] --  -- (GLogin)
DRV - [2012.12.17 19:00:04 | 000,030,416 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2012.12.15 08:47:05 | 000,050,080 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PktIcpt.sys -- (GDPkIcpt)
DRV - [2012.12.15 08:44:19 | 000,093,728 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV - [2012.12.15 08:44:19 | 000,041,888 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\GDBehave.sys -- (GDBehave)
DRV - [2012.12.15 08:44:18 | 000,053,664 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\gdwfpcd32.sys -- (gdwfpcd)
DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.12.13 20:52:24 | 000,103,928 | ---- | M] (G Data Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TS4nt.sys -- (TS4NT)
DRV - [2012.12.13 20:51:42 | 000,050,040 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\HookCentre.sys -- (HookCentre)
DRV - [2011.10.31 15:44:14 | 007,346,176 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETwNv32.sys -- (NETwNv32)
DRV - [2010.10.07 13:34:32 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2008.04.27 16:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008.04.11 03:55:04 | 000,084,240 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008.04.03 13:56:00 | 007,444,672 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.04.03 13:56:00 | 000,043,552 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.03.26 21:49:00 | 001,094,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2008.02.14 00:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - homepage: hxxp://google.de/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\TotalProtection\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\TotalProtection\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A47EC58-DBD9-451B-BC97-037C6764AA50}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20ECE4C8-9665-45EC-9ADE-15C484F9EFBE}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.09 00:53:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Anne\Desktop\OTL.exe
[2013.01.09 00:23:41 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Malwarebytes
[2013.01.09 00:23:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.01.09 00:23:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.09 00:22:55 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.01.09 00:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.01.08 19:01:39 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2013.01.08 16:36:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2013.01.07 18:39:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2013.01.07 18:39:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2013.01.07 18:39:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2013.01.07 18:23:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2013.01.07 18:08:42 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.01.07 12:29:31 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2013.01.02 13:36:13 | 000,000,000 | ---D | C] -- C:\Windows\Cache
[2012.12.30 17:10:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2012.12.17 19:00:06 | 000,015,600 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2012.12.17 19:00:04 | 000,030,416 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2012.12.17 18:24:25 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Microsoft Games
[2012.12.15 11:05:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.12.15 08:55:56 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Gedichte
[2012.12.15 08:54:41 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Anne
[2012.12.15 08:53:13 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Beratung
[2012.12.15 08:44:18 | 000,010,792 | ---- | C] (G Data Software AG) -- C:\Windows\System32\GdScrSv.de.dll
[2012.12.14 20:46:08 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\ashampoo
[2012.12.14 20:46:08 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo
[2012.12.14 20:46:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2012.12.14 20:45:38 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2012.12.14 20:14:34 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.12.14 20:14:29 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.12.14 20:14:29 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.12.14 20:14:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011
[2012.12.14 20:13:58 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\TuneUp Software
[2012.12.14 20:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2011
[2012.12.14 20:12:22 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.12.14 20:12:12 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.12.14 17:51:35 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Intel
[2012.12.14 17:49:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
[2012.12.14 17:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco
[2012.12.14 17:49:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2012.12.14 17:49:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2012.12.14 16:10:02 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\WinRAR
[2012.12.13 21:06:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.12.13 21:04:45 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.12.13 21:04:40 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Google
[2012.12.13 21:04:29 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Deployment
[2012.12.13 21:04:29 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Apps
[2012.12.13 20:56:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2012.12.13 20:53:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data TotalProtection 2013
[2012.12.13 20:52:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\BioAPIFFDB
[2012.12.13 20:52:24 | 000,103,928 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\TS4nt.sys
[2012.12.13 20:52:09 | 000,050,080 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2012.12.13 20:51:42 | 000,093,728 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys
[2012.12.13 20:51:42 | 000,050,040 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys
[2012.12.13 20:51:41 | 000,041,888 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys
[2012.12.13 20:51:20 | 000,053,664 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys
[2012.12.13 20:49:30 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA Software
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\G Data
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\G Data
[2012.12.13 20:47:10 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.12.13 20:46:57 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Downloaded Installations
[2012.12.13 19:38:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.12.13 19:36:08 | 000,000,000 | ---D | C] -- C:\Program Files\Hotkey
[2012.12.13 19:35:18 | 000,000,000 | ---D | C] -- C:\Windows\JMCR_DIR
[2012.12.13 19:33:59 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2012.12.13 19:32:43 | 000,118,784 | ---- | C] (Realtek Corporation                                            ) -- C:\Windows\System32\drivers\Rtlh86.sys
[2012.12.13 19:32:22 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\InstallShield
[2012.12.13 19:31:18 | 000,000,000 | ---D | C] -- C:\Program Files\Motorola
[2012.12.13 19:31:06 | 001,094,272 | ---- | C] (Motorola Inc.) -- C:\Windows\System32\drivers\smserial.sys
[2012.12.13 19:31:06 | 000,364,544 | ---- | C] (Motorola Inc.) -- C:\Windows\System32\sm56co81.dll
[2012.12.13 19:29:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM
[2012.12.13 19:29:29 | 001,773,568 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll
[2012.12.13 19:29:29 | 000,339,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll
[2012.12.13 19:29:29 | 000,185,776 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll
[2012.12.13 19:29:29 | 000,167,936 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll
[2012.12.13 19:29:29 | 000,135,168 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll
[2012.12.13 19:29:26 | 006,111,232 | ---- | C] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
[2012.12.13 19:29:25 | 001,929,216 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll
[2012.12.13 19:29:25 | 000,155,648 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll
[2012.12.13 19:29:25 | 000,140,288 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\FMAPO.dll
[2012.12.13 19:29:25 | 000,126,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll
[2012.12.13 19:29:25 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012.12.13 19:29:24 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.12.13 19:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012.12.13 19:24:14 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2012.12.13 19:24:14 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\Searches
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.12.13 18:54:58 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Identities
[2012.12.13 18:54:54 | 000,000,000 | R--D | C] -- C:\Users\Anne\Contacts
[2012.12.13 18:54:54 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\VirtualStore
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Vorlagen
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Verlauf
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Temporary Internet Files
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Startmenü
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\SendTo
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Recent
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Netzwerkumgebung
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Lokale Einstellungen
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Videos
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Musik
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Eigene Dateien
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Bilder
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Druckumgebung
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Cookies
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Anwendungsdaten
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Anwendungsdaten
[2012.12.13 18:54:49 | 000,000,000 | --SD | C] -- C:\Users\Anne\AppData\Roaming\Microsoft
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Videos
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Saved Games
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Pictures
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Music
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Links
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Favorites
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Downloads
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Documents
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Desktop
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.12.13 18:54:49 | 000,000,000 | -H-D | C] -- C:\Users\Anne\AppData
[2012.12.13 18:54:49 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Temp
[2012.12.13 18:54:49 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Microsoft
[2012.12.13 18:54:49 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Media Center Programs
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.12.13 18:52:11 | 000,000,000 | ---D | C] -- C:\Windows\Debug
[2012.12.13 18:44:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.12.13 18:30:37 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.12.13 18:29:44 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.12.13 18:10:06 | 000,000,000 | ---D | C] -- C:\Windows.old.001
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.09 08:43:56 | 000,000,000 | ---- | M] () -- C:\Users\Anne\defogger_reenable
[2013.01.09 08:31:48 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.09 08:31:48 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.09 08:31:48 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.09 08:31:48 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.09 08:30:14 | 000,940,180 | ---- | M] () -- C:\Windows\System32\sig.bin
[2013.01.09 08:30:14 | 000,050,845 | ---- | M] () -- C:\Windows\System32\nmp.map
[2013.01.09 08:25:04 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.01.09 08:24:49 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013.01.09 08:24:47 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.09 08:24:47 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.09 08:24:44 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.09 08:24:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.09 08:24:07 | 2676,903,936 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.09 01:09:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.09 00:53:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Anne\Desktop\OTL.exe
[2013.01.09 00:23:08 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.08 16:40:18 | 000,228,296 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.08 16:35:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.01.08 12:33:29 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2013.01.08 12:33:29 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2013.01.08 12:33:20 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.01.07 18:10:12 | 000,001,356 | ---- | M] () -- C:\Users\Anne\AppData\Local\d3d9caps.dat
[2013.01.07 18:08:42 | 284,405,572 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.01.07 12:41:31 | 000,000,058 | ---- | M] () -- C:\Windows\nfsc_patch.ini
[2012.12.30 17:03:50 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2012.12.17 19:00:06 | 000,015,600 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2012.12.17 19:00:04 | 000,030,416 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2012.12.15 08:47:05 | 000,050,080 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2012.12.15 08:44:19 | 000,093,728 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys
[2012.12.15 08:44:19 | 000,041,888 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys
[2012.12.15 08:44:18 | 000,053,664 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys
[2012.12.14 20:46:06 | 000,001,032 | ---- | M] () -- C:\Users\Public\Desktop\Ashampoo Photo Commander 9.lnk
[2012.12.14 20:14:27 | 000,001,875 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.12.14 20:14:27 | 000,001,871 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.12.13 21:06:06 | 000,001,969 | ---- | M] () -- C:\Users\Anne\Desktop\Google Chrome.lnk
[2012.12.13 21:02:41 | 000,001,595 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2012.12.13 20:52:24 | 000,103,928 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\TS4nt.sys
[2012.12.13 20:51:42 | 000,050,040 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys
[2012.12.13 20:51:12 | 000,002,010 | ---- | M] () -- C:\Users\Public\Desktop\G Data TotalProtection.lnk
[2012.12.13 19:35:45 | 000,000,251 | ---- | M] () -- C:\Windows\xUninstall.bat
[2012.12.13 19:34:06 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2012.12.13 19:08:22 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2012.12.13 18:45:44 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012.12.13 18:29:30 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
 
========== Files Created - No Company Name ==========
 
[2013.01.09 08:43:56 | 000,000,000 | ---- | C] () -- C:\Users\Anne\defogger_reenable
[2013.01.09 00:23:08 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.08 16:43:03 | 000,000,955 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.01.08 16:35:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.01.08 12:33:20 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.01.08 12:21:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.01.08 12:21:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.01.07 18:14:28 | 2676,903,936 | -HS- | C] () -- C:\hiberfil.sys
[2013.01.07 18:07:48 | 284,405,572 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.01.07 12:40:19 | 000,000,058 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2012.12.30 17:03:50 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2012.12.17 18:29:56 | 000,940,180 | ---- | C] () -- C:\Windows\System32\sig.bin
[2012.12.17 18:29:56 | 000,050,845 | ---- | C] () -- C:\Windows\System32\nmp.map
[2012.12.14 20:46:06 | 000,001,032 | ---- | C] () -- C:\Users\Public\Desktop\Ashampoo Photo Commander 9.lnk
[2012.12.14 20:14:27 | 000,001,875 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.12.14 20:14:27 | 000,001,871 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.12.14 20:14:26 | 000,001,883 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk
[2012.12.14 16:42:40 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2012.12.14 16:42:39 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2012.12.14 16:42:33 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2012.12.14 16:42:32 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.12.14 16:42:32 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.12.14 16:42:30 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2012.12.14 16:42:28 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2012.12.14 16:42:19 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2012.12.14 16:42:17 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2012.12.14 16:41:46 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2012.12.14 16:41:42 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2012.12.14 16:30:05 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2012.12.13 21:06:06 | 000,001,969 | ---- | C] () -- C:\Users\Anne\Desktop\Google Chrome.lnk
[2012.12.13 21:04:56 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.13 21:04:52 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.13 21:02:41 | 000,001,595 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2012.12.13 20:51:12 | 000,002,010 | ---- | C] () -- C:\Users\Public\Desktop\G Data TotalProtection.lnk
[2012.12.13 20:34:24 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.12.13 20:34:23 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex
[2012.12.13 20:30:44 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2012.12.13 20:30:44 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2012.12.13 20:30:44 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2012.12.13 19:38:35 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.001
[2012.12.13 19:38:29 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2012.12.13 19:35:45 | 000,000,251 | ---- | C] () -- C:\Windows\xUninstall.bat
[2012.12.13 19:34:06 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2012.12.13 19:33:39 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2012.12.13 19:30:50 | 000,000,553 | R--- | C] () -- C:\Windows\USetup.iss
[2012.12.13 19:27:56 | 000,008,060 | ---- | C] () -- C:\Windows\System32\nvdisp.nvu
[2012.12.13 19:27:21 | 000,000,354 | ---- | C] () -- C:\Windows\System32\nvhda.nvu
[2012.12.13 19:08:22 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2012.12.13 18:55:07 | 000,000,950 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.12.13 18:54:54 | 000,000,921 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012.12.13 18:54:51 | 000,001,356 | ---- | C] () -- C:\Users\Anne\AppData\Local\d3d9caps.dat
[2012.12.13 18:45:21 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.12.14 20:13:58 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 

< End of report >

cosinus 09.01.2013 13:33
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Malwarebytes Anti-Rootkit http://img.trojaner-board.de/malware...otkit/logo.png

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Devilspearl 09.01.2013 13:42
rutergeladen hab ich es aber noch nicht geöffnet, soll ich den download einfach auf den dektop ziehen?? und dann öffnen ???

ach und noch gleich mal vorweg soll bei dem scan des Programs auch wieder internetverbindung und auch der Vierenscanner deaktiviert sein??

Danke für die Antwort , auch wenn die Frage Laienhaft ist

hier das ergebnis
Code:
Malwarebytes Anti-Rootkit 1.01.0.1011
www.malwarebytes.org

Database version: v2013.01.09.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anne :: ANNE-PC [administrator]

09.01.2013 14:14:21
mbar-log-2013-01-09 (14-14-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 26682
Time elapsed: 12 minute(s), 37 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus 09.01.2013 14:57
1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Devilspearl 09.01.2013 15:35
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-09 15:23:10
-----------------------------
15:23:10.917    OS Version: Windows 6.0.6002 Service Pack 2
15:23:10.917    Number of processors: 2 586 0x1706
15:23:10.917    ComputerName: ANNE-PC  UserName: Anne
15:23:43.459    Initialize success
15:25:54.425    AVAST engine defs: 13010900
15:26:10.681    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:26:10.681    Disk 0 Vendor: FUJITSU_MHZ2320BH_G2 00000009 Size: 305245MB BusType: 3
15:26:10.696    Disk 0 MBR read successfully
15:26:10.696    Disk 0 MBR scan
15:26:10.712    Disk 0 Windows VISTA default MBR code
15:26:10.712    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      305243 MB offset 2048
15:26:10.727    Disk 0 scanning sectors +625140400
15:26:10.883    Disk 0 scanning C:\Windows\system32\drivers
15:26:22.100    Service scanning
15:26:52.972    Modules scanning
15:27:01.724    Disk 0 trace - called modules:
15:27:01.771    ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys
15:27:01.771    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a2bac8]
15:27:01.771    3 CLASSPNP.SYS[893af8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8519f8a0]
15:27:02.909    AVAST engine scan C:\Windows
15:27:05.998    AVAST engine scan C:\Windows\system32
15:29:52.169    AVAST engine scan C:\Windows\system32\drivers
15:30:03.214    AVAST engine scan C:\Users\Anne
15:30:55.630    AVAST engine scan C:\ProgramData
15:31:14.366    Scan finished successfully
15:31:30.434    Disk 0 MBR has been saved successfully to "C:\Users\Anne\Desktop\MBR.dat"
15:31:30.434    The log file has been saved successfully to "C:\Users\Anne\Desktop\aswMBR.txt"
Code:
15:42:44.0808 5992  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
15:42:45.0198 5992  ============================================================
15:42:45.0198 5992  Current date / time: 2013/01/09 15:42:45.0198
15:42:45.0198 5992  SystemInfo:
15:42:45.0198 5992 
15:42:45.0198 5992  OS Version: 6.0.6002 ServicePack: 2.0
15:42:45.0198 5992  Product type: Workstation
15:42:45.0198 5992  ComputerName: ANNE-PC
15:42:45.0198 5992  UserName: Anne
15:42:45.0198 5992  Windows directory: C:\Windows
15:42:45.0198 5992  System windows directory: C:\Windows
15:42:45.0198 5992  Processor architecture: Intel x86
15:42:45.0198 5992  Number of processors: 2
15:42:45.0198 5992  Page size: 0x1000
15:42:45.0198 5992  Boot type: Normal boot
15:42:45.0198 5992  ============================================================
15:42:46.0508 5992  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
15:42:46.0524 5992  ============================================================
15:42:46.0524 5992  \Device\Harddisk0\DR0:
15:42:46.0524 5992  MBR partitions:
15:42:46.0524 5992  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2542DAB0
15:42:46.0524 5992  ============================================================
15:42:46.0540 5992  C: <-> \Device\Harddisk0\DR0\Partition1
15:42:46.0540 5992  ============================================================
15:42:46.0540 5992  Initialize success
15:42:46.0540 5992  ============================================================
15:43:14.0854 4524  ============================================================
15:43:14.0854 4524  Scan started
15:43:14.0854 4524  Mode: Manual; SigCheck; TDLFS;
15:43:14.0854 4524  ============================================================
15:43:15.0134 4524  ================ Scan system memory ========================
15:43:15.0134 4524  System memory - ok
15:43:15.0134 4524  ================ Scan services =============================
15:43:15.0618 4524  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
15:43:15.0727 4524  ACPI - ok
15:43:15.0774 4524  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
15:43:15.0805 4524  adp94xx - ok
15:43:15.0836 4524  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci        C:\Windows\system32\drivers\adpahci.sys
15:43:15.0852 4524  adpahci - ok
15:43:15.0883 4524  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
15:43:15.0899 4524  adpu160m - ok
15:43:15.0914 4524  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
15:43:15.0930 4524  adpu320 - ok
15:43:15.0992 4524  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
15:43:16.0039 4524  AeLookupSvc - ok
15:43:16.0102 4524  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
15:43:16.0133 4524  AFD - ok
15:43:16.0195 4524  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\Windows\system32\drivers\agp440.sys
15:43:16.0195 4524  agp440 - ok
15:43:16.0273 4524  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
15:43:16.0273 4524  aic78xx - ok
15:43:16.0304 4524  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
15:43:16.0351 4524  ALG - ok
15:43:16.0351 4524  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\Windows\system32\drivers\aliide.sys
15:43:16.0367 4524  aliide - ok
15:43:16.0367 4524  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
15:43:16.0382 4524  amdagp - ok
15:43:16.0382 4524  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\Windows\system32\drivers\amdide.sys
15:43:16.0398 4524  amdide - ok
15:43:16.0429 4524  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
15:43:16.0476 4524  AmdK7 - ok
15:43:16.0492 4524  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
15:43:16.0507 4524  AmdK8 - ok
15:43:16.0554 4524  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
15:43:16.0570 4524  Appinfo - ok
15:43:16.0601 4524  [ 5D2888182FB46632511ACEE92FDAD522 ] arc            C:\Windows\system32\drivers\arc.sys
15:43:16.0616 4524  arc - ok
15:43:16.0648 4524  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
15:43:16.0663 4524  arcsas - ok
15:43:16.0679 4524  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
15:43:16.0710 4524  AsyncMac - ok
15:43:16.0741 4524  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi          C:\Windows\system32\drivers\atapi.sys
15:43:16.0741 4524  atapi - ok
15:43:16.0804 4524  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
15:43:16.0850 4524  AudioEndpointBuilder - ok
15:43:16.0866 4524  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
15:43:16.0882 4524  Audiosrv - ok
15:43:17.0038 4524  [ C48176DA44D0298A7075D3C5CF8C3D8D ] AVKProxy        C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
15:43:17.0147 4524  AVKProxy - ok
15:43:17.0225 4524  [ 29DA2D5958B352022A1BB5CE6FDB427C ] AVKService      C:\Program Files\G Data\TotalProtection\AVK\AVKService.exe
15:43:17.0256 4524  AVKService - ok
15:43:17.0318 4524  [ 6BBEF99B9A4DA3568ECCF32FCB10C6FE ] AVKWCtl        C:\Program Files\G Data\TotalProtection\AVK\AVKWCtl.exe
15:43:17.0428 4524  AVKWCtl - ok
15:43:17.0474 4524  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
15:43:17.0537 4524  Beep - ok
15:43:17.0584 4524  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
15:43:17.0646 4524  BFE - ok
15:43:17.0724 4524  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
15:43:17.0802 4524  BITS - ok
15:43:17.0849 4524  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
15:43:17.0864 4524  blbdrive - ok
15:43:17.0911 4524  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
15:43:17.0927 4524  bowser - ok
15:43:17.0958 4524  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
15:43:17.0989 4524  BrFiltLo - ok
15:43:17.0989 4524  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
15:43:18.0036 4524  BrFiltUp - ok
15:43:18.0052 4524  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
15:43:18.0098 4524  Browser - ok
15:43:18.0130 4524  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
15:43:18.0332 4524  Brserid - ok
15:43:18.0332 4524  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
15:43:18.0379 4524  BrSerWdm - ok
15:43:18.0410 4524  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
15:43:18.0473 4524  BrUsbMdm - ok
15:43:18.0473 4524  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
15:43:18.0520 4524  BrUsbSer - ok
15:43:18.0551 4524  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
15:43:18.0598 4524  BTHMODEM - ok
15:43:18.0644 4524  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
15:43:18.0707 4524  cdfs - ok
15:43:18.0738 4524  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
15:43:18.0769 4524  cdrom - ok
15:43:18.0816 4524  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
15:43:18.0832 4524  CertPropSvc - ok
15:43:18.0847 4524  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\drivers\circlass.sys
15:43:18.0910 4524  circlass - ok
15:43:18.0956 4524  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
15:43:18.0972 4524  CLFS - ok
15:43:19.0081 4524  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
15:43:19.0097 4524  clr_optimization_v2.0.50727_32 - ok
15:43:19.0268 4524  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
15:43:19.0268 4524  clr_optimization_v4.0.30319_32 - ok
15:43:19.0331 4524  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
15:43:19.0362 4524  CmBatt - ok
15:43:19.0393 4524  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
15:43:19.0409 4524  cmdide - ok
15:43:19.0409 4524  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
15:43:19.0424 4524  Compbatt - ok
15:43:19.0424 4524  COMSysApp - ok
15:43:19.0440 4524  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
15:43:19.0456 4524  crcdisk - ok
15:43:19.0471 4524  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
15:43:19.0502 4524  Crusoe - ok
15:43:19.0549 4524  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
15:43:19.0596 4524  CryptSvc - ok
15:43:19.0658 4524  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
15:43:19.0705 4524  DcomLaunch - ok
15:43:19.0736 4524  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
15:43:19.0783 4524  DfsC - ok
15:43:19.0861 4524  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
15:43:20.0002 4524  DFSR - ok
15:43:20.0048 4524  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
15:43:20.0095 4524  Dhcp - ok
15:43:20.0142 4524  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
15:43:20.0142 4524  disk - ok
15:43:20.0204 4524  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
15:43:20.0251 4524  Dnscache - ok
15:43:20.0282 4524  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
15:43:20.0314 4524  dot3svc - ok
15:43:20.0376 4524  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
15:43:20.0438 4524  DPS - ok
15:43:20.0470 4524  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
15:43:20.0516 4524  drmkaud - ok
15:43:20.0548 4524  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
15:43:20.0563 4524  DXGKrnl - ok
15:43:20.0626 4524  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
15:43:20.0657 4524  E1G60 - ok
15:43:20.0704 4524  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
15:43:20.0735 4524  EapHost - ok
15:43:20.0797 4524  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
15:43:20.0813 4524  Ecache - ok
15:43:20.0860 4524  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
15:43:20.0875 4524  ehRecvr - ok
15:43:20.0891 4524  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
15:43:20.0922 4524  ehSched - ok
15:43:20.0953 4524  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
15:43:20.0969 4524  ehstart - ok
15:43:21.0047 4524  [ 23B62471681A124889978F6295B3F4C6 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
15:43:21.0062 4524  elxstor - ok
15:43:21.0109 4524  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
15:43:21.0187 4524  EMDMgmt - ok
15:43:21.0218 4524  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
15:43:21.0250 4524  ErrDev - ok
15:43:21.0296 4524  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
15:43:21.0328 4524  EventSystem - ok
15:43:21.0624 4524  [ 9D6A019DEA917F305AF23209FEDD5F16 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
15:43:21.0671 4524  EvtEng - ok
15:43:21.0733 4524  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
15:43:21.0764 4524  exfat - ok
15:43:21.0827 4524  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
15:43:21.0858 4524  fastfat - ok
15:43:21.0905 4524  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
15:43:21.0936 4524  fdc - ok
15:43:21.0983 4524  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
15:43:21.0998 4524  fdPHost - ok
15:43:22.0014 4524  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
15:43:22.0045 4524  FDResPub - ok
15:43:22.0076 4524  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
15:43:22.0092 4524  FileInfo - ok
15:43:22.0092 4524  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
15:43:22.0139 4524  Filetrace - ok
15:43:22.0139 4524  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
15:43:22.0186 4524  flpydisk - ok
15:43:22.0217 4524  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
15:43:22.0232 4524  FltMgr - ok
15:43:22.0295 4524  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
15:43:22.0342 4524  FontCache - ok
15:43:22.0420 4524  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
15:43:22.0435 4524  FontCache3.0.0.0 - ok
15:43:22.0466 4524  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
15:43:22.0513 4524  Fs_Rec - ok
15:43:22.0560 4524  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
15:43:22.0576 4524  gagp30kx - ok
15:43:22.0685 4524  [ C85543022E99762B5DF58109152E48D5 ] GDBackupSvc    C:\Program Files\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
15:43:22.0778 4524  GDBackupSvc - ok
15:43:22.0825 4524  [ 1F0A3452B77638FF4106CF914B3DAB3D ] GDBehave        C:\Windows\system32\drivers\GDBehave.sys
15:43:22.0825 4524  GDBehave - ok
15:43:22.0919 4524  [ EB4D63C618555024DAC54F619859AD92 ] GDFwSvc        C:\Program Files\G Data\TotalProtection\Firewall\GDFwSvc.exe
15:43:23.0059 4524  GDFwSvc - ok
15:43:23.0075 4524  [ 724070D41BC6471DAEDDB6C6A75C8CD3 ] GDMnIcpt        C:\Windows\system32\drivers\MiniIcpt.sys
15:43:23.0090 4524  GDMnIcpt - ok
15:43:23.0122 4524  [ 56B968449ADF9E0F7151B36005731721 ] GDPkIcpt        C:\Windows\system32\drivers\PktIcpt.sys
15:43:23.0122 4524  GDPkIcpt - ok
15:43:23.0200 4524  [ 110C6DC36EA9F5DA664A584756B1B297 ] GDScan          C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
15:43:23.0215 4524  GDScan - ok
15:43:23.0262 4524  [ 0567B5641DF3C52FB4E6B623726669ED ] GDTunerSvc      C:\Program Files\G Data\TotalProtection\AVKTuner\AVKTunerService.exe
15:43:23.0324 4524  GDTunerSvc - ok
15:43:23.0387 4524  [ 0EBC9CEBF9FC3E256E6D196FB3DE61E9 ] gdwfpcd        C:\Windows\system32\drivers\gdwfpcd32.sys
15:43:23.0402 4524  gdwfpcd - ok
15:43:23.0402 4524  GLogin - ok
15:43:23.0465 4524  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
15:43:23.0527 4524  gpsvc - ok
15:43:23.0590 4524  [ 6D92D51B56A893D72786C9E260B36DA2 ] GRD            C:\Windows\system32\drivers\GRD.sys
15:43:23.0590 4524  GRD - ok
15:43:23.0652 4524  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
15:43:23.0652 4524  gupdate - ok
15:43:23.0668 4524  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
15:43:23.0668 4524  gupdatem - ok
15:43:23.0730 4524  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
15:43:23.0777 4524  HdAudAddService - ok
15:43:23.0824 4524  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
15:43:23.0886 4524  HDAudBus - ok
15:43:23.0917 4524  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
15:43:23.0980 4524  HidBth - ok
15:43:23.0980 4524  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr          C:\Windows\system32\drivers\hidir.sys
15:43:24.0026 4524  HidIr - ok
15:43:24.0073 4524  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\system32\hidserv.dll
15:43:24.0104 4524  hidserv - ok
15:43:24.0120 4524  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
15:43:24.0151 4524  HidUsb - ok
15:43:24.0198 4524  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
15:43:24.0229 4524  hkmsvc - ok
15:43:24.0276 4524  [ A3D1EE9B310ED1FE6136FEC4E0DEA366 ] HookCentre      C:\Windows\system32\drivers\HookCentre.sys
15:43:24.0276 4524  HookCentre - ok
15:43:24.0307 4524  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
15:43:24.0323 4524  HpCISSs - ok
15:43:24.0370 4524  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
15:43:24.0448 4524  HTTP - ok
15:43:24.0510 4524  [ C6B032D69650985468160FC9937CF5B4 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
15:43:24.0510 4524  i2omp - ok
15:43:24.0557 4524  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
15:43:24.0588 4524  i8042prt - ok
15:43:24.0635 4524  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
15:43:24.0650 4524  iaStorV - ok
15:43:24.0744 4524  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
15:43:24.0775 4524  idsvc - ok
15:43:24.0791 4524  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
15:43:24.0791 4524  iirsp - ok
15:43:24.0853 4524  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
15:43:24.0916 4524  IKEEXT - ok
15:43:25.0025 4524  [ FFD2B3BC042596ABE785D3C15F51AB46 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
15:43:25.0150 4524  IntcAzAudAddService - ok
15:43:25.0212 4524  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
15:43:25.0228 4524  intelide - ok
15:43:25.0259 4524  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
15:43:25.0290 4524  intelppm - ok
15:43:25.0321 4524  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
15:43:25.0368 4524  IPBusEnum - ok
15:43:25.0384 4524  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:43:25.0415 4524  IpFilterDriver - ok
15:43:25.0462 4524  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
15:43:25.0508 4524  iphlpsvc - ok
15:43:25.0524 4524  IpInIp - ok
15:43:25.0524 4524  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
15:43:25.0571 4524  IPMIDRV - ok
15:43:25.0571 4524  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
15:43:25.0586 4524  IPNAT - ok
15:43:25.0602 4524  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
15:43:25.0618 4524  IRENUM - ok
15:43:25.0649 4524  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
15:43:25.0664 4524  isapnp - ok
15:43:25.0696 4524  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
15:43:25.0711 4524  iScsiPrt - ok
15:43:25.0727 4524  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
15:43:25.0727 4524  iteatapi - ok
15:43:25.0742 4524  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
15:43:25.0742 4524  iteraid - ok
15:43:25.0805 4524  [ DEDB6CC1B166928A8F3F68DEF1766DB0 ] JMCR            C:\Windows\system32\DRIVERS\jmcr.sys
15:43:25.0961 4524  JMCR - ok
15:43:25.0992 4524  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
15:43:25.0992 4524  kbdclass - ok
15:43:26.0008 4524  [ 18247836959BA67E3511B62846B9C2E0 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
15:43:26.0023 4524  kbdhid - ok
15:43:26.0070 4524  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
15:43:26.0070 4524  KeyIso - ok
15:43:26.0101 4524  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
15:43:26.0132 4524  KSecDD - ok
15:43:26.0210 4524  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
15:43:26.0273 4524  KtmRm - ok
15:43:26.0304 4524  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
15:43:26.0351 4524  LanmanServer - ok
15:43:26.0413 4524  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
15:43:26.0444 4524  LanmanWorkstation - ok
15:43:26.0476 4524  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
15:43:26.0507 4524  lltdio - ok
15:43:26.0538 4524  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
15:43:26.0585 4524  lltdsvc - ok
15:43:26.0585 4524  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
15:43:26.0632 4524  lmhosts - ok
15:43:26.0647 4524  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
15:43:26.0663 4524  LSI_FC - ok
15:43:26.0678 4524  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
15:43:26.0678 4524  LSI_SAS - ok
15:43:26.0725 4524  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
15:43:26.0725 4524  LSI_SCSI - ok
15:43:26.0741 4524  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
15:43:26.0772 4524  luafv - ok
15:43:26.0803 4524  [ 629CABB0421668C9D3D402A3C3D77E14 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
15:43:26.0803 4524  MBAMProtector - ok
15:43:26.0834 4524  [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler  C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
15:43:26.0850 4524  MBAMScheduler - ok
15:43:26.0897 4524  [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
15:43:26.0944 4524  MBAMService - ok
15:43:26.0975 4524  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
15:43:26.0990 4524  Mcx2Svc - ok
15:43:27.0022 4524  [ 0001CE609D66632FA17B84705F658879 ] megasas        C:\Windows\system32\drivers\megasas.sys
15:43:27.0022 4524  megasas - ok
15:43:27.0053 4524  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\Windows\system32\drivers\megasr.sys
15:43:27.0068 4524  MegaSR - ok
15:43:27.0115 4524  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
15:43:27.0162 4524  MMCSS - ok
15:43:27.0178 4524  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
15:43:27.0224 4524  Modem - ok
15:43:27.0224 4524  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
15:43:27.0271 4524  monitor - ok
15:43:27.0287 4524  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
15:43:27.0302 4524  mouclass - ok
15:43:27.0302 4524  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
15:43:27.0349 4524  mouhid - ok
15:43:27.0349 4524  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
15:43:27.0365 4524  MountMgr - ok
15:43:27.0396 4524  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\Windows\system32\drivers\mpio.sys
15:43:27.0412 4524  mpio - ok
15:43:27.0412 4524  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
15:43:27.0458 4524  mpsdrv - ok
15:43:27.0490 4524  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
15:43:27.0536 4524  MpsSvc - ok
15:43:27.0568 4524  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
15:43:27.0583 4524  Mraid35x - ok
15:43:27.0630 4524  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
15:43:27.0646 4524  MRxDAV - ok
15:43:27.0692 4524  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
15:43:27.0739 4524  mrxsmb - ok
15:43:27.0770 4524  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:43:27.0786 4524  mrxsmb10 - ok
15:43:27.0802 4524  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:43:27.0833 4524  mrxsmb20 - ok
15:43:27.0880 4524  [ 5457DCFA7C0DA43522F4D9D4049C1472 ] msahci          C:\Windows\system32\drivers\msahci.sys
15:43:27.0895 4524  msahci - ok
15:43:27.0911 4524  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
15:43:27.0926 4524  msdsm - ok
15:43:27.0973 4524  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
15:43:28.0020 4524  MSDTC - ok
15:43:28.0036 4524  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
15:43:28.0067 4524  Msfs - ok
15:43:28.0082 4524  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
15:43:28.0098 4524  msisadrv - ok
15:43:28.0145 4524  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
15:43:28.0192 4524  MSiSCSI - ok
15:43:28.0192 4524  msiserver - ok
15:43:28.0223 4524  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
15:43:28.0254 4524  MSKSSRV - ok
15:43:28.0270 4524  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
15:43:28.0316 4524  MSPCLOCK - ok
15:43:28.0316 4524  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
15:43:28.0348 4524  MSPQM - ok
15:43:28.0363 4524  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
15:43:28.0379 4524  MsRPC - ok
15:43:28.0410 4524  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
15:43:28.0426 4524  mssmbios - ok
15:43:28.0426 4524  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
15:43:28.0457 4524  MSTEE - ok
15:43:28.0488 4524  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
15:43:28.0488 4524  Mup - ok
15:43:28.0535 4524  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
15:43:28.0566 4524  napagent - ok
15:43:28.0613 4524  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
15:43:28.0644 4524  NativeWifiP - ok
15:43:28.0675 4524  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
15:43:28.0706 4524  NDIS - ok
15:43:28.0738 4524  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
15:43:28.0753 4524  NdisTapi - ok
15:43:28.0769 4524  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
15:43:28.0784 4524  Ndisuio - ok
15:43:28.0816 4524  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
15:43:28.0831 4524  NdisWan - ok
15:43:28.0847 4524  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
15:43:28.0862 4524  NDProxy - ok
15:43:28.0862 4524  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
15:43:28.0909 4524  NetBIOS - ok
15:43:28.0940 4524  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
15:43:28.0972 4524  netbt - ok
15:43:29.0003 4524  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
15:43:29.0018 4524  Netlogon - ok
15:43:29.0065 4524  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
15:43:29.0112 4524  Netman - ok
15:43:29.0143 4524  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
15:43:29.0190 4524  netprofm - ok
15:43:29.0221 4524  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
15:43:29.0237 4524  NetTcpPortSharing - ok
15:43:29.0377 4524  [ 2FF0C43CEA308AD5AA5A3D8E56ED74D7 ] NETw5v32        C:\Windows\system32\DRIVERS\NETw5v32.sys
15:43:29.0689 4524  NETw5v32 ( UnsignedFile.Multi.Generic ) - warning
15:43:29.0689 4524  NETw5v32 - detected UnsignedFile.Multi.Generic (1)
15:43:29.0908 4524  [ 383712AEC962B72BF6D368A4A64CFE09 ] NETwNv32        C:\Windows\system32\DRIVERS\NETwNv32.sys
15:43:30.0469 4524  NETwNv32 - ok
15:43:30.0516 4524  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
15:43:30.0516 4524  nfrd960 - ok
15:43:30.0563 4524  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
15:43:30.0594 4524  NlaSvc - ok
15:43:30.0625 4524  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
15:43:30.0672 4524  Npfs - ok
15:43:30.0688 4524  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
15:43:30.0703 4524  nsi - ok
15:43:30.0703 4524  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
15:43:30.0750 4524  nsiproxy - ok
15:43:30.0812 4524  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
15:43:31.0093 4524  Ntfs - ok
15:43:31.0109 4524  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
15:43:31.0140 4524  ntrigdigi - ok
15:43:31.0140 4524  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
15:43:31.0171 4524  Null - ok
15:43:31.0234 4524  [ F972DC046C374A9E02F2DFBE74EBB203 ] NVHDA          C:\Windows\system32\drivers\nvhda32v.sys
15:43:31.0249 4524  NVHDA - ok
15:43:31.0546 4524  [ 0A19680CA54D262534F8A2F4CF79E271 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
15:43:31.0811 4524  nvlddmkm - ok
15:43:31.0858 4524  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
15:43:31.0873 4524  nvraid - ok
15:43:31.0873 4524  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
15:43:31.0889 4524  nvstor - ok
15:43:31.0936 4524  [ 342FCBF0B293DBEC54B055418DF1EE7E ] nvsvc          C:\Windows\system32\nvvsvc.exe
15:43:31.0951 4524  nvsvc - ok
15:43:31.0967 4524  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
15:43:31.0982 4524  nv_agp - ok
15:43:31.0982 4524  NwlnkFlt - ok
15:43:31.0998 4524  NwlnkFwd - ok
15:43:32.0029 4524  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
15:43:32.0076 4524  ohci1394 - ok
15:43:32.0107 4524  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
15:43:32.0170 4524  p2pimsvc - ok
15:43:32.0216 4524  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
15:43:32.0232 4524  p2psvc - ok
15:43:32.0263 4524  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
15:43:32.0310 4524  Parport - ok
15:43:32.0341 4524  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
15:43:32.0357 4524  partmgr - ok
15:43:32.0404 4524  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
15:43:32.0450 4524  Parvdm - ok
15:43:32.0482 4524  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
15:43:32.0513 4524  PcaSvc - ok
15:43:32.0544 4524  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
15:43:32.0560 4524  pci - ok
15:43:32.0591 4524  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\Windows\system32\drivers\pciide.sys
15:43:32.0591 4524  pciide - ok
15:43:32.0606 4524  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
15:43:32.0622 4524  pcmcia - ok
15:43:32.0684 4524  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
15:43:32.0747 4524  PEAUTH - ok
15:43:32.0809 4524  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
15:43:32.0918 4524  pla - ok
15:43:32.0965 4524  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
15:43:32.0996 4524  PlugPlay - ok
15:43:33.0043 4524  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
15:43:33.0074 4524  PNRPAutoReg - ok
15:43:33.0106 4524  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
15:43:33.0137 4524  PNRPsvc - ok
15:43:33.0168 4524  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
15:43:33.0230 4524  PolicyAgent - ok
15:43:33.0324 4524  [ 1B0E581802CAFB5624B79616D73B8E4D ] PowerBiosServer C:\Program Files\Hotkey\PowerBiosServer.exe
15:43:33.0340 4524  PowerBiosServer ( UnsignedFile.Multi.Generic ) - warning
15:43:33.0340 4524  PowerBiosServer - detected UnsignedFile.Multi.Generic (1)
15:43:33.0371 4524  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
15:43:33.0418 4524  PptpMiniport - ok
15:43:33.0433 4524  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor      C:\Windows\system32\drivers\processr.sys
15:43:33.0464 4524  Processor - ok
15:43:33.0511 4524  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
15:43:33.0527 4524  ProfSvc - ok
15:43:33.0558 4524  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
15:43:33.0589 4524  ProtectedStorage - ok
15:43:33.0636 4524  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
15:43:33.0667 4524  PSched - ok
15:43:33.0745 4524  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
15:43:33.0823 4524  ql2300 - ok
15:43:33.0870 4524  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
15:43:33.0886 4524  ql40xx - ok
15:43:33.0948 4524  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
15:43:33.0979 4524  QWAVE - ok
15:43:34.0026 4524  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
15:43:34.0026 4524  QWAVEdrv - ok
15:43:34.0042 4524  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
15:43:34.0073 4524  RasAcd - ok
15:43:34.0088 4524  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
15:43:34.0135 4524  RasAuto - ok
15:43:34.0135 4524  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
15:43:34.0182 4524  Rasl2tp - ok
15:43:34.0213 4524  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
15:43:34.0260 4524  RasMan - ok
15:43:34.0291 4524  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
15:43:34.0322 4524  RasPppoe - ok
15:43:34.0354 4524  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
15:43:34.0369 4524  RasSstp - ok
15:43:34.0400 4524  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
15:43:34.0432 4524  rdbss - ok
15:43:34.0463 4524  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
15:43:34.0510 4524  RDPCDD - ok
15:43:34.0541 4524  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
15:43:34.0572 4524  rdpdr - ok
15:43:34.0572 4524  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
15:43:34.0588 4524  RDPENCDD - ok
15:43:34.0650 4524  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
15:43:34.0681 4524  RDPWD - ok
15:43:34.0790 4524  [ 6987DC1DD7A7159752DFB1F6AABAE062 ] RegSrvc        C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
15:43:34.0822 4524  RegSrvc - ok
15:43:34.0868 4524  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
15:43:34.0884 4524  RemoteAccess - ok
15:43:34.0931 4524  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
15:43:34.0946 4524  RemoteRegistry - ok
15:43:34.0978 4524  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
15:43:35.0009 4524  RpcLocator - ok
15:43:35.0040 4524  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
15:43:35.0071 4524  RpcSs - ok
15:43:35.0118 4524  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
15:43:35.0134 4524  rspndr - ok
15:43:35.0180 4524  [ ABBE0F54BA3A378262C9CB86CF7D91F8 ] RTL8169        C:\Windows\system32\DRIVERS\Rtlh86.sys
15:43:35.0212 4524  RTL8169 - ok
15:43:35.0243 4524  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
15:43:35.0258 4524  SamSs - ok
15:43:35.0258 4524  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
15:43:35.0274 4524  sbp2port - ok
15:43:35.0321 4524  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
15:43:35.0336 4524  SCardSvr - ok
15:43:35.0399 4524  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
15:43:35.0461 4524  Schedule - ok
15:43:35.0524 4524  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
15:43:35.0539 4524  SCPolicySvc - ok
15:43:35.0570 4524  [ 126EA89BCC413EE45E3004FB0764888F ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
15:43:35.0602 4524  sdbus - ok
15:43:35.0633 4524  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
15:43:35.0664 4524  SDRSVC - ok
15:43:35.0711 4524  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
15:43:35.0773 4524  secdrv - ok
15:43:35.0804 4524  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
15:43:35.0851 4524  seclogon - ok
15:43:35.0867 4524  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
15:43:35.0898 4524  SENS - ok
15:43:35.0898 4524  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\drivers\serenum.sys
15:43:35.0929 4524  Serenum - ok
15:43:35.0960 4524  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
15:43:36.0023 4524  Serial - ok
15:43:36.0023 4524  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
15:43:36.0054 4524  sermouse - ok
15:43:36.0070 4524  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
15:43:36.0101 4524  SessionEnv - ok
15:43:36.0132 4524  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
15:43:36.0148 4524  sffdisk - ok
15:43:36.0148 4524  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
15:43:36.0194 4524  sffp_mmc - ok
15:43:36.0194 4524  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
15:43:36.0241 4524  sffp_sd - ok
15:43:36.0241 4524  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
15:43:36.0288 4524  sfloppy - ok
15:43:36.0335 4524  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
15:43:36.0366 4524  SharedAccess - ok
15:43:36.0413 4524  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
15:43:36.0428 4524  ShellHWDetection - ok
15:43:36.0475 4524  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
15:43:36.0491 4524  sisagp - ok
15:43:36.0522 4524  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
15:43:36.0538 4524  SiSRaid2 - ok
15:43:36.0538 4524  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
15:43:36.0553 4524  SiSRaid4 - ok
15:43:36.0662 4524  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
15:43:36.0850 4524  slsvc - ok
15:43:36.0896 4524  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
15:43:36.0928 4524  SLUINotify - ok
15:43:36.0959 4524  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
15:43:36.0974 4524  Smb - ok
15:43:37.0037 4524  [ BE44AE880E8D22A5615E352C68B278B9 ] smserial        C:\Windows\system32\DRIVERS\smserial.sys
15:43:37.0130 4524  smserial - ok
15:43:37.0193 4524  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
15:43:37.0193 4524  SNMPTRAP - ok
15:43:37.0240 4524  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
15:43:37.0255 4524  spldr - ok
15:43:37.0286 4524  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
15:43:37.0302 4524  Spooler - ok
15:43:37.0333 4524  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
15:43:37.0364 4524  srv - ok
15:43:37.0396 4524  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
15:43:37.0427 4524  srv2 - ok
15:43:37.0458 4524  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
15:43:37.0489 4524  srvnet - ok
15:43:37.0520 4524  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
15:43:37.0552 4524  SSDPSRV - ok
15:43:37.0583 4524  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
15:43:37.0598 4524  SstpSvc - ok
15:43:37.0661 4524  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
15:43:37.0723 4524  stisvc - ok
15:43:37.0754 4524  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
15:43:37.0770 4524  swenum - ok
15:43:37.0801 4524  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
15:43:37.0848 4524  swprv - ok
15:43:37.0848 4524  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
15:43:37.0864 4524  Symc8xx - ok
15:43:37.0864 4524  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
15:43:37.0879 4524  Sym_hi - ok
15:43:37.0879 4524  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
15:43:37.0879 4524  Sym_u3 - ok
15:43:37.0942 4524  [ 55F6E55CC2430CA8713387106FA79817 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
15:43:37.0942 4524  SynTP - ok
15:43:38.0004 4524  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
15:43:38.0082 4524  SysMain - ok
15:43:38.0129 4524  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
15:43:38.0160 4524  TabletInputService - ok
15:43:38.0191 4524  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
15:43:38.0222 4524  TapiSrv - ok
15:43:38.0238 4524  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
15:43:38.0285 4524  TBS - ok
15:43:38.0332 4524  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
15:43:38.0363 4524  Tcpip - ok
15:43:38.0410 4524  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
15:43:38.0441 4524  Tcpip6 - ok
15:43:38.0488 4524  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
15:43:38.0503 4524  tcpipreg - ok
15:43:38.0550 4524  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
15:43:38.0566 4524  TDPIPE - ok
15:43:38.0566 4524  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
15:43:38.0597 4524  TDTCP - ok
15:43:38.0628 4524  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
15:43:38.0644 4524  tdx - ok
15:43:38.0659 4524  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
15:43:38.0675 4524  TermDD - ok
15:43:38.0706 4524  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
15:43:38.0753 4524  TermService - ok
15:43:38.0768 4524  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
15:43:38.0784 4524  Themes - ok
15:43:38.0815 4524  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
15:43:38.0846 4524  THREADORDER - ok
15:43:38.0878 4524  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
15:43:38.0893 4524  TrkWks - ok
15:43:38.0971 4524  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
15:43:39.0002 4524  TrustedInstaller - ok
15:43:39.0018 4524  [ 1829AA7B9860A5FAA019D54519BB6635 ] TS4NT          C:\Windows\system32\Drivers\TS4nt.sys
15:43:39.0018 4524  TS4NT - ok
15:43:39.0080 4524  [ B4A0237AF692AC90E18F61880A48D010 ] TSNxGService    C:\Program Files\G Data\TotalProtection\TSNxG\TSNxGService.exe
15:43:39.0096 4524  TSNxGService - ok
15:43:39.0127 4524  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
15:43:39.0174 4524  tssecsrv - ok
15:43:39.0299 4524  [ 876A1FE7A7CA957E84C3AF797F2E7FC5 ] TuneUp.UtilitiesSvc C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
15:43:39.0361 4524  TuneUp.UtilitiesSvc - ok
15:43:39.0377 4524  [ F2107C9D85EC0DF116939CCCE06AE697 ] TuneUpUtilitiesDrv C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys
15:43:39.0377 4524  TuneUpUtilitiesDrv - ok
15:43:39.0408 4524  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
15:43:39.0455 4524  tunmp - ok
15:43:39.0470 4524  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
15:43:39.0502 4524  tunnel - ok
15:43:39.0548 4524  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\Windows\system32\drivers\uagp35.sys
15:43:39.0564 4524  uagp35 - ok
15:43:39.0611 4524  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
15:43:39.0626 4524  udfs - ok
15:43:39.0673 4524  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
15:43:39.0689 4524  UI0Detect - ok
15:43:39.0720 4524  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
15:43:39.0736 4524  uliagpkx - ok
15:43:39.0751 4524  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci        C:\Windows\system32\drivers\uliahci.sys
15:43:39.0767 4524  uliahci - ok
15:43:39.0782 4524  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
15:43:39.0798 4524  UlSata - ok
15:43:39.0829 4524  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
15:43:39.0829 4524  ulsata2 - ok
15:43:39.0845 4524  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
15:43:39.0876 4524  umbus - ok
15:43:39.0907 4524  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
15:43:39.0954 4524  upnphost - ok
15:43:40.0001 4524  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
15:43:40.0032 4524  usbccgp - ok
15:43:40.0048 4524  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
15:43:40.0094 4524  usbcir - ok
15:43:40.0141 4524  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
15:43:40.0172 4524  usbehci - ok
15:43:40.0188 4524  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
15:43:40.0204 4524  usbhub - ok
15:43:40.0219 4524  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci        C:\Windows\system32\drivers\usbohci.sys
15:43:40.0266 4524  usbohci - ok
15:43:40.0297 4524  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
15:43:40.0328 4524  usbprint - ok
15:43:40.0328 4524  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:43:40.0375 4524  USBSTOR - ok
15:43:40.0391 4524  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
15:43:40.0406 4524  usbuhci - ok
15:43:40.0453 4524  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
15:43:40.0500 4524  usbvideo - ok
15:43:40.0516 4524  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
15:43:40.0547 4524  UxSms - ok
15:43:40.0594 4524  [ 907C6BCE7A235B128A585040B5E7D319 ] UxTuneUp        C:\Windows\System32\uxtuneup.dll
15:43:40.0609 4524  UxTuneUp - ok
15:43:40.0640 4524  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
15:43:40.0672 4524  vds - ok
15:43:40.0703 4524  [ 87B06E1F30B749A114F74622D013F8D4 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
15:43:40.0734 4524  vga - ok
15:43:40.0750 4524  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
15:43:40.0796 4524  VgaSave - ok
15:43:40.0796 4524  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\Windows\system32\drivers\viaagp.sys
15:43:40.0812 4524  viaagp - ok
15:43:40.0828 4524  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7          C:\Windows\system32\drivers\viac7.sys
15:43:40.0859 4524  ViaC7 - ok
15:43:40.0859 4524  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\Windows\system32\drivers\viaide.sys
15:43:40.0874 4524  viaide - ok
15:43:40.0890 4524  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
15:43:40.0906 4524  volmgr - ok
15:43:40.0937 4524  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
15:43:40.0968 4524  volmgrx - ok
15:43:40.0999 4524  [ 786DB5771F05EF300390399F626BF30A ] volsnap        C:\Windows\system32\drivers\volsnap.sys
15:43:41.0015 4524  volsnap - ok
15:43:41.0030 4524  [ 587253E09325E6BF226B299774B728A9 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
15:43:41.0046 4524  vsmraid - ok
15:43:41.0093 4524  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
15:43:41.0186 4524  VSS - ok
15:43:41.0233 4524  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
15:43:41.0264 4524  W32Time - ok
15:43:41.0296 4524  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
15:43:41.0327 4524  WacomPen - ok
15:43:41.0342 4524  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
15:43:41.0358 4524  Wanarp - ok
15:43:41.0358 4524  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
15:43:41.0389 4524  Wanarpv6 - ok
15:43:41.0420 4524  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
15:43:41.0452 4524  wcncsvc - ok
15:43:41.0483 4524  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
15:43:41.0514 4524  WcsPlugInService - ok
15:43:41.0545 4524  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\Windows\system32\drivers\wd.sys
15:43:41.0561 4524  Wd - ok
15:43:41.0608 4524  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
15:43:41.0639 4524  Wdf01000 - ok
15:43:41.0654 4524  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
15:43:41.0701 4524  WdiServiceHost - ok
15:43:41.0701 4524  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
15:43:41.0717 4524  WdiSystemHost - ok
15:43:41.0764 4524  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
15:43:41.0795 4524  WebClient - ok
15:43:41.0826 4524  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
15:43:41.0842 4524  Wecsvc - ok
15:43:41.0888 4524  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
15:43:41.0920 4524  wercplsupport - ok
15:43:41.0951 4524  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
15:43:41.0982 4524  WerSvc - ok
15:43:42.0060 4524  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
15:43:42.0076 4524  WinDefend - ok
15:43:42.0076 4524  WinHttpAutoProxySvc - ok
15:43:42.0169 4524  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
15:43:42.0200 4524  Winmgmt - ok
15:43:42.0263 4524  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
15:43:42.0372 4524  WinRM - ok
15:43:42.0403 4524  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
15:43:42.0434 4524  Wlansvc - ok
15:43:42.0450 4524  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi        C:\Windows\system32\DRIVERS\wmiacpi.sys
15:43:42.0497 4524  WmiAcpi - ok
15:43:42.0528 4524  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:43:42.0544 4524  wmiApSrv - ok
15:43:42.0622 4524  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
15:43:42.0684 4524  WMPNetworkSvc - ok
15:43:42.0731 4524  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:43:42.0778 4524  WPCSvc - ok
15:43:42.0824 4524  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:43:42.0840 4524  WPDBusEnum - ok
15:43:43.0074 4524  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
15:43:43.0090 4524  WPFFontCache_v0400 - ok
15:43:43.0121 4524  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
15:43:43.0183 4524  ws2ifsl - ok
15:43:43.0214 4524  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
15:43:43.0230 4524  wscsvc - ok
15:43:43.0246 4524  WSearch - ok
15:43:43.0308 4524  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
15:43:43.0402 4524  wuauserv - ok
15:43:43.0417 4524  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:43:43.0433 4524  WudfPf - ok
15:43:43.0448 4524  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
15:43:43.0480 4524  WUDFRd - ok
15:43:43.0495 4524  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
15:43:43.0511 4524  wudfsvc - ok
15:43:43.0558 4524  [ A640C90B007762939507C28A021BE3B3 ] xusb21          C:\Windows\system32\DRIVERS\xusb21.sys
15:43:43.0589 4524  xusb21 - ok
15:43:43.0589 4524  ================ Scan global ===============================
15:43:43.0636 4524  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
15:43:43.0682 4524  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
15:43:43.0698 4524  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
15:43:43.0760 4524  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
15:43:43.0760 4524  [Global] - ok
15:43:43.0760 4524  ================ Scan MBR ==================================
15:43:43.0792 4524  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
15:43:44.0353 4524  \Device\Harddisk0\DR0 - ok
15:43:44.0353 4524  ================ Scan VBR ==================================
15:43:44.0353 4524  [ 1DFEF537AB39ED8976282B857B3A4AE4 ] \Device\Harddisk0\DR0\Partition1
15:43:44.0353 4524  \Device\Harddisk0\DR0\Partition1 - ok
15:43:44.0353 4524  ============================================================
15:43:44.0353 4524  Scan finished
15:43:44.0353 4524  ============================================================
15:43:44.0353 3748  Detected object count: 2
15:43:44.0353 3748  Actual detected object count: 2
15:44:16.0552 3748  NETw5v32 ( UnsignedFile.Multi.Generic ) - skipped by user
15:44:16.0552 3748  NETw5v32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:44:16.0552 3748  PowerBiosServer ( UnsignedFile.Multi.Generic ) - skipped by user
15:44:16.0552 3748  PowerBiosServer ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 09.01.2013 17:29
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Devilspearl 09.01.2013 17:29
ich hoffe das es die richtigen Dateien sind ;-)))

soll ich vorher noch mit TDSS-Killer etwas löschen die einstellungen waren ja auf skip

combofix läuft nun schon über 40 min und steht seid 30 min bei stufe 4 ist das so richtig???

Es sieht so aus als wenn combofix sich aufgehängt hat was soll ich nun machen ??

warum hat sich combofix aufgehängt ich hatte bei G datatotalprotaction beide Virenwächter und die Firewall deaktiviert sowie die Windows Firewall auch. aber Combofix hängt nun 1std 40min auf stufe 4 fest.

was soll ich jetzt machen

cosinus 09.01.2013 23:45
Starte Windows neu, lösch die alte combofix.exe, lade CF neu runter und probier es bitte nochmal.

Devilspearl 10.01.2013 14:59
hab ich irgendwas zu wenig ausgeschaltet ? wie deaktiviert man den Google browser??

Code:
ComboFix 13-01-08.01 - Anne 10.01.2013  15:16:43.3.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2554.1401 [GMT 1:00]
ausgeführt von:: c:\users\Anne\Downloads\ComboFix.exe
AV: G Data TotalProtection 2013 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
FW: G Data Personal Firewall *Disabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}
SP: G Data TotalProtection 2013 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-12-10 bis 2013-01-10  ))))))))))))))))))))))))))))))
.
.
2013-01-10 14:26 . 2013-01-10 14:26        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-01-08 23:23 . 2013-01-08 23:23        --------        d-----w-        c:\programdata\Malwarebytes
2013-01-08 23:22 . 2013-01-08 23:23        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2013-01-08 23:22 . 2012-12-14 15:49        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-01-08 18:01 . 2013-01-08 21:51        --------        d-----w-        c:\program files\VideoLAN
2013-01-08 15:36 . 2013-01-08 15:36        --------        d-----w-        c:\program files\Windows Portable Devices
2013-01-08 11:48 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll
2013-01-08 11:48 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll
2013-01-08 11:48 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll
2013-01-08 11:42 . 2012-02-29 15:11        5120        ----a-w-        c:\windows\system32\wmi.dll
2013-01-08 11:42 . 2012-02-29 15:09        157696        ----a-w-        c:\windows\system32\imagehlp.dll
2013-01-08 11:42 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2013-01-08 11:32 . 2013-01-08 11:32        98816        ----a-w-        c:\windows\system32\mfps.dll
2013-01-08 11:31 . 2013-01-08 11:31        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2013-01-08 11:31 . 2013-01-08 11:31        519680        ----a-w-        c:\windows\system32\d3d11.dll
2013-01-08 11:31 . 2013-01-08 11:31        369664        ----a-w-        c:\windows\system32\WMPhoto.dll
2013-01-08 11:31 . 2013-01-08 11:31        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll
2013-01-08 11:31 . 2013-01-08 11:31        252928        ----a-w-        c:\windows\system32\dxdiag.exe
2013-01-08 11:31 . 2013-01-08 11:31        195584        ----a-w-        c:\windows\system32\dxdiagn.dll
2013-01-08 11:31 . 2013-01-08 11:31        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll
2013-01-08 11:21 . 2012-07-26 02:46        9728        ----a-w-        c:\windows\system32\Wdfres.dll
2013-01-08 11:21 . 2012-07-26 03:39        526952        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys
2013-01-08 11:21 . 2012-07-26 03:39        47720        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys
2013-01-08 11:21 . 2012-07-26 03:20        73216        ----a-w-        c:\windows\system32\WUDFSvc.dll
2013-01-08 11:21 . 2012-07-26 03:20        172032        ----a-w-        c:\windows\system32\WUDFPlatform.dll
2013-01-08 11:21 . 2012-07-26 02:33        66560        ----a-w-        c:\windows\system32\drivers\WUDFPf.sys
2013-01-08 11:21 . 2012-07-26 02:32        155136        ----a-w-        c:\windows\system32\drivers\WUDFRd.sys
2013-01-08 11:21 . 2009-07-14 12:12        16896        ----a-w-        c:\windows\system32\winusb.dll
2013-01-08 11:21 . 2012-07-26 03:21        196608        ----a-w-        c:\windows\system32\WUDFHost.exe
2013-01-08 11:21 . 2012-07-26 03:20        613888        ----a-w-        c:\windows\system32\WUDFx.dll
2013-01-08 11:21 . 2012-07-26 03:20        38912        ----a-w-        c:\windows\system32\WUDFCoinstaller.dll
2013-01-08 11:14 . 2012-12-16 13:12        34304        ----a-w-        c:\windows\system32\atmlib.dll
2013-01-08 11:14 . 2012-12-16 10:50        293376        ----a-w-        c:\windows\system32\atmfd.dll
2013-01-08 09:48 . 2011-07-29 16:01        293376        ----a-w-        c:\windows\system32\psisdecd.dll
2013-01-08 09:48 . 2011-07-29 16:01        217088        ----a-w-        c:\windows\system32\psisrndr.ax
2013-01-08 09:48 . 2011-07-29 16:00        57856        ----a-w-        c:\windows\system32\MSDvbNP.ax
2013-01-08 09:48 . 2011-07-29 16:00        69632        ----a-w-        c:\windows\system32\Mpeg2Data.ax
2013-01-08 09:48 . 2012-08-29 11:27        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-01-08 09:48 . 2012-08-29 11:27        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-01-08 09:48 . 2012-05-11 15:57        623616        ----a-w-        c:\windows\system32\localspl.dll
2013-01-08 09:47 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll
2013-01-08 09:47 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll
2013-01-08 09:47 . 2012-11-13 01:36        2048000        ----a-w-        c:\windows\system32\win32k.sys
2013-01-08 09:47 . 2012-09-25 16:19        75776        ----a-w-        c:\windows\system32\synceng.dll
2013-01-08 09:47 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll
2013-01-08 09:47 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll
2013-01-08 09:47 . 2012-03-30 12:39        905600        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-01-08 09:47 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll
2013-01-08 09:47 . 2012-03-20 23:28        53120        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2013-01-08 09:45 . 2012-08-24 15:53        172544        ----a-w-        c:\windows\system32\wintrust.dll
2013-01-08 09:45 . 2012-06-02 00:02        985088        ----a-w-        c:\windows\system32\crypt32.dll
2013-01-08 09:45 . 2012-06-02 00:02        98304        ----a-w-        c:\windows\system32\cryptnet.dll
2013-01-08 09:45 . 2012-06-02 00:02        133120        ----a-w-        c:\windows\system32\cryptsvc.dll
2013-01-08 09:45 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2013-01-08 09:45 . 2012-06-05 16:47        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll
2013-01-08 09:45 . 2012-11-13 01:29        2048        ----a-w-        c:\windows\system32\tzres.dll
2013-01-08 09:45 . 2012-03-01 11:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2013-01-08 09:45 . 2011-08-25 16:15        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll
2013-01-08 09:45 . 2011-08-25 16:14        563712        ----a-w-        c:\windows\system32\oleaut32.dll
2013-01-08 09:45 . 2011-08-25 16:14        238080        ----a-w-        c:\windows\system32\oleacc.dll
2013-01-08 09:45 . 2011-08-25 13:31        4096        ----a-w-        c:\windows\system32\oleaccrc.dll
2013-01-08 09:44 . 2012-06-05 16:47        1401856        ----a-w-        c:\windows\system32\msxml6.dll
2013-01-08 09:44 . 2012-06-05 16:47        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2013-01-08 09:44 . 2012-05-01 14:03        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2013-01-08 09:44 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll
2013-01-08 09:43 . 2012-06-04 15:26        440704        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2013-01-08 09:43 . 2012-06-02 00:04        278528        ----a-w-        c:\windows\system32\schannel.dll
2013-01-08 09:43 . 2012-06-02 00:03        204288        ----a-w-        c:\windows\system32\ncrypt.dll
2013-01-08 09:43 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll
2013-01-08 09:43 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll
2013-01-08 09:43 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe
2013-01-08 09:43 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll
2013-01-08 08:44 . 2012-11-19 00:04        6812136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{030F9654-A72C-4689-9116-03EF9981AA3D}\mpengine.dll
2013-01-08 08:39 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll
2013-01-08 08:28 . 2012-06-02 22:19        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2013-01-08 08:28 . 2012-06-02 22:19        45080        ----a-w-        c:\windows\system32\wups2.dll
2013-01-08 08:28 . 2012-06-02 22:19        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2013-01-08 08:28 . 2012-06-02 22:12        2422272        ----a-w-        c:\windows\system32\wucltux.dll
2013-01-08 08:27 . 2012-06-02 22:19        35864        ----a-w-        c:\windows\system32\wups.dll
2013-01-08 08:27 . 2012-06-02 22:19        577048        ----a-w-        c:\windows\system32\wuapi.dll
2013-01-08 08:27 . 2012-06-02 22:12        88576        ----a-w-        c:\windows\system32\wudriver.dll
2013-01-08 08:27 . 2012-06-02 14:19        171904        ----a-w-        c:\windows\system32\wuwebv.dll
2013-01-08 08:27 . 2012-06-02 14:12        33792        ----a-w-        c:\windows\system32\wuapp.exe
2013-01-07 17:39 . 2013-01-07 17:40        --------        d-----w-        c:\windows\system32\ca-ES
2013-01-07 17:39 . 2013-01-07 17:40        --------        d-----w-        c:\windows\system32\eu-ES
2013-01-07 17:39 . 2013-01-07 17:40        --------        d-----w-        c:\windows\system32\vi-VN
2013-01-07 17:23 . 2013-01-07 17:23        --------        d-----w-        c:\windows\system32\EventProviders
2013-01-07 11:29 . 2013-01-07 11:29        --------        d-----w-        c:\program files\Electronic Arts
2013-01-02 12:36 . 2013-01-02 12:36        --------        d-----w-        c:\windows\Cache
2012-12-30 16:10 . 2012-12-30 16:10        --------        d-----w-        c:\windows\system32\Macromed
2012-12-30 16:10 . 2005-05-26 14:34        2297552        ----a-w-        c:\windows\system32\d3dx9_26.dll
2012-12-22 14:09 . 2008-01-21 02:23        89600        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
2012-12-17 18:00 . 2012-12-17 18:00        15600        ----a-w-        c:\windows\system32\drivers\GdPhyMem.sys
2012-12-17 18:00 . 2012-12-17 18:00        30416        ----a-w-        c:\windows\system32\drivers\GRD.sys
2012-12-17 17:31 . 2010-09-06 16:20        125952        ----a-w-        c:\windows\system32\srvsvc.dll
2012-12-17 17:31 . 2010-09-06 16:19        17920        ----a-w-        c:\windows\system32\netevent.dll
2012-12-17 17:29 . 2013-01-10 14:12        940655        ----a-w-        c:\windows\system32\sig.bin
2012-12-15 10:05 . 2012-12-15 10:05        --------        d-----w-        c:\program files\Microsoft.NET
2012-12-15 10:04 . 2009-11-08 09:55        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll
2012-12-15 10:04 . 2009-11-08 09:55        49472        ----a-w-        c:\windows\system32\netfxperf.dll
2012-12-15 10:04 . 2009-11-08 09:55        297808        ----a-w-        c:\windows\system32\mscoree.dll
2012-12-15 10:04 . 2009-11-08 09:55        295264        ----a-w-        c:\windows\system32\PresentationHost.exe
2012-12-15 10:04 . 2009-11-08 09:55        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2012-12-15 07:44 . 2012-05-29 07:24        10792        ----a-w-        c:\windows\system32\GdScrSv.de.dll
2012-12-14 19:46 . 2012-12-14 19:49        --------        d-----w-        c:\programdata\ashampoo
2012-12-14 19:45 . 2012-12-14 19:49        --------        d-----w-        c:\program files\Ashampoo
2012-12-14 19:14 . 2011-12-13 08:35        31552        ----a-w-        c:\windows\system32\TURegOpt.exe
2012-12-14 19:14 . 2011-12-13 08:29        21312        ----a-w-        c:\windows\system32\authuitu.dll
2012-12-14 19:14 . 2011-12-13 08:29        29504        ----a-w-        c:\windows\system32\uxtuneup.dll
2012-12-14 19:13 . 2012-12-14 19:16        --------        d-----w-        c:\program files\TuneUp Utilities 2011
2012-12-14 19:12 . 2012-12-14 19:16        --------        d-----w-        c:\programdata\TuneUp Software
2012-12-14 19:12 . 2012-12-14 19:12        --------        d-sh--w-        c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2012-12-14 16:49 . 2012-12-14 16:49        --------        d-----w-        c:\program files\Cisco
2012-12-14 16:49 . 2012-12-14 16:49        --------        d-----w-        c:\program files\Common Files\Intel
2012-12-14 16:49 . 2012-12-14 16:49        --------        d-----w-        c:\programdata\Intel
2012-12-14 15:43 . 2009-04-11 05:03        12240896        ----a-w-        c:\windows\system32\NlsLexicons0007.dll
2012-12-14 15:43 . 2009-04-11 06:28        1081344        ----a-w-        c:\windows\system32\SLCExt.dll
2012-12-14 15:43 . 2009-04-11 06:27        3408896        ----a-w-        c:\windows\system32\SLsvc.exe
2012-12-14 15:43 . 2009-04-11 06:28        2134528        ----a-w-        c:\windows\system32\FunctionDiscoveryFolder.dll
2012-12-14 15:43 . 2009-04-11 06:27        65536        ----a-w-        c:\windows\system32\DevicePairingWizard.exe
2012-12-14 15:41 . 2009-04-11 06:28        17920        ----a-w-        c:\windows\system32\wscisvif.dll
2012-12-14 15:31 . 2011-04-21 13:58        273408        ----a-w-        c:\windows\system32\drivers\afd.sys
2012-12-14 15:31 . 2011-07-06 15:31        214016        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2012-12-14 15:31 . 2011-04-29 13:24        79872        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2012-12-14 15:31 . 2011-04-29 13:24        106496        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-08 11:31 . 2013-01-08 11:31        4096        ----a-w-        c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-03 13535776]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-16 6111232]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"G Data AntiVirus Tray Application"="c:\program files\G Data\TotalProtection\AVKTray\AVKTray.exe" [2012-09-17 995352]
"GDFirewallTray"="c:\program files\G Data\TotalProtection\Firewall\GDFirewallTray.exe" [2012-01-27 1470968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-13 20:04]
.
2013-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-13 20:04]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-10 15:26
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2013-01-10  15:28:24
ComboFix-quarantined-files.txt  2013-01-10 14:28
.
Vor Suchlauf: 14 Verzeichnis(se), 151.865.487.360 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 151.977.758.720 Bytes frei
.
- - End Of File - - DDEE3AE5B903A1E4176022473D6A8B95
so hat diesmal geklappt obwohl ich alles so wie gestern gemacht habe

cosinus 10.01.2013 20:37
Wer sagt du sollst den Google-Browser deaktivieren?! Wenn solltest du nur alle aktiven (gestarteten) Programme beenden. Beenden ist nicht dasselbe wie deaktivieren

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Devilspearl 10.01.2013 20:50
Code:
# AdwCleaner v2.105 - Datei am 10/01/2013 um 20:49:10 erstellt
# Aktualisiert am 08/01/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Anne - ANNE-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Anne\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v23.0.1271.97

Datei : C:\Users\Anne\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [718 octets] - [10/01/2013 20:49:10]

########## EOF - C:\AdwCleaner[R1].txt - [777 octets] ##########

cosinus 10.01.2013 21:40
Eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

Devilspearl 11.01.2013 16:37
Code:
OTL logfile created on: 11.01.2013 16:08:48 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Anne\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,49 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 52,30% Memory free
5,20 Gb Paging File | 3,89 Gb Available in Paging File | 74,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 140,99 Gb Free Space | 47,30% Space Free | Partition Type: NTFS
 
Computer Name: ANNE-PC | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Anne\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Programme\G Data\TotalProtection\AVKTray\AVKTray.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\AVKBackup\AVKBackupService.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\AVK\AVKWCtl.exe (G Data Software AG)
PRC - C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\Firewall\GDFwSvc.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\TSNxG\TSNxGService.exe (G Data Software)
PRC - C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\Firewall\GDFirewallTray.exe (G Data Software AG)
PRC - C:\Programme\G Data\TotalProtection\AVK\AVKService.exe (G Data Software AG)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Hotkey\PowerBiosServer.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (GDBackupSvc) -- C:\Programme\G Data\TotalProtection\AVKBackup\AVKBackupService.exe (G Data Software AG)
SRV - (AVKWCtl) -- C:\Programme\G Data\TotalProtection\AVK\AVKWCtl.exe (G Data Software AG)
SRV - (AVKProxy) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (GDFwSvc) -- C:\Programme\G Data\TotalProtection\Firewall\GDFwSvc.exe (G Data Software AG)
SRV - (TSNxGService) -- C:\Programme\G Data\TotalProtection\TSNxG\TSNxGService.exe (G Data Software)
SRV - (GDTunerSvc) -- C:\Programme\G Data\TotalProtection\AVKTuner\AVKTunerService.exe (G Data Software AG)
SRV - (GDScan) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
SRV - (AVKService) -- C:\Programme\G Data\TotalProtection\AVK\AVKService.exe (G Data Software AG)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (PowerBiosServer) -- C:\Programme\Hotkey\PowerBiosServer.exe ()
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (GLogin) --  File not found
DRV - (catchme) -- C:\Users\Anne\AppData\Local\Temp\catchme.sys File not found
DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)
DRV - (GDPkIcpt) -- C:\Windows\System32\drivers\PktIcpt.sys (G Data Software AG)
DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)
DRV - (GDBehave) -- C:\Windows\System32\drivers\GDBehave.sys (G Data Software AG)
DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G Data Software AG)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (TS4NT) -- C:\Windows\System32\drivers\TS4nt.sys (G Data Software)
DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)
DRV - (NETwNv32) -- C:\Windows\System32\drivers\NETwNv32.sys (Intel Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-6757586-1979965592-498421705-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-6757586-1979965592-498421705-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-6757586-1979965592-498421705-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-6757586-1979965592-498421705-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-6757586-1979965592-498421705-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - homepage: hxxp://google.de/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\TotalProtection\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\TotalProtection\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-6757586-1979965592-498421705-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-6757586-1979965592-498421705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A47EC58-DBD9-451B-BC97-037C6764AA50}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20ECE4C8-9665-45EC-9ADE-15C484F9EFBE}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.10 15:28:26 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\temp
[2013.01.10 15:28:04 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.01.10 15:13:39 | 000,000,000 | ---D | C] -- C:\ComboFix
[2013.01.09 17:41:14 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.01.09 17:41:14 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.01.09 17:41:14 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.01.09 17:41:03 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.01.09 17:40:10 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.01.09 15:15:45 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Anne\Desktop\aswMBR.exe
[2013.01.09 13:54:48 | 000,000,000 | ---D | C] -- C:\Users\Anne\Desktop\mbar-1.01.0.1011
[2013.01.09 11:07:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Anne\Desktop\OTL.exe
[2013.01.09 00:23:41 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Malwarebytes
[2013.01.09 00:23:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.01.09 00:23:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.09 00:22:55 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.01.09 00:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.01.08 19:01:39 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2013.01.08 16:36:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2013.01.08 12:48:43 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2013.01.08 12:48:43 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2013.01.08 12:48:43 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2013.01.08 12:47:19 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2013.01.08 12:47:19 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2013.01.08 12:47:18 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2013.01.08 12:47:17 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2013.01.08 12:47:17 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2013.01.08 12:47:17 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2013.01.08 12:47:17 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2013.01.08 12:47:17 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2013.01.08 12:47:17 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2013.01.08 12:33:21 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.01.08 12:33:21 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.01.08 12:33:21 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.01.08 12:33:20 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.01.08 12:33:20 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.01.08 12:33:20 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.01.08 12:33:20 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.01.08 12:33:20 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.01.08 12:33:20 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.01.08 12:33:20 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.01.08 12:33:20 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.01.08 12:33:20 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.01.08 12:33:20 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.01.08 12:33:20 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.01.08 12:33:20 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.01.08 12:33:19 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.01.08 12:33:19 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.01.08 12:33:19 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.01.08 12:33:19 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.01.08 12:33:19 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.01.08 12:33:19 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.01.08 12:33:19 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.01.08 12:33:19 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.01.08 12:33:19 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.01.08 12:33:19 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.01.08 12:33:19 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.01.08 12:33:19 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.01.08 12:33:18 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.01.08 12:33:18 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.01.08 12:33:18 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.01.08 12:33:18 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.01.08 12:33:18 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.01.08 12:33:18 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.01.08 12:33:18 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.01.08 12:33:18 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.01.08 12:33:18 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.01.08 12:33:18 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.01.08 12:32:27 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.01.08 12:32:27 | 000,979,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll
[2013.01.08 12:32:27 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll
[2013.01.08 12:32:27 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll
[2013.01.08 12:32:27 | 000,261,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2013.01.08 12:32:27 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2013.01.08 12:32:26 | 000,209,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2013.01.08 12:32:25 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2013.01.08 12:32:25 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2013.01.08 12:32:25 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2013.01.08 12:32:25 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2013.01.08 12:32:25 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2013.01.08 12:32:25 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2013.01.08 12:32:25 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2013.01.08 12:32:25 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2013.01.08 12:32:25 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2013.01.08 12:32:25 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2013.01.08 12:32:25 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2013.01.08 12:32:25 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.01.08 12:32:25 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2013.01.08 12:32:24 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2013.01.08 12:32:24 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2013.01.08 12:31:57 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2013.01.08 12:31:57 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2013.01.08 12:31:57 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2013.01.08 12:31:57 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2013.01.08 12:31:57 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2013.01.08 12:31:57 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2013.01.08 12:21:12 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2013.01.08 12:21:08 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2013.01.08 12:21:08 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2013.01.08 12:21:08 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll
[2013.01.08 12:21:07 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2013.01.08 12:21:07 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2013.01.08 12:14:57 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013.01.08 12:14:57 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013.01.08 10:48:17 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2013.01.08 10:48:17 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2013.01.08 10:48:17 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2013.01.08 10:48:17 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2013.01.08 10:48:15 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.01.08 10:48:15 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.01.08 10:47:58 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll
[2013.01.08 10:47:56 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.08 10:47:41 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2013.01.08 10:47:17 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2013.01.08 10:46:52 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.01.08 10:46:52 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll
[2013.01.08 10:46:52 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnsvr.exe
[2013.01.08 10:46:51 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2013.01.08 10:46:43 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2013.01.08 10:46:25 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2013.01.08 10:46:24 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2013.01.08 10:46:19 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2013.01.08 10:45:35 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2013.01.08 10:45:26 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2013.01.08 10:45:07 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2013.01.08 10:45:07 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2013.01.08 10:43:55 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.08 10:43:53 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2013.01.08 09:39:43 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2013.01.08 09:28:14 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2013.01.08 09:28:14 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2013.01.08 09:27:46 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2013.01.08 09:27:46 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2013.01.08 09:27:46 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2013.01.08 09:27:35 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2013.01.08 09:27:35 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2013.01.07 18:39:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2013.01.07 18:39:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2013.01.07 18:39:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2013.01.07 18:23:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2013.01.07 18:08:42 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.01.07 12:29:31 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2013.01.07 12:29:23 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll
[2013.01.07 12:29:23 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll
[2013.01.07 12:29:22 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll
[2013.01.07 12:29:16 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2013.01.07 12:29:15 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll
[2013.01.07 12:29:15 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll
[2013.01.07 12:29:15 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll
[2013.01.07 12:29:15 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll
[2013.01.07 12:29:14 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll
[2013.01.07 12:29:13 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_25.dll
[2013.01.07 12:29:13 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll
[2013.01.02 13:36:13 | 000,000,000 | ---D | C] -- C:\Windows\Cache
[2012.12.30 17:10:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2012.12.30 17:10:44 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll
[2012.12.17 19:00:06 | 000,015,600 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2012.12.17 19:00:04 | 000,030,416 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2012.12.17 18:31:29 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2012.12.17 18:24:25 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Microsoft Games
[2012.12.15 11:05:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.12.15 11:04:16 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2012.12.15 11:04:16 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2012.12.15 11:04:16 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2012.12.15 08:55:56 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Gedichte
[2012.12.15 08:54:41 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Anne
[2012.12.15 08:53:13 | 000,000,000 | ---D | C] -- C:\Users\Anne\Documents\Beratung
[2012.12.15 08:44:18 | 000,010,792 | ---- | C] (G Data Software AG) -- C:\Windows\System32\GdScrSv.de.dll
[2012.12.14 20:46:08 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\ashampoo
[2012.12.14 20:46:08 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo
[2012.12.14 20:46:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2012.12.14 20:45:38 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2012.12.14 20:14:34 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.12.14 20:14:29 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.12.14 20:14:29 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.12.14 20:14:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011
[2012.12.14 20:13:58 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\TuneUp Software
[2012.12.14 20:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2011
[2012.12.14 20:12:22 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.12.14 20:12:12 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.12.14 17:51:35 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Intel
[2012.12.14 17:49:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
[2012.12.14 17:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco
[2012.12.14 17:49:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2012.12.14 17:49:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2012.12.14 16:43:03 | 012,240,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0007.dll
[2012.12.14 16:43:01 | 001,081,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLCExt.dll
[2012.12.14 16:43:00 | 002,134,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FunctionDiscoveryFolder.dll
[2012.12.14 16:43:00 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingWizard.exe
[2012.12.14 16:42:59 | 002,644,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0009.dll
[2012.12.14 16:42:57 | 001,480,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2012.12.14 16:42:56 | 001,576,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2012.12.14 16:42:56 | 000,684,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\spsys.sys
[2012.12.14 16:42:55 | 000,779,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationNative_v0300.dll
[2012.12.14 16:42:54 | 000,928,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scavenge.dll
[2012.12.14 16:42:53 | 000,968,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz2.dll
[2012.12.14 16:42:53 | 000,677,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi2fs.dll
[2012.12.14 16:42:53 | 000,291,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WscEapPr.dll
[2012.12.14 16:42:52 | 000,619,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardagt.exe
[2012.12.14 16:42:51 | 001,216,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayCpl.dll
[2012.12.14 16:42:51 | 000,978,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmv2clt.dll
[2012.12.14 16:42:51 | 000,289,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spinstall.exe
[2012.12.14 16:42:51 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spreview.exe
[2012.12.14 16:42:50 | 000,438,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mcupdate_GenuineIntel.dll
[2012.12.14 16:42:50 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwizui.dll
[2012.12.14 16:42:49 | 000,670,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2012.12.14 16:42:48 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMPEG2VDEC.DLL
[2012.12.14 16:42:48 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi2.dll
[2012.12.14 16:42:48 | 000,351,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2012.12.14 16:42:48 | 000,203,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2012.12.14 16:42:47 | 000,729,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10K.DLL
[2012.12.14 16:42:47 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairing.dll
[2012.12.14 16:42:47 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2012.12.14 16:42:46 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sperror.dll
[2012.12.14 16:42:46 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\korwbrkr.dll
[2012.12.14 16:42:45 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IasMigReader.exe
[2012.12.14 16:42:44 | 001,589,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjet40.dll
[2012.12.14 16:42:43 | 000,883,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10.IME
[2012.12.14 16:42:43 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msexch40.dll
[2012.12.14 16:42:42 | 001,078,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diagperf.dll
[2012.12.14 16:42:42 | 000,986,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe
[2012.12.14 16:42:42 | 000,327,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\P2PGraph.dll
[2012.12.14 16:42:42 | 000,301,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srchadmin.dll
[2012.12.14 16:42:41 | 001,792,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmc.exe
[2012.12.14 16:42:41 | 000,950,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mblctr.exe
[2012.12.14 16:42:41 | 000,454,144 | ---- | C] (Microsoft) -- C:\Windows\System32\IasMigPlugin.dll
[2012.12.14 16:42:41 | 000,203,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\uDWM.dll
[2012.12.14 16:42:40 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RacEngn.dll
[2012.12.14 16:42:40 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdBth.dll
[2012.12.14 16:42:39 | 002,012,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\milcore.dll
[2012.12.14 16:42:39 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll
[2012.12.14 16:42:39 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NaturalLanguage6.dll
[2012.12.14 16:42:39 | 000,120,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EhStorAPI.dll
[2012.12.14 16:42:38 | 000,950,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpedit.dll
[2012.12.14 16:42:38 | 000,290,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjtes40.dll
[2012.12.14 16:42:38 | 000,115,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayDriverLib.dll
[2012.12.14 16:42:38 | 000,099,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardapi.dll
[2012.12.14 16:42:37 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinSAT.exe
[2012.12.14 16:42:37 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Magnify.exe
[2012.12.14 16:42:37 | 000,282,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstext40.dll
[2012.12.14 16:42:37 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationSettings.exe
[2012.12.14 16:42:37 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayServices.dll
[2012.12.14 16:42:36 | 000,339,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msexcl40.dll
[2012.12.14 16:42:36 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwmi.dll
[2012.12.14 16:42:35 | 001,985,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2012.12.14 16:42:35 | 001,524,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsAnytimeUpgradeCPL.dll
[2012.12.14 16:42:35 | 000,454,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxbde40.dll
[2012.12.14 16:42:34 | 001,086,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NetProjW.dll
[2012.12.14 16:42:34 | 000,643,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrepl40.dll
[2012.12.14 16:42:34 | 000,640,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthprops.cpl
[2012.12.14 16:42:34 | 000,469,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\newdev.dll
[2012.12.14 16:42:34 | 000,119,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2012.12.14 16:42:34 | 000,102,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2012.12.14 16:42:33 | 002,926,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2012.12.14 16:42:33 | 001,788,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d9.dll
[2012.12.14 16:42:33 | 000,368,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mspbde40.dll
[2012.12.14 16:42:33 | 000,205,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eudcedit.exe
[2012.12.14 16:42:32 | 001,053,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtctm.dll
[2012.12.14 16:42:32 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrd3x40.dll
[2012.12.14 16:42:32 | 000,250,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtapi.dll
[2012.12.14 16:42:32 | 000,241,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msltus40.dll
[2012.12.14 16:42:32 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EhStorPwdMgr.dll
[2012.12.14 16:42:31 | 000,614,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ci.dll
[2012.12.14 16:42:31 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nlhtml.dll
[2012.12.14 16:42:30 | 000,582,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLCommDlg.dll
[2012.12.14 16:42:30 | 000,165,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WcnNetsh.dll
[2012.12.14 16:42:30 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\compcln.exe
[2012.12.14 16:42:29 | 001,730,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apds.dll
[2012.12.14 16:42:29 | 000,618,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mswstr10.dll
[2012.12.14 16:42:29 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xmlfilter.dll
[2012.12.14 16:42:28 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLUI.exe
[2012.12.14 16:42:28 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrd2x40.dll
[2012.12.14 16:42:28 | 000,223,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012.12.14 16:42:28 | 000,183,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eapphost.dll
[2012.12.14 16:42:27 | 000,926,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe
[2012.12.14 16:42:27 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sqlsrv32.dll
[2012.12.14 16:42:27 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\propdefs.dll
[2012.12.14 16:42:26 | 001,856,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dbgeng.dll
[2012.12.14 16:42:26 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtutil.exe
[2012.12.14 16:42:26 | 000,087,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssitlb.dll
[2012.12.14 16:42:25 | 002,167,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmcndmgr.dll
[2012.12.14 16:42:24 | 001,533,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz.dll
[2012.12.14 16:42:24 | 000,485,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\evr.dll
[2012.12.14 16:42:24 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\devmgr.dll
[2012.12.14 16:42:24 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drvinst.exe
[2012.12.14 16:42:24 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingProxy.dll
[2012.12.14 16:42:24 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscb.dll
[2012.12.14 16:42:24 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdBthProxy.dll
[2012.12.14 16:42:23 | 001,382,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVSDECD.DLL
[2012.12.14 16:42:23 | 001,143,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wercon.exe
[2012.12.14 16:42:23 | 000,617,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adtschema.dll
[2012.12.14 16:42:23 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quick.ime
[2012.12.14 16:42:23 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qintlgnt.ime
[2012.12.14 16:42:23 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\phon.ime
[2012.12.14 16:42:23 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cintlgnt.ime
[2012.12.14 16:42:23 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chajei.ime
[2012.12.14 16:42:22 | 000,856,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mswdat10.dll
[2012.12.14 16:42:22 | 000,560,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2012.12.14 16:42:22 | 000,396,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipsmsnap.dll
[2012.12.14 16:42:22 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\reg.exe
[2012.12.14 16:42:22 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjter40.dll
[2012.12.14 16:42:22 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mimefilt.dll
[2012.12.14 16:42:22 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtffilt.dll
[2012.12.14 16:42:22 | 000,035,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardcpl.cpl
[2012.12.14 16:42:21 | 000,996,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2012.12.14 16:42:21 | 000,799,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2012.12.14 16:42:21 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoScreensaver.scr
[2012.12.14 16:42:21 | 000,274,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bcrypt.dll
[2012.12.14 16:42:21 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2012.12.14 16:42:21 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2012.12.14 16:42:21 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshooks.dll
[2012.12.14 16:42:20 | 000,332,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msihnd.dll
[2012.12.14 16:42:20 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MMDevAPI.dll
[2012.12.14 16:42:20 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msstrc.dll
[2012.12.14 16:42:20 | 000,035,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsWpfWrp.exe
[2012.12.14 16:42:19 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fundisc.dll
[2012.12.14 16:42:19 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2012.12.14 16:42:19 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi.dll
[2012.12.14 16:42:19 | 000,080,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2012.12.14 16:42:18 | 001,823,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnidui.dll
[2012.12.14 16:42:18 | 001,671,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chsbrkr.dll
[2012.12.14 16:42:18 | 001,020,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wdc.dll
[2012.12.14 16:42:18 | 000,636,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autofmt.exe
[2012.12.14 16:42:18 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassdo.dll
[2012.12.14 16:42:18 | 000,125,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Classpnp.sys
[2012.12.14 16:42:18 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Kswdmcap.ax
[2012.12.14 16:42:18 | 000,009,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardres.dll
[2012.12.14 16:42:17 | 001,107,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pidgenx.dll
[2012.12.14 16:42:17 | 000,757,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\azroles.dll
[2012.12.14 16:42:17 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnrollUI.dll
[2012.12.14 16:42:17 | 000,122,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Storport.sys
[2012.12.14 16:42:17 | 000,109,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ataport.sys
[2012.12.14 16:42:17 | 000,050,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PSHED.DLL
[2012.12.14 16:42:17 | 000,035,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\crashdmp.sys
[2012.12.14 16:42:16 | 002,205,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SyncCenter.dll
[2012.12.14 16:42:16 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sysmon.ocx
[2012.12.14 16:42:15 | 001,502,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certmgr.dll
[2012.12.14 16:42:15 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sethc.exe
[2012.12.14 16:42:15 | 000,593,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\comuid.dll
[2012.12.14 16:42:15 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\untfs.dll
[2012.12.14 16:42:15 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassam.dll
[2012.12.14 16:42:15 | 000,180,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scrobj.dll
[2012.12.14 16:42:15 | 000,017,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kd1394.dll
[2012.12.14 16:42:14 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imkr80.ime
[2012.12.14 16:42:14 | 000,099,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2012.12.14 16:42:14 | 000,043,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\pciidex.sys
[2012.12.14 16:42:13 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autoconv.exe
[2012.12.14 16:42:13 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasnap.dll
[2012.12.14 16:42:13 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cscript.exe
[2012.12.14 16:42:13 | 000,130,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\basecsp.dll
[2012.12.14 16:42:13 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe
[2012.12.14 16:42:13 | 000,027,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Dumpata.sys
[2012.12.14 16:42:13 | 000,017,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kdcom.dll
[2012.12.14 16:42:12 | 000,564,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msftedit.dll
[2012.12.14 16:42:12 | 000,340,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RelMon.dll
[2012.12.14 16:42:12 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wow32.dll
[2012.12.14 16:42:12 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\osk.exe
[2012.12.14 16:42:12 | 000,019,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kdusb.dll
[2012.12.14 16:42:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spcmsg.dll
[2012.12.14 16:42:11 | 000,860,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WerFaultSecure.exe
[2012.12.14 16:42:11 | 000,638,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Utilman.exe
[2012.12.14 16:42:11 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WerFault.exe
[2012.12.14 16:42:11 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\offfilt.dll
[2012.12.14 16:42:11 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsepno.dll
[2012.12.14 16:42:10 | 000,852,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mcmde.dll
[2012.12.14 16:42:10 | 000,551,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prnntfy.dll
[2012.12.14 16:42:10 | 000,391,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscms.dll
[2012.12.14 16:42:10 | 000,230,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diskraid.exe
[2012.12.14 16:42:10 | 000,197,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SndVol.exe
[2012.12.14 16:42:10 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msnetobj.dll
[2012.12.14 16:42:10 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll
[2012.12.14 16:42:10 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sysclass.dll
[2012.12.14 16:42:10 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adsmsext.dll
[2012.12.14 16:42:10 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2012.12.14 16:42:09 | 000,444,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dsound.dll
[2012.12.14 16:42:09 | 000,223,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscntfy.dll
[2012.12.14 16:42:09 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ulib.dll
[2012.12.14 16:42:08 | 001,342,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\brcpl.dll
[2012.12.14 16:42:08 | 000,759,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipsecsnp.dll
[2012.12.14 16:42:08 | 000,507,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdsdyn.dll
[2012.12.14 16:42:08 | 000,399,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlangpui.dll
[2012.12.14 16:42:08 | 000,181,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnpsetup.dll
[2012.12.14 16:42:08 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diskpart.exe
[2012.12.14 16:42:08 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpapi.dll
[2012.12.14 16:42:08 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iashlpr.dll
[2012.12.14 16:42:08 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdProxy.dll
[2012.12.14 16:42:07 | 001,575,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVENCOD.DLL
[2012.12.14 16:42:07 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntprint.dll
[2012.12.14 16:42:07 | 000,155,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2012.12.14 16:42:07 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wusa.exe
[2012.12.14 16:42:07 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logman.exe
[2012.12.14 16:42:06 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrad.dll
[2012.12.14 16:42:06 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\findstr.exe
[2012.12.14 16:42:05 | 002,225,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcenter.dll
[2012.12.14 16:42:05 | 001,580,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpccpl.dll
[2012.12.14 16:42:04 | 001,152,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\themecpl.dll
[2012.12.14 16:42:04 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wer.dll
[2012.12.14 16:42:04 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassvcs.dll
[2012.12.14 16:42:04 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsnmp32.dll
[2012.12.14 16:42:03 | 000,777,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slcc.dll
[2012.12.14 16:42:03 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scansetting.dll
[2012.12.14 16:42:03 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2012.12.14 16:42:03 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssprxy.dll
[2012.12.14 16:42:02 | 003,072,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\networkmap.dll
[2012.12.14 16:42:02 | 001,645,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\connect.dll
[2012.12.14 16:42:02 | 001,248,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PerfCenterCPL.dll
[2012.12.14 16:42:02 | 000,723,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\powercpl.dll
[2012.12.14 16:42:02 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2012.12.14 16:42:02 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\newdev.exe
[2012.12.14 16:42:02 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasacct.dll
[2012.12.14 16:42:01 | 002,515,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\accessibilitycpl.dll
[2012.12.14 16:42:01 | 001,224,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sud.dll
[2012.12.14 16:42:01 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\usercpl.dll
[2012.12.14 16:42:01 | 000,842,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\systemcpl.dll
[2012.12.14 16:42:01 | 000,516,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autoplay.dll
[2012.12.14 16:42:01 | 000,464,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pcaui.dll
[2012.12.14 16:42:01 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmci.dll
[2012.12.14 16:42:00 | 001,671,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanpref.dll
[2012.12.14 16:42:00 | 000,532,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpcao.dll
[2012.12.14 16:42:00 | 000,408,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msinfo32.exe
[2012.12.14 16:42:00 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scksp.dll
[2012.12.14 16:42:00 | 000,128,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdsutil.dll
[2012.12.14 16:42:00 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rpchttp.dll
[2012.12.14 16:42:00 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pintlgnt.ime
[2012.12.14 16:42:00 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\feclient.dll
[2012.12.14 16:41:59 | 001,689,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscui.cpl
[2012.12.14 16:41:59 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncryptui.dll
[2012.12.14 16:41:59 | 000,407,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpapimig.exe
[2012.12.14 16:41:59 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Faultrep.dll
[2012.12.14 16:41:59 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AudioSes.dll
[2012.12.14 16:41:59 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleprn.dll
[2012.12.14 16:41:59 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dot3msm.dll
[2012.12.14 16:41:59 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rekeywiz.exe
[2012.12.14 16:41:59 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iaspolcy.dll
[2012.12.14 16:41:59 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DeviceEject.exe
[2012.12.14 16:41:59 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscisvif.dll
[2012.12.14 16:41:58 | 000,642,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasgcw.dll
[2012.12.14 16:41:58 | 000,595,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FWPUCLNT.DLL
[2012.12.14 16:41:58 | 000,542,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnpui.dll
[2012.12.14 16:41:58 | 000,505,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qedit.dll
[2012.12.14 16:41:58 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasplap.dll
[2012.12.14 16:41:58 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certreq.exe
[2012.12.14 16:41:58 | 000,170,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2012.12.14 16:41:58 | 000,167,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\portcls.sys
[2012.12.14 16:41:58 | 000,134,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SmartcardCredentialProvider.dll
[2012.12.14 16:41:58 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\hdwwiz.exe
[2012.12.14 16:41:58 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdWSD.dll
[2012.12.14 16:41:58 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PnPUnattend.exe
[2012.12.14 16:41:58 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cmmon32.exe
[2012.12.14 16:41:58 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSTheme.exe
[2012.12.14 16:41:58 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\whealogr.dll
[2012.12.14 16:41:58 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\USBCAMD2.sys
[2012.12.14 16:41:58 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\USBCAMD.sys
[2012.12.14 16:41:58 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwinsat.dll
[2012.12.14 16:41:57 | 000,657,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVXENCD.DLL
[2012.12.14 16:41:57 | 000,547,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wiaaut.dll
[2012.12.14 16:41:57 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cmdial32.dll
[2012.12.14 16:41:57 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2012.12.14 16:41:57 | 000,275,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SnippingTool.exe
[2012.12.14 16:41:57 | 000,202,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanui.dll
[2012.12.14 16:41:57 | 000,137,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dsprop.dll
[2012.12.14 16:41:57 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
[2012.12.14 16:41:57 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PnPutil.exe
[2012.12.14 16:41:56 | 006,103,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chtbrkr.dll
[2012.12.14 16:41:56 | 002,153,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oobefldr.dll
[2012.12.14 16:41:56 | 000,425,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\shwebsvc.dll
[2012.12.14 16:41:56 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\modemui.dll
[2012.12.14 16:41:56 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscandui.dll
[2012.12.14 16:41:56 | 000,155,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasmontr.dll
[2012.12.14 16:41:56 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\shsetup.dll
[2012.12.14 16:41:56 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dimsroam.dll
[2012.12.14 16:41:55 | 000,542,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\blackbox.dll
[2012.12.14 16:41:55 | 000,533,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmsdk.dll
[2012.12.14 16:41:55 | 000,107,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.12.14 16:41:55 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlgpclnt.dll
[2012.12.14 16:41:55 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dataclen.dll
[2012.12.14 16:41:54 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll
[2012.12.14 16:41:54 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDMon.dll
[2012.12.14 16:41:54 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rmcast.sys
[2012.12.14 16:41:53 | 000,414,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscp.dll
[2012.12.14 16:41:53 | 000,313,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\thawbrkr.dll
[2012.12.14 16:41:53 | 000,217,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\InkEd.dll
[2012.12.14 16:41:53 | 000,128,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpresult.exe
[2012.12.14 16:41:53 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\softkbd.dll
[2012.12.14 16:41:53 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2012.12.14 16:41:53 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cipher.exe
[2012.12.14 16:41:53 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2012.12.14 16:41:53 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\watchdog.sys
[2012.12.14 16:41:53 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msimtf.dll
[2012.12.14 16:41:53 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ifmon.dll
[2012.12.14 16:41:52 | 000,356,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MediaMetadataHandler.dll
[2012.12.14 16:41:52 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmmgrtn.dll
[2012.12.14 16:41:52 | 000,200,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\input.dll
[2012.12.14 16:41:52 | 000,166,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\puiapi.dll
[2012.12.14 16:41:52 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dmsynth.dll
[2012.12.14 16:41:52 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msctfui.dll
[2012.12.14 16:41:52 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2012.12.14 16:41:51 | 000,187,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eapp3hst.dll
[2012.12.14 16:41:51 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLLUA.exe
[2012.12.14 16:41:51 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tintlgnt.ime
[2012.12.14 16:41:51 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dmusic.dll
[2012.12.14 16:41:51 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2012.12.14 16:41:51 | 000,068,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdSSDP.dll
[2012.12.14 16:41:51 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\l2nacp.dll
[2012.12.14 16:41:51 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjint40.dll
[2012.12.14 16:41:51 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fc.exe
[2012.12.14 16:41:51 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsCtfMonitor.dll
[2012.12.14 16:41:51 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msisip.dll
[2012.12.14 16:41:50 | 000,083,456 | ---- | C] (Microsoft) -- C:\Windows\System32\SMBHelperClass.dll
[2012.12.14 16:41:50 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdWCN.dll
[2012.12.14 16:41:50 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Storprop.dll
[2012.12.14 16:41:50 | 000,052,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasdiag.dll
[2012.12.14 16:41:50 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dot3cfg.dll
[2012.12.14 16:41:50 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthci.dll
[2012.12.14 16:41:50 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ftp.exe
[2012.12.14 16:41:50 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthudtask.exe
[2012.12.14 16:41:50 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipconfig.exe
[2012.12.14 16:41:50 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsdchngr.dll
[2012.12.14 16:41:50 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasdial.exe
[2012.12.14 16:41:49 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eappgnui.dll
[2012.12.14 16:41:49 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nslookup.exe
[2012.12.14 16:41:49 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdeploy.dll
[2012.12.14 16:41:49 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slcinst.dll
[2012.12.14 16:41:49 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\hbaapi.dll
[2012.12.14 16:41:49 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\networkitemfactory.dll
[2012.12.14 16:41:49 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidclass.sys
[2012.12.14 16:41:49 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ocsetup.exe
[2012.12.14 16:41:49 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FwRemoteSvr.dll
[2012.12.14 16:41:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmcico.dll
[2012.12.14 16:41:49 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CHxReadingStringIME.dll
[2012.12.14 16:41:48 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PNPXAssoc.dll
[2012.12.14 16:41:48 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpupdate.exe
[2012.12.14 16:41:47 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxg.sys
[2012.12.14 16:41:47 | 000,046,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrstub.exe
[2012.12.14 16:41:47 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cbsra.exe
[2012.12.14 16:41:47 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbcconf.dll
[2012.12.14 16:41:47 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bitsigd.dll
[2012.12.14 16:41:47 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NcdProp.dll
[2012.12.14 16:41:47 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdmdbg.dll
[2012.12.14 16:41:47 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iscsilog.dll
[2012.12.14 16:41:46 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2012.12.14 16:41:46 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetppui.dll
[2012.12.14 16:41:46 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2012.12.14 16:41:45 | 000,052,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\stream.sys
[2012.12.14 16:41:45 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\RNDISMP.sys
[2012.12.14 16:41:45 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys
[2012.12.14 16:41:44 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\f3ahvoas.dll
[2012.12.14 16:41:44 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msimsg.dll
[2012.12.14 16:41:33 | 000,705,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SmiEngine.dll
[2012.12.14 16:41:31 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wdscore.dll
[2012.12.14 16:41:31 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PkgMgr.exe
[2012.12.14 16:41:28 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drvstore.dll
[2012.12.14 16:31:13 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2012.12.14 16:31:13 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2012.12.14 16:31:13 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2012.12.14 16:31:13 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2012.12.14 16:30:53 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2012.12.14 16:30:53 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2012.12.14 16:30:30 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll
[2012.12.14 16:30:30 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE
[2012.12.14 16:30:30 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE
[2012.12.14 16:30:30 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE
[2012.12.14 16:30:30 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE
[2012.12.14 16:30:30 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe
[2012.12.14 16:30:30 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE
[2012.12.14 16:30:04 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2012.12.14 16:30:04 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2012.12.14 16:30:04 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2012.12.14 16:30:04 | 000,068,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanhlp.dll
[2012.12.14 16:30:04 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll
[2012.12.14 16:29:43 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2012.12.14 16:29:43 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2012.12.14 16:29:38 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2012.12.14 16:29:32 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2012.12.14 16:29:31 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rrinstaller.exe
[2012.12.14 16:29:31 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfpmp.exe
[2012.12.14 16:29:31 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mferror.dll
[2012.12.14 16:29:26 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2012.12.14 16:29:18 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2012.12.14 16:28:40 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2012.12.14 16:27:28 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2012.12.14 16:26:59 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2012.12.14 16:26:53 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2012.12.14 16:25:39 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2012.12.14 16:25:39 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2012.12.14 16:25:27 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2012.12.14 16:25:27 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2012.12.14 16:25:27 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2012.12.14 16:25:06 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kbd106n.dll
[2012.12.14 16:24:50 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2012.12.14 16:24:40 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2012.12.14 16:24:39 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2012.12.14 16:24:39 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2012.12.14 16:24:38 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2012.12.14 16:24:38 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2012.12.14 16:24:26 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2012.12.14 16:24:26 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2012.12.14 16:24:26 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2012.12.14 16:24:15 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2012.12.14 16:23:28 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2012.12.14 16:23:28 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2012.12.14 16:23:26 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2012.12.14 16:23:26 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2012.12.14 16:23:26 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2012.12.14 16:23:26 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2012.12.14 16:23:26 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2012.12.14 16:23:26 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2012.12.14 16:23:25 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2012.12.14 16:23:25 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2012.12.14 16:23:25 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2012.12.14 16:23:01 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2012.12.14 16:23:01 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tscupgrd.exe
[2012.12.14 16:23:01 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2012.12.14 16:22:38 | 000,355,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2012.12.14 16:22:20 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2012.12.14 16:22:15 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2012.12.14 16:10:02 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\WinRAR
[2012.12.13 21:06:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.12.13 21:04:45 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.12.13 21:04:40 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Google
[2012.12.13 21:04:29 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Deployment
[2012.12.13 21:04:29 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Apps
[2012.12.13 20:56:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2012.12.13 20:53:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data TotalProtection 2013
[2012.12.13 20:52:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\BioAPIFFDB
[2012.12.13 20:52:24 | 000,103,928 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\TS4nt.sys
[2012.12.13 20:52:09 | 000,050,080 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2012.12.13 20:51:42 | 000,093,728 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys
[2012.12.13 20:51:42 | 000,050,040 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys
[2012.12.13 20:51:41 | 000,041,888 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys
[2012.12.13 20:51:20 | 000,053,664 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys
[2012.12.13 20:49:30 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA Software
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\G Data
[2012.12.13 20:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\G Data
[2012.12.13 20:47:10 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.12.13 20:46:57 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Downloaded Installations
[2012.12.13 20:36:11 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.12.13 20:33:06 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2012.12.13 20:31:52 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2012.12.13 20:30:54 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrsmgr.dll
[2012.12.13 20:30:49 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrs.exe
[2012.12.13 20:30:49 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrshost.exe
[2012.12.13 20:30:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmprovhost.exe
[2012.12.13 20:30:48 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmplpxy.dll
[2012.12.13 20:30:48 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrssrv.dll
[2012.12.13 20:30:47 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtfwd.dll
[2012.12.13 20:30:47 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecutil.exe
[2012.12.13 20:30:47 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecapi.dll
[2012.12.13 20:30:47 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmRes.dll
[2012.12.13 20:30:47 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pwrshplugin.dll
[2012.12.13 20:30:43 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManMigrationPlugin.dll
[2012.12.13 20:30:43 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManHTTPConfig.exe
[2012.12.13 20:30:43 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrscmd.dll
[2012.12.13 20:30:43 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmWmiPl.dll
[2012.12.13 20:30:43 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmAuto.dll
[2012.12.13 20:05:52 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2012.12.13 20:00:46 | 003,658,752 | ---- | C] (Intel Corporation) -- C:\Windows\System32\drivers\NETw5v32.sys
[2012.12.13 20:00:46 | 002,756,608 | ---- | C] (Intel Corporation) -- C:\Windows\System32\NETw5r32.dll
[2012.12.13 20:00:46 | 000,659,456 | ---- | C] (Intel Corporation) -- C:\Windows\System32\NETw5c32.dll
[2012.12.13 19:38:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.12.13 19:36:08 | 000,007,680 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Windows\System32\CLEVOMOF.dll
[2012.12.13 19:36:08 | 000,000,000 | ---D | C] -- C:\Program Files\Hotkey
[2012.12.13 19:35:19 | 000,084,240 | ---- | C] (JMicron Technology Corp.) -- C:\Windows\System32\drivers\jmcr.sys
[2012.12.13 19:35:18 | 000,000,000 | ---D | C] -- C:\Windows\JMCR_DIR
[2012.12.13 19:33:59 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2012.12.13 19:32:43 | 000,118,784 | ---- | C] (Realtek Corporation                                            ) -- C:\Windows\System32\drivers\Rtlh86.sys
[2012.12.13 19:32:22 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\InstallShield
[2012.12.13 19:31:18 | 000,000,000 | ---D | C] -- C:\Program Files\Motorola
[2012.12.13 19:31:06 | 001,094,272 | ---- | C] (Motorola Inc.) -- C:\Windows\System32\drivers\smserial.sys
[2012.12.13 19:31:06 | 000,364,544 | ---- | C] (Motorola Inc.) -- C:\Windows\System32\sm56co81.dll
[2012.12.13 19:29:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM
[2012.12.13 19:29:31 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll
[2012.12.13 19:29:29 | 001,773,568 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll
[2012.12.13 19:29:29 | 000,339,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll
[2012.12.13 19:29:29 | 000,185,776 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll
[2012.12.13 19:29:29 | 000,167,936 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll
[2012.12.13 19:29:29 | 000,135,168 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll
[2012.12.13 19:29:28 | 002,172,416 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkAPO.dll
[2012.12.13 19:29:28 | 001,196,032 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlUpd.exe
[2012.12.13 19:29:28 | 000,694,272 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll
[2012.12.13 19:29:28 | 000,285,216 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkApoApi.dll
[2012.12.13 19:29:28 | 000,031,232 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoInst.dll
[2012.12.13 19:29:26 | 006,111,232 | ---- | C] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
[2012.12.13 19:29:26 | 000,532,480 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTSndMgr.cpl
[2012.12.13 19:29:25 | 001,929,216 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll
[2012.12.13 19:29:25 | 000,155,648 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll
[2012.12.13 19:29:25 | 000,140,288 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\FMAPO.dll
[2012.12.13 19:29:25 | 000,126,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll
[2012.12.13 19:29:25 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012.12.13 19:29:24 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.12.13 19:29:16 | 000,520,192 | R--- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2012.12.13 19:29:16 | 000,315,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\HideWin.exe
[2012.12.13 19:27:57 | 000,442,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvudisp.exe
[2012.12.13 19:27:17 | 000,442,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVUNINST.EXE
[2012.12.13 19:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012.12.13 19:24:14 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2012.12.13 19:24:14 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\Searches
[2012.12.13 18:55:08 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.12.13 18:54:58 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Identities
[2012.12.13 18:54:54 | 000,000,000 | R--D | C] -- C:\Users\Anne\Contacts
[2012.12.13 18:54:54 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\VirtualStore
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Vorlagen
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Verlauf
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Temporary Internet Files
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Startmenü
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\SendTo
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Recent
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Netzwerkumgebung
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Lokale Einstellungen
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Videos
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Musik
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Eigene Dateien
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Documents\Eigene Bilder
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Druckumgebung
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Cookies
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\AppData\Local\Anwendungsdaten
[2012.12.13 18:54:50 | 000,000,000 | -HSD | C] -- C:\Users\Anne\Anwendungsdaten
[2012.12.13 18:54:49 | 000,000,000 | --SD | C] -- C:\Users\Anne\AppData\Roaming\Microsoft
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Videos
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Saved Games
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Pictures
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Music
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Links
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Favorites
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Downloads
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Documents
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\Desktop
[2012.12.13 18:54:49 | 000,000,000 | R--D | C] -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.12.13 18:54:49 | 000,000,000 | -H-D | C] -- C:\Users\Anne\AppData
[2012.12.13 18:54:49 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Local\Microsoft
[2012.12.13 18:54:49 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Media Center Programs
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.12.13 18:52:39 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.12.13 18:52:11 | 000,000,000 | ---D | C] -- C:\Windows\Debug
[2012.12.13 18:44:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.12.13 18:30:37 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.12.13 18:29:44 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.12.13 18:10:06 | 000,000,000 | ---D | C] -- C:\Windows.old.001
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.11 16:13:26 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.11 16:13:25 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.11 16:13:25 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.11 16:13:25 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.11 16:09:14 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.11 16:06:01 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013.01.11 16:06:01 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.01.11 16:05:58 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.11 16:05:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.11 16:05:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.11 16:05:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.11 16:05:12 | 2678,988,800 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.10 20:47:58 | 000,554,087 | ---- | M] () -- C:\Users\Anne\Desktop\adwcleaner.exe
[2013.01.10 19:10:59 | 000,940,615 | ---- | M] () -- C:\Windows\System32\sig.bin
[2013.01.10 19:10:59 | 000,050,877 | ---- | M] () -- C:\Windows\System32\nmp.map
[2013.01.10 15:12:43 | 000,000,842 | ---- | M] () -- C:\Users\Anne\Desktop\ComboFix - Verknüpfung.lnk
[2013.01.09 15:31:30 | 000,000,512 | ---- | M] () -- C:\Users\Anne\Desktop\MBR.dat
[2013.01.09 15:16:45 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Anne\Desktop\aswMBR.exe
[2013.01.09 13:40:33 | 013,485,902 | ---- | M] () -- C:\Users\Anne\Desktop\mbar-1.01.0.1011.zip
[2013.01.09 13:26:37 | 000,003,699 | ---- | M] () -- C:\Users\Anne\Documents\G Data Protokoll ID 146.html
[2013.01.09 11:08:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Anne\Desktop\OTL.exe
[2013.01.09 08:43:56 | 000,000,000 | ---- | M] () -- C:\Users\Anne\defogger_reenable
[2013.01.09 00:23:08 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.08 16:40:18 | 000,228,296 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.08 16:35:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.01.08 12:33:29 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2013.01.08 12:33:29 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2013.01.08 12:33:21 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.01.08 12:33:21 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.01.08 12:33:21 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.01.08 12:33:20 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.01.08 12:33:20 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.01.08 12:33:20 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.01.08 12:33:20 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.01.08 12:33:20 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.01.08 12:33:20 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.01.08 12:33:20 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.01.08 12:33:20 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.01.08 12:33:20 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.01.08 12:33:20 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.01.08 12:33:20 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.01.08 12:33:20 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.01.08 12:33:20 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.01.08 12:33:19 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.01.08 12:33:19 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.01.08 12:33:19 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.01.08 12:33:19 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.01.08 12:33:19 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.01.08 12:33:19 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.01.08 12:33:19 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.01.08 12:33:19 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.01.08 12:33:19 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.01.08 12:33:19 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.01.08 12:33:19 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.01.08 12:33:19 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.01.08 12:33:18 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.01.08 12:33:18 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.01.08 12:33:18 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.01.08 12:33:18 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.01.08 12:33:18 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.01.08 12:33:18 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.01.08 12:33:18 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.01.08 12:33:18 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.01.08 12:33:18 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.01.08 12:33:18 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.01.08 12:32:27 | 002,873,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.01.08 12:32:27 | 000,979,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll
[2013.01.08 12:32:27 | 000,357,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll
[2013.01.08 12:32:27 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll
[2013.01.08 12:32:27 | 000,261,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2013.01.08 12:32:27 | 000,098,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2013.01.08 12:32:26 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2013.01.08 12:32:25 | 001,554,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2013.01.08 12:32:25 | 001,172,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2013.01.08 12:32:25 | 001,029,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2013.01.08 12:32:25 | 000,847,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2013.01.08 12:32:25 | 000,683,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2013.01.08 12:32:25 | 000,667,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2013.01.08 12:32:25 | 000,486,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2013.01.08 12:32:25 | 000,478,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2013.01.08 12:32:25 | 000,219,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2013.01.08 12:32:25 | 000,189,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2013.01.08 12:32:25 | 000,160,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2013.01.08 12:32:25 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2013.01.08 12:32:25 | 000,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.01.08 12:32:25 | 000,026,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2013.01.08 12:32:24 | 000,876,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2013.01.08 12:31:58 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\de-DE\dxgkrnl.sys.mui
[2013.01.08 12:31:57 | 000,519,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2013.01.08 12:31:57 | 000,369,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2013.01.08 12:31:57 | 000,321,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2013.01.08 12:31:57 | 000,252,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2013.01.08 12:31:57 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2013.01.08 12:31:57 | 000,189,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2013.01.07 18:10:12 | 000,001,356 | ---- | M] () -- C:\Users\Anne\AppData\Local\d3d9caps.dat
[2013.01.07 18:08:42 | 284,405,572 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.01.07 12:41:31 | 000,000,058 | ---- | M] () -- C:\Windows\nfsc_patch.ini
[2012.12.30 17:03:50 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2012.12.17 19:00:06 | 000,015,600 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2012.12.17 19:00:04 | 000,030,416 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2012.12.16 14:12:54 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2012.12.16 11:50:29 | 000,293,376 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2012.12.15 08:47:05 | 000,050,080 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2012.12.15 08:44:19 | 000,093,728 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys
[2012.12.15 08:44:19 | 000,041,888 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys
[2012.12.15 08:44:18 | 000,053,664 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys
[2012.12.14 20:46:06 | 000,001,032 | ---- | M] () -- C:\Users\Public\Desktop\Ashampoo Photo Commander 9.lnk
[2012.12.14 20:14:27 | 000,001,875 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.12.14 20:14:27 | 000,001,871 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.12.13 21:06:06 | 000,001,969 | ---- | M] () -- C:\Users\Anne\Desktop\Google Chrome.lnk
[2012.12.13 21:02:41 | 000,001,595 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2012.12.13 20:52:24 | 000,103,928 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\TS4nt.sys
[2012.12.13 20:51:42 | 000,050,040 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys
[2012.12.13 20:51:12 | 000,002,010 | ---- | M] () -- C:\Users\Public\Desktop\G Data TotalProtection.lnk
[2012.12.13 19:35:45 | 000,000,251 | ---- | M] () -- C:\Windows\xUninstall.bat
[2012.12.13 19:34:06 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2012.12.13 19:29:31 | 000,319,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll
[2012.12.13 19:29:16 | 000,315,392 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\HideWin.exe
[2012.12.13 19:08:22 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2012.12.13 18:45:44 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012.12.13 18:29:30 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
 
========== Files Created - No Company Name ==========
 
[2013.01.11 16:05:12 | 2678,988,800 | -HS- | C] () -- C:\hiberfil.sys
[2013.01.10 20:47:56 | 000,554,087 | ---- | C] () -- C:\Users\Anne\Desktop\adwcleaner.exe
[2013.01.10 15:12:43 | 000,000,842 | ---- | C] () -- C:\Users\Anne\Desktop\ComboFix - Verknüpfung.lnk
[2013.01.09 17:41:14 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.01.09 17:41:14 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.01.09 17:41:14 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.01.09 17:41:14 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.01.09 17:41:14 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.01.09 15:31:30 | 000,000,512 | ---- | C] () -- C:\Users\Anne\Desktop\MBR.dat
[2013.01.09 13:40:18 | 013,485,902 | ---- | C] () -- C:\Users\Anne\Desktop\mbar-1.01.0.1011.zip
[2013.01.09 13:26:37 | 000,003,699 | ---- | C] () -- C:\Users\Anne\Documents\G Data Protokoll ID 146.html
[2013.01.09 08:43:56 | 000,000,000 | ---- | C] () -- C:\Users\Anne\defogger_reenable
[2013.01.09 00:23:08 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.08 16:43:03 | 000,000,955 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.01.08 16:35:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.01.08 12:33:20 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.01.08 12:21:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.01.08 12:21:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.01.07 18:07:48 | 284,405,572 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.01.07 12:40:19 | 000,000,058 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2012.12.30 17:03:50 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2012.12.17 18:29:56 | 000,940,615 | ---- | C] () -- C:\Windows\System32\sig.bin
[2012.12.17 18:29:56 | 000,050,877 | ---- | C] () -- C:\Windows\System32\nmp.map
[2012.12.14 20:46:06 | 000,001,032 | ---- | C] () -- C:\Users\Public\Desktop\Ashampoo Photo Commander 9.lnk
[2012.12.14 20:14:27 | 000,001,875 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.12.14 20:14:27 | 000,001,871 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.12.14 20:14:26 | 000,001,883 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk
[2012.12.14 16:42:40 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2012.12.14 16:42:39 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2012.12.14 16:42:33 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2012.12.14 16:42:32 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.12.14 16:42:32 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.12.14 16:42:30 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2012.12.14 16:42:28 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2012.12.14 16:42:19 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2012.12.14 16:42:17 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2012.12.14 16:41:46 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2012.12.14 16:41:42 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2012.12.14 16:30:05 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2012.12.13 21:06:06 | 000,001,969 | ---- | C] () -- C:\Users\Anne\Desktop\Google Chrome.lnk
[2012.12.13 21:04:56 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.13 21:04:52 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.13 21:02:41 | 000,001,595 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2012.12.13 20:51:12 | 000,002,010 | ---- | C] () -- C:\Users\Public\Desktop\G Data TotalProtection.lnk
[2012.12.13 20:34:24 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.12.13 20:34:23 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex
[2012.12.13 20:30:44 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2012.12.13 20:30:44 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2012.12.13 20:30:44 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2012.12.13 19:38:35 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.001
[2012.12.13 19:38:29 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2012.12.13 19:35:45 | 000,000,251 | ---- | C] () -- C:\Windows\xUninstall.bat
[2012.12.13 19:34:06 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2012.12.13 19:33:39 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2012.12.13 19:30:50 | 000,000,553 | R--- | C] () -- C:\Windows\USetup.iss
[2012.12.13 19:27:56 | 000,008,060 | ---- | C] () -- C:\Windows\System32\nvdisp.nvu
[2012.12.13 19:27:21 | 000,000,354 | ---- | C] () -- C:\Windows\System32\nvhda.nvu
[2012.12.13 19:08:22 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2012.12.13 18:55:07 | 000,000,950 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.12.13 18:54:54 | 000,000,921 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012.12.13 18:54:51 | 000,001,356 | ---- | C] () -- C:\Users\Anne\AppData\Local\d3d9caps.dat
[2012.12.13 18:45:21 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
Code:
OTL Extras logfile created on: 11.01.2013 16:08:48 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Anne\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,49 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 52,30% Memory free
5,20 Gb Paging File | 3,89 Gb Available in Paging File | 74,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 140,99 Gb Free Space | 47,30% Space Free | Partition Type: NTFS
 
Computer Name: ANNE-PC | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-6757586-1979965592-498421705-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2815E119-F325-4658-ACDA-3E2E64E61028}" = protocol=17 | dir=in | app=d:\dwizard300.exe |
"{496D929B-0730-4DFC-BE84-2205B36784AF}" = protocol=17 | dir=in | app=d:\libneap.dll |
"{9CB23B4C-2A56-4FDC-A91B-2070F2A1ECE9}" = protocol=6 | dir=in | app=d:\libneap.dll |
"{D210CF26-1B54-44AD-B428-4C1FD230EC24}" = protocol=6 | dir=in | app=d:\dwizard300.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{164714B6-46BC-4649-9A30-A6ED32F03B5A}" = Hotkey
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{C8005A7B-9638-41DD-B83B-AF277754E211}" = Intel(R) PROSet/Wireless WiFi-Software
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE6217F3-6072-40E2-9157-A4695C334F8E}" = G Data TotalProtection 2013
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Ashampoo Photo Commander 9_is1" = Ashampoo Photo Commander 9 v.9.4.3
"Google Chrome" = Google Chrome
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel PROSet Wireless
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2011" = TuneUp Utilities 2011
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 09.01.2013 08:39:13 | Computer Name = Anne-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mbar.exe, Version 1.1.0.1011, Zeitstempel 0x50bd4069,
 fehlerhaftes Modul QtGui4.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0000135, Fehleroffset 0x00009f5d,  Prozess-ID 0x984, Anwendungsstartzeit
 01cdee6652721a47.
 
Error - 09.01.2013 09:25:22 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 09.01.2013 14:51:36 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 10.01.2013 09:55:38 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 10.01.2013 14:23:21 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 11.01.2013 10:44:02 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 11.01.2013 10:53:05 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 11.01.2013 10:59:18 | Computer Name = Anne-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 11.01.2013 10:59:53 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 11.01.2013 11:05:48 | Computer Name = Anne-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 28.12.2012 04:09:47 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7026
Description =
 
Error - 28.12.2012 05:29:06 | Computer Name = Anne-PC | Source = HTTP | ID = 15016
Description =
 
Error - 28.12.2012 05:29:21 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 28.12.2012 05:29:21 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7026
Description =
 
Error - 28.12.2012 05:35:14 | Computer Name = Anne-PC | Source = DCOM | ID = 10005
Description =
 
Error - 28.12.2012 05:35:14 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7009
Description =
 
Error - 28.12.2012 05:35:14 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 28.12.2012 12:10:24 | Computer Name = Anne-PC | Source = HTTP | ID = 15016
Description =
 
Error - 28.12.2012 12:10:41 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 28.12.2012 12:10:41 | Computer Name = Anne-PC | Source = Service Control Manager | ID = 7026
Description =
 
 
< End of report >
war denn das system nun Infiziert?????

cosinus 11.01.2013 17:25
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Devilspearl 11.01.2013 21:54
Code:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.11.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anne :: ANNE-PC [Administrator]

Schutz: Aktiviert

11.01.2013 18:38:57
mbam-log-2013-01-11 (18-38-57).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 192076
Laufzeit: 4 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6844
# api_version=3.0.2
# EOSSerial=766335ea57975645851c81b99b6d76f1
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-01-11 08:48:26
# local_time=2013-01-11 09:48:26 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 21937 195470034 0 0
# scanned=387223
# found=0
# cleaned=0
# scan_time=10567

cosinus 11.01.2013 22:09
Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Devilspearl 12.01.2013 14:29
Danke für die Hilfe, es kommt mir etwas langsamer vor als vor den ganzen scans aber ansonsten nix, meine Virensoftware hat nix weiter gefunden....

Sollen die ganzen exe wie otl adwcleaner etc auf dem >System bleiben???

ich hoffe ja das ich das irgendwann selber alles Checken kann,(wenn ihr wieder neue Schüler nehmt) beworben hab ich mich schon...

Macht weiter so
mfG
Devilspearl

cosinus 12.01.2013 15:56
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen: Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Devilspearl 13.01.2013 14:51
nachdem ich bei "ausführen" combofix / uninstall eingegeben habe ist combofix gestartet und wieder mit nem scan angefangen soll das so sein kann ich mir eigentlich nicht vorstellen

Jetzt wird es ziemlich kurios, combofix stürzt bei erstellen der Log Datei ab, nach Neustart des Systems ist otl verschwunden, ein alter Wiederherstellungspunkt wurde von Windows geladen. hnd GData meldet einen Trojaner in der Exe von gmer.... das ist doch ein program das ich mir von euch geladen hab zur erstellung des beitrags???????

cosinus 13.01.2013 20:36
Zitat:
nachdem ich bei "ausführen" combofix / uninstall eingegeben habe ist combofix gestartet und wieder mit nem scan angefangen soll das so sein kann ich mir eigentlich nicht vorstellen
Wenn man das falsch eintippt ist das auch kein Wunder!
Zwischen dem / und uninstall darf kein Leerzeichen sein! Da ist nur genau ein Leerzeichen und zwar zwischen combofix und /uninstall!

Code:
"combofix /uninstall"


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:11 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132