Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU Trojaner bringt nur weissen Bildschirm (https://www.trojaner-board.de/130240-gvu-trojaner-bringt-nur-weissen-bildschirm.html)

markus21 28.01.2013 19:51
GVU Trojaner bringt nur weissen Bildschirm
 
Guten Abend zusammen!

Ich habe hier ein Notebook von einem Freud, der sich einen GVU Trojaner eingefangen hat. Der Rechner hat Win7 64bit Home Premium installiert.

Ich selbst hab diese meldung nicht gesehen. Der Rechner bringt beim normalen booten nur einen weissen Bildschirm, sonst nichts. Ich hab dem Rechner bis jetzt noch keinen Internetzugang gewährt. Ich habe versucht, den Rechner im abgesicherten Modus zu starten, leider ohne Erfolg, der Rechner fährt kurz nach dem Anmelde-Bildschirm wiederrunter. Gleiches passiert, wenn ich den Rechner im abgesicherten Modus mit Netzwerktreibern boote.:daumenrunter:

Ich hab keine Idee, was ich tun kann und bin für jeden Tipp dankbar:dankeschoen:

Gruss
Markus

PS: Ich hab den Rechner mal von USB Stick mit gparted gebootet, ClamAV Scan gestartet, 6 Files wurden erkannt und entfernt. Wenn ich den Rechner wider von HDD gebootet habe, war alles wie vorher, nur ein weisser Bildschirm.

markusg 28.01.2013 20:23
hi
wo ist das scan log?
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLpe Download OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

markus21 28.01.2013 20:35
Danke erstmal für Deine Hinweise!

Ich hab Euch gerade erstmal unterstützt.

Logfiles hab ich noch nicht, ich wusste leider bis eben nicht wie ich die erstellen kann, ich komm ja nit an den Desktop ran. Jetzt weiss ich es und werde es durchführen und mich gleich melden....

Zitat:
Zitat von markusg (Beitrag 1000644)
...
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs
Mit beide Logs meinst Du ein Log vor und ein Log nach dem Fix!?

markus21 28.01.2013 21:35
Liste der Anhänge anzeigen (Anzahl: 1)
Hm, sobald der Rechner von der CD gebootet hat und der WindXP Startbildschirm kommt, erhalte ich kurz danach den allseits bekannten Windows Bluescreen...

markusg 28.01.2013 21:36
hi
ich meinte eig das clamav log, welches du erstellt hattest.
mit beide logs, meine ich otl + extras.txt
wegen der spende, danke!

Bluescreen:
gehe ins Bios, prüfe ob ide oder ahci mode gewählt ist, konfiguriere den gegenteiligen, und versuchs erneut

markus21 28.01.2013 21:51
Im non ahci Mode startet der REATOGO-X-PE Desktop...

scan läuft...

So, hier der OTL Scan Log.

OTL Logfile:
Code:
OTL logfile created on: 1/28/2013 10:14:25 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\Windows | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 101.00 Mb Total Space | 76.57 Mb Free Space | 75.81% Space Free | Partition Type: NTFS
Drive D: | 38.00 Gb Total Space | 15.45 Gb Free Space | 40.67% Space Free | Partition Type: NTFS
Drive F: | 657.54 Gb Total Space | 606.65 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive G: | 1.85 Gb Total Space | 1.62 Gb Free Space | 87.61% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/10/02 21:39:44 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto] -- F:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/10 17:44:19 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- F:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/20 20:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- F:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/10/01 01:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 01:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/12/24 02:26:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010/12/23 21:48:02 | 000,378,984 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/12/06 06:52:40 | 000,062,464 | ---- | M] () [Disabled] -- F:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2010/11/02 16:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto] -- F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Disabled] -- F:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [Disabled] -- F:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- F:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/02/08 10:59:49 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System] -- F:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2011/10/01 01:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 01:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 01:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- F:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 01:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/01/07 20:42:34 | 012,262,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/12/24 02:26:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- F:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/12/21 03:08:48 | 008,505,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2010/12/20 14:31:18 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/12/20 14:31:16 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/10/28 23:07:44 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/15 03:28:17 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/09/23 16:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand] -- F:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2010/06/09 10:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV:64bit: - [2010/06/09 10:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot] -- F:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/04/22 12:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/02/26 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/11/02 13:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand] -- F:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/08/13 02:39:42 | 000,909,408 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- F:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/07/01 06:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- F:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
 
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKU\User_ON_F\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\User_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\System32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: F:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: F:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: F:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: F:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/28 04:34:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/04/28 04:34:49 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions\toolbar@gmx.net
[2012/04/20 20:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- F:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 20:54:08 | 000,001,392 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/20 20:54:08 | 000,002,252 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 20:54:08 | 000,001,153 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/20 20:54:08 | 000,006,805 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/20 20:54:08 | 000,001,178 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/20 20:54:08 | 000,001,105 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - F:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKU\User_ON_F\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [MedionReminder] F:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4:64bit: - HKLM..\Run: [RtHDVBg] F:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] F:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVP] F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [NUSB3MON] F:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKU\LocalService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [MEDION]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - F:\Windows\System32\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\sbhook64.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - F:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\sbhook.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - F:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\User_ON_F Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\User_ON_F Winlogon: Shell - (C:\Users\User\AppData\Roaming\skype.dat) - F:\Users\User\AppData\Roaming\skype.dat ()
O20:64bit: - Winlogon\Notify\klogon: DllName - %SystemRoot%\System32\klogon.dll - F:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^watchmi tray.lnk - F:\Windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe - (Acresso Software Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Versandhelfer.lnk - F:\Program Files (x86)\Versandhelfer\Versandhelfer.exe - ()
MsConfig:64bit - StartUpReg: ApnUpdater - hkey= - key= - F:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - F:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig:64bit - StartUpReg: HotkeyApp - hkey= - key= - F:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
MsConfig:64bit - StartUpReg: LMgrOSD - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LMgrVolOSD - hkey= - key= - F:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - F:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: swg - hkey= - key= - F:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Wbutton - hkey= - key= - F:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
MsConfig:64bit - State: "startup" - 2
MsConfig:64bit - State: "services" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/28 13:42:39 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\ElevatedDiagnostics
[2013/01/28 04:47:46 | 000,000,000 | ---D | C] -- F:\Windows\pss
[2013/01/27 16:49:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A8E10897-85DC-4115-8E49-22E30A3DFA65}
[2013/01/25 14:05:25 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F3BB0F8D-796D-4858-9D0F-FA53AF78B5ED}
[2013/01/25 02:04:59 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4B497E4A-E57A-483F-8AE4-F3ED12C47534}
[2013/01/24 09:23:23 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BD2621D9-9ACA-4320-B29E-278E2BC62804}
[2013/01/23 10:19:36 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA767207-5849-4B00-A83D-6ECD8D78F99F}
[2013/01/22 08:34:43 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4109A79D-A5BF-486A-A672-DC9C83262D9E}
[2013/01/21 03:24:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{45A70FA6-8637-4AE7-B7A7-C0CE067544C5}
[2013/01/20 06:12:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{AF674A5B-5D54-46D0-B0E4-726837CF67EE}
[2013/01/19 10:57:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F9427EA7-C9A6-4AA2-9ED1-FA4D6A4DCD1F}
[2013/01/18 18:04:54 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{09FCC795-1256-4D4F-8070-C649CDF8383E}
[2013/01/18 06:04:16 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A078D784-D705-464B-AF98-AC0FC9EB5650}
[2013/01/17 08:03:27 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EA588076-723F-4707-943A-16C97C565540}
[2013/01/17 06:24:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{7F5F6799-D1FC-456A-877D-61C1318ABE32}
[2013/01/16 15:34:49 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C9EFC31C-8F62-48F5-A4F5-C8C827FC6C9D}
[2013/01/16 03:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F7737912-B238-42E3-8E75-07C25CEB310E}
[2013/01/15 09:29:18 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{FE14D0F0-02E4-4380-9086-BB879CD99EFD}
[2013/01/14 16:54:29 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F72C27D3-C69F-4D53-AE37-71139F420330}
[2013/01/14 04:53:38 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA3CD085-4E84-42C8-A63B-F8CA838F0956}
[2013/01/13 09:25:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6B6B6CBF-6E9E-42CA-A311-99C173901884}
[2013/01/12 20:34:50 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E061C0D5-3BB7-4611-BC54-F3FFA3247643}
[2013/01/12 08:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6EF42AD3-C8E7-4475-A95F-D03EB76745B3}
[2013/01/11 05:15:55 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2ADE9677-1D0D-4C57-90F0-59D490458A4F}
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Ask.com
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\APN
[2013/01/10 09:05:42 | 000,000,000 | ---D | C] -- F:\ProgramData\Ask
[2013/01/10 09:05:40 | 000,000,000 | ---D | C] -- F:\ProgramData\Sun
[2013/01/10 09:05:39 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Common Files\Java
[2013/01/10 09:04:55 | 000,779,704 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:54 | 000,859,072 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:54 | 000,260,528 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:39 | 000,174,000 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:39 | 000,173,992 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/10 09:04:39 | 000,095,184 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:28 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Java
[2013/01/10 08:36:11 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{D25CEA9C-DD91-4C6F-95C0-AEC7169394CC}
[2013/01/09 08:37:22 | 000,750,592 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\win32spl.dll
[2013/01/09 08:37:22 | 000,492,032 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\win32spl.dll
[2013/01/09 08:37:08 | 000,307,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ncrypt.dll
[2013/01/09 08:37:08 | 000,220,160 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ncrypt.dll
[2013/01/09 08:37:07 | 000,800,768 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\usp10.dll
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\fpb.rs
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\System32\fpb.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc-nz.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\System32\pegibbfc.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\csrr.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\System32\csrr.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cob-au.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\System32\cob-au.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\usk.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\System32\usk.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\grb.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\System32\grb.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\djctq.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\System32\djctq.rs
[2013/01/09 08:37:03 | 002,746,368 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\gameux.dll
[2013/01/09 08:37:03 | 002,576,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\gameux.dll
[2013/01/09 08:37:03 | 000,441,856 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\Wpc.dll
[2013/01/09 08:37:03 | 000,308,736 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\Wpc.dll
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\esrb.rs
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\System32\esrb.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-pt.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cero.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\System32\cero.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-fi.rs
[2013/01/09 08:36:42 | 000,424,448 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\KernelBase.dll
[2013/01/09 08:36:41 | 001,161,216 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\kernel32.dll
[2013/01/09 08:36:41 | 000,362,496 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64win.dll
[2013/01/09 08:36:41 | 000,338,432 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\conhost.exe
[2013/01/09 08:36:41 | 000,243,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64.dll
[2013/01/09 08:36:41 | 000,215,040 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\winsrv.dll
[2013/01/09 08:36:41 | 000,025,600 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\setup16.exe
[2013/01/09 08:36:41 | 000,016,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ntvdm64.dll
[2013/01/09 08:36:41 | 000,014,336 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 08:36:41 | 000,013,312 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64cpu.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\wow32.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:40 | 000,007,680 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\instnm.exe
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\user.exe
[2013/01/09 08:36:31 | 000,068,608 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\taskhost.exe
[2013/01/09 08:27:05 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{0443C667-ABA9-4D2D-9F00-BCA83D4EC7A0}
[2013/01/08 06:29:00 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{9DC0D96C-13A2-40A7-8DDA-C85F780D6D72}
[2013/01/07 11:47:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2AA4DD3B-3CEB-4812-B661-B0E141068029}
[2013/01/06 10:56:15 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CDD50BE9-673E-4D61-9169-3D59AB0E9A0B}
[2013/01/05 06:51:31 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EE6FEF4A-671D-462D-99CC-E6F84F7B1B9D}
[2013/01/04 11:10:58 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E914D87C-1989-4BC5-8A8D-72F067940457}
[2013/01/03 13:01:44 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CF6FC07D-E775-49A3-9155-82330500929F}
[2013/01/02 14:14:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C4D0E46B-4157-4F61-878E-8A284C6E8A9F}
[2013/01/01 10:19:34 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C1E40AB9-5701-4927-AC94-54564142380D}
[2012/12/31 07:34:56 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{94A2ADA4-B153-4E9C-B392-E87DE0436ED7}
[2012/12/30 14:12:42 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2213A2DD-FA05-4070-98AE-A5157496A8F9}
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/28 15:09:25 | 000,067,584 | --S- | M] () -- F:\Windows\bootstat.dat
[2013/01/28 14:47:15 | 000,001,037 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 13:38:58 | 3061,903,360 | -HS- | M] () -- F:\hiberfil.sys
[2013/01/28 13:34:32 | 000,000,004 | ---- | M] () -- F:\Users\User\AppData\Roaming\skype.ini
[2013/01/28 13:26:10 | 000,001,110 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:10:04 | 000,001,106 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/28 05:36:00 | 000,000,017 | ---- | M] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/28 04:47:46 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2013/01/25 13:44:08 | 000,000,884 | ---- | M] () -- F:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/21 03:29:38 | 000,654,844 | ---- | M] () -- F:\Windows\System32\perfh007.dat
[2013/01/21 03:29:38 | 000,616,686 | ---- | M] () -- F:\Windows\System32\perfh009.dat
[2013/01/21 03:29:38 | 000,130,426 | ---- | M] () -- F:\Windows\System32\perfc007.dat
[2013/01/21 03:29:38 | 000,106,808 | ---- | M] () -- F:\Windows\System32\perfc009.dat
[2013/01/11 09:50:13 | 000,002,287 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/10 17:44:19 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/10 17:44:19 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/01/10 09:04:32 | 000,095,184 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:31 | 000,859,072 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:31 | 000,779,704 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:31 | 000,260,528 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:31 | 000,174,000 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:31 | 000,173,992 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/09 11:20:38 | 000,306,672 | ---- | M] () -- F:\Windows\System32\FNTCACHE.DAT
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/28 14:47:15 | 000,001,037 | ---- | C] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 05:36:00 | 000,000,017 | ---- | C] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/24 20:44:36 | 000,000,004 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.ini
[2012/04/17 14:32:28 | 001,526,948 | ---- | C] () -- F:\Windows\SysWow64\PerfStringBackup.INI
[2012/02/19 08:31:48 | 000,252,928 | ---- | C] () -- F:\Windows\SysWow64\DShowRdpFilter.dll
[2012/02/18 09:04:53 | 000,047,104 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.dat
[2011/02/03 16:13:48 | 000,127,184 | ---- | C] () -- F:\Windows\Unwise.exe
[2011/02/03 16:13:47 | 000,149,504 | ---- | C] () -- F:\Windows\unwise32_setup.exe
[2011/01/27 19:21:10 | 000,867,020 | ---- | C] () -- F:\Windows\SysWow64\igkrng575.bin
[2011/01/27 19:21:08 | 000,105,416 | ---- | C] () -- F:\Windows\SysWow64\igfcg575m.bin
[2011/01/27 19:21:07 | 000,128,204 | ---- | C] () -- F:\Windows\SysWow64\igcompkrng575.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- F:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- F:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- F:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- F:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- F:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- F:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- F:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- F:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Application Data
[2013/01/10 09:05:42 | 000,000,000 | ---D | M] -- F:\ProgramData\Ask
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Documents
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favorites
[2012/02/08 11:02:16 | 000,000,000 | -H-D | M] -- F:\ProgramData\Medion Reminder
[2012/04/07 18:08:20 | 000,000,000 | ---D | M] -- F:\ProgramData\Partner
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Start Menu
[2013/01/28 05:02:32 | 000,000,000 | ---D | M] -- F:\ProgramData\Temp
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Templates
[2012/02/08 10:58:59 | 000,000,000 | ---D | M] -- F:\ProgramData\TvdPersonal
[2012/04/21 10:25:24 | 000,000,000 | ---D | M] -- F:\ProgramData\VirtualizedApplications
[2011/02/03 16:19:51 | 000,000,000 | ---D | M] -- F:\ProgramData\X10 Settings
[2013/01/17 13:59:37 | 000,032,640 | ---- | M] () -- F:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/02/08 11:01:32 | 000,000,000 | -HSD | M] -- F:\$RECYCLE.BIN
[2012/02/08 10:48:29 | 000,000,000 | -HSD | M] -- F:\Documents and Settings
[2012/02/09 03:13:47 | 000,000,000 | ---D | M] -- F:\img
[2011/02/03 15:50:02 | 000,000,000 | ---D | M] -- F:\Intel
[2012/04/17 14:32:16 | 000,000,000 | R--D | M] -- F:\Program Files
[2013/01/10 09:15:53 | 000,000,000 | R--D | M] -- F:\Program Files (x86)
[2013/01/10 09:05:42 | 000,000,000 | -H-D | M] -- F:\ProgramData
[2012/02/08 10:48:30 | 000,000,000 | -HSD | M] -- F:\Recovery
[2013/01/20 09:41:30 | 000,000,000 | -HSD | M] -- F:\System Volume Information
[2012/02/08 11:01:17 | 000,000,000 | R--D | M] -- F:\Users
[2013/01/28 04:47:46 | 000,000,000 | ---D | M] -- F:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\System32\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2008/06/06 17:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- F:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 01:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 01:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 01:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 01:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 01:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\drivers\iaStor.sys
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010/05/12 03:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011/03/11 01:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 01:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 01:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 20:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010/05/12 03:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 20:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\System32\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\SysWOW64\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010/05/12 03:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009/07/13 20:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 01:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 01:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010/05/12 03:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011/03/11 01:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 20:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\SysWOW64\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\System32\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\SysWOW64\user32.dll
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 20:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 20:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\System32\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\SysWOW64\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 20:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\System32\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\System32\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 02:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 01:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
--- --- ---

[/CODE]

Eine extras.txt hab ich leider nirgends gefunden :(

Ich hab auch nochmal nach extras.txt suchen lassen, leider nichts....

markusg 29.01.2013 15:12
hi
warum hast du eig so ein altes kaspersky, aktuell ist 2013.
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O20 - HKU\User_ON_F Winlogon: Shell - (C:\Users\User\AppData\Roaming\skype.dat) - F:\Users\User\AppData\Roaming\skype.dat ()
:Files
C:\Users\User\AppData\Roaming\skype.dat
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

vor dem neustart bitte im bios den modus umendern.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

markus21 29.01.2013 22:12
Hat Super geklappt :)

Upload war erfolgreich, die Meldung lautete:

Zitat:
Datei: MovedFiles.zip_1 empfangen

Vorgang erfolgreich abgeschlossen.
BTW: Warum da ein Virenscanner von 2011 drauf installiert ist, KA, is nit mein Rechner ;(

Ich hau jetzt erstmal was kostenloses drauf. Darf ich schon oder muss ich noch was machen/beachten?

Und der Desktop war sofort wieder da :)

Hier noch die OTL.txt nach dem Fix...

OTL Logfile:
Code:
OTL logfile created on: 1/28/2013 10:14:25 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\Windows | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 101.00 Mb Total Space | 76.57 Mb Free Space | 75.81% Space Free | Partition Type: NTFS
Drive D: | 38.00 Gb Total Space | 15.45 Gb Free Space | 40.67% Space Free | Partition Type: NTFS
Drive F: | 657.54 Gb Total Space | 606.65 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive G: | 1.85 Gb Total Space | 1.62 Gb Free Space | 87.61% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/10/02 21:39:44 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto] -- F:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/10 17:44:19 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- F:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/20 20:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- F:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/10/01 01:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 01:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/12/24 02:26:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010/12/23 21:48:02 | 000,378,984 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/12/06 06:52:40 | 000,062,464 | ---- | M] () [Disabled] -- F:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2010/11/02 16:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto] -- F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Disabled] -- F:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [Disabled] -- F:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- F:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/02/08 10:59:49 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System] -- F:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2011/10/01 01:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 01:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 01:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- F:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 01:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/01/07 20:42:34 | 012,262,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/12/24 02:26:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- F:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/12/21 03:08:48 | 008,505,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2010/12/20 14:31:18 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/12/20 14:31:16 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/10/28 23:07:44 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/15 03:28:17 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/09/23 16:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand] -- F:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2010/06/09 10:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV:64bit: - [2010/06/09 10:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot] -- F:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/04/22 12:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/02/26 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/11/02 13:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand] -- F:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/08/13 02:39:42 | 000,909,408 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- F:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/07/01 06:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- F:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
 
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI
IE - HKU\User_ON_F\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\User_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\System32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: F:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: F:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: F:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: F:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/28 04:34:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/04/28 04:34:49 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions\toolbar@gmx.net
[2012/04/20 20:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- F:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 20:54:08 | 000,001,392 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/20 20:54:08 | 000,002,252 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 20:54:08 | 000,001,153 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/20 20:54:08 | 000,006,805 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/20 20:54:08 | 000,001,178 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/20 20:54:08 | 000,001,105 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - F:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKU\User_ON_F\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [MedionReminder] F:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4:64bit: - HKLM..\Run: [RtHDVBg] F:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] F:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVP] F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [NUSB3MON] F:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKU\LocalService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [MEDION]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - F:\Windows\System32\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\sbhook64.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - F:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\sbhook.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - F:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\User_ON_F Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\User_ON_F Winlogon: Shell - (C:\Users\User\AppData\Roaming\skype.dat) - F:\Users\User\AppData\Roaming\skype.dat ()
O20:64bit: - Winlogon\Notify\klogon: DllName - %SystemRoot%\System32\klogon.dll - F:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^watchmi tray.lnk - F:\Windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe - (Acresso Software Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Versandhelfer.lnk - F:\Program Files (x86)\Versandhelfer\Versandhelfer.exe - ()
MsConfig:64bit - StartUpReg: ApnUpdater - hkey= - key= - F:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - F:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig:64bit - StartUpReg: HotkeyApp - hkey= - key= - F:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
MsConfig:64bit - StartUpReg: LMgrOSD - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LMgrVolOSD - hkey= - key= - F:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - F:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: swg - hkey= - key= - F:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Wbutton - hkey= - key= - F:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
MsConfig:64bit - State: "startup" - 2
MsConfig:64bit - State: "services" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/28 13:42:39 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\ElevatedDiagnostics
[2013/01/28 04:47:46 | 000,000,000 | ---D | C] -- F:\Windows\pss
[2013/01/27 16:49:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A8E10897-85DC-4115-8E49-22E30A3DFA65}
[2013/01/25 14:05:25 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F3BB0F8D-796D-4858-9D0F-FA53AF78B5ED}
[2013/01/25 02:04:59 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4B497E4A-E57A-483F-8AE4-F3ED12C47534}
[2013/01/24 09:23:23 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BD2621D9-9ACA-4320-B29E-278E2BC62804}
[2013/01/23 10:19:36 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA767207-5849-4B00-A83D-6ECD8D78F99F}
[2013/01/22 08:34:43 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4109A79D-A5BF-486A-A672-DC9C83262D9E}
[2013/01/21 03:24:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{45A70FA6-8637-4AE7-B7A7-C0CE067544C5}
[2013/01/20 06:12:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{AF674A5B-5D54-46D0-B0E4-726837CF67EE}
[2013/01/19 10:57:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F9427EA7-C9A6-4AA2-9ED1-FA4D6A4DCD1F}
[2013/01/18 18:04:54 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{09FCC795-1256-4D4F-8070-C649CDF8383E}
[2013/01/18 06:04:16 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A078D784-D705-464B-AF98-AC0FC9EB5650}
[2013/01/17 08:03:27 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EA588076-723F-4707-943A-16C97C565540}
[2013/01/17 06:24:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{7F5F6799-D1FC-456A-877D-61C1318ABE32}
[2013/01/16 15:34:49 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C9EFC31C-8F62-48F5-A4F5-C8C827FC6C9D}
[2013/01/16 03:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F7737912-B238-42E3-8E75-07C25CEB310E}
[2013/01/15 09:29:18 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{FE14D0F0-02E4-4380-9086-BB879CD99EFD}
[2013/01/14 16:54:29 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F72C27D3-C69F-4D53-AE37-71139F420330}
[2013/01/14 04:53:38 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA3CD085-4E84-42C8-A63B-F8CA838F0956}
[2013/01/13 09:25:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6B6B6CBF-6E9E-42CA-A311-99C173901884}
[2013/01/12 20:34:50 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E061C0D5-3BB7-4611-BC54-F3FFA3247643}
[2013/01/12 08:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6EF42AD3-C8E7-4475-A95F-D03EB76745B3}
[2013/01/11 05:15:55 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2ADE9677-1D0D-4C57-90F0-59D490458A4F}
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Ask.com
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\APN
[2013/01/10 09:05:42 | 000,000,000 | ---D | C] -- F:\ProgramData\Ask
[2013/01/10 09:05:40 | 000,000,000 | ---D | C] -- F:\ProgramData\Sun
[2013/01/10 09:05:39 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Common Files\Java
[2013/01/10 09:04:55 | 000,779,704 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:54 | 000,859,072 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:54 | 000,260,528 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:39 | 000,174,000 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:39 | 000,173,992 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/10 09:04:39 | 000,095,184 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:28 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Java
[2013/01/10 08:36:11 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{D25CEA9C-DD91-4C6F-95C0-AEC7169394CC}
[2013/01/09 08:37:22 | 000,750,592 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\win32spl.dll
[2013/01/09 08:37:22 | 000,492,032 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\win32spl.dll
[2013/01/09 08:37:08 | 000,307,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ncrypt.dll
[2013/01/09 08:37:08 | 000,220,160 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ncrypt.dll
[2013/01/09 08:37:07 | 000,800,768 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\usp10.dll
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\fpb.rs
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\System32\fpb.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc-nz.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\System32\pegibbfc.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\csrr.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\System32\csrr.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cob-au.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\System32\cob-au.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\usk.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\System32\usk.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\grb.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\System32\grb.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\djctq.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\System32\djctq.rs
[2013/01/09 08:37:03 | 002,746,368 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\gameux.dll
[2013/01/09 08:37:03 | 002,576,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\gameux.dll
[2013/01/09 08:37:03 | 000,441,856 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\Wpc.dll
[2013/01/09 08:37:03 | 000,308,736 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\Wpc.dll
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\esrb.rs
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\System32\esrb.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-pt.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cero.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\System32\cero.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-fi.rs
[2013/01/09 08:36:42 | 000,424,448 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\KernelBase.dll
[2013/01/09 08:36:41 | 001,161,216 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\kernel32.dll
[2013/01/09 08:36:41 | 000,362,496 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64win.dll
[2013/01/09 08:36:41 | 000,338,432 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\conhost.exe
[2013/01/09 08:36:41 | 000,243,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64.dll
[2013/01/09 08:36:41 | 000,215,040 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\winsrv.dll
[2013/01/09 08:36:41 | 000,025,600 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\setup16.exe
[2013/01/09 08:36:41 | 000,016,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ntvdm64.dll
[2013/01/09 08:36:41 | 000,014,336 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 08:36:41 | 000,013,312 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64cpu.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\wow32.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:40 | 000,007,680 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\instnm.exe
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\user.exe
[2013/01/09 08:36:31 | 000,068,608 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\taskhost.exe
[2013/01/09 08:27:05 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{0443C667-ABA9-4D2D-9F00-BCA83D4EC7A0}
[2013/01/08 06:29:00 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{9DC0D96C-13A2-40A7-8DDA-C85F780D6D72}
[2013/01/07 11:47:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2AA4DD3B-3CEB-4812-B661-B0E141068029}
[2013/01/06 10:56:15 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CDD50BE9-673E-4D61-9169-3D59AB0E9A0B}
[2013/01/05 06:51:31 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EE6FEF4A-671D-462D-99CC-E6F84F7B1B9D}
[2013/01/04 11:10:58 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E914D87C-1989-4BC5-8A8D-72F067940457}
[2013/01/03 13:01:44 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CF6FC07D-E775-49A3-9155-82330500929F}
[2013/01/02 14:14:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C4D0E46B-4157-4F61-878E-8A284C6E8A9F}
[2013/01/01 10:19:34 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C1E40AB9-5701-4927-AC94-54564142380D}
[2012/12/31 07:34:56 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{94A2ADA4-B153-4E9C-B392-E87DE0436ED7}
[2012/12/30 14:12:42 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2213A2DD-FA05-4070-98AE-A5157496A8F9}
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/28 15:09:25 | 000,067,584 | --S- | M] () -- F:\Windows\bootstat.dat
[2013/01/28 14:47:15 | 000,001,037 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 13:38:58 | 3061,903,360 | -HS- | M] () -- F:\hiberfil.sys
[2013/01/28 13:34:32 | 000,000,004 | ---- | M] () -- F:\Users\User\AppData\Roaming\skype.ini
[2013/01/28 13:26:10 | 000,001,110 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:10:04 | 000,001,106 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/28 05:36:00 | 000,000,017 | ---- | M] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/28 04:47:46 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2013/01/25 13:44:08 | 000,000,884 | ---- | M] () -- F:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/21 03:29:38 | 000,654,844 | ---- | M] () -- F:\Windows\System32\perfh007.dat
[2013/01/21 03:29:38 | 000,616,686 | ---- | M] () -- F:\Windows\System32\perfh009.dat
[2013/01/21 03:29:38 | 000,130,426 | ---- | M] () -- F:\Windows\System32\perfc007.dat
[2013/01/21 03:29:38 | 000,106,808 | ---- | M] () -- F:\Windows\System32\perfc009.dat
[2013/01/11 09:50:13 | 000,002,287 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/10 17:44:19 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/10 17:44:19 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/01/10 09:04:32 | 000,095,184 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:31 | 000,859,072 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:31 | 000,779,704 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:31 | 000,260,528 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:31 | 000,174,000 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:31 | 000,173,992 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/09 11:20:38 | 000,306,672 | ---- | M] () -- F:\Windows\System32\FNTCACHE.DAT
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/28 14:47:15 | 000,001,037 | ---- | C] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 05:36:00 | 000,000,017 | ---- | C] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/24 20:44:36 | 000,000,004 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.ini
[2012/04/17 14:32:28 | 001,526,948 | ---- | C] () -- F:\Windows\SysWow64\PerfStringBackup.INI
[2012/02/19 08:31:48 | 000,252,928 | ---- | C] () -- F:\Windows\SysWow64\DShowRdpFilter.dll
[2012/02/18 09:04:53 | 000,047,104 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.dat
[2011/02/03 16:13:48 | 000,127,184 | ---- | C] () -- F:\Windows\Unwise.exe
[2011/02/03 16:13:47 | 000,149,504 | ---- | C] () -- F:\Windows\unwise32_setup.exe
[2011/01/27 19:21:10 | 000,867,020 | ---- | C] () -- F:\Windows\SysWow64\igkrng575.bin
[2011/01/27 19:21:08 | 000,105,416 | ---- | C] () -- F:\Windows\SysWow64\igfcg575m.bin
[2011/01/27 19:21:07 | 000,128,204 | ---- | C] () -- F:\Windows\SysWow64\igcompkrng575.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- F:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- F:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- F:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- F:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- F:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- F:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- F:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- F:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Application Data
[2013/01/10 09:05:42 | 000,000,000 | ---D | M] -- F:\ProgramData\Ask
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Documents
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favorites
[2012/02/08 11:02:16 | 000,000,000 | -H-D | M] -- F:\ProgramData\Medion Reminder
[2012/04/07 18:08:20 | 000,000,000 | ---D | M] -- F:\ProgramData\Partner
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Start Menu
[2013/01/28 05:02:32 | 000,000,000 | ---D | M] -- F:\ProgramData\Temp
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Templates
[2012/02/08 10:58:59 | 000,000,000 | ---D | M] -- F:\ProgramData\TvdPersonal
[2012/04/21 10:25:24 | 000,000,000 | ---D | M] -- F:\ProgramData\VirtualizedApplications
[2011/02/03 16:19:51 | 000,000,000 | ---D | M] -- F:\ProgramData\X10 Settings
[2013/01/17 13:59:37 | 000,032,640 | ---- | M] () -- F:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/02/08 11:01:32 | 000,000,000 | -HSD | M] -- F:\$RECYCLE.BIN
[2012/02/08 10:48:29 | 000,000,000 | -HSD | M] -- F:\Documents and Settings
[2012/02/09 03:13:47 | 000,000,000 | ---D | M] -- F:\img
[2011/02/03 15:50:02 | 000,000,000 | ---D | M] -- F:\Intel
[2012/04/17 14:32:16 | 000,000,000 | R--D | M] -- F:\Program Files
[2013/01/10 09:15:53 | 000,000,000 | R--D | M] -- F:\Program Files (x86)
[2013/01/10 09:05:42 | 000,000,000 | -H-D | M] -- F:\ProgramData
[2012/02/08 10:48:30 | 000,000,000 | -HSD | M] -- F:\Recovery
[2013/01/20 09:41:30 | 000,000,000 | -HSD | M] -- F:\System Volume Information
[2012/02/08 11:01:17 | 000,000,000 | R--D | M] -- F:\Users
[2013/01/28 04:47:46 | 000,000,000 | ---D | M] -- F:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\System32\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2008/06/06 17:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- F:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 01:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 01:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 01:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 01:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 01:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\drivers\iaStor.sys
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010/05/12 03:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011/03/11 01:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 01:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 01:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 20:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010/05/12 03:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 20:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\System32\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\SysWOW64\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010/05/12 03:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009/07/13 20:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 01:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 01:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010/05/12 03:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011/03/11 01:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 20:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\SysWOW64\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\System32\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\SysWOW64\user32.dll
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 20:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 20:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\System32\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\SysWOW64\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 20:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\System32\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\System32\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 02:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 01:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
--- --- ---

markus21 29.01.2013 22:35
Hier noch die OTL.txt nach dem Fix...

OTL Logfile:
Code:
OTL logfile created on: 1/28/2013 10:14:25 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\Windows | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 101.00 Mb Total Space | 76.57 Mb Free Space | 75.81% Space Free | Partition Type: NTFS
Drive D: | 38.00 Gb Total Space | 15.45 Gb Free Space | 40.67% Space Free | Partition Type: NTFS
Drive F: | 657.54 Gb Total Space | 606.65 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive G: | 1.85 Gb Total Space | 1.62 Gb Free Space | 87.61% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/10/02 21:39:44 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto] -- F:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/10 17:44:19 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- F:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/20 20:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- F:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/10/01 01:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 01:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/12/24 02:26:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010/12/23 21:48:02 | 000,378,984 | ---- | M] (NVIDIA Corporation) [Auto] -- F:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/12/06 06:52:40 | 000,062,464 | ---- | M] () [Disabled] -- F:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2010/11/02 16:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto] -- F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- F:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Disabled] -- F:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [Disabled] -- F:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- F:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/02/08 10:59:49 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System] -- F:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2011/10/01 01:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 01:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 01:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- F:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 01:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/01/07 20:42:34 | 012,262,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/12/24 02:26:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- F:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/12/21 03:08:48 | 008,505,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2010/12/20 14:31:18 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/12/20 14:31:16 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/10/28 23:07:44 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/15 03:28:17 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/09/23 16:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand] -- F:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2010/06/09 10:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV:64bit: - [2010/06/09 10:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot] -- F:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/04/22 12:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System] -- F:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/02/26 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/11/02 13:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand] -- F:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/08/13 02:39:42 | 000,909,408 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- F:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/07/01 06:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- F:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
 
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\User_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI
IE - HKU\User_ON_F\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\User_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\System32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: F:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: F:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: F:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: F:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: F:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: F:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: F:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: F:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru [2012/02/18 13:26:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/28 04:34:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/04/28 04:34:49 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (No name found) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2012/04/28 04:34:50 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Program Files (x86)\Mozilla Firefox\distribution\extensions\toolbar@gmx.net
[2012/04/20 20:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- F:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 20:54:08 | 000,001,392 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/20 20:54:08 | 000,002,252 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 20:54:08 | 000,001,153 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/20 20:54:08 | 000,006,805 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/20 20:54:08 | 000,001,178 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/20 20:54:08 | 000,001,105 | ---- | M] () -- F:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - F:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKU\User_ON_F\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - F:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [MedionReminder] F:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4:64bit: - HKLM..\Run: [RtHDVBg] F:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] F:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVP] F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [NUSB3MON] F:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKU\LocalService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_F..\RunOnce: [MEDION]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - F:\Windows\System32\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\sbhook64.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - F:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - F:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\sbhook.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - F:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\User_ON_F Winlogon: Shell - (explorer.exe) - F:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\User_ON_F Winlogon: Shell - (C:\Users\User\AppData\Roaming\skype.dat) - F:\Users\User\AppData\Roaming\skype.dat ()
O20:64bit: - Winlogon\Notify\klogon: DllName - %SystemRoot%\System32\klogon.dll - F:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^watchmi tray.lnk - F:\Windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe - (Acresso Software Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Versandhelfer.lnk - F:\Program Files (x86)\Versandhelfer\Versandhelfer.exe - ()
MsConfig:64bit - StartUpReg: ApnUpdater - hkey= - key= - F:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - F:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig:64bit - StartUpReg: HotkeyApp - hkey= - key= - F:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
MsConfig:64bit - StartUpReg: LMgrOSD - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LMgrVolOSD - hkey= - key= - F:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - F:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: swg - hkey= - key= - F:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Wbutton - hkey= - key= - F:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
MsConfig:64bit - State: "startup" - 2
MsConfig:64bit - State: "services" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/28 13:42:39 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\ElevatedDiagnostics
[2013/01/28 04:47:46 | 000,000,000 | ---D | C] -- F:\Windows\pss
[2013/01/27 16:49:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A8E10897-85DC-4115-8E49-22E30A3DFA65}
[2013/01/25 14:05:25 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F3BB0F8D-796D-4858-9D0F-FA53AF78B5ED}
[2013/01/25 02:04:59 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4B497E4A-E57A-483F-8AE4-F3ED12C47534}
[2013/01/24 09:23:23 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BD2621D9-9ACA-4320-B29E-278E2BC62804}
[2013/01/23 10:19:36 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA767207-5849-4B00-A83D-6ECD8D78F99F}
[2013/01/22 08:34:43 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{4109A79D-A5BF-486A-A672-DC9C83262D9E}
[2013/01/21 03:24:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{45A70FA6-8637-4AE7-B7A7-C0CE067544C5}
[2013/01/20 06:12:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{AF674A5B-5D54-46D0-B0E4-726837CF67EE}
[2013/01/19 10:57:40 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F9427EA7-C9A6-4AA2-9ED1-FA4D6A4DCD1F}
[2013/01/18 18:04:54 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{09FCC795-1256-4D4F-8070-C649CDF8383E}
[2013/01/18 06:04:16 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{A078D784-D705-464B-AF98-AC0FC9EB5650}
[2013/01/17 08:03:27 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EA588076-723F-4707-943A-16C97C565540}
[2013/01/17 06:24:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{7F5F6799-D1FC-456A-877D-61C1318ABE32}
[2013/01/16 15:34:49 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C9EFC31C-8F62-48F5-A4F5-C8C827FC6C9D}
[2013/01/16 03:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F7737912-B238-42E3-8E75-07C25CEB310E}
[2013/01/15 09:29:18 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{FE14D0F0-02E4-4380-9086-BB879CD99EFD}
[2013/01/14 16:54:29 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{F72C27D3-C69F-4D53-AE37-71139F420330}
[2013/01/14 04:53:38 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{BA3CD085-4E84-42C8-A63B-F8CA838F0956}
[2013/01/13 09:25:17 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6B6B6CBF-6E9E-42CA-A311-99C173901884}
[2013/01/12 20:34:50 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E061C0D5-3BB7-4611-BC54-F3FFA3247643}
[2013/01/12 08:34:24 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{6EF42AD3-C8E7-4475-A95F-D03EB76745B3}
[2013/01/11 05:15:55 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2ADE9677-1D0D-4C57-90F0-59D490458A4F}
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Ask.com
[2013/01/10 09:15:53 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\APN
[2013/01/10 09:05:42 | 000,000,000 | ---D | C] -- F:\ProgramData\Ask
[2013/01/10 09:05:40 | 000,000,000 | ---D | C] -- F:\ProgramData\Sun
[2013/01/10 09:05:39 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Common Files\Java
[2013/01/10 09:04:55 | 000,779,704 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:54 | 000,859,072 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:54 | 000,260,528 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:39 | 000,174,000 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:39 | 000,173,992 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/10 09:04:39 | 000,095,184 | ---- | C] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:28 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\Java
[2013/01/10 08:36:11 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{D25CEA9C-DD91-4C6F-95C0-AEC7169394CC}
[2013/01/09 08:37:22 | 000,750,592 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\win32spl.dll
[2013/01/09 08:37:22 | 000,492,032 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\win32spl.dll
[2013/01/09 08:37:08 | 000,307,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ncrypt.dll
[2013/01/09 08:37:08 | 000,220,160 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ncrypt.dll
[2013/01/09 08:37:07 | 000,800,768 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\usp10.dll
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\fpb.rs
[2013/01/09 08:37:04 | 000,046,592 | ---- | C] (Microsoft) -- F:\Windows\System32\fpb.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 08:37:04 | 000,045,568 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc-nz.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 08:37:04 | 000,044,544 | ---- | C] (Microsoft) -- F:\Windows\System32\pegibbfc.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\csrr.rs
[2013/01/09 08:37:04 | 000,043,520 | ---- | C] (Microsoft) -- F:\Windows\System32\csrr.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cob-au.rs
[2013/01/09 08:37:04 | 000,040,960 | ---- | C] (Microsoft) -- F:\Windows\System32\cob-au.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\usk.rs
[2013/01/09 08:37:04 | 000,030,720 | ---- | C] (Microsoft) -- F:\Windows\System32\usk.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\grb.rs
[2013/01/09 08:37:04 | 000,021,504 | ---- | C] (Microsoft) -- F:\Windows\System32\grb.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi.rs
[2013/01/09 08:37:04 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\djctq.rs
[2013/01/09 08:37:04 | 000,015,360 | ---- | C] (Microsoft) -- F:\Windows\System32\djctq.rs
[2013/01/09 08:37:03 | 002,746,368 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\gameux.dll
[2013/01/09 08:37:03 | 002,576,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\gameux.dll
[2013/01/09 08:37:03 | 000,441,856 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\Wpc.dll
[2013/01/09 08:37:03 | 000,308,736 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\Wpc.dll
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\esrb.rs
[2013/01/09 08:37:03 | 000,051,712 | ---- | C] (Microsoft) -- F:\Windows\System32\esrb.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 08:37:03 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-pt.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\cero.rs
[2013/01/09 08:37:02 | 000,055,296 | ---- | C] (Microsoft) -- F:\Windows\System32\cero.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\oflc.rs
[2013/01/09 08:37:02 | 000,023,552 | ---- | C] (Microsoft) -- F:\Windows\System32\oflc.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 08:37:02 | 000,020,480 | ---- | C] (Microsoft) -- F:\Windows\System32\pegi-fi.rs
[2013/01/09 08:36:42 | 000,424,448 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\KernelBase.dll
[2013/01/09 08:36:41 | 001,161,216 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\kernel32.dll
[2013/01/09 08:36:41 | 000,362,496 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64win.dll
[2013/01/09 08:36:41 | 000,338,432 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\conhost.exe
[2013/01/09 08:36:41 | 000,243,200 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64.dll
[2013/01/09 08:36:41 | 000,215,040 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\winsrv.dll
[2013/01/09 08:36:41 | 000,025,600 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\setup16.exe
[2013/01/09 08:36:41 | 000,016,384 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ntvdm64.dll
[2013/01/09 08:36:41 | 000,014,336 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 08:36:41 | 000,013,312 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wow64cpu.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 08:36:41 | 000,005,120 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\wow32.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 08:36:40 | 000,007,680 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\instnm.exe
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- F:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 08:36:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\user.exe
[2013/01/09 08:36:31 | 000,068,608 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\taskhost.exe
[2013/01/09 08:27:05 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{0443C667-ABA9-4D2D-9F00-BCA83D4EC7A0}
[2013/01/08 06:29:00 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{9DC0D96C-13A2-40A7-8DDA-C85F780D6D72}
[2013/01/07 11:47:28 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2AA4DD3B-3CEB-4812-B661-B0E141068029}
[2013/01/06 10:56:15 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CDD50BE9-673E-4D61-9169-3D59AB0E9A0B}
[2013/01/05 06:51:31 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{EE6FEF4A-671D-462D-99CC-E6F84F7B1B9D}
[2013/01/04 11:10:58 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{E914D87C-1989-4BC5-8A8D-72F067940457}
[2013/01/03 13:01:44 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{CF6FC07D-E775-49A3-9155-82330500929F}
[2013/01/02 14:14:30 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C4D0E46B-4157-4F61-878E-8A284C6E8A9F}
[2013/01/01 10:19:34 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{C1E40AB9-5701-4927-AC94-54564142380D}
[2012/12/31 07:34:56 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{94A2ADA4-B153-4E9C-B392-E87DE0436ED7}
[2012/12/30 14:12:42 | 000,000,000 | ---D | C] -- F:\Users\User\AppData\Local\{2213A2DD-FA05-4070-98AE-A5157496A8F9}
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/28 15:09:25 | 000,067,584 | --S- | M] () -- F:\Windows\bootstat.dat
[2013/01/28 14:47:15 | 000,001,037 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 13:38:58 | 3061,903,360 | -HS- | M] () -- F:\hiberfil.sys
[2013/01/28 13:34:32 | 000,000,004 | ---- | M] () -- F:\Users\User\AppData\Roaming\skype.ini
[2013/01/28 13:26:10 | 000,001,110 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:18:00 | 000,009,920 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 13:10:04 | 000,001,106 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/28 05:36:00 | 000,000,017 | ---- | M] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/28 04:47:46 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2013/01/25 13:44:08 | 000,000,884 | ---- | M] () -- F:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/21 03:29:38 | 000,654,844 | ---- | M] () -- F:\Windows\System32\perfh007.dat
[2013/01/21 03:29:38 | 000,616,686 | ---- | M] () -- F:\Windows\System32\perfh009.dat
[2013/01/21 03:29:38 | 000,130,426 | ---- | M] () -- F:\Windows\System32\perfc007.dat
[2013/01/21 03:29:38 | 000,106,808 | ---- | M] () -- F:\Windows\System32\perfc009.dat
[2013/01/11 09:50:13 | 000,002,287 | ---- | M] () -- F:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/10 17:44:19 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/10 17:44:19 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- F:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/01/10 09:04:32 | 000,095,184 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/10 09:04:31 | 000,859,072 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\npDeployJava1.dll
[2013/01/10 09:04:31 | 000,779,704 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\deployJava1.dll
[2013/01/10 09:04:31 | 000,260,528 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaws.exe
[2013/01/10 09:04:31 | 000,174,000 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\javaw.exe
[2013/01/10 09:04:31 | 000,173,992 | ---- | M] (Oracle Corporation) -- F:\Windows\SysWow64\java.exe
[2013/01/09 11:20:38 | 000,306,672 | ---- | M] () -- F:\Windows\System32\FNTCACHE.DAT
[11 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\*.tmp files -> F:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/28 14:47:15 | 000,001,037 | ---- | C] () -- F:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
[2013/01/28 05:36:00 | 000,000,017 | ---- | C] () -- F:\Windows\SysWow64\shortcut_ex.dat
[2013/01/24 20:44:36 | 000,000,004 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.ini
[2012/04/17 14:32:28 | 001,526,948 | ---- | C] () -- F:\Windows\SysWow64\PerfStringBackup.INI
[2012/02/19 08:31:48 | 000,252,928 | ---- | C] () -- F:\Windows\SysWow64\DShowRdpFilter.dll
[2012/02/18 09:04:53 | 000,047,104 | ---- | C] () -- F:\Users\User\AppData\Roaming\skype.dat
[2011/02/03 16:13:48 | 000,127,184 | ---- | C] () -- F:\Windows\Unwise.exe
[2011/02/03 16:13:47 | 000,149,504 | ---- | C] () -- F:\Windows\unwise32_setup.exe
[2011/01/27 19:21:10 | 000,867,020 | ---- | C] () -- F:\Windows\SysWow64\igkrng575.bin
[2011/01/27 19:21:08 | 000,105,416 | ---- | C] () -- F:\Windows\SysWow64\igfcg575m.bin
[2011/01/27 19:21:07 | 000,128,204 | ---- | C] () -- F:\Windows\SysWow64\igcompkrng575.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- F:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- F:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- F:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- F:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- F:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- F:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- F:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- F:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Application Data
[2013/01/10 09:05:42 | 000,000,000 | ---D | M] -- F:\ProgramData\Ask
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Documents
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favorites
[2012/02/08 11:02:16 | 000,000,000 | -H-D | M] -- F:\ProgramData\Medion Reminder
[2012/04/07 18:08:20 | 000,000,000 | ---D | M] -- F:\ProgramData\Partner
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Start Menu
[2013/01/28 05:02:32 | 000,000,000 | ---D | M] -- F:\ProgramData\Temp
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Templates
[2012/02/08 10:58:59 | 000,000,000 | ---D | M] -- F:\ProgramData\TvdPersonal
[2012/04/21 10:25:24 | 000,000,000 | ---D | M] -- F:\ProgramData\VirtualizedApplications
[2011/02/03 16:19:51 | 000,000,000 | ---D | M] -- F:\ProgramData\X10 Settings
[2013/01/17 13:59:37 | 000,032,640 | ---- | M] () -- F:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/02/08 11:01:32 | 000,000,000 | -HSD | M] -- F:\$RECYCLE.BIN
[2012/02/08 10:48:29 | 000,000,000 | -HSD | M] -- F:\Documents and Settings
[2012/02/09 03:13:47 | 000,000,000 | ---D | M] -- F:\img
[2011/02/03 15:50:02 | 000,000,000 | ---D | M] -- F:\Intel
[2012/04/17 14:32:16 | 000,000,000 | R--D | M] -- F:\Program Files
[2013/01/10 09:15:53 | 000,000,000 | R--D | M] -- F:\Program Files (x86)
[2013/01/10 09:05:42 | 000,000,000 | -H-D | M] -- F:\ProgramData
[2012/02/08 10:48:30 | 000,000,000 | -HSD | M] -- F:\Recovery
[2013/01/20 09:41:30 | 000,000,000 | -HSD | M] -- F:\System Volume Information
[2012/02/08 11:01:17 | 000,000,000 | R--D | M] -- F:\Users
[2013/01/28 04:47:46 | 000,000,000 | ---D | M] -- F:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- F:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- F:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- F:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\System32\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- F:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2008/06/06 17:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- F:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 01:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 01:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 01:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 01:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- F:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 01:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- F:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\drivers\iaStor.sys
[2010/03/03 22:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- F:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 08:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010/05/12 03:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011/03/11 01:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 01:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 01:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 20:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010/05/12 03:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- F:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 20:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\System32\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- F:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\SysWOW64\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- F:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010/05/12 03:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009/07/13 20:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 01:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 01:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010/05/12 03:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011/03/11 01:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- F:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 20:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\SysWOW64\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- F:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\System32\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- F:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\SysWOW64\user32.dll
[2010/11/20 07:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 20:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 20:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- F:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\System32\user32.dll
[2010/11/20 08:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- F:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\SysWOW64\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- F:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 20:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\System32\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- F:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\System32\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 02:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 01:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- F:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- F:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
--- --- ---

[/QUOTE]

markusg 31.01.2013 14:26
hi
danke
in den normalen Modus kommst du?
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten

markus21 31.01.2013 18:32
Hier isser...

Zitat:
18:29:09.0311 5384 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
18:29:09.0611 5384 ============================================================
18:29:09.0611 5384 Current date / time: 2013/01/31 18:29:09.0611
18:29:09.0611 5384 SystemInfo:
18:29:09.0611 5384
18:29:09.0611 5384 OS Version: 6.1.7601 ServicePack: 1.0
18:29:09.0611 5384 Product type: Workstation
18:29:09.0611 5384 ComputerName: USER-PC
18:29:09.0611 5384 UserName: User
18:29:09.0611 5384 Windows directory: C:\Windows
18:29:09.0611 5384 System windows directory: C:\Windows
18:29:09.0611 5384 Running under WOW64
18:29:09.0611 5384 Processor architecture: Intel x64
18:29:09.0611 5384 Number of processors: 4
18:29:09.0611 5384 Page size: 0x1000
18:29:09.0611 5384 Boot type: Normal boot
18:29:09.0611 5384 ============================================================
18:29:10.0661 5384 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:29:10.0691 5384 ============================================================
18:29:10.0691 5384 \Device\Harddisk0\DR0:
18:29:10.0701 5384 MBR partitions:
18:29:10.0701 5384 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32800
18:29:10.0701 5384 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x33000, BlocksNum 0x52313000
18:29:10.0721 5384 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x52346800, BlocksNum 0x4BFE000
18:29:10.0801 5384 ============================================================
18:29:10.0901 5384 C: <-> \Device\Harddisk0\DR0\Partition2
18:29:10.0951 5384 D: <-> \Device\Harddisk0\DR0\Partition3
18:29:10.0951 5384 ============================================================
18:29:10.0951 5384 Initialize success
18:29:10.0951 5384 ============================================================
18:29:19.0731 5312 ============================================================
18:29:19.0731 5312 Scan started
18:29:19.0731 5312 Mode: Manual; SigCheck; TDLFS;
18:29:19.0731 5312 ============================================================
18:29:21.0441 5312 ================ Scan system memory ========================
18:29:21.0441 5312 System memory - ok
18:29:21.0441 5312 ================ Scan services =============================
18:29:22.0011 5312 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
18:29:22.0281 5312 1394ohci - ok
18:29:22.0451 5312 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
18:29:22.0481 5312 ACPI - ok
18:29:22.0581 5312 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
18:29:22.0731 5312 AcpiPmi - ok
18:29:23.0261 5312 [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
18:29:23.0311 5312 AdobeFlashPlayerUpdateSvc - ok
18:29:23.0391 5312 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
18:29:23.0431 5312 adp94xx - ok
18:29:23.0551 5312 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
18:29:23.0591 5312 adpahci - ok
18:29:23.0761 5312 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
18:29:23.0791 5312 adpu320 - ok
18:29:23.0881 5312 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
18:29:23.0951 5312 AeLookupSvc - ok
18:29:24.0031 5312 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
18:29:24.0081 5312 AFD - ok
18:29:24.0131 5312 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
18:29:24.0161 5312 agp440 - ok
18:29:24.0211 5312 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
18:29:24.0251 5312 ALG - ok
18:29:24.0301 5312 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
18:29:24.0331 5312 aliide - ok
18:29:24.0461 5312 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
18:29:24.0491 5312 amdide - ok
18:29:24.0571 5312 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
18:29:24.0651 5312 AmdK8 - ok
18:29:24.0701 5312 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
18:29:24.0801 5312 AmdPPM - ok
18:29:24.0871 5312 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
18:29:24.0891 5312 amdsata - ok
18:29:24.0991 5312 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
18:29:25.0021 5312 amdsbs - ok
18:29:25.0031 5312 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
18:29:25.0051 5312 amdxata - ok
18:29:25.0141 5312 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
18:29:25.0231 5312 AppID - ok
18:29:25.0261 5312 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
18:29:25.0351 5312 AppIDSvc - ok
18:29:25.0421 5312 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
18:29:25.0471 5312 Appinfo - ok
18:29:25.0531 5312 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
18:29:25.0551 5312 arc - ok
18:29:25.0601 5312 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
18:29:25.0621 5312 arcsas - ok
18:29:25.0711 5312 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
18:29:25.0781 5312 AsyncMac - ok
18:29:25.0861 5312 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
18:29:25.0891 5312 atapi - ok
18:29:25.0951 5312 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:29:26.0041 5312 AudioEndpointBuilder - ok
18:29:26.0051 5312 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
18:29:26.0091 5312 AudioSrv - ok
18:29:27.0691 5312 [ 4AFC14AFA58878FAA1D249E7E90EA54B ] AVGIDSAgent C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
18:29:27.0781 5312 AVGIDSAgent - ok
18:29:27.0861 5312 [ 388056EBD5FE6718FE669078DBE37897 ] AVGIDSDriver C:\Windows\system32\DRIVERS\avgidsdrivera.sys
18:29:27.0891 5312 AVGIDSDriver - ok
18:29:27.0911 5312 [ 550E981747D6A6C55078C77346FFC2C6 ] AVGIDSHA C:\Windows\system32\DRIVERS\avgidsha.sys
18:29:27.0951 5312 AVGIDSHA - ok
18:29:27.0981 5312 [ 5989592A91A17587799792A81E1541D4 ] Avgldx64 C:\Windows\system32\DRIVERS\avgldx64.sys
18:29:27.0991 5312 Avgldx64 - ok
18:29:28.0101 5312 [ 3FC43AA02545FCDDC22817829114DEC8 ] Avgloga C:\Windows\system32\DRIVERS\avgloga.sys
18:29:28.0121 5312 Avgloga - ok
18:29:28.0161 5312 [ 841C40C193889730848849AC220D9242 ] Avgmfx64 C:\Windows\system32\DRIVERS\avgmfx64.sys
18:29:28.0191 5312 Avgmfx64 - ok
18:29:28.0231 5312 [ FE4F444DBE4BBBDFD8FECF49398DEFC7 ] Avgrkx64 C:\Windows\system32\DRIVERS\avgrkx64.sys
18:29:28.0251 5312 Avgrkx64 - ok
18:29:28.0321 5312 [ 6E634525613D48A1D1657FB21F21F3B2 ] Avgtdia C:\Windows\system32\DRIVERS\avgtdia.sys
18:29:28.0381 5312 Avgtdia - ok
18:29:28.0411 5312 [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
18:29:28.0431 5312 avgwd - ok
18:29:28.0481 5312 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
18:29:28.0531 5312 AxInstSV - ok
18:29:28.0581 5312 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
18:29:28.0651 5312 b06bdrv - ok
18:29:28.0711 5312 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
18:29:28.0751 5312 b57nd60a - ok
18:29:28.0801 5312 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
18:29:28.0861 5312 BDESVC - ok
18:29:28.0951 5312 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
18:29:29.0051 5312 Beep - ok
18:29:29.0111 5312 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
18:29:29.0191 5312 BFE - ok
18:29:29.0411 5312 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
18:29:29.0501 5312 BITS - ok
18:29:29.0701 5312 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
18:29:29.0741 5312 blbdrive - ok
18:29:29.0801 5312 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
18:29:29.0861 5312 bowser - ok
18:29:29.0911 5312 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:29:29.0951 5312 BrFiltLo - ok
18:29:30.0011 5312 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:29:30.0071 5312 BrFiltUp - ok
18:29:30.0111 5312 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
18:29:30.0161 5312 Browser - ok
18:29:30.0211 5312 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
18:29:30.0251 5312 Brserid - ok
18:29:30.0291 5312 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
18:29:30.0361 5312 BrSerWdm - ok
18:29:30.0411 5312 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
18:29:30.0471 5312 BrUsbMdm - ok
18:29:30.0521 5312 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
18:29:30.0551 5312 BrUsbSer - ok
18:29:30.0611 5312 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
18:29:30.0711 5312 BthEnum - ok
18:29:30.0771 5312 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
18:29:30.0811 5312 BTHMODEM - ok
18:29:30.0861 5312 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
18:29:30.0901 5312 BthPan - ok
18:29:30.0941 5312 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
18:29:31.0021 5312 BTHPORT - ok
18:29:31.0071 5312 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
18:29:31.0151 5312 bthserv - ok
18:29:31.0221 5312 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
18:29:31.0281 5312 BTHUSB - ok
18:29:31.0351 5312 [ 6E04458E98DAF28826482E41A7A62DF5 ] btusbflt C:\Windows\system32\drivers\btusbflt.sys
18:29:31.0381 5312 btusbflt - ok
18:29:31.0441 5312 [ AF838D8029AE7C27470862D63FA54D24 ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
18:29:31.0471 5312 btwaudio - ok
18:29:31.0511 5312 [ 5C849BD7C78791C5CEE9F4651D7FE38D ] btwavdt C:\Windows\system32\DRIVERS\btwavdt.sys
18:29:31.0531 5312 btwavdt - ok
18:29:31.0781 5312 [ DCF8D8F1F87743509D9C0207CB28637D ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
18:29:31.0811 5312 btwdins - ok
18:29:31.0901 5312 [ 6149301DC3F81D6F9667A3FBAC410975 ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
18:29:31.0921 5312 btwl2cap - ok
18:29:31.0961 5312 [ 3E1991AFA851A36DC978B0A1B0535C8B ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
18:29:31.0981 5312 btwrchid - ok
18:29:32.0011 5312 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
18:29:32.0051 5312 cdfs - ok
18:29:32.0131 5312 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\drivers\cdrom.sys
18:29:32.0201 5312 cdrom - ok
18:29:32.0261 5312 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
18:29:32.0351 5312 CertPropSvc - ok
18:29:32.0411 5312 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
18:29:32.0471 5312 circlass - ok
18:29:32.0521 5312 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
18:29:32.0551 5312 CLFS - ok
18:29:32.0721 5312 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:29:32.0741 5312 clr_optimization_v2.0.50727_32 - ok
18:29:32.0761 5312 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:29:32.0791 5312 clr_optimization_v2.0.50727_64 - ok
18:29:32.0941 5312 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:29:32.0971 5312 clr_optimization_v4.0.30319_32 - ok
18:29:33.0181 5312 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:29:33.0201 5312 clr_optimization_v4.0.30319_64 - ok
18:29:33.0271 5312 [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd C:\Windows\system32\DRIVERS\clwvd.sys
18:29:33.0291 5312 clwvd - ok
18:29:33.0351 5312 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
18:29:33.0391 5312 CmBatt - ok
18:29:33.0431 5312 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
18:29:33.0471 5312 cmdide - ok
18:29:33.0531 5312 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys
18:29:33.0571 5312 CNG - ok
18:29:33.0621 5312 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
18:29:33.0641 5312 Compbatt - ok
18:29:33.0721 5312 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
18:29:33.0791 5312 CompositeBus - ok
18:29:33.0801 5312 COMSysApp - ok
18:29:33.0821 5312 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
18:29:33.0841 5312 crcdisk - ok
18:29:33.0901 5312 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
18:29:33.0951 5312 CryptSvc - ok
18:29:34.0151 5312 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
18:29:34.0191 5312 cvhsvc - ok
18:29:34.0321 5312 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
18:29:34.0401 5312 DcomLaunch - ok
18:29:34.0461 5312 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
18:29:34.0561 5312 defragsvc - ok
18:29:34.0581 5312 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
18:29:34.0631 5312 DfsC - ok
18:29:34.0671 5312 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
18:29:34.0711 5312 Dhcp - ok
18:29:34.0751 5312 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
18:29:34.0841 5312 discache - ok
18:29:34.0941 5312 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
18:29:34.0981 5312 Disk - ok
18:29:35.0021 5312 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
18:29:35.0051 5312 Dnscache - ok
18:29:35.0091 5312 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
18:29:35.0161 5312 dot3svc - ok
18:29:35.0201 5312 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
18:29:35.0261 5312 DPS - ok
18:29:35.0331 5312 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
18:29:35.0371 5312 drmkaud - ok
18:29:35.0468 5312 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
18:29:35.0530 5312 DXGKrnl - ok
18:29:35.0593 5312 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
18:29:35.0671 5312 EapHost - ok
18:29:35.0998 5312 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
18:29:36.0139 5312 ebdrv - ok
18:29:36.0185 5312 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
18:29:36.0232 5312 EFS - ok
18:29:36.0341 5312 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
18:29:36.0388 5312 ehRecvr - ok
18:29:36.0435 5312 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
18:29:36.0466 5312 ehSched - ok
18:29:36.0529 5312 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
18:29:36.0591 5312 elxstor - ok
18:29:36.0622 5312 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
18:29:36.0653 5312 ErrDev - ok
18:29:36.0700 5312 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
18:29:36.0778 5312 EventSystem - ok
18:29:36.0809 5312 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
18:29:36.0841 5312 exfat - ok
18:29:36.0887 5312 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
18:29:36.0934 5312 fastfat - ok
18:29:37.0012 5312 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
18:29:37.0059 5312 Fax - ok
18:29:37.0106 5312 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
18:29:37.0137 5312 fdc - ok
18:29:37.0199 5312 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
18:29:37.0246 5312 fdPHost - ok
18:29:37.0277 5312 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
18:29:37.0355 5312 FDResPub - ok
18:29:37.0402 5312 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
18:29:37.0418 5312 FileInfo - ok
18:29:37.0433 5312 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
18:29:37.0511 5312 Filetrace - ok
18:29:37.0558 5312 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
18:29:37.0599 5312 flpydisk - ok
18:29:37.0649 5312 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
18:29:37.0679 5312 FltMgr - ok
18:29:37.0989 5312 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
18:29:38.0079 5312 FontCache - ok
18:29:38.0139 5312 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:29:38.0159 5312 FontCache3.0.0.0 - ok
18:29:38.0189 5312 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
18:29:38.0199 5312 FsDepends - ok
18:29:38.0269 5312 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
18:29:38.0279 5312 Fs_Rec - ok
18:29:38.0319 5312 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
18:29:38.0339 5312 fvevol - ok
18:29:38.0399 5312 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
18:29:38.0429 5312 gagp30kx - ok
18:29:38.0509 5312 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
18:29:38.0579 5312 gpsvc - ok
18:29:38.0679 5312 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:29:38.0699 5312 gupdate - ok
18:29:38.0709 5312 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:29:38.0719 5312 gupdatem - ok
18:29:38.0759 5312 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
18:29:38.0809 5312 hcw85cir - ok
18:29:38.0859 5312 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:29:38.0919 5312 HdAudAddService - ok
18:29:38.0949 5312 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
18:29:38.0989 5312 HDAudBus - ok
18:29:39.0039 5312 [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
18:29:39.0059 5312 HECIx64 - ok
18:29:39.0079 5312 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
18:29:39.0129 5312 HidBatt - ok
18:29:39.0149 5312 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
18:29:39.0209 5312 HidBth - ok
18:29:39.0239 5312 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
18:29:39.0289 5312 HidIr - ok
18:29:39.0329 5312 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
18:29:39.0399 5312 hidserv - ok
18:29:39.0469 5312 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
18:29:39.0509 5312 HidUsb - ok
18:29:39.0549 5312 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
18:29:39.0639 5312 hkmsvc - ok
18:29:39.0719 5312 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
18:29:39.0779 5312 HomeGroupListener - ok
18:29:39.0849 5312 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
18:29:39.0899 5312 HomeGroupProvider - ok
18:29:39.0959 5312 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
18:29:39.0999 5312 HpSAMD - ok
18:29:40.0209 5312 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
18:29:40.0319 5312 HTTP - ok
18:29:40.0379 5312 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
18:29:40.0399 5312 hwpolicy - ok
18:29:40.0479 5312 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
18:29:40.0499 5312 i8042prt - ok
18:29:40.0549 5312 [ ABBF174CB394F5C437410A788B7E404A ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
18:29:40.0579 5312 iaStor - ok
18:29:40.0789 5312 [ 31A0E93CDF29007D6C6FFFB632F375ED ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
18:29:40.0809 5312 IAStorDataMgrSvc - ok
18:29:40.0889 5312 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
18:29:40.0919 5312 iaStorV - ok
18:29:41.0029 5312 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:29:41.0079 5312 idsvc - ok
18:29:41.0699 5312 [ F4F91789C7C7A159CE8215C1F69F2A85 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
18:29:42.0029 5312 igfx - ok
18:29:42.0129 5312 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
18:29:42.0169 5312 iirsp - ok
18:29:42.0269 5312 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
18:29:42.0329 5312 IKEEXT - ok
18:29:42.0379 5312 [ DD587A55390ED2295BCE6D36AD567DA9 ] Impcd C:\Windows\system32\DRIVERS\Impcd.sys
18:29:42.0429 5312 Impcd - ok
18:29:42.0729 5312 [ 4E2745DB3ADEF0FFA5E14857666AAE13 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
18:29:42.0849 5312 IntcAzAudAddService - ok
18:29:42.0929 5312 [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
18:29:42.0959 5312 IntcDAud - ok
18:29:43.0009 5312 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
18:29:43.0029 5312 intelide - ok
18:29:43.0079 5312 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
18:29:43.0129 5312 intelppm - ok
18:29:43.0159 5312 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
18:29:43.0229 5312 IPBusEnum - ok
18:29:43.0299 5312 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:29:43.0379 5312 IpFilterDriver - ok
18:29:43.0469 5312 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
18:29:43.0509 5312 iphlpsvc - ok
18:29:43.0549 5312 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
18:29:43.0609 5312 IPMIDRV - ok
18:29:43.0659 5312 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
18:29:43.0719 5312 IPNAT - ok
18:29:43.0769 5312 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
18:29:43.0819 5312 IRENUM - ok
18:29:43.0879 5312 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
18:29:43.0909 5312 isapnp - ok
18:29:43.0939 5312 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
18:29:43.0959 5312 iScsiPrt - ok
18:29:44.0099 5312 [ BE72D2B3A99615F84E270C80F0A18448 ] ISWKL C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
18:29:44.0129 5312 ISWKL - ok
18:29:44.0269 5312 [ D9A4C1353CC653F8E2FE4D2C6A490E96 ] IswSvc C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
18:29:44.0301 5312 IswSvc - ok
18:29:44.0519 5312 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
18:29:44.0550 5312 kbdclass - ok
18:29:44.0613 5312 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
18:29:44.0659 5312 kbdhid - ok
18:29:44.0753 5312 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
18:29:44.0769 5312 KeyIso - ok
18:29:44.0847 5312 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
18:29:44.0878 5312 KSecDD - ok
18:29:44.0925 5312 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
18:29:44.0940 5312 KSecPkg - ok
18:29:44.0990 5312 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
18:29:45.0050 5312 ksthunk - ok
18:29:45.0110 5312 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
18:29:45.0210 5312 KtmRm - ok
18:29:45.0260 5312 [ 48686C29856F46443952A831424F8D6F ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
18:29:45.0280 5312 L1C - ok
18:29:45.0330 5312 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
18:29:45.0400 5312 LanmanServer - ok
18:29:45.0440 5312 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:29:45.0530 5312 LanmanWorkstation - ok
18:29:45.0590 5312 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
18:29:45.0670 5312 lltdio - ok
18:29:45.0810 5312 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
18:29:45.0880 5312 lltdsvc - ok
18:29:45.0930 5312 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
18:29:45.0990 5312 lmhosts - ok
18:29:46.0180 5312 [ 1E2F802846EB944E0333EFEE7C9532A8 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
18:29:46.0200 5312 LMS - ok
18:29:46.0330 5312 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
18:29:46.0350 5312 LSI_FC - ok
18:29:46.0360 5312 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
18:29:46.0380 5312 LSI_SAS - ok
18:29:46.0410 5312 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:29:46.0420 5312 LSI_SAS2 - ok
18:29:46.0470 5312 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:29:46.0510 5312 LSI_SCSI - ok
18:29:46.0530 5312 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
18:29:46.0580 5312 luafv - ok
18:29:46.0690 5312 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
18:29:46.0730 5312 Mcx2Svc - ok
18:29:46.0810 5312 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
18:29:46.0830 5312 megasas - ok
18:29:46.0890 5312 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
18:29:46.0920 5312 MegaSR - ok
18:29:46.0960 5312 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
18:29:47.0020 5312 MMCSS - ok
18:29:47.0090 5312 [ F7AB9BBD2D973607C0E69B1D79C7611F ] mod7764 C:\Windows\system32\DRIVERS\mod77-64.sys
18:29:47.0150 5312 mod7764 - ok
18:29:47.0220 5312 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
18:29:47.0340 5312 Modem - ok
18:29:47.0390 5312 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
18:29:47.0400 5312 monitor - ok
18:29:47.0470 5312 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
18:29:47.0510 5312 mouclass - ok
18:29:47.0560 5312 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
18:29:47.0600 5312 mouhid - ok
18:29:47.0630 5312 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
18:29:47.0650 5312 mountmgr - ok
18:29:47.0760 5312 [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
18:29:47.0800 5312 MozillaMaintenance - ok
18:29:47.0830 5312 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
18:29:47.0880 5312 mpio - ok
18:29:47.0900 5312 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
18:29:47.0940 5312 mpsdrv - ok
18:29:48.0130 5312 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
18:29:48.0240 5312 MpsSvc - ok
18:29:48.0280 5312 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
18:29:48.0350 5312 MRxDAV - ok
18:29:48.0390 5312 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
18:29:48.0430 5312 mrxsmb - ok
18:29:48.0470 5312 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:29:48.0520 5312 mrxsmb10 - ok
18:29:48.0540 5312 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:29:48.0600 5312 mrxsmb20 - ok
18:29:48.0620 5312 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
18:29:48.0640 5312 msahci - ok
18:29:48.0660 5312 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
18:29:48.0680 5312 msdsm - ok
18:29:48.0700 5312 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
18:29:48.0740 5312 MSDTC - ok
18:29:48.0780 5312 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
18:29:48.0860 5312 Msfs - ok
18:29:48.0860 5312 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
18:29:48.0910 5312 mshidkmdf - ok
18:29:48.0980 5312 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
18:29:49.0010 5312 msisadrv - ok
18:29:49.0080 5312 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
18:29:49.0150 5312 MSiSCSI - ok
18:29:49.0150 5312 msiserver - ok
18:29:49.0200 5312 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
18:29:49.0280 5312 MSKSSRV - ok
18:29:49.0300 5312 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
18:29:49.0350 5312 MSPCLOCK - ok
18:29:49.0350 5312 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
18:29:49.0390 5312 MSPQM - ok
18:29:49.0420 5312 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
18:29:49.0440 5312 MsRPC - ok
18:29:49.0540 5312 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
18:29:49.0560 5312 mssmbios - ok
18:29:49.0650 5312 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
18:29:49.0750 5312 MSTEE - ok
18:29:49.0790 5312 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
18:29:49.0830 5312 MTConfig - ok
18:29:49.0850 5312 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
18:29:49.0870 5312 Mup - ok
18:29:49.0910 5312 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
18:29:49.0990 5312 napagent - ok
18:29:50.0070 5312 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
18:29:50.0140 5312 NativeWifiP - ok
18:29:50.0220 5312 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
18:29:50.0260 5312 NDIS - ok
18:29:50.0330 5312 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
18:29:50.0410 5312 NdisCap - ok
18:29:50.0480 5312 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
18:29:50.0550 5312 NdisTapi - ok
18:29:50.0590 5312 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
18:29:50.0640 5312 Ndisuio - ok
18:29:50.0680 5312 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
18:29:50.0770 5312 NdisWan - ok
18:29:50.0830 5312 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
18:29:50.0920 5312 NDProxy - ok
18:29:50.0980 5312 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
18:29:51.0060 5312 NetBIOS - ok
18:29:51.0100 5312 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
18:29:51.0160 5312 NetBT - ok
18:29:51.0200 5312 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
18:29:51.0210 5312 Netlogon - ok
18:29:51.0270 5312 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
18:29:51.0360 5312 Netman - ok
18:29:51.0380 5312 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
18:29:51.0450 5312 netprofm - ok
18:29:51.0550 5312 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:29:51.0590 5312 NetTcpPortSharing - ok
18:29:53.0114 5312 [ 5D262402B0634C998F8CBCEAD7DD8676 ] NETwNs64 C:\Windows\system32\DRIVERS\NETwNs64.sys
18:29:53.0379 5312 NETwNs64 - ok
18:29:53.0441 5312 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
18:29:53.0473 5312 nfrd960 - ok
18:29:53.0535 5312 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
18:29:53.0566 5312 NlaSvc - ok
18:29:53.0660 5312 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
18:29:53.0722 5312 Npfs - ok
18:29:53.0753 5312 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
18:29:53.0831 5312 nsi - ok
18:29:53.0863 5312 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
18:29:53.0941 5312 nsiproxy - ok
18:29:54.0596 5312 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
18:29:54.0643 5312 Ntfs - ok
18:29:54.0830 5312 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
18:29:54.0877 5312 Null - ok
18:29:54.0963 5312 [ 158AD24745BD85BA9BE3C51C38F48C32 ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
18:29:54.0983 5312 nusb3hub - ok
18:29:54.0993 5312 [ D40A13B2C0891E218F9523B376955DB6 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
18:29:55.0033 5312 nusb3xhc - ok
18:29:59.0147 5312 [ 5B87B16D2781982E32BAB6D359034C37 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:29:59.0522 5312 nvlddmkm - ok
18:29:59.0553 5312 [ 0FB06978E39D3B2BB02D616B71A718DC ] nvpciflt C:\Windows\system32\DRIVERS\nvpciflt.sys
18:29:59.0553 5312 nvpciflt - ok
18:29:59.0634 5312 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
18:29:59.0664 5312 nvraid - ok
18:29:59.0674 5312 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
18:29:59.0694 5312 nvstor - ok
18:30:00.0064 5312 [ E0978D69D66403BEB006BED61B27B883 ] NVSvc C:\Windows\system32\nvvsvc.exe
18:30:00.0104 5312 NVSvc - ok
18:30:00.0854 5312 [ DC49EC481397457AEA7D094383C0E1B6 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
18:30:00.0894 5312 nvUpdatusService - ok
18:30:01.0104 5312 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
18:30:01.0164 5312 nv_agp - ok
18:30:01.0184 5312 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
18:30:01.0224 5312 ohci1394 - ok
18:30:01.0304 5312 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:30:01.0344 5312 ose - ok
18:30:01.0835 5312 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
18:30:02.0023 5312 osppsvc - ok
18:30:02.0085 5312 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
18:30:02.0147 5312 p2pimsvc - ok
18:30:02.0210 5312 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
18:30:02.0257 5312 p2psvc - ok
18:30:02.0288 5312 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
18:30:02.0335 5312 Parport - ok
18:30:02.0381 5312 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
18:30:02.0397 5312 partmgr - ok
18:30:02.0459 5312 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
18:30:02.0522 5312 PcaSvc - ok
18:30:02.0569 5312 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
18:30:02.0600 5312 pci - ok
18:30:02.0693 5312 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
18:30:02.0725 5312 pciide - ok
18:30:02.0756 5312 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
18:30:02.0803 5312 pcmcia - ok
18:30:02.0865 5312 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
18:30:02.0881 5312 pcw - ok
18:30:02.0959 5312 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
18:30:03.0021 5312 PEAUTH - ok
18:30:03.0672 5312 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
18:30:03.0742 5312 PerfHost - ok
18:30:03.0842 5312 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
18:30:03.0962 5312 pla - ok
18:30:04.0062 5312 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
18:30:04.0122 5312 PlugPlay - ok
18:30:04.0162 5312 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
18:30:04.0222 5312 PNRPAutoReg - ok
18:30:04.0242 5312 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
18:30:04.0272 5312 PNRPsvc - ok
18:30:04.0422 5312 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
18:30:04.0492 5312 PolicyAgent - ok
18:30:04.0552 5312 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
18:30:04.0632 5312 Power - ok
18:30:04.0692 5312 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
18:30:04.0772 5312 PptpMiniport - ok
18:30:04.0812 5312 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
18:30:04.0852 5312 Processor - ok
18:30:04.0922 5312 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
18:30:04.0982 5312 ProfSvc - ok
18:30:05.0012 5312 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
18:30:05.0022 5312 ProtectedStorage - ok
18:30:05.0162 5312 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
18:30:05.0232 5312 Psched - ok
18:30:05.0282 5312 [ A6A7AD767BF5141665F5C675F671B3E1 ] PSI_SVC_2 c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
18:30:05.0312 5312 PSI_SVC_2 - ok
18:30:05.0452 5312 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
18:30:05.0552 5312 ql2300 - ok
18:30:05.0632 5312 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
18:30:05.0672 5312 ql40xx - ok
18:30:05.0702 5312 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
18:30:05.0742 5312 QWAVE - ok
18:30:05.0802 5312 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
18:30:05.0872 5312 QWAVEdrv - ok
18:30:05.0872 5312 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
18:30:05.0922 5312 RasAcd - ok
18:30:05.0952 5312 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
18:30:06.0012 5312 RasAgileVpn - ok
18:30:06.0102 5312 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
18:30:06.0182 5312 RasAuto - ok
18:30:06.0252 5312 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
18:30:06.0312 5312 Rasl2tp - ok
18:30:06.0382 5312 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
18:30:06.0452 5312 RasMan - ok
18:30:06.0542 5312 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
18:30:06.0622 5312 RasPppoe - ok
18:30:06.0642 5312 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
18:30:06.0692 5312 RasSstp - ok
18:30:06.0772 5312 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
18:30:06.0832 5312 rdbss - ok
18:30:06.0902 5312 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
18:30:06.0962 5312 rdpbus - ok
18:30:07.0012 5312 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
18:30:07.0102 5312 RDPCDD - ok
18:30:07.0112 5312 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
18:30:07.0142 5312 RDPENCDD - ok
18:30:07.0152 5312 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
18:30:07.0192 5312 RDPREFMP - ok
18:30:07.0252 5312 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
18:30:07.0302 5312 RdpVideoMiniport - ok
18:30:07.0362 5312 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
18:30:07.0402 5312 RDPWD - ok
18:30:07.0452 5312 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
18:30:07.0472 5312 rdyboost - ok
18:30:07.0532 5312 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
18:30:07.0592 5312 RemoteAccess - ok
18:30:07.0702 5312 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
18:30:07.0802 5312 RemoteRegistry - ok
18:30:07.0872 5312 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
18:30:07.0932 5312 RFCOMM - ok
18:30:08.0152 5312 [ F12A68ED55053940CADD59CA5E3468DD ] RichVideo C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
18:30:08.0212 5312 RichVideo ( UnsignedFile.Multi.Generic ) - warning
18:30:08.0212 5312 RichVideo - detected UnsignedFile.Multi.Generic (1)
18:30:08.0322 5312 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
18:30:08.0402 5312 RpcEptMapper - ok
18:30:08.0452 5312 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
18:30:08.0492 5312 RpcLocator - ok
18:30:08.0562 5312 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
18:30:08.0612 5312 RpcSs - ok
18:30:08.0792 5312 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
18:30:08.0882 5312 rspndr - ok
18:30:08.0952 5312 [ 44ED82612403021E36998E1ECB1198F1 ] RSUSBSTOR C:\Windows\System32\Drivers\RtsUStor.sys
18:30:09.0002 5312 RSUSBSTOR - ok
18:30:09.0012 5312 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
18:30:09.0022 5312 SamSs - ok
18:30:09.0272 5312 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
18:30:09.0312 5312 sbp2port - ok
18:30:09.0372 5312 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
18:30:09.0462 5312 SCardSvr - ok
18:30:09.0492 5312 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
18:30:09.0582 5312 scfilter - ok
18:30:09.0782 5312 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
18:30:09.0872 5312 Schedule - ok
18:30:09.0952 5312 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
18:30:10.0002 5312 SCPolicySvc - ok
18:30:10.0082 5312 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
18:30:10.0132 5312 SDRSVC - ok
18:30:10.0192 5312 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
18:30:10.0272 5312 secdrv - ok
18:30:10.0382 5312 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
18:30:10.0472 5312 seclogon - ok
18:30:10.0562 5312 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
18:30:10.0632 5312 SENS - ok
18:30:10.0652 5312 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
18:30:10.0692 5312 SensrSvc - ok
18:30:10.0742 5312 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
18:30:10.0792 5312 Serenum - ok
18:30:10.0832 5312 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
18:30:10.0892 5312 Serial - ok
18:30:10.0942 5312 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
18:30:11.0002 5312 sermouse - ok
18:30:11.0052 5312 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
18:30:11.0142 5312 SessionEnv - ok
18:30:11.0192 5312 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
18:30:11.0252 5312 sffdisk - ok
18:30:11.0272 5312 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
18:30:11.0312 5312 sffp_mmc - ok
18:30:11.0322 5312 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
18:30:11.0352 5312 sffp_sd - ok
18:30:11.0382 5312 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
18:30:11.0412 5312 sfloppy - ok
18:30:11.0482 5312 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys
18:30:11.0532 5312 Sftfs - ok
18:30:11.0632 5312 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
18:30:11.0662 5312 sftlist - ok
18:30:11.0792 5312 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys
18:30:11.0822 5312 Sftplay - ok
18:30:11.0882 5312 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys
18:30:11.0892 5312 Sftredir - ok
18:30:11.0942 5312 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys
18:30:11.0972 5312 Sftvol - ok
18:30:12.0022 5312 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
18:30:12.0042 5312 sftvsa - ok
18:30:12.0082 5312 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
18:30:12.0132 5312 SharedAccess - ok
18:30:12.0192 5312 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:30:12.0252 5312 ShellHWDetection - ok
18:30:12.0342 5312 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:30:12.0382 5312 SiSRaid2 - ok
18:30:12.0402 5312 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
18:30:12.0432 5312 SiSRaid4 - ok
18:30:12.0482 5312 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
18:30:12.0542 5312 Smb - ok
18:30:12.0582 5312 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
18:30:12.0602 5312 SNMPTRAP - ok
18:30:12.0632 5312 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
18:30:12.0642 5312 spldr - ok
18:30:12.0842 5312 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
18:30:12.0932 5312 Spooler - ok
18:30:13.0392 5312 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
18:30:13.0542 5312 sppsvc - ok
18:30:13.0622 5312 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
18:30:13.0692 5312 sppuinotify - ok
18:30:13.0822 5312 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
18:30:13.0892 5312 srv - ok
18:30:13.0962 5312 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
18:30:14.0052 5312 srv2 - ok
18:30:14.0112 5312 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
18:30:14.0132 5312 srvnet - ok
18:30:14.0252 5312 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
18:30:14.0372 5312 SSDPSRV - ok
18:30:14.0412 5312 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
18:30:14.0522 5312 SstpSvc - ok
18:30:14.0672 5312 [ 39D9CA03CC9FF883F8E36D95E7BFD193 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
18:30:14.0692 5312 Stereo Service - ok
18:30:14.0842 5312 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
18:30:14.0872 5312 stexstor - ok
18:30:15.0062 5312 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
18:30:15.0142 5312 stisvc - ok
18:30:15.0182 5312 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
18:30:15.0222 5312 swenum - ok
18:30:15.0352 5312 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
18:30:15.0472 5312 swprv - ok
18:30:15.0552 5312 [ 064A2530A4A7C7CEC1BE6A1945645BE4 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
18:30:15.0572 5312 SynTP - ok
18:30:15.0702 5312 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
18:30:15.0802 5312 SysMain - ok
18:30:15.0862 5312 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:30:15.0892 5312 TabletInputService - ok
18:30:15.0922 5312 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
18:30:15.0972 5312 TapiSrv - ok
18:30:16.0062 5312 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
18:30:16.0132 5312 TBS - ok
18:30:16.0322 5312 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
18:30:16.0372 5312 Tcpip - ok
18:30:16.0532 5312 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
18:30:16.0582 5312 TCPIP6 - ok
18:30:16.0942 5312 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
18:30:16.0992 5312 tcpipreg - ok
18:30:17.0092 5312 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
18:30:17.0122 5312 TDPIPE - ok
18:30:17.0162 5312 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
18:30:17.0492 5312 TDTCP - ok
18:30:17.0522 5312 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
18:30:17.0652 5312 tdx - ok
18:30:19.0172 5312 [ 9F3E7CABE86BBDECA009DE291DB6D9E2 ] TeamViewer8 C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
18:30:19.0292 5312 TeamViewer8 - ok
18:30:19.0382 5312 [ F5520DBB47C60EE83024B38720ABDA24 ] teamviewervpn C:\Windows\system32\DRIVERS\teamviewervpn.sys
18:30:19.0402 5312 teamviewervpn - ok
18:30:19.0442 5312 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
18:30:19.0472 5312 TermDD - ok
18:30:19.0512 5312 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
18:30:19.0602 5312 TermService - ok
18:30:19.0662 5312 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
18:30:19.0742 5312 Themes - ok
18:30:19.0832 5312 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
18:30:19.0892 5312 THREADORDER - ok
18:30:20.0002 5312 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
18:30:20.0112 5312 TrkWks - ok
18:30:20.0172 5312 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:30:20.0282 5312 TrustedInstaller - ok
18:30:20.0552 5312 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
18:30:20.0612 5312 tssecsrv - ok
18:30:20.0762 5312 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
18:30:20.0832 5312 TsUsbFlt - ok
18:30:20.0902 5312 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
18:30:20.0992 5312 tunnel - ok
18:30:21.0172 5312 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
18:30:21.0212 5312 uagp35 - ok
18:30:21.0402 5312 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
18:30:21.0492 5312 udfs - ok
18:30:21.0882 5312 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
18:30:21.0922 5312 UI0Detect - ok
18:30:21.0992 5312 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
18:30:22.0032 5312 uliagpkx - ok
18:30:22.0052 5312 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
18:30:22.0092 5312 umbus - ok
18:30:22.0132 5312 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
18:30:22.0172 5312 UmPass - ok
18:30:23.0072 5312 [ AF905F4966CFC8B973623AB150CD4B2B ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
18:30:23.0162 5312 UNS - ok
18:30:23.0242 5312 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
18:30:23.0322 5312 upnphost - ok
18:30:23.0382 5312 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\drivers\usbccgp.sys
18:30:23.0442 5312 usbccgp - ok
18:30:23.0472 5312 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
18:30:23.0522 5312 usbcir - ok
18:30:23.0572 5312 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
18:30:23.0652 5312 usbehci - ok
18:30:23.0692 5312 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
18:30:23.0732 5312 usbhub - ok
18:30:23.0742 5312 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
18:30:23.0792 5312 usbohci - ok
18:30:23.0822 5312 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
18:30:23.0912 5312 usbprint - ok
18:30:23.0962 5312 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:30:24.0002 5312 USBSTOR - ok
18:30:24.0022 5312 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
18:30:24.0062 5312 usbuhci - ok
18:30:24.0112 5312 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
18:30:24.0152 5312 usbvideo - ok
18:30:24.0182 5312 uxddrv - ok
18:30:24.0212 5312 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
18:30:24.0302 5312 UxSms - ok
18:30:24.0342 5312 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
18:30:24.0352 5312 VaultSvc - ok
18:30:24.0462 5312 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
18:30:24.0482 5312 vdrvroot - ok
18:30:24.0622 5312 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
18:30:24.0722 5312 vds - ok
18:30:24.0782 5312 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
18:30:24.0812 5312 vga - ok
18:30:24.0812 5312 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
18:30:24.0862 5312 VgaSave - ok
18:30:24.0912 5312 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
18:30:24.0932 5312 vhdmp - ok
18:30:24.0972 5312 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
18:30:24.0982 5312 viaide - ok
18:30:25.0022 5312 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
18:30:25.0032 5312 volmgr - ok
18:30:25.0082 5312 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
18:30:25.0112 5312 volmgrx - ok
18:30:25.0242 5312 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
18:30:25.0272 5312 volsnap - ok
18:30:25.0352 5312 [ 1065A957523ED51AAFFF737CC63010A6 ] Vsdatant C:\Windows\system32\DRIVERS\vsdatant.sys
18:30:25.0382 5312 Vsdatant - ok
18:30:25.0532 5312 vsmon - ok
18:30:25.0652 5312 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
18:30:25.0692 5312 vsmraid - ok
18:30:25.0902 5312 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
18:30:26.0072 5312 VSS - ok
18:30:26.0162 5312 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
18:30:26.0222 5312 vwifibus - ok
18:30:26.0262 5312 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
18:30:26.0292 5312 vwififlt - ok
18:30:26.0332 5312 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
18:30:26.0372 5312 vwifimp - ok
18:30:26.0412 5312 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
18:30:26.0492 5312 W32Time - ok
18:30:26.0552 5312 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
18:30:26.0602 5312 WacomPen - ok
18:30:26.0662 5312 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
18:30:26.0722 5312 WANARP - ok
18:30:26.0722 5312 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
18:30:26.0762 5312 Wanarpv6 - ok
18:30:26.0872 5312 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
18:30:26.0972 5312 WatAdminSvc - ok
18:30:27.0082 5312 [ 878C947C69EE89E4DBFF9DBD6155C15D ] watchmi C:\Program Files (x86)\watchmi\TvdService.exe
18:30:27.0152 5312 watchmi ( UnsignedFile.Multi.Generic ) - warning
18:30:27.0152 5312 watchmi - detected UnsignedFile.Multi.Generic (1)
18:30:27.0322 5312 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
18:30:27.0412 5312 wbengine - ok
18:30:27.0562 5312 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
18:30:27.0612 5312 WbioSrvc - ok
18:30:27.0702 5312 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
18:30:27.0782 5312 wcncsvc - ok
18:30:27.0832 5312 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:30:27.0882 5312 WcsPlugInService - ok
18:30:27.0922 5312 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
18:30:27.0952 5312 Wd - ok
18:30:28.0102 5312 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
18:30:28.0172 5312 Wdf01000 - ok
18:30:28.0252 5312 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
18:30:28.0312 5312 WdiServiceHost - ok
18:30:28.0312 5312 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
18:30:28.0332 5312 WdiSystemHost - ok
18:30:28.0402 5312 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
18:30:28.0582 5312 WebClient - ok
18:30:28.0682 5312 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
18:30:28.0772 5312 Wecsvc - ok
18:30:28.0842 5312 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
18:30:28.0912 5312 wercplsupport - ok
18:30:28.0962 5312 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
18:30:29.0032 5312 WerSvc - ok
18:30:29.0092 5312 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
18:30:29.0142 5312 WfpLwf - ok
18:30:29.0152 5312 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
18:30:29.0162 5312 WIMMount - ok
18:30:29.0202 5312 WinDefend - ok
18:30:29.0212 5312 WinHttpAutoProxySvc - ok
18:30:29.0402 5312 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
18:30:29.0502 5312 Winmgmt - ok
18:30:29.0852 5312 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
18:30:29.0962 5312 WinRM - ok
18:30:30.0042 5312 [ 4C69A8E2E159C1C59BC4B688E9DD7F8C ] WisLMSvc C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
18:30:30.0072 5312 WisLMSvc - ok
18:30:30.0122 5312 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
18:30:30.0172 5312 Wlansvc - ok
18:30:30.0322 5312 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
18:30:30.0332 5312 wlcrasvc - ok
18:30:30.0582 5312 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:30:30.0672 5312 wlidsvc - ok
18:30:30.0732 5312 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
18:30:30.0772 5312 WmiAcpi - ok
18:30:30.0812 5312 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
18:30:30.0842 5312 wmiApSrv - ok
18:30:30.0892 5312 WMPNetworkSvc - ok
18:30:30.0922 5312 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
18:30:30.0952 5312 WPCSvc - ok
18:30:30.0982 5312 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
18:30:31.0002 5312 WPDBusEnum - ok
18:30:31.0032 5312 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
18:30:31.0092 5312 ws2ifsl - ok
18:30:31.0132 5312 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
18:30:31.0182 5312 wscsvc - ok
18:30:31.0192 5312 WSearch - ok
18:30:31.0252 5312 [ 82E8F5AA03DF7DBDB8A33F700D5D8CDA ] wsvd C:\Windows\system32\DRIVERS\wsvd.sys
18:30:31.0322 5312 wsvd - ok
18:30:31.0472 5312 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
18:30:31.0552 5312 wuauserv - ok
18:30:31.0622 5312 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
18:30:31.0672 5312 WudfPf - ok
18:30:31.0712 5312 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
18:30:31.0722 5312 WUDFRd - ok
18:30:31.0762 5312 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
18:30:31.0802 5312 wudfsvc - ok
18:30:31.0832 5312 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
18:30:31.0872 5312 WwanSvc - ok
18:30:31.0922 5312 [ BAA813A76F5DB6CC3C2CEAB7D82B6972 ] X10Hid C:\Windows\System32\Drivers\x10hid.sys
18:30:31.0952 5312 X10Hid - ok
18:30:32.0002 5312 [ 5A0C788C5BC5F2C993CB60940ADCF95E ] x10nets C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe
18:30:32.0032 5312 x10nets ( UnsignedFile.Multi.Generic ) - warning
18:30:32.0032 5312 x10nets - detected UnsignedFile.Multi.Generic (1)
18:30:32.0102 5312 [ A4B2A8751A8F96134BE6063B8A759116 ] XUIF C:\Windows\System32\Drivers\x10ufx2.sys
18:30:32.0122 5312 XUIF - ok
18:30:32.0172 5312 ================ Scan global ===============================
18:30:32.0212 5312 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
18:30:32.0262 5312 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
18:30:32.0302 5312 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
18:30:32.0332 5312 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
18:30:32.0372 5312 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
18:30:32.0402 5312 [Global] - ok
18:30:32.0402 5312 ================ Scan MBR ==================================
18:30:32.0412 5312 [ 01C6AE8EADD5F5B4C22DD5848D9CB4B9 ] \Device\Harddisk0\DR0
18:30:35.0272 5312 \Device\Harddisk0\DR0 - ok
18:30:35.0272 5312 ================ Scan VBR ==================================
18:30:35.0350 5312 [ 63482BAAC3E876B1296CC32F4EF70196 ] \Device\Harddisk0\DR0\Partition1
18:30:35.0365 5312 \Device\Harddisk0\DR0\Partition1 - ok
18:30:35.0381 5312 [ 303A4178D31191FC1188CBBA559A594D ] \Device\Harddisk0\DR0\Partition2
18:30:35.0397 5312 \Device\Harddisk0\DR0\Partition2 - ok
18:30:35.0459 5312 [ B5D898746ED0A8172F3F80955A90DBE3 ] \Device\Harddisk0\DR0\Partition3
18:30:35.0490 5312 \Device\Harddisk0\DR0\Partition3 - ok
18:30:35.0490 5312 ============================================================
18:30:35.0490 5312 Scan finished
18:30:35.0490 5312 ============================================================
18:30:35.0490 5984 Detected object count: 3
18:30:35.0490 5984 Actual detected object count: 3
18:30:58.0254 5984 RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
18:30:58.0254 5984 RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:30:58.0254 5984 watchmi ( UnsignedFile.Multi.Generic ) - skipped by user
18:30:58.0254 5984 watchmi ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:30:58.0254 5984 x10nets ( UnsignedFile.Multi.Generic ) - skipped by user
18:30:58.0254 5984 x10nets ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg 31.01.2013 20:15
sehr gut
combofix:
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

markus21 31.01.2013 23:13
Keine Fehlermeldung nach Neustart :)

Combofix Logfile:
Code:
ComboFix 13-01-31.03 - User 31.01.2013  22:56:02.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3893.2065 [GMT 1:00]
ausgeführt von:: c:\users\User\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\User\AppData\Roaming\skype.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-12-28 bis 2013-01-31  ))))))))))))))))))))))))))))))
.
.
2013-01-31 22:01 . 2013-01-31 22:01        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-01-31 17:29 . 2013-01-12 02:30        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-01-30 18:38 . 2013-01-31 17:21        --------        d-----w-        c:\programdata\AVG January 2013 Campaign
2013-01-30 18:35 . 2012-11-28 17:49        35112        ----a-w-        c:\windows\system32\drivers\teamviewervpn.sys
2013-01-30 18:35 . 2013-01-30 18:35        --------        d-----w-        c:\program files (x86)\TeamViewer
2013-01-29 22:50 . 2012-08-24 18:13        154480        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2013-01-29 22:50 . 2012-08-24 18:09        458712        ----a-w-        c:\windows\system32\drivers\cng.sys
2013-01-29 22:50 . 2012-08-24 18:05        340992        ----a-w-        c:\windows\system32\schannel.dll
2013-01-29 22:50 . 2012-08-24 18:03        1448448        ----a-w-        c:\windows\system32\lsasrv.dll
2013-01-29 22:50 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll
2013-01-29 22:50 . 2012-08-24 16:57        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2013-01-29 22:50 . 2012-08-24 16:53        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2013-01-29 22:49 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll
2013-01-29 22:49 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2013-01-29 22:47 . 2013-01-29 23:00        --------        d-----w-        c:\users\User\AppData\Roaming\CheckPoint
2013-01-29 22:46 . 2013-01-29 22:46        --------        d-----w-        c:\program files\CheckPoint
2013-01-29 22:46 . 2013-01-29 22:46        --------        d-----w-        c:\programdata\CheckPoint
2013-01-29 22:41 . 2013-01-29 22:46        --------        d-----w-        c:\program files (x86)\CheckPoint
2013-01-29 21:38 . 2013-01-29 21:38        --------        d-----w-        c:\users\User\AppData\Roaming\AVG2013
2013-01-29 21:37 . 2013-01-29 21:37        --------        d-----w-        c:\users\User\AppData\Roaming\TuneUp Software
2013-01-29 21:36 . 2013-01-29 21:36        --------        d-----w-        C:\$AVG
2013-01-29 21:36 . 2013-01-29 21:38        --------        d-----w-        c:\programdata\AVG2013
2013-01-29 21:35 . 2013-01-29 21:35        --------        d-----w-        c:\program files (x86)\AVG
2013-01-29 21:32 . 2013-01-31 17:37        --------        d-----w-        c:\programdata\MFAData
2013-01-29 21:32 . 2013-01-29 23:04        --------        d-----w-        c:\users\User\AppData\Local\Avg2013
2013-01-29 21:32 . 2013-01-29 21:32        --------        d--h--w-        c:\programdata\Common Files
2013-01-29 21:32 . 2013-01-29 21:32        --------        d-----w-        c:\users\User\AppData\Local\MFAData
2013-01-29 21:31 . 2013-01-29 21:31        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service
2013-01-29 21:30 . 2013-01-29 22:13        --------        d-----w-        C:\Temp
2013-01-28 18:42 . 2013-01-28 18:42        --------        d-----w-        c:\users\User\AppData\Local\ElevatedDiagnostics
2013-01-10 14:05 . 2013-01-10 14:05        --------        d-----w-        c:\programdata\Ask
2013-01-10 14:05 . 2013-01-10 14:05        --------        d-----w-        c:\program files (x86)\Common Files\Java
2013-01-10 14:04 . 2013-01-10 14:04        779704        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2013-01-10 14:04 . 2013-01-10 14:04        859072        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-01-10 14:04 . 2013-01-31 17:29        --------        d-----w-        c:\program files (x86)\Java
2013-01-09 13:36 . 2012-11-30 05:41        424448        ----a-w-        c:\windows\system32\KernelBase.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-10 22:44 . 2012-11-11 13:36        697864        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-10 22:44 . 2012-02-26 13:25        74248        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-01-09 15:51 . 2011-02-03 17:14        67599240        ----a-w-        c:\windows\system32\MRT.exe
2012-12-16 17:11 . 2012-12-23 11:09        46080        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-23 11:09        367616        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-23 11:09        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-23 11:09        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2012-12-13 10:49 . 2011-05-07 16:51        450136        ----a-w-        c:\windows\system32\drivers\vsdatant.sys
2012-11-30 04:45 . 2013-01-09 13:36        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2012-11-15 22:33 . 2012-11-15 22:33        111968        ----a-w-        c:\windows\system32\drivers\avgmfx64.sys
2012-11-14 07:06 . 2012-12-12 18:21        17811968        ----a-w-        c:\windows\system32\mshtml.dll
2012-11-14 06:32 . 2012-12-12 18:21        10925568        ----a-w-        c:\windows\system32\ieframe.dll
2012-11-14 06:11 . 2012-12-12 18:21        2312704        ----a-w-        c:\windows\system32\jscript9.dll
2012-11-14 06:04 . 2012-12-12 18:21        1346048        ----a-w-        c:\windows\system32\urlmon.dll
2012-11-14 06:04 . 2012-12-12 18:21        1392128        ----a-w-        c:\windows\system32\wininet.dll
2012-11-14 06:02 . 2012-12-12 18:21        1494528        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-11-14 06:02 . 2012-12-12 18:21        237056        ----a-w-        c:\windows\system32\url.dll
2012-11-14 05:59 . 2012-12-12 18:21        85504        ----a-w-        c:\windows\system32\jsproxy.dll
2012-11-14 05:58 . 2012-12-12 18:21        816640        ----a-w-        c:\windows\system32\jscript.dll
2012-11-14 05:57 . 2012-12-12 18:21        599040        ----a-w-        c:\windows\system32\vbscript.dll
2012-11-14 05:57 . 2012-12-12 18:21        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-11-14 05:55 . 2012-12-12 18:21        2144768        ----a-w-        c:\windows\system32\iertutil.dll
2012-11-14 05:55 . 2012-12-12 18:21        729088        ----a-w-        c:\windows\system32\msfeeds.dll
2012-11-14 05:53 . 2012-12-12 18:21        96768        ----a-w-        c:\windows\system32\mshtmled.dll
2012-11-14 05:52 . 2012-12-12 18:21        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-11-14 05:46 . 2012-12-12 18:21        248320        ----a-w-        c:\windows\system32\ieui.dll
2012-11-14 02:09 . 2012-12-12 18:21        1800704        ----a-w-        c:\windows\SysWow64\jscript9.dll
2012-11-14 01:58 . 2012-12-12 18:21        1427968        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2012-11-14 01:57 . 2012-12-12 18:21        1129472        ----a-w-        c:\windows\SysWow64\wininet.dll
2012-11-14 01:49 . 2012-12-12 18:21        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-11-14 01:48 . 2012-12-12 18:21        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2012-11-14 01:44 . 2012-12-12 18:21        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2012-11-09 05:45 . 2012-12-12 14:01        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-11-09 04:42 . 2012-12-12 14:01        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-12-20 113288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]
"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2013-01-02 73984]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-10-3 1082144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
R3 mod7764;TV Tuner device;c:\windows\system32\DRIVERS\mod77-64.sys [2009-08-13 909408]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 uxddrv;Dynamically loaded UxdDrv;F:\uxddrv64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-10 1255736]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2010-09-23 129008]
R4 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
R4 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-12-24 25960]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-11-22 33712]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-11-22 828072]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-12-24 378984]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-10-29 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-03-04 75816]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-20 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-20 181248]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2012-11-28 35112]
S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 15896]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 30838528
*NewlyCreated* - 96277911
*Deregistered* - 30838528
*Deregistered* - 96277911
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-25 18:26        1607120        ----a-w-        c:\program files (x86)\Google\Chrome\Application\24.0.1312.56\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-11 22:44]
.
2013-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-08 15:57]
.
2013-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-08 15:57]
.
2013-01-31 c:\windows\Tasks\ROC_REG_JAN_DELETE.job
- c:\programdata\AVG January 2013 Campaign\ROC.exe [2013-01-30 21:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-03 11548264]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-11-03 2181224]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-01-26 443688]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-10 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-10 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-10 417560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.aldi.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.179.1
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\oluxndww.default\
FF - ExtSQL: 2013-01-29 23:56; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-ISW - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-01-31  23:03:31
ComboFix-quarantined-files.txt  2013-01-31 22:03
.
Vor Suchlauf: 8 Verzeichnis(se), 662.903.336.960 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 662.786.375.680 Bytes frei
.
- - End Of File - - 7AC63C2AD50DF327D43BF35C3473C602
--- --- ---

markusg 02.02.2013 20:21
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

markus21 02.02.2013 22:14
Danke Dir!

Hier das Log:

Code:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.02.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
User :: USER-PC [Administrator]

Schutz: Aktiviert

02.02.2013 21:23:27
mbam-log-2013-02-02 (21-23-27).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 365760
Laufzeit: 49 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Keine bösartigen Objekte gefunden :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:42 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131