Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trj/Dtcontx.A - cgm.exe bzw. uninx84.exe (https://www.trojaner-board.de/131929-trj-dtcontx-a-cgm-exe-bzw-uninx84-exe.html)

aoxo 08.03.2013 08:59
Trj/Dtcontx.A - cgm.exe bzw. uninx84.exe
 
Hallo,

ich habe seit ein paar Tagen ein Problem auf dem Rechner meiner Frau. Ein paar Minuten nach dem Start von Windows findet Panda Cloud einen Trojaner Dtcontx.A in der Datei cgm.exe und schiebt diese in die Quarantäne. Daraufhin meldet Windows, dass uninx84.exe nicht mehr funktionieren würde und meldet einen E/A-Fehler 105 in uninx84.de.
Die cgm.exe befand sich im Ordner cgnew in den Eigenen Dokumenten. In diesem Ordner befinden sich einige DLLs, einige TXT-Dateien und ein Ordner "bitstream"

Wenn in nun sowohl den Ordner cgnew als auch die Datei uninx84.de lösche und Windows dann neu starte, tauchen die beiden nach kurzer Zeit automatisch wieder auf und Panda schlägt wieder wegen der cgm.exe an.

Habe nun schon ein paar Tools ausprobiert (Spy Doctor etc.) aber nichts hat geholfen. Hoffe, hier weiss jemand Rat...

Danke schon einmal im vorraus...

markusg 08.03.2013 13:13
Hi
bitte nur noch das von uns gepostete einsetzen

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

aoxo 08.03.2013 14:44
Ich habe das System inzwischen mit "Anti-Malware" untersucht und er hat auch ein paar Sachen gefunden und seitdem ist das Problem auch nicht mehr aufgetreten.

Hier nun trotzdem noch die Logs:

OTL Logfile:
Code:
OTL logfile created on: 08.03.2013 14:05:16 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Didi\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 68,72% Memory free
5,98 Gb Paging File | 4,96 Gb Available in Paging File | 82,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 60,14 Gb Total Space | 6,29 Gb Free Space | 10,46% Space Free | Partition Type: NTFS
Drive D: | 405,52 Gb Total Space | 97,77 Gb Free Space | 24,11% Space Free | Partition Type: NTFS
 
Computer Name: NOTEBOOK | User Name: Didi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.08 09:01:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Didi\Downloads\OTL.exe
PRC - [2013.02.05 16:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2013.01.27 22:38:26 | 000,037,088 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe
PRC - [2013.01.27 22:38:26 | 000,032,480 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe
PRC - [2013.01.27 20:16:48 | 000,140,512 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
PRC - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.11.23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012.06.08 08:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe
PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\System32\dgdersvc.exe
PRC - [2010.09.15 09:33:32 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2009.11.13 09:30:50 | 000,486,216 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2009.11.13 09:28:44 | 001,021,256 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2009.10.30 12:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe
PRC - [2009.08.06 16:59:52 | 000,381,440 | ---- | M] (shbox.de) -- C:\Program Files\FreePDF_XP\fpassist.exe
PRC - [2008.02.27 13:35:42 | 000,498,792 | ---- | M] () -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
PRC - [2007.05.11 02:09:48 | 001,050,120 | ---- | M] (O&O Software GmbH) -- C:\Windows\System32\oodag.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\PS3 Media Server\win32\service\wrapper.exe -- (PS3 Media Server)
SRV - File not found [Disabled | Stopped] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2013.02.20 21:39:46 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.05 16:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2013.01.27 22:38:26 | 000,037,088 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe -- (PSUAService)
SRV - [2013.01.27 20:16:48 | 000,140,512 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)
SRV - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.10.18 11:07:32 | 000,084,848 | ---- | M] (Moborobo Inc.) [Auto | Stopped] -- C:\Program Files\Moborobo\MoboroboDeviceService.exe -- (MoboroboDeviceService)
SRV - [2012.09.20 13:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012.06.08 08:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice)
SRV - [2012.03.09 22:08:08 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010.11.20 13:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\System32\dgdersvc.exe -- (dgdersvc)
SRV - [2010.09.15 09:33:32 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2009.12.01 12:12:42 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2009.11.13 09:28:44 | 001,021,256 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2009.11.13 09:24:42 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2008.02.27 13:35:42 | 000,498,792 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- (TryAndDecideService)
SRV - [2008.02.27 10:42:06 | 000,427,288 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007.05.31 16:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 16:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.05.11 02:09:48 | 001,050,120 | ---- | M] (O&O Software GmbH) [Auto | Running] -- C:\Windows\System32\oodag.exe -- (O&O Defrag)
SRV - [2007.03.09 15:29:44 | 002,232,296 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe -- (AcronisOSSReinstallSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vmnetadapter.sys -- (VMnetAdapter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motusbdevice.sys -- (motusbdevice)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Motousbnet.sys -- (Motousbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motswch.sys -- (MotoSwitchService)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgpfl.sys -- (motccgpfl)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgp.sys -- (motccgp)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\motoandroid.sys -- (motandroidusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motfilt.sys -- (BTCFilterService)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (abhlsd6l)
DRV - [2013.01.09 21:45:52 | 000,095,584 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSHttps.sys -- (NNSHTTPS)
DRV - [2012.11.28 14:04:00 | 000,218,024 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSStrm.sys -- (NNSSTRM)
DRV - [2012.11.28 14:04:00 | 000,060,968 | ---- | M] (Panda Security, S.L.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\NNSPihsw.sys -- (NNSPIHSW)
DRV - [2012.11.26 16:48:51 | 000,108,200 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSSmtp.sys -- (NNSSMTP)
DRV - [2012.11.26 16:48:51 | 000,093,096 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNStlsc.sys -- (NNSTLSC)
DRV - [2012.11.26 16:48:50 | 000,286,888 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSProt.sys -- (NNSPROT)
DRV - [2012.11.26 16:48:50 | 000,159,528 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSPrv.sys -- (NNSPRV)
DRV - [2012.11.26 16:48:50 | 000,105,640 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSPop3.sys -- (NNSPOP3)
DRV - [2012.11.26 16:48:48 | 000,094,632 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSpicc.sys -- (NNSPICC)
DRV - [2012.11.26 16:48:47 | 000,123,944 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSIds.sys -- (NNSIDS)
DRV - [2012.11.26 16:48:47 | 000,119,080 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSHttp.sys -- (NNSHTTP)
DRV - [2012.11.26 16:48:46 | 000,082,728 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NNSAlpc.sys -- (NNSALPC)
DRV - [2012.11.09 19:01:19 | 000,123,944 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PSINProt.sys -- (PSINProt)
DRV - [2012.11.09 19:01:19 | 000,114,216 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\PSINProc.sys -- (PSINProc)
DRV - [2012.11.09 19:01:18 | 000,174,632 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\System32\drivers\PSINKNC.sys -- (PSINKNC)
DRV - [2012.11.09 19:00:37 | 000,149,544 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PSINAflt.sys -- (PSINAflt)
DRV - [2012.11.09 19:00:37 | 000,104,488 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\PSINFile.sys -- (PSINFile)
DRV - [2012.11.07 09:00:12 | 000,046,672 | ---- | M] (Panda Security, S.L.) [Kernel | On_Demand | Unknown] -- C:\Windows\System32\drivers\PSKMAD.sys -- (PSKMAD)
DRV - [2012.10.22 12:08:35 | 000,029,224 | ---- | M] (Panda Security, S.L.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NNSNAHSL.sys -- (NNSNAHSL)
DRV - [2012.03.14 18:57:50 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.15 09:37:40 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.09.15 09:33:32 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2010.04.19 19:29:20 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010.04.12 21:44:32 | 000,229,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2010.01.17 10:53:44 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.01.13 15:36:40 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32)
DRV - [2009.10.22 18:06:12 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\timntr.sys -- (timounter)
DRV - [2009.10.22 18:06:12 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\Windows\System32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2009.10.22 18:06:09 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\snapman.sys -- (snapman)
DRV - [2009.10.22 18:06:07 | 000,368,480 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tdrpman.sys -- (tdrpman)
DRV - [2009.10.14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.13 23:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.07.13 23:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)
DRV - [2009.07.13 23:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.04.25 10:04:28 | 000,006,144 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sioctl.sys -- (SIoctl)
DRV - [2008.02.05 00:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2008.01.18 23:43:20 | 000,131,000 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2007.11.09 04:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2007.03.31 23:00:00 | 000,119,424 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2007.02.16 01:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2007.01.24 15:27:54 | 000,039,704 | ---- | M] (Belcarra Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rcblan.sys -- (RemoteControl-USBLAN)
DRV - [2005.03.09 19:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DB DC 62 47 51 27 CA 01  [binary data]
IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local;192.168.*.*
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: adapter%40babylontc.com:1.0.0.1
FF - prefs.js..extensions.enabledAddons: fastdial%40telega.phpnet.us:3.4
FF - prefs.js..extensions.enabledAddons: ffxtlbr%40babylon.com:1.5.0
FF - prefs.js..extensions.enabledAddons: LDSI_plashcor%40gmail.com:0.7.0
FF - prefs.js..extensions.enabledAddons: ocr%40babylon.com:1.1
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.7
FF - prefs.js..extensions.enabledAddons: %7Bd10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d%7D:1.3.10
FF - prefs.js..extensions.enabledAddons: %7BDDC359D1-844A-42a7-9AA1-88A850A938A8%7D:2.0.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:3.4
FF - prefs.js..extensions.enabledItems: LDSI_plashcor@gmail.com:0.6.8
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.4: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.16: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6i: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Didi\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Didi\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.10 00:45:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.20 21:39:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.20 21:39:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
 
[2009.08.27 21:32:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Didi\AppData\Roaming\mozilla\Extensions
[2013.03.08 11:54:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Didi\AppData\Roaming\mozilla\Firefox\Profiles\tcyumvmt.default\extensions
[2011.11.10 12:42:08 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Didi\AppData\Roaming\mozilla\Firefox\Profiles\tcyumvmt.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.02.13 11:14:05 | 000,000,000 | ---D | M] (Fast Dial) -- C:\Users\Didi\AppData\Roaming\mozilla\Firefox\Profiles\tcyumvmt.default\extensions\fastdial@telega.phpnet.us
[2011.06.02 00:14:53 | 000,073,154 | ---- | M] () (No name found) -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\extensions\LDSI_plashcor@gmail.com.xpi
[2011.10.04 13:31:42 | 000,627,675 | ---- | M] () (No name found) -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.17 09:59:40 | 000,688,596 | ---- | M] () (No name found) -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2009.11.23 13:44:54 | 000,004,687 | ---- | M] () -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\searchplugins\cover-paradies.xml
[2011.11.21 16:17:11 | 000,004,873 | ---- | M] () -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\searchplugins\isohunt---bt-search.xml
[2009.09.14 22:38:06 | 000,000,913 | ---- | M] () -- C:\Users\Didi\AppData\Roaming\mozilla\firefox\profiles\tcyumvmt.default\searchplugins\torrentsto.xml
[2013.02.20 21:39:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
File not found (No name found) -- C:\USERS\DIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TCYUMVMT.DEFAULT\EXTENSIONS\ADAPTER@BABYLONTC.COM.XPI
File not found (No name found) -- C:\USERS\DIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TCYUMVMT.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM
File not found (No name found) -- C:\USERS\DIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TCYUMVMT.DEFAULT\EXTENSIONS\OCR@BABYLON.COM.XPI
[2013.02.20 21:39:49 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009.08.30 09:04:41 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2008.02.22 16:24:06 | 000,095,832 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPPDLicenseHelper.dll
[2012.05.05 18:07:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.15 10:16:09 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.05.05 18:07:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.05 18:07:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.05 18:07:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.05 18:07:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://www.google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Didi\AppData\Local\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Didi\AppData\Local\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Didi\AppData\Local\Google\Chrome\Application\25.0.1364.152\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Protect Disc License Acquisition Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPPDLicenseHelper.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll
CHR - plugin: VLC Multimedia Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - Extension: YouTube = C:\Users\Didi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Didi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\Didi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.61_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Didi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\Didi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.10.22 23:02:02 | 000,000,854 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [PSUAMain] C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe (Panda Security, S.L.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.17.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{13DAB22F-6456-4295-937A-A2231A8D5F39}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A7F1501C-823F-4A6C-BF6E-56391AA6D458}: DhcpNameServer = 193.189.244.225 193.189.244.206
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - C:\Windows\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{b7c72d84-bf47-11de-ab97-001e3368ec5e}\Shell - "" = AutoRun
O33 - MountPoints2\{b7c72d84-bf47-11de-ab97-001e3368ec5e}\Shell\AutoRun\command - "" = "G:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: BDRegion - hkey= - key= -  File not found
MsConfig - StartUpReg: PDVD9LanguageShortcut - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.08 11:55:50 | 000,046,672 | ---- | C] (Panda Security, S.L.) -- C:\Windows\System32\drivers\PSKMAD.sys
[2013.03.08 09:49:06 | 000,000,000 | ---D | C] -- C:\Users\Didi\AppData\Roaming\Malwarebytes
[2013.03.08 09:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.03.08 09:48:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.03.08 09:48:43 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.03.08 09:48:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.03.08 09:43:43 | 000,000,000 | ---D | C] -- C:\Users\Didi\AppData\Roaming\GoforFiles
[2013.03.08 09:11:42 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.03.07 14:47:19 | 000,000,000 | ---D | C] -- C:\Users\Didi\Documents\ProcAlyzer Dumps
[2013.03.07 14:45:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.03.07 14:44:46 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013.03.07 14:44:19 | 000,000,000 | ---D | C] -- C:\Users\Didi\AppData\Local\Programs
[2013.03.07 14:16:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.03.07 14:09:04 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.03.07 14:08:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2013.03.07 11:40:57 | 000,000,000 | ---D | C] -- C:\Users\Didi\AppData\Roaming\QuickScan
[2013.03.06 06:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Cloud Antivirus
[2013.02.20 21:39:35 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.19 13:53:18 | 000,000,000 | ---D | C] -- C:\Users\Didi\.gstreamer-0.10
[2013.02.19 13:45:54 | 000,000,000 | ---D | C] -- C:\Users\Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DreamStream-E2
[2013.02.19 13:45:54 | 000,000,000 | ---D | C] -- C:\Users\Didi\.dreamstream
[2013.02.19 13:45:47 | 000,000,000 | ---D | C] -- C:\Program Files\DreamStream-E2
[2013.02.09 15:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.02.06 19:19:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.06 19:19:25 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.06 19:19:25 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.06 19:19:25 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.02.06 19:16:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.02.06 19:16:20 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.08 13:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.08 13:24:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001UA.job
[2013.03.08 13:24:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001Core.job
[2013.03.08 12:00:39 | 000,023,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.08 12:00:39 | 000,023,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.08 11:55:41 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.08 11:55:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.08 11:55:23 | 2408,026,112 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.08 11:55:22 | 000,521,664 | ---- | M] () -- C:\Windows\System32\oodbs.lor
[2013.03.08 11:50:36 | 000,751,030 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.03.08 11:50:36 | 000,695,938 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.03.08 11:50:36 | 000,165,652 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.03.08 11:50:36 | 000,135,304 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.03.08 11:24:02 | 007,069,714 | ---- | M] () -- C:\Users\Didi\Documents\explor.temp
[2013.03.08 09:51:34 | 000,597,667 | ---- | M] () -- C:\Users\Didi\Desktop\adwcleaner.exe
[2013.03.08 09:48:46 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.03.07 15:40:18 | 000,008,324 | ---- | M] () -- C:\Windows\wininit.ini
[2013.03.06 11:31:27 | 000,482,200 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.02.19 13:47:21 | 000,001,021 | ---- | M] () -- C:\Users\Public\Desktop\DreamStream E2.lnk
[2013.02.19 13:47:21 | 000,001,021 | ---- | M] () -- C:\Users\Didi\Application Data\Microsoft\Internet Explorer\Quick Launch\DreamStream E2.lnk
[2013.02.09 15:51:11 | 000,002,011 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.02.09 15:51:11 | 000,002,011 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.02.06 19:19:59 | 000,001,760 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.02.06 19:16:28 | 000,001,822 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
 
========== Files Created - No Company Name ==========
 
[2013.03.08 09:51:33 | 000,597,667 | ---- | C] () -- C:\Users\Didi\Desktop\adwcleaner.exe
[2013.03.08 09:48:46 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.03.07 15:40:17 | 000,008,324 | ---- | C] () -- C:\Windows\wininit.ini
[2013.02.19 13:47:21 | 000,001,021 | ---- | C] () -- C:\Users\Public\Desktop\DreamStream E2.lnk
[2013.02.19 13:47:21 | 000,001,021 | ---- | C] () -- C:\Users\Didi\Application Data\Microsoft\Internet Explorer\Quick Launch\DreamStream E2.lnk
[2013.02.06 19:19:59 | 000,001,760 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.02.06 19:16:28 | 000,001,822 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.09.12 23:15:05 | 000,000,000 | ---- | C] () -- C:\ProgramData\0x0304A000.sfl
[2012.09.10 15:01:17 | 000,007,605 | ---- | C] () -- C:\Users\Didi\AppData\Local\Resmon.ResmonCfg
[2012.07.09 14:40:35 | 000,000,600 | ---- | C] () -- C:\Users\Didi\AppData\Roaming\winscp.rnd
[2011.12.07 11:44:16 | 000,000,853 | ---- | C] () -- C:\Windows\wiso.ini
[2011.12.01 11:17:21 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.12.01 11:10:24 | 000,000,275 | ---- | C] () -- C:\Users\Didi\AppData\Local\HamsterVideoConverterSettings.cfg
[2011.09.27 11:17:26 | 000,198,144 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2011.09.27 11:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\System32\LxDNT100.dll
[2011.09.27 11:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\System32\LxDNTvmc100.dll
[2011.09.27 11:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\System32\LxDNTvm100.dll
[2011.05.19 10:16:50 | 000,033,792 | ---- | C] () -- C:\Windows\System32\drivers\libusb0.sys
[2011.05.10 00:28:10 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.04.25 00:29:15 | 000,158,720 | ---- | C] () -- C:\Windows\System32\WS_VideoConverterContextMenu.dll
[2010.10.25 18:58:25 | 000,004,096 | -H-- | C] () -- C:\Users\Didi\AppData\Local\keyfile3.drm
[2010.04.16 08:41:12 | 000,000,156 | -H-- | C] () -- C:\Users\Didi\AppData\Roaming\eSReg.ini
[2009.12.17 01:56:52 | 000,005,120 | ---- | C] () -- C:\Users\Didi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.01 12:57:34 | 000,000,600 | ---- | C] () -- C:\Users\Didi\AppData\Local\PUTTY.RND
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.11.09 16:51:37 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\.trackballs
[2010.03.12 19:55:38 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Ancient Quest of Saqqarah__intenium
[2011.12.05 10:13:42 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\BitTorrent
[2010.01.30 14:17:42 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\BonkEnc
[2011.12.14 09:50:39 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Buhl Data Service
[2009.11.10 20:07:03 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Buhl Data Service GmbH
[2011.12.17 12:30:07 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Canneverbe Limited
[2012.08.14 14:45:17 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Canon
[2009.10.01 20:43:17 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\CD-LabelPrint
[2011.12.07 11:40:12 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\DAEMON Tools Lite
[2009.11.10 20:09:01 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\DataDesign
[2011.01.16 20:19:30 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\DataLayer
[2011.09.23 01:42:48 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\DiskAid
[2012.01.23 23:55:06 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\EAC
[2011.12.07 11:27:24 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\elsterformular
[2012.01.20 16:36:44 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Extensible XML Editor
[2011.11.16 09:35:01 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\FileZilla
[2009.10.05 11:02:07 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\FlashFXP
[2012.10.18 06:37:06 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\foobar2000
[2009.08.30 09:05:00 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Foxit
[2009.12.01 16:53:04 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Foxit Software
[2012.07.14 09:10:38 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\GARMIN
[2013.03.08 09:43:51 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\GoforFiles
[2012.09.08 23:13:30 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\GrabIt
[2009.12.14 11:36:27 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\ImgBurn
[2012.08.12 11:40:39 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\IrfanView
[2012.11.20 14:53:35 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\IT-Service Christian Hau (www.a-bit-more.de)
[2012.05.26 09:00:56 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\JAM Software
[2011.09.15 13:05:31 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Jason Robitaille
[2009.11.30 16:33:43 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Leadertech
[2010.11.03 16:14:13 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Lexware
[2012.06.02 00:01:21 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\MAGIX
[2010.01.27 20:46:05 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\mC2
[2012.09.08 11:05:40 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\MediaMonkey
[2012.01.03 00:40:15 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\MotioninJoy
[2012.10.15 21:51:54 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Motorola
[2012.10.15 21:54:43 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Motorola Mobility
[2012.10.24 09:30:33 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Mp3tag
[2010.04.16 08:51:20 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\NAVI
[2011.01.16 21:31:05 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Nokia
[2011.11.16 09:41:50 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Notepad++
[2010.02.27 11:44:23 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\OpenOffice.org
[2010.01.24 11:49:06 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Opera
[2012.06.04 09:26:54 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Panda Security
[2011.01.16 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\PC Suite
[2009.12.17 18:09:30 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Pegasys Inc
[2013.03.07 11:40:59 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\QuickScan
[2012.04.06 14:41:12 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\redsn0w
[2010.01.27 19:55:51 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\rockbox.org
[2010.10.18 12:11:59 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Samsung
[2009.11.19 16:10:29 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\ScreeNet iSaver
[2009.09.15 00:05:14 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\SharePod
[2010.07.06 20:29:02 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Sony
[2009.12.12 18:11:12 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\ThumbGen
[2009.10.03 17:13:19 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\TuneUp Software
[2012.12.07 13:02:38 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\UseNeXT
[2012.07.18 11:38:11 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\uTorrent
[2011.01.04 20:40:22 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Windows Home Server
[2012.10.15 19:23:54 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\WindSolutions
[2011.04.24 22:10:09 | 000,000,000 | ---D | M] -- C:\Users\Didi\AppData\Roaming\Xilisoft Corporation
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2009.12.14 13:39:48 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.04.10 11:03:45 | 000,000,000 | -H-D | M] -- C:\CanoScan
[2013.03.08 09:18:37 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.08.02 17:26:20 | 000,000,000 | ---D | M] -- C:\games
[2011.01.16 20:58:54 | 000,000,000 | ---D | M] -- C:\Garmin
[2009.12.12 00:50:51 | 000,000,000 | ---D | M] -- C:\inetpub
[2012.03.06 14:00:08 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013.03.08 09:50:04 | 000,000,000 | R--D | M] -- C:\Program Files
[2013.03.08 11:54:03 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009.08.27 20:49:19 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.01.16 15:24:40 | 000,000,000 | ---D | M] -- C:\SWSetup
[2013.03.08 14:07:12 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.10.22 23:19:51 | 000,000,000 | ---D | M] -- C:\temp
[2011.06.04 11:22:04 | 000,000,000 | R--D | M] -- C:\Users
[2013.03.08 09:18:53 | 000,000,000 | ---D | M] -- C:\Windows
[2013.03.08 09:11:42 | 000,000,000 | ---D | M] -- C:\_OTL
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2010.11.20 13:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2011.04.08 16:40:06 | 000,000,880 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011.04.08 16:40:07 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2011.11.25 08:19:01 | 000,001,064 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001Core.job
[2011.11.25 08:19:01 | 000,001,116 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001UA.job
[2012.12.25 08:42:01 | 000,000,634 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.12.14 16:49:28 | 000,216,424 | ---- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.01.17 10:53:44 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2013.03.08 14:10:15 | 005,767,168 | -HS- | M] () -- C:\Users\Didi\NTUSER.DAT
[2013.03.08 14:10:15 | 000,262,144 | -HS- | M] () -- C:\Users\Didi\ntuser.dat.LOG1
[2009.08.27 20:49:36 | 000,000,000 | -HS- | M] () -- C:\Users\Didi\ntuser.dat.LOG2
[2009.08.27 20:59:53 | 000,065,536 | -HS- | M] () -- C:\Users\Didi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2009.08.27 20:59:53 | 000,524,288 | -HS- | M] () -- C:\Users\Didi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2009.08.27 20:59:53 | 000,524,288 | -HS- | M] () -- C:\Users\Didi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2009.08.27 20:49:36 | 000,000,020 | -HS- | M] () -- C:\Users\Didi\ntuser.ini
[2011.09.19 23:13:44 | 001,085,952 | -HS- | M] () -- C:\Users\Didi\Thumbs.db
[2012.10.22 22:41:51 | 000,000,216 | ---- | M] () -- C:\Users\Didi\umbrella0.log
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
[2013.03.08 09:43:06 | 006,220,936 | ---- | M] (hxxp://www.goforfiles.com/) -- C:\Users\Didi\Local Settings\Temp\uninstall1894912.exe
[2013.03.08 09:43:45 | 000,901,712 | ---- | M] (hxxp://goforfiles.com/) -- C:\Users\Didi\Local Settings\Temp\uninstall1902400.exe
[2013.03.08 09:43:44 | 000,947,200 | ---- | M] (Terra Informatica Software, Inc., British Columbia, Canada.) -- C:\Users\Didi\Local Settings\Temp\uninstall1903633.exe
[4 C:\Users\Didi\Local Settings\Temp\*.tmp files -> C:\Users\Didi\Local Settings\Temp\*.tmp -> ]
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
[2013.03.08 09:49:58 | 000,947,200 | ---- | M] (Terra Informatica Software, Inc., British Columbia, Canada.) -- C:\Users\Didi\Local Settings\Temp\htmlayout.dll
[4 C:\Users\Didi\Local Settings\Temp\*.tmp files -> C:\Users\Didi\Local Settings\Temp\*.tmp -> ]
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 70 bytes -> C:\Users\Didi\Documents\TelephoneList1.xlsx:com.apple.quarantine
@Alternate Data Stream - 64 bytes -> C:\Users\Didi\Documents\Anmeldung.pdf:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Users\Didi\Documents\ynwa konto.ods:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Users\Didi\Documents\Ausweis2.JPG:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Users\Didi\Documents\Ausweis1.JPG:AFP_AfpInfo
@Alternate Data Stream - 286 bytes -> C:\Users\Didi\Documents\YNWA Mailverteiler.doc:AFP_Resource
@Alternate Data Stream - 199 bytes -> C:\Users\Didi\Documents\TelephoneList1.xlsx:com.apple.metadatakMDItemWhereFroms

< End of report >
--- --- ---

aoxo 08.03.2013 14:45
Und der Extras-Log:

OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 08.03.2013 14:05:16 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Didi\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 68,72% Memory free
5,98 Gb Paging File | 4,96 Gb Available in Paging File | 82,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 60,14 Gb Total Space | 6,29 Gb Free Space | 10,46% Space Free | Partition Type: NTFS
Drive D: | 405,52 Gb Total Space | 97,77 Gb Free Space | 24,11% Space Free | Partition Type: NTFS
 
Computer Name: NOTEBOOK | User Name: Didi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.js [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
.txt [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Users\Steph\Saturn Fotoservice\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Saturn Fotoservice] -- "C:\Users\Steph\Saturn Fotoservice\Saturn Fotoservice.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files\Moborobo\update.exe" = C:\Program Files\Moborobo\update.exe:*:Enabled:update.exe -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files\Moborobo\update.exe" = C:\Program Files\Moborobo\update.exe:*:Enabled:update.exe -- ()
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03769FD5-4B3E-4DEC-A2C5-1D6549B37F8E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{066C28AF-A39B-4128-9DB2-F18BB7228281}" = lport=139 | protocol=6 | dir=in | app=system |
"{06D26768-81C0-44D4-B6FB-DDFBF4320DC4}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{0E86BDF7-9047-4558-ACB1-F055C4D3948B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{1254EE44-6555-40D2-ABE4-9C2BBC3E6E25}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1483F9A5-E554-4111-ADD1-BF50AAA483EB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{16FB9152-AA5E-47B7-9AF5-3D22DC422D89}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1896A745-3EBF-4B31-A0FE-75AC9676D02F}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1B144508-7822-46B0-9B73-581E38743A0D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1E7E1D56-B03A-4351-AC3A-D549E73854C1}" = rport=139 | protocol=6 | dir=out | app=system |
"{26FE380D-61F2-4542-8DC3-8D88FE905792}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2FDCE793-2ED2-49B8-91BB-FDB9B62BA501}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{3404B012-39D2-45C4-829C-970184698B50}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{369F6E68-82A3-4CB6-B156-F6AF3BC57744}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{383367D9-3797-42F1-870C-C3F4B530A5CE}" = lport=138 | protocol=17 | dir=in | app=system |
"{38CCD247-91E8-49BA-B94D-5F84DA07E73B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{425ED5FC-7ADE-4613-B769-BB0EFD33B3BF}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{42ECFBDC-B337-4553-B6F2-9DDCB2AFB593}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{467BAF66-C143-47AE-A81A-69E2F82A3FA9}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{493B1DA6-89A5-4954-9945-FA710C61C617}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{4968BC18-0F58-4A96-8C16-855B74FD98DC}" = rport=445 | protocol=6 | dir=out | app=system |
"{4AED070D-F470-4BAC-AD1A-E4C4E2630F0B}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{4AF14A29-5BE4-4CE1-9D7B-AB693C65AF4B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{52DDA3E1-90AE-4A12-A97D-440836564F49}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{52E01B6B-6454-4BFB-BBA4-0A7890B2950D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5712E287-BB67-4941-A87C-A0F93C7E463D}" = lport=137 | protocol=17 | dir=in | app=system |
"{57E7AC41-C794-477C-8FA7-790029EFB4A4}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{6297BA6E-0EE2-466E-BF8C-2FDD0BFE7E50}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6FEE82E3-1BC9-46FC-9B2F-5BF2B746A2B2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{73BB27B1-A174-4126-BE56-54FEC9B07DB1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{85C96875-28EA-44FA-887E-14B7BE71275C}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{89E125EB-A3FB-49A4-83B4-5F3CB716E400}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{8E0B1166-CC5A-4140-BEF2-9EF1F21778DC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8F9D9679-22F6-4DD1-8FF8-1341FA6A8A38}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{96A38BF9-3C4A-4927-8984-79E4BBD95A57}" = lport=10243 | protocol=6 | dir=in | app=system |
"{97F7D24E-28F5-436B-8193-CC4888F8F4EB}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9B627EB2-1CE4-433D-8C8B-509C7910397E}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{9C60F824-8ED7-40A2-97E2-1DC2BB0B474D}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A84D4AAF-CCDF-429D-B678-0E60E901B38E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AEEABC0A-C125-4853-B271-EB0F53EAA6C9}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{AFEC8D27-6003-405E-8C4A-9DF6FFEF6040}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{C01EA318-694A-4066-AA95-C1CBBED79304}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C517BE4A-1EB5-4841-A93B-40593DCFE064}" = lport=445 | protocol=6 | dir=in | app=system |
"{C6EBA23F-4A74-4D87-9AFF-7F064B0033BE}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{C7CE1BEE-BE7C-4A69-81FE-3261EEE197FB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CC62513C-4EFB-4AC9-AD7E-31359099D703}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{CDB23938-725F-4975-9151-006C02AAC6AA}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D76409C9-B2C4-414C-B73E-052AA4730FB0}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{D83580BF-0EE1-4E1A-AEF2-450CCABBFC24}" = rport=138 | protocol=17 | dir=out | app=system |
"{DB0E5D51-E0CC-422F-8183-A6152047DDE7}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E5989789-F300-468E-BFFA-A335F83F85CF}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{F50C9464-E51D-473E-B233-D15A675B449F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FB32E743-2557-424E-B3A5-CFFF6287FA34}" = rport=137 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04C97483-9BAC-4E8D-A1B9-0FD1E7EE51F8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0562CFC6-016B-4545-90BF-8F353B991315}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0936196B-8C2A-4DDB-B79E-B1CEF4E1DE1D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{0D27F5CB-AD7F-47B7-AE2E-7B56521289C2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{102FE6A3-88FE-4C2E-808A-F271CD4A54CF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{17E8E674-1E09-482B-AAEB-AB17BB10276A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{18458573-BF32-461F-9424-F65133310B67}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{202FC892-E70A-48AD-96BE-3E16CDF9A805}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2327AE9B-6DB1-4473-8F87-3088CCC4D39B}" = protocol=6 | dir=in | app=c:\users\didi\documents\clarke-tech\dcc_e2.exe |
"{264A3BE8-9865-4500-97C0-73523D5745FD}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2B9062C9-6CAB-4D00-9D56-4871F2C64E42}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3170BC83-4A6B-4034-9D29-C0720C5766E5}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{325580C1-7FDA-4682-ADC9-159DDCC1422E}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{32762D06-69BB-4B87-B2E1-E27EB1B513C5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{48F9E887-A014-44E0-B25D-4E77E1935157}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{4AD8EB5D-4CDB-4394-A377-C3AA4B661018}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{4CEEA611-A9B0-4730-BEEC-497F63D82396}" = protocol=6 | dir=in | app=c:\program files\pumpkin tftp\pumpkin.exe |
"{5167DD1D-9952-40BB-88FC-E8D4CCBE6E93}" = protocol=6 | dir=in | app=c:\program files\tftpd32\tftpd32.exe |
"{517949B8-F95B-4D93-ACB9-BCB4C37B20C8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{53CC2391-4A2B-434D-8562-9434C438543C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{55DB3CEF-0187-4075-AE12-AB51B118CA2D}" = protocol=17 | dir=in | app=c:\program files\goforfiles\goforfilesdl.exe |
"{580AED85-52AC-4229-9C41-9DAC2526C499}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5BFF38AB-EC48-409F-A3F6-B26BDFA33BBF}" = protocol=17 | dir=in | app=c:\users\didi\documents\clarke-tech\dcc_e2.exe |
"{5C27A0B9-A91F-49F8-B570-BF02C582E7A5}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{5D38BBCE-83E0-496B-BA01-E43983BDAC74}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6570931E-CD9F-495F-82D7-1D748D05944D}" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"{6AB52CDA-4209-4DCF-9096-49DF5D90949D}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{6BCFA078-F19B-409A-AD2E-FD6A00721ABB}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{6DBBC2EE-231C-4A59-9882-D04B86B79540}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{6EDD0971-FB9D-4D6E-9E8F-0E12CABD0A1C}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{700098C1-7C04-4CD0-A13C-CA1973F98810}" = dir=in | app=c:\program files\moborobo\update.exe |
"{706AF2EE-5657-4B94-91E2-3AFD4ECD9B23}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{71F8E159-A4D6-4736-869D-22BCF24AB96B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{76942A69-3864-4F1A-881E-4913EC5A94D6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{78115A68-4FA7-4BB6-8661-8C4D49EF75A5}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{7CA674D9-EAFB-4EFE-ADCB-DB45F130B1E2}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{81E6628B-641C-4B32-88FF-109C2177F1D2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{81EB8DF8-4A74-4FA8-8494-B57F2ACF8BEE}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{882715EA-FF55-4CB9-B006-1FB0B632248A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{88E4B5C6-E562-4F7B-8C36-32B2AE632B53}" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"{8C543AD4-929F-49E1-BE0D-B1D362B72090}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{8CA45B1B-0726-4E28-826E-44B8F6856EC6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{926ECFEC-81A2-44C0-9224-6720E239D5E7}" = protocol=17 | dir=in | app=c:\users\didi\documents\clarke-tech\dreamset\dreamset.exe |
"{92C3704F-2014-4D48-91DE-1590F12B45D6}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9EA277BF-2E94-4025-A2AB-8A6CC4DD956F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9F1412E5-6E3A-410C-A87E-007207AF95A4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9FA29617-6625-4D46-A3D1-AB296D1D4C9F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A05A9CB4-1CA6-4766-BF9B-ECDA76AB6467}" = protocol=17 | dir=in | app=c:\program files\pumpkin tftp\pumpkin.exe |
"{A0D08F2F-9AAB-42C5-AA2B-B23079069CA5}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A283D1EF-8638-470B-A010-FA61581D7FC0}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{A2B5A634-F699-471C-AB5F-54716397BD64}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A46A9759-1711-44B1-BBE9-63E22AEAF1D5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A66607FB-07F9-4100-BD41-8DFD979B1D0D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A6CCB998-C29C-45D2-8747-B66CBC37F1BC}" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"{A77DED43-3B1E-4B8D-86D7-AAF9B62521FE}" = protocol=6 | dir=in | app=c:\users\didi\documents\clarke-tech\dreamset\dreamset.exe |
"{A7CA60B4-ADD5-43D2-ADA9-0667FC5DC309}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{AADCD750-82CC-4E09-BA23-C478E1F74973}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{AB41A10A-719B-4EDB-A4A8-A0FF6A64F5E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AC73C9F2-B1AE-40E8-8020-8CABDAE89F76}" = protocol=6 | dir=in | app=c:\program files\goforfiles\goforfiles.exe |
"{AC983AC3-870C-4B0B-A142-BCECD5A97E74}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{B078C05F-9349-494A-A761-A416F25313A5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B2A4FB31-BF6C-4544-8963-FFE6C51BD268}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B2AF1107-9930-4641-A0DB-4764552ED7F8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{B45EE5E5-712D-4C96-AF6F-FFCD06380BD2}" = protocol=6 | dir=out | app=system |
"{B5843151-E328-48C7-9106-CB4DABD8F3AC}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{B90B5425-6579-4A65-8288-BBD4B0933921}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{BAFE8DD0-BDC5-4797-A9A5-2AD1D0F82C67}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BB2DEFC1-B811-46E0-A6DF-C5B43B022241}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BD5039A8-6657-411D-9E8C-36EEB37B7467}" = protocol=6 | dir=in | app=c:\program files\goforfiles\goforfilesdl.exe |
"{CC91E72B-BDFF-4E42-9BEA-BAC558F2DA89}" = protocol=17 | dir=in | app=c:\program files\goforfiles\goforfiles.exe |
"{D8285D44-FE32-4509-9416-9C5BA63625DB}" = protocol=17 | dir=in | app=c:\program files\tftpd32\tftpd32.exe |
"{DCE70B69-8196-4A0E-AF3D-A25CBE304CB5}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{DDEBF5B2-4E59-40E4-B166-1EF831615E76}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{DF1682E0-C052-429C-86B8-E142C2660906}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E1D79507-99FB-481A-877F-0B52DCDAC778}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{EABC9899-0BD0-4DC7-B743-3949DAA48552}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{EC65F0CD-E6A0-4999-BA3D-7619CF79A0E6}" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"{EFCF98DF-A117-460B-8EAC-EED06A057F87}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F74609D1-B71A-4582-8065-271536A2A2DE}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{FDB29D04-37ED-4521-9CFE-24421CE1920C}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"TCP Query User{01B7EDB7-366C-41AF-A6D1-702C577AA651}C:\program files\moborobo\update.exe" = protocol=6 | dir=in | app=c:\program files\moborobo\update.exe |
"TCP Query User{24D24318-AA56-48B4-956B-752B4A7817E1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{267D6237-66F4-417E-9E81-6BDAE0F43810}C:\users\didi\documents\clarke-tech\dreamset\dreamset.exe" = protocol=6 | dir=in | app=c:\users\didi\documents\clarke-tech\dreamset\dreamset.exe |
"TCP Query User{43151598-859A-4EF7-A819-68457F9C5790}C:\users\didi\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\didi\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{50D45FDB-0F54-4B67-AFB4-E3506C8B475C}C:\program files\dreamstream-e2\dreamstream.exe" = protocol=6 | dir=in | app=c:\program files\dreamstream-e2\dreamstream.exe |
"TCP Query User{539C7AB5-6A70-488A-A532-48A13AAF57F0}C:\users\didi\documents\clarke-tech\dcc_e2.exe" = protocol=6 | dir=in | app=c:\users\didi\documents\clarke-tech\dcc_e2.exe |
"TCP Query User{84835865-34C6-4CE3-AA88-17981EA2D10E}C:\program files\qnap\finder\finder.exe" = protocol=6 | dir=in | app=c:\program files\qnap\finder\finder.exe |
"TCP Query User{9DE1284C-F2CA-4EFD-B9C8-4F2E1B2C55E8}C:\program files\pumpkin tftp\pumpkin.exe" = protocol=6 | dir=in | app=c:\program files\pumpkin tftp\pumpkin.exe |
"TCP Query User{ED3B22FD-BC9B-4615-B41D-6279CF8D7E72}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{2CEAC04E-D573-423B-A8A1-105F471C025E}C:\program files\dreamstream-e2\dreamstream.exe" = protocol=17 | dir=in | app=c:\program files\dreamstream-e2\dreamstream.exe |
"UDP Query User{411CCB7E-07DC-4EEA-9D99-94A3E067A931}C:\users\didi\documents\clarke-tech\dcc_e2.exe" = protocol=17 | dir=in | app=c:\users\didi\documents\clarke-tech\dcc_e2.exe |
"UDP Query User{6905F158-5E75-4B2C-9B16-46ECBD8C971D}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{AD1FC839-DFDE-4555-B919-C00FF0AF1F8A}C:\program files\qnap\finder\finder.exe" = protocol=17 | dir=in | app=c:\program files\qnap\finder\finder.exe |
"UDP Query User{B10BFBD7-32C3-463D-9CDB-470BC16E500D}C:\program files\moborobo\update.exe" = protocol=17 | dir=in | app=c:\program files\moborobo\update.exe |
"UDP Query User{C3288841-5990-4987-9E0B-12B4263FAC71}C:\users\didi\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\didi\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{CAA44CF9-48E4-458D-AE9C-C2E4DD0417D2}C:\users\didi\documents\clarke-tech\dreamset\dreamset.exe" = protocol=17 | dir=in | app=c:\users\didi\documents\clarke-tech\dreamset\dreamset.exe |
"UDP Query User{CDFFBDC4-3A0D-4643-A7CC-80D70706A958}C:\program files\pumpkin tftp\pumpkin.exe" = protocol=17 | dir=in | app=c:\program files\pumpkin tftp\pumpkin.exe |
"UDP Query User{EB5DA929-2EF9-44D8-927D-B3D01B7D5C61}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02B934E4-C574-4605-842B-01CD16295185}_is1" = Moborobo 2.0.7.501
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID-Anmelde-Assistent
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2300EE96-0A41-4FAB-BD03-989EC44577A0}" = Acronis*Disk Director Suite
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{31E8F586-4EF7-4500-844D-BA8756474FF1}" = Windows Automated Installation Kit
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{423A9ABA-E167-42F4-9715-485F17843750}" = Panda Cloud Antivirus
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{4448ABF6-786D-4C3D-A49D-7BB237E6DD17}" = Foxit PDF IFilter
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53480330-E1D1-41CA-B8F8-7F78644F7F50}" = O&O Defrag Professional Edition
"{55B4F525-9768-40A8-85B7-78229144B883}" = O&O SafeErase
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{5DDB3393-E08B-447E-925F-6C00B95D0FE7}" = iCloud
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0
"{633A06C3-B709-479A-AAB3-5EE94AD9EE4B}" = Acronis*True*Image*Home
"{65A5E87D-7A3F-4819-807D-B86990D5F369}" = inSSIDer
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97D23E68-AF01-4B69-B31E-7DFC209D01F3}" = Essential XML Editor
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B0261E53-B6F1-474A-864B-E7C3CBF468E0}" = iTunes
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B860298B-CE03-4DE2-B92E-422F2C20A2D8}_is1" = PDF-XChange Lite 4
"{BCE46757-7674-4416-BEDB-68205A60409E}" = CanoScan Toolbox Ver4.1
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D3A80508-CD83-4CA3-8671-914A1BC78B61}" = Microsoft Sync Framework 2.0 Provider Services (x86) ENU
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E8033CB5-A8DF-47B3-BDE9-1796626994C6}" = Lexware faktura+auftrag 2012
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FBD7A67D-D700-4043-B54F-DD106D00F308}" = LameXP
"{FF63121D-91C6-42CC-B341-F1AA729728E7}" = Microsoft Sync Framework 2.0 Core Components (x86) ENU
"845CCCCA-B77C-43EA-9A43-62DACEA4F902" = DreamStream E2
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Alt.Binz" = Alt.Binz 0.39.4
"CANONIJINBOXADDON100" = Canon Inkjet Printer Driver Add-On Module
"CCleaner" = CCleaner
"CCS64 V3.6" = CCS64 V3.6
"CloneCD" = CloneCD
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup" = DivX-Setup
"DreamBoxEdit" = DreamBoxEdit -- The one and only settings editor for your Dreambox
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"ElsterFormular 12.4.0.7094p" = ElsterFormular
"Exact Audio Copy" = Exact Audio Copy 1.0beta3
"FLAC" = FLAC 1.2.1b (remove only)
"foobar2000" = foobar2000 v0.9.6.3
"Fotosizer" = Fotosizer 1.35
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF (Remove only)
"Freeware Faktura" = Freeware Faktura 2012.04.20
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ImgBurn" = ImgBurn
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.52
"Mystery P.I. Stolen in San Francisco 1.00" = Mystery P.I. Stolen in San Francisco 1.00
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Online Games Manager" = Online Games Manager v1.10
"Panda Universal Agent Endpoint" = Panda Cloud Antivirus
"QNAP_FINDER" = QNAP Finder
"QuickPar" = QuickPar 0.9
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SABnzbd" = SABnzbd 0.7.4
"Saturn Fotoservice" = Saturn Fotoservice
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TreeSize Free_is1" = TreeSize Free V2.7
"TuneUp Utilities" = TuneUp Utilities
"UseNeXT_is1" = UseNeXT
"uTorrent" = µTorrent
"VLC media player" = VideoLAN VLC media player 0.8.6i
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.3.8
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"d734575cd6cff35b" = Stegano.Net
"Essential XML Editor" = Essential XML Editor
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 06.03.2012 10:44:35 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:35 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:36 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:36 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:39 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:45 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 10:44:50 | Computer Name = Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 06.03.2012 13:27:03 | Computer Name = Notebook | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 10.0.2.4428 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: cc8    Startzeit:
01ccfbbe0d49d982    Endzeit: 47    Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe

Berichts-ID:
 94fcb659-67b1-11e1-bc34-001e3368ec5e 
 
Error - 08.03.2012 01:18:47 | Computer Name = Notebook | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common
 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei
 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.
Der
 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
Error - 09.03.2012 11:39:24 | Computer Name = Notebook | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common
 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei
 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.
Der
 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
[ System Events ]
Error - 07.03.2013 06:36:46 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Moborobo Device Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 07.03.2013 08:11:24 | Computer Name = Notebook | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 07.03.2013 08:19:27 | Computer Name = Notebook | Source = VDS Basic Provider | ID = 33554433
Description =
 
Error - 07.03.2013 08:40:33 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Moborobo Device Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 08.03.2013 01:32:02 | Computer Name = Notebook | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 08.03.2013 04:11:43 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 08.03.2013 04:19:18 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Moborobo Device Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 08.03.2013 04:29:23 | Computer Name = Notebook | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 08.03.2013 06:46:41 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Moborobo Device Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 08.03.2013 06:56:02 | Computer Name = Notebook | Source = Service Control Manager | ID = 7034
Description = Dienst "Moborobo Device Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
 
< End of report >
--- --- ---

markusg 08.03.2013 18:55
warum fragt man nach Hilfe und macht dann doch was ganz anderes vorher?
Malwarebytes log fehlt.
http://www.trojaner-board.de/125889-...en-posten.html
lässt sich sonst schlecht auswerten :-)

aoxo 09.03.2013 01:04
Zitat:
Zitat von markusg (Beitrag 1025782)
warum fragt man nach Hilfe und macht dann doch was ganz anderes vorher?
Malwarebytes log fehlt.
http://www.trojaner-board.de/125889-...en-posten.html
lässt sich sonst schlecht auswerten :-)
Ja, sorry... Habe halt rumprobiert... Hast ja recht...

Hier also der Log:
Zitat:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.03.08.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Didi :: NOTEBOOK [Administrator]

08.03.2013 09:50:59
MBAM-log-2013-03-08 (11-44-07).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 441661
Laufzeit: 1 Stunde(n), 52 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\Didi\Documents\wincmd.exe (Trojan.Agent) -> 4872 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Keine Aktion durchgeführt.
HKCU\Software\DC3_FEXEC (Malware.Trace) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|idle32 (Trojan.Agent) -> Daten: C:\Users\Didi\Documents\wincmd.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Didi\AppData\Roaming\dclogs (Stolen.Data) -> Keine Aktion durchgeführt.

Infizierte Dateien: 13
C:\Users\Steph\AppData\Local\Zylom Games\10 Days Under The Sea Deluxe\10daysunderthesea.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Dream Chronicles Deluxe\dreamchronicles.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Hidden Identity - Chicago Blackout Deluxe\HiddenIdentity.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Interpol - The Trail of Dr. Chaos Deluxe\interpolthetrailofdrchaos.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Jewel Quest Mysteries - Trail of the Midnight Heart Deluxe\jewelquestmysteriestrailofthemidnightheart.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Little Shop - World Traveler Deluxe\littleshopworldtraveler.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Mystery P.I. - Stolen in San Francisco Deluxe\MysteryPISanFrancisco.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Mystery P.I. - The London Caper Deluxe\MysteryPILondon.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Steph\AppData\Local\Zylom Games\Zuma's Revenge Deluxe\zumasrevenge.exe (PUP.Downloader.ZYL) -> Keine Aktion durchgeführt.
C:\Users\Didi\AppData\Roaming\dclogs\2012-10-15-2.dc (Stolen.Data) -> Keine Aktion durchgeführt.
C:\Users\Didi\AppData\Roaming\dclogs\2012-10-16-3.dc (Stolen.Data) -> Keine Aktion durchgeführt.
C:\Users\Didi\AppData\Roaming\dclogs\2012-10-17-4.dc (Stolen.Data) -> Keine Aktion durchgeführt.
C:\Users\Didi\Documents\wincmd.exe (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)

markusg 11.03.2013 18:28
hi,
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

aoxo 11.03.2013 19:29
Ok, hier das Logfile:
Zitat:
19:25:32.0897 7380 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
19:25:32.0991 7380 ============================================================
19:25:32.0991 7380 Current date / time: 2013/03/11 19:25:32.0991
19:25:32.0991 7380 SystemInfo:
19:25:32.0991 7380
19:25:32.0992 7380 OS Version: 6.1.7601 ServicePack: 1.0
19:25:32.0992 7380 Product type: Workstation
19:25:32.0992 7380 ComputerName: NOTEBOOK
19:25:32.0992 7380 UserName: Didi
19:25:32.0992 7380 Windows directory: C:\Windows
19:25:32.0992 7380 System windows directory: C:\Windows
19:25:32.0992 7380 Processor architecture: Intel x86
19:25:32.0992 7380 Number of processors: 2
19:25:32.0992 7380 Page size: 0x1000
19:25:32.0992 7380 Boot type: Normal boot
19:25:32.0992 7380 ============================================================
19:25:34.0384 7380 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
19:25:34.0386 7380 ============================================================
19:25:34.0386 7380 \Device\Harddisk0\DR0:
19:25:34.0386 7380 MBR partitions:
19:25:34.0386 7380 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x32F8E
19:25:34.0386 7380 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32FCD, BlocksNum 0x78488EB
19:25:34.0386 7380 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x787B8B8, BlocksNum 0x32B09389
19:25:34.0386 7380 ============================================================
19:25:34.0411 7380 C: <-> \Device\Harddisk0\DR0\Partition2
19:25:34.0439 7380 D: <-> \Device\Harddisk0\DR0\Partition3
19:25:34.0439 7380 ============================================================
19:25:34.0439 7380 Initialize success
19:25:34.0439 7380 ============================================================
19:26:42.0978 7232 ============================================================
19:26:42.0978 7232 Scan started
19:26:42.0978 7232 Mode: Manual; SigCheck; TDLFS;
19:26:42.0978 7232 ============================================================
19:26:43.0818 7232 ================ Scan system memory ========================
19:26:43.0818 7232 System memory - ok
19:26:43.0818 7232 ================ Scan services =============================
19:26:43.0951 7232 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
19:26:44.0087 7232 1394ohci - ok
19:26:44.0122 7232 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
19:26:44.0142 7232 ACPI - ok
19:26:44.0194 7232 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
19:26:44.0476 7232 AcpiPmi - ok
19:26:44.0603 7232 [ 7E0275A22A0CE8C448767ADB9A287F25 ] AcronisOSSReinstallSvc C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
19:26:44.0669 7232 AcronisOSSReinstallSvc ( UnsignedFile.Multi.Generic ) - warning
19:26:44.0669 7232 AcronisOSSReinstallSvc - detected UnsignedFile.Multi.Generic (1)
19:26:44.0709 7232 [ 1F1EA08A21369A01ECF2DFF9F4C4E59A ] AcrSch2Svc C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
19:26:44.0729 7232 AcrSch2Svc - ok
19:26:44.0832 7232 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
19:26:44.0846 7232 AdobeARMservice - ok
19:26:44.0900 7232 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
19:26:44.0924 7232 adp94xx - ok
19:26:44.0947 7232 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
19:26:44.0967 7232 adpahci - ok
19:26:44.0979 7232 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
19:26:44.0997 7232 adpu320 - ok
19:26:45.0030 7232 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
19:26:45.0067 7232 AeLookupSvc - ok
19:26:45.0114 7232 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys
19:26:45.0171 7232 AFD - ok
19:26:45.0225 7232 [ 7E10E3BB9B258AD8A9300F91214D67B9 ] AgereSoftModem C:\Windows\system32\DRIVERS\AGRSM.sys
19:26:45.0292 7232 AgereSoftModem - ok
19:26:45.0319 7232 [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440 C:\Windows\system32\drivers\agp440.sys
19:26:45.0334 7232 agp440 - ok
19:26:45.0377 7232 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
19:26:45.0393 7232 aic78xx - ok
19:26:45.0436 7232 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe
19:26:45.0491 7232 ALG - ok
19:26:45.0523 7232 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys
19:26:45.0552 7232 aliide - ok
19:26:45.0577 7232 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
19:26:45.0593 7232 amdagp - ok
19:26:45.0621 7232 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys
19:26:45.0635 7232 amdide - ok
19:26:45.0677 7232 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
19:26:45.0722 7232 AmdK8 - ok
19:26:45.0734 7232 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
19:26:45.0759 7232 AmdPPM - ok
19:26:45.0785 7232 [ D320BF87125326F996D4904FE24300FC ] amdsata C:\Windows\system32\drivers\amdsata.sys
19:26:45.0800 7232 amdsata - ok
19:26:45.0830 7232 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
19:26:45.0848 7232 amdsbs - ok
19:26:45.0861 7232 [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
19:26:45.0875 7232 amdxata - ok
19:26:45.0956 7232 [ D1AF38FBAC0DC7E6D796B0ED01707EE0 ] AppHostSvc C:\Windows\system32\inetsrv\apphostsvc.dll
19:26:45.0995 7232 AppHostSvc - ok
19:26:46.0035 7232 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys
19:26:46.0095 7232 AppID - ok
19:26:46.0132 7232 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
19:26:46.0183 7232 AppIDSvc - ok
19:26:46.0209 7232 [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo C:\Windows\System32\appinfo.dll
19:26:46.0252 7232 Appinfo - ok
19:26:46.0338 7232 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
19:26:46.0350 7232 Apple Mobile Device - ok
19:26:46.0390 7232 [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt C:\Windows\System32\appmgmts.dll
19:26:46.0431 7232 AppMgmt - ok
19:26:46.0471 7232 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys
19:26:46.0487 7232 arc - ok
19:26:46.0497 7232 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
19:26:46.0513 7232 arcsas - ok
19:26:46.0625 7232 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
19:26:46.0638 7232 aspnet_state - ok
19:26:46.0660 7232 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
19:26:46.0732 7232 AsyncMac - ok
19:26:46.0750 7232 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys
19:26:46.0763 7232 atapi - ok
19:26:46.0819 7232 [ 76BAB0C824E2D05B940C4DD40A9B08BF ] athr C:\Windows\system32\DRIVERS\athr.sys
19:26:46.0884 7232 athr - ok
19:26:46.0925 7232 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
19:26:46.0960 7232 AudioEndpointBuilder - ok
19:26:46.0970 7232 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
19:26:47.0003 7232 Audiosrv - ok
19:26:47.0044 7232 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
19:26:47.0091 7232 AxInstSV - ok
19:26:47.0137 7232 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
19:26:47.0176 7232 b06bdrv - ok
19:26:47.0211 7232 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
19:26:47.0237 7232 b57nd60x - ok
19:26:47.0275 7232 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll
19:26:47.0319 7232 BDESVC - ok
19:26:47.0337 7232 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys
19:26:47.0384 7232 Beep - ok
19:26:47.0496 7232 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll
19:26:47.0592 7232 BFE - ok
19:26:47.0621 7232 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\System32\qmgr.dll
19:26:47.0668 7232 BITS - ok
19:26:47.0681 7232 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
19:26:47.0712 7232 blbdrive - ok
19:26:47.0780 7232 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
19:26:47.0798 7232 Bonjour Service - ok
19:26:47.0835 7232 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
19:26:47.0869 7232 bowser - ok
19:26:47.0896 7232 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
19:26:47.0923 7232 BrFiltLo - ok
19:26:47.0934 7232 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
19:26:47.0972 7232 BrFiltUp - ok
19:26:48.0002 7232 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll
19:26:48.0044 7232 Browser - ok
19:26:48.0072 7232 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys
19:26:48.0105 7232 Brserid - ok
19:26:48.0117 7232 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
19:26:48.0147 7232 BrSerWdm - ok
19:26:48.0160 7232 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
19:26:48.0187 7232 BrUsbMdm - ok
19:26:48.0203 7232 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
19:26:48.0234 7232 BrUsbSer - ok
19:26:48.0260 7232 BTCFilterService - ok
19:26:48.0294 7232 [ 2865A5C8E98C70C605F417908CEBB3A4 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
19:26:48.0340 7232 BthEnum - ok
19:26:48.0362 7232 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
19:26:48.0460 7232 BTHMODEM - ok
19:26:48.0483 7232 [ AD1872E5829E8A2C3B5B4B641C3EAB0E ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
19:26:48.0510 7232 BthPan - ok
19:26:48.0546 7232 [ C2FBF6D271D9A94D839C416BF186EAD9 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
19:26:48.0592 7232 BTHPORT - ok
19:26:48.0630 7232 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll
19:26:48.0667 7232 bthserv - ok
19:26:48.0682 7232 [ C81E9413A25A439F436B1D4B6A0CF9E9 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
19:26:48.0708 7232 BTHUSB - ok
19:26:48.0732 7232 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
19:26:48.0769 7232 cdfs - ok
19:26:48.0806 7232 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
19:26:48.0830 7232 cdrom - ok
19:26:48.0870 7232 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll
19:26:48.0915 7232 CertPropSvc - ok
19:26:48.0962 7232 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
19:26:48.0988 7232 circlass - ok
19:26:49.0028 7232 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys
19:26:49.0046 7232 CLFS - ok
19:26:49.0082 7232 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:26:49.0096 7232 clr_optimization_v2.0.50727_32 - ok
19:26:49.0140 7232 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:26:49.0154 7232 clr_optimization_v4.0.30319_32 - ok
19:26:49.0180 7232 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
19:26:49.0202 7232 CmBatt - ok
19:26:49.0234 7232 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys
19:26:49.0250 7232 cmdide - ok
19:26:49.0275 7232 [ 247B4CE2DAB1160CD422D532D5241E1F ] CNG C:\Windows\system32\Drivers\cng.sys
19:26:49.0303 7232 CNG - ok
19:26:49.0333 7232 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
19:26:49.0348 7232 Compbatt - ok
19:26:49.0377 7232 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
19:26:49.0431 7232 CompositeBus - ok
19:26:49.0450 7232 COMSysApp - ok
19:26:49.0501 7232 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
19:26:49.0568 7232 crcdisk - ok
19:26:49.0610 7232 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll
19:26:49.0637 7232 CryptSvc - ok
19:26:49.0661 7232 [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC C:\Windows\system32\drivers\csc.sys
19:26:49.0703 7232 CSC - ok
19:26:49.0742 7232 [ 15F93B37F6801943360D9EB42485D5D3 ] CscService C:\Windows\System32\cscsvc.dll
19:26:49.0782 7232 CscService - ok
19:26:49.0804 7232 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll
19:26:49.0855 7232 DcomLaunch - ok
19:26:49.0884 7232 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll
19:26:49.0924 7232 defragsvc - ok
19:26:49.0957 7232 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
19:26:49.0991 7232 DfsC - ok
19:26:50.0035 7232 [ 3BE1651C63954067940E7F473498AD70 ] dgderdrv C:\Windows\system32\drivers\dgderdrv.sys
19:26:50.0051 7232 dgderdrv - ok
19:26:50.0095 7232 [ 10B8F89D146D0E20B1284D47BB4EC6C9 ] dgdersvc C:\Windows\system32\dgdersvc.exe
19:26:50.0115 7232 dgdersvc - ok
19:26:50.0173 7232 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll
19:26:50.0218 7232 Dhcp - ok
19:26:50.0243 7232 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys
19:26:50.0284 7232 discache - ok
19:26:50.0315 7232 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys
19:26:50.0330 7232 Disk - ok
19:26:50.0357 7232 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll
19:26:50.0393 7232 Dnscache - ok
19:26:50.0421 7232 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll
19:26:50.0463 7232 dot3svc - ok
19:26:50.0490 7232 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll
19:26:50.0521 7232 DPS - ok
19:26:50.0544 7232 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
19:26:50.0561 7232 drmkaud - ok
19:26:50.0594 7232 [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
19:26:50.0624 7232 DXGKrnl - ok
19:26:50.0646 7232 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll
19:26:50.0684 7232 EapHost - ok
19:26:50.0823 7232 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys
19:26:50.0942 7232 ebdrv - ok
19:26:50.0968 7232 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe
19:26:51.0012 7232 EFS - ok
19:26:51.0078 7232 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
19:26:51.0102 7232 ehRecvr - ok
19:26:51.0125 7232 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe
19:26:51.0160 7232 ehSched - ok
19:26:51.0204 7232 [ CE37E3D51912E59C80C6D84337C0B4CD ] ElbyCDFL C:\Windows\system32\Drivers\ElbyCDFL.sys
19:26:51.0218 7232 ElbyCDFL - ok
19:26:51.0236 7232 [ 178CC9403816C082D22A1D47FA1F9C85 ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys
19:26:51.0249 7232 ElbyCDIO - ok
19:26:51.0286 7232 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
19:26:51.0309 7232 elxstor - ok
19:26:51.0328 7232 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys
19:26:51.0359 7232 ErrDev - ok
19:26:51.0406 7232 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll
19:26:51.0450 7232 EventSystem - ok
19:26:51.0479 7232 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys
19:26:51.0519 7232 exfat - ok
19:26:51.0533 7232 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys
19:26:51.0566 7232 fastfat - ok
19:26:51.0612 7232 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe
19:26:51.0656 7232 Fax - ok
19:26:51.0680 7232 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
19:26:51.0708 7232 fdc - ok
19:26:51.0736 7232 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll
19:26:51.0767 7232 fdPHost - ok
19:26:51.0780 7232 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll
19:26:51.0810 7232 FDResPub - ok
19:26:51.0824 7232 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
19:26:51.0838 7232 FileInfo - ok
19:26:51.0855 7232 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
19:26:51.0891 7232 Filetrace - ok
19:26:51.0916 7232 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
19:26:51.0931 7232 flpydisk - ok
19:26:51.0950 7232 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
19:26:51.0968 7232 FltMgr - ok
19:26:52.0014 7232 [ B3A5EC6B6B6673DB7E87C2BCDBDDC074 ] FontCache C:\Windows\system32\FntCache.dll
19:26:52.0067 7232 FontCache - ok
19:26:52.0121 7232 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
19:26:52.0133 7232 FontCache3.0.0.0 - ok
19:26:52.0162 7232 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
19:26:52.0177 7232 FsDepends - ok
19:26:52.0221 7232 [ B07663A810E861EEBFD0EAC7E82CA62D ] FsUsbExDisk C:\Windows\system32\FsUsbExDisk.SYS
19:26:52.0254 7232 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
19:26:52.0254 7232 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
19:26:52.0306 7232 [ F96C429788350DB4BA6771C3034DFD88 ] FsUsbExService C:\Windows\system32\FsUsbExService.Exe
19:26:52.0335 7232 FsUsbExService ( UnsignedFile.Multi.Generic ) - warning
19:26:52.0335 7232 FsUsbExService - detected UnsignedFile.Multi.Generic (1)
19:26:52.0375 7232 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
19:26:52.0389 7232 Fs_Rec - ok
19:26:52.0430 7232 [ 8A73E79089B282100B9393B644CB853B ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
19:26:52.0451 7232 fvevol - ok
19:26:52.0493 7232 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
19:26:52.0508 7232 gagp30kx - ok
19:26:52.0553 7232 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
19:26:52.0563 7232 GEARAspiWDM - ok
19:26:52.0608 7232 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll
19:26:52.0655 7232 gpsvc - ok
19:26:52.0684 7232 [ D956358054E99E6FFAC69CD87E893A89 ] grmnusb C:\Windows\system32\drivers\grmnusb.sys
19:26:52.0703 7232 grmnusb - ok
19:26:52.0794 7232 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
19:26:52.0807 7232 gupdate - ok
19:26:52.0841 7232 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
19:26:52.0853 7232 gupdatem - ok
19:26:52.0885 7232 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
19:26:52.0920 7232 hcw85cir - ok
19:26:52.0951 7232 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:26:52.0985 7232 HdAudAddService - ok
19:26:53.0020 7232 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
19:26:53.0052 7232 HDAudBus - ok
19:26:53.0079 7232 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
19:26:53.0106 7232 HidBatt - ok
19:26:53.0125 7232 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
19:26:53.0158 7232 HidBth - ok
19:26:53.0182 7232 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
19:26:53.0200 7232 HidIr - ok
19:26:53.0224 7232 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll
19:26:53.0270 7232 hidserv - ok
19:26:53.0313 7232 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
19:26:53.0328 7232 HidUsb - ok
19:26:53.0359 7232 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll
19:26:53.0397 7232 hkmsvc - ok
19:26:53.0416 7232 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
19:26:53.0449 7232 HomeGroupListener - ok
19:26:53.0474 7232 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
19:26:53.0518 7232 HomeGroupProvider - ok
19:26:53.0553 7232 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
19:26:53.0568 7232 HpSAMD - ok
19:26:53.0607 7232 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys
19:26:53.0644 7232 HTTP - ok
19:26:53.0661 7232 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
19:26:53.0674 7232 hwpolicy - ok
19:26:53.0709 7232 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
19:26:53.0734 7232 i8042prt - ok
19:26:53.0773 7232 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
19:26:53.0794 7232 iaStorV - ok
19:26:53.0848 7232 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
19:26:53.0878 7232 idsvc - ok
19:26:54.0004 7232 [ 9467514EA189475A6E7FDC5D7BDE9D3F ] igfx C:\Windows\system32\DRIVERS\igdkmd32.sys
19:26:54.0157 7232 igfx - ok
19:26:54.0191 7232 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
19:26:54.0206 7232 iirsp - ok
19:26:54.0248 7232 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll
19:26:54.0297 7232 IKEEXT - ok
19:26:54.0334 7232 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys
19:26:54.0348 7232 intelide - ok
19:26:54.0386 7232 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
19:26:54.0414 7232 intelppm - ok
19:26:54.0447 7232 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
19:26:54.0493 7232 IPBusEnum - ok
19:26:54.0507 7232 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:26:54.0549 7232 IpFilterDriver - ok
19:26:54.0583 7232 [ 4D65A07B795D6674312F879D09AA7663 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
19:26:54.0628 7232 iphlpsvc - ok
19:26:54.0656 7232 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
19:26:54.0682 7232 IPMIDRV - ok
19:26:54.0707 7232 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys
19:26:54.0751 7232 IPNAT - ok
19:26:54.0802 7232 [ E8A39D41474BE42FD8830CED32932D6C ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
19:26:54.0825 7232 iPod Service - ok
19:26:54.0851 7232 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys
19:26:54.0879 7232 IRENUM - ok
19:26:54.0906 7232 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys
19:26:54.0921 7232 isapnp - ok
19:26:54.0939 7232 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
19:26:54.0958 7232 iScsiPrt - ok
19:26:54.0992 7232 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
19:26:55.0007 7232 kbdclass - ok
19:26:55.0025 7232 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
19:26:55.0050 7232 kbdhid - ok
19:26:55.0068 7232 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe
19:26:55.0083 7232 KeyIso - ok
19:26:55.0107 7232 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
19:26:55.0122 7232 KSecDD - ok
19:26:55.0156 7232 [ D30159AC9237519FBC62C6EC247D2D46 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
19:26:55.0173 7232 KSecPkg - ok
19:26:55.0203 7232 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll
19:26:55.0253 7232 KtmRm - ok
19:26:55.0282 7232 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\system32\srvsvc.dll
19:26:55.0320 7232 LanmanServer - ok
19:26:55.0333 7232 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:26:55.0364 7232 LanmanWorkstation - ok
19:26:55.0408 7232 [ E2F1DCF4A68CC6CF694FBFBA1842F4CD ] libusb0 C:\Windows\system32\drivers\libusb0.sys
19:26:55.0420 7232 libusb0 ( UnsignedFile.Multi.Generic ) - warning
19:26:55.0420 7232 libusb0 - detected UnsignedFile.Multi.Generic (1)
19:26:55.0460 7232 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
19:26:55.0491 7232 lltdio - ok
19:26:55.0512 7232 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll
19:26:55.0554 7232 lltdsvc - ok
19:26:55.0569 7232 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll
19:26:55.0613 7232 lmhosts - ok
19:26:55.0642 7232 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
19:26:55.0658 7232 LSI_FC - ok
19:26:55.0692 7232 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
19:26:55.0708 7232 LSI_SAS - ok
19:26:55.0719 7232 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
19:26:55.0734 7232 LSI_SAS2 - ok
19:26:55.0754 7232 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
19:26:55.0770 7232 LSI_SCSI - ok
19:26:55.0796 7232 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys
19:26:55.0827 7232 luafv - ok
19:26:55.0889 7232 [ DDCC236009C707761D60E5C76D639176 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe
19:26:55.0906 7232 McComponentHostService - ok
19:26:55.0933 7232 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
19:26:55.0951 7232 Mcx2Svc - ok
19:26:55.0974 7232 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
19:26:56.0001 7232 megasas - ok
19:26:56.0038 7232 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
19:26:56.0058 7232 MegaSR - ok
19:26:56.0155 7232 Microsoft SharePoint Workspace Audit Service - ok
19:26:56.0209 7232 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll
19:26:56.0241 7232 MMCSS - ok
19:26:56.0307 7232 [ 76C7CAA7B4789052EC844747A1D6CE24 ] MoboroboDeviceService C:\Program Files\Moborobo\MoboroboDeviceService.exe
19:26:56.0319 7232 MoboroboDeviceService - ok
19:26:56.0338 7232 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys
19:26:56.0377 7232 Modem - ok
19:26:56.0409 7232 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
19:26:56.0434 7232 monitor - ok
19:26:56.0447 7232 motandroidusb - ok
19:26:56.0467 7232 motccgp - ok
19:26:56.0475 7232 motccgpfl - ok
19:26:56.0481 7232 MotoSwitchService - ok
19:26:56.0489 7232 Motousbnet - ok
19:26:56.0497 7232 motusbdevice - ok
19:26:56.0525 7232 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
19:26:56.0541 7232 mouclass - ok
19:26:56.0592 7232 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
19:26:56.0607 7232 mouhid - ok
19:26:56.0631 7232 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
19:26:56.0646 7232 mountmgr - ok
19:26:56.0717 7232 [ 8A7C8F4C713E70D73946833D76B77035 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
19:26:56.0732 7232 MozillaMaintenance - ok
19:26:56.0752 7232 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys
19:26:56.0768 7232 mpio - ok
19:26:56.0790 7232 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
19:26:56.0826 7232 mpsdrv - ok
19:26:56.0860 7232 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll
19:26:56.0898 7232 MpsSvc - ok
19:26:56.0930 7232 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
19:26:56.0956 7232 MRxDAV - ok
19:26:56.0983 7232 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
19:26:57.0011 7232 mrxsmb - ok
19:26:57.0048 7232 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:26:57.0076 7232 mrxsmb10 - ok
19:26:57.0098 7232 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:26:57.0123 7232 mrxsmb20 - ok
19:26:57.0152 7232 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys
19:26:57.0167 7232 msahci - ok
19:26:57.0190 7232 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys
19:26:57.0205 7232 msdsm - ok
19:26:57.0227 7232 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe
19:26:57.0253 7232 MSDTC - ok
19:26:57.0286 7232 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys
19:26:57.0317 7232 Msfs - ok
19:26:57.0327 7232 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
19:26:57.0365 7232 mshidkmdf - ok
19:26:57.0392 7232 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
19:26:57.0407 7232 msisadrv - ok
19:26:57.0438 7232 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
19:26:57.0481 7232 MSiSCSI - ok
19:26:57.0487 7232 msiserver - ok
19:26:57.0524 7232 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
19:26:57.0565 7232 MSKSSRV - ok
19:26:57.0583 7232 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
19:26:57.0613 7232 MSPCLOCK - ok
19:26:57.0618 7232 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
19:26:57.0658 7232 MSPQM - ok
19:26:57.0676 7232 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
19:26:57.0693 7232 MsRPC - ok
19:26:57.0728 7232 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
19:26:57.0742 7232 mssmbios - ok
19:26:57.0762 7232 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
19:26:57.0792 7232 MSTEE - ok
19:26:57.0805 7232 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
19:26:57.0820 7232 MTConfig - ok
19:26:57.0832 7232 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys
19:26:57.0847 7232 Mup - ok
19:26:57.0897 7232 [ C2B5B6D9AF274E85DE29D719CF5BC3D6 ] NanoServiceMain C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
19:26:57.0910 7232 NanoServiceMain - ok
19:26:57.0947 7232 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll
19:26:57.0990 7232 napagent - ok
19:26:58.0037 7232 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
19:26:58.0067 7232 NativeWifiP - ok
19:26:58.0113 7232 [ E7C54812A2AAF43316EB6930C1FFA108 ] NDIS C:\Windows\system32\drivers\ndis.sys
19:26:58.0141 7232 NDIS - ok
19:26:58.0163 7232 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
19:26:58.0208 7232 NdisCap - ok
19:26:58.0251 7232 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
19:26:58.0287 7232 NdisTapi - ok
19:26:58.0308 7232 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
19:26:58.0351 7232 Ndisuio - ok
19:26:58.0370 7232 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
19:26:58.0415 7232 NdisWan - ok
19:26:58.0436 7232 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
19:26:58.0478 7232 NDProxy - ok
19:26:58.0512 7232 Nero BackItUp Scheduler 4.0 - ok
19:26:58.0547 7232 [ 7AFD0E39AB15CB355487B7CC19F4E2C5 ] Netaapl C:\Windows\system32\DRIVERS\netaapl.sys
19:26:58.0565 7232 Netaapl ( UnsignedFile.Multi.Generic ) - warning
19:26:58.0566 7232 Netaapl - detected UnsignedFile.Multi.Generic (1)
19:26:58.0597 7232 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
19:26:58.0641 7232 NetBIOS - ok
19:26:58.0666 7232 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
19:26:58.0705 7232 NetBT - ok
19:26:58.0719 7232 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe
19:26:58.0734 7232 Netlogon - ok
19:26:58.0784 7232 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll
19:26:58.0828 7232 Netman - ok
19:26:58.0858 7232 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:26:58.0872 7232 NetMsmqActivator - ok
19:26:58.0877 7232 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:26:58.0890 7232 NetPipeActivator - ok
19:26:58.0910 7232 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll
19:26:58.0947 7232 netprofm - ok
19:26:58.0953 7232 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:26:58.0966 7232 NetTcpActivator - ok
19:26:58.0971 7232 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:26:58.0984 7232 NetTcpPortSharing - ok
19:26:59.0169 7232 [ 5B2DFA9C5C02DDF2A113CC0F551B59DF ] NETw5s32 C:\Windows\system32\DRIVERS\NETw5s32.sys
19:26:59.0374 7232 NETw5s32 - ok
19:26:59.0501 7232 [ 58218EC6B61B1169CF54AAB0D00F5FE2 ] netw5v32 C:\Windows\system32\DRIVERS\netw5v32.sys
19:26:59.0641 7232 netw5v32 - ok
19:26:59.0683 7232 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
19:26:59.0698 7232 nfrd960 - ok
19:26:59.0731 7232 [ 912084381D30D8B89EC4E293053F4710 ] NlaSvc C:\Windows\System32\nlasvc.dll
19:26:59.0775 7232 NlaSvc - ok
19:26:59.0836 7232 [ DD834264C3A3C3B12333CE27AE2F4BE5 ] NNSALPC C:\Windows\system32\DRIVERS\NNSAlpc.sys
19:26:59.0848 7232 NNSALPC - ok
19:26:59.0906 7232 [ 15D5A84DCF62E51201DE338C2E057FBE ] NNSHTTP C:\Windows\system32\DRIVERS\NNSHttp.sys
19:26:59.0917 7232 NNSHTTP - ok
19:26:59.0971 7232 [ B8EF512752407FB3A2B0E57E1DB33ED8 ] NNSHTTPS C:\Windows\system32\DRIVERS\NNSHttps.sys
19:26:59.0983 7232 NNSHTTPS - ok
19:27:00.0002 7232 [ 7725EBE34AFC990015255768BEB2FA3E ] NNSIDS C:\Windows\system32\DRIVERS\NNSIds.sys
19:27:00.0015 7232 NNSIDS - ok
19:27:00.0044 7232 [ FEE70AB8FBA7A2A0304070850801B035 ] NNSNAHSL C:\Windows\system32\DRIVERS\NNSNAHSL.sys
19:27:00.0055 7232 NNSNAHSL - ok
19:27:00.0098 7232 [ 59C95C55ECD98AA167038DE29CD5D994 ] NNSPICC C:\Windows\system32\DRIVERS\NNSPicc.sys
19:27:00.0111 7232 NNSPICC - ok
19:27:00.0145 7232 [ 8B602236D4B7A8785F6087D50B95286D ] NNSPIHSW C:\Windows\system32\DRIVERS\NNSPihsw.sys
19:27:00.0156 7232 NNSPIHSW - ok
19:27:00.0196 7232 [ 81955B1424B4355DDFE2EBAF98F188C7 ] NNSPOP3 C:\Windows\system32\DRIVERS\NNSPop3.sys
19:27:00.0208 7232 NNSPOP3 - ok
19:27:00.0250 7232 [ 7F7584B99174061B3964146EBD212CA9 ] NNSPROT C:\Windows\system32\DRIVERS\NNSProt.sys
19:27:00.0266 7232 NNSPROT - ok
19:27:00.0280 7232 [ 82A1E37F372085518ED4322D99A4FAEF ] NNSPRV C:\Windows\system32\DRIVERS\NNSPrv.sys
19:27:00.0294 7232 NNSPRV - ok
19:27:00.0350 7232 [ A8266DEAF8643A8E060E08B73FFD6114 ] NNSSMTP C:\Windows\system32\DRIVERS\NNSSmtp.sys
19:27:00.0363 7232 NNSSMTP - ok
19:27:00.0375 7232 [ 82EFF92A4CCB8288D993F5B4A0C53F2E ] NNSSTRM C:\Windows\system32\DRIVERS\NNSStrm.sys
19:27:00.0390 7232 NNSSTRM - ok
19:27:00.0427 7232 [ 418402FE2C590B92942CC98ED254FF6C ] NNSTLSC C:\Windows\system32\DRIVERS\NNSTlsc.sys
19:27:00.0440 7232 NNSTLSC - ok
19:27:00.0458 7232 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys
19:27:00.0495 7232 Npfs - ok
19:27:00.0516 7232 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll
19:27:00.0561 7232 nsi - ok
19:27:00.0581 7232 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
19:27:00.0612 7232 nsiproxy - ok
19:27:00.0664 7232 [ 81189C3D7763838E55C397759D49007A ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
19:27:00.0703 7232 Ntfs - ok
19:27:00.0719 7232 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys
19:27:00.0749 7232 Null - ok
19:27:00.0773 7232 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys
19:27:00.0790 7232 nvraid - ok
19:27:00.0807 7232 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\drivers\nvstor.sys
19:27:00.0824 7232 nvstor - ok
19:27:00.0851 7232 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
19:27:00.0867 7232 nv_agp - ok
19:27:00.0915 7232 [ AE404E89E2A936CE62A27A104894D6B4 ] O&O Defrag C:\Windows\system32\oodag.exe
19:27:00.0949 7232 O&O Defrag - ok
19:27:01.0057 7232 [ 0182074B2B8915C8371EA5A006BAC44E ] ogmservice C:\Program Files\Online Games Manager\ogmservice.exe
19:27:01.0077 7232 ogmservice - ok
19:27:01.0108 7232 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
19:27:01.0130 7232 ohci1394 - ok
19:27:01.0194 7232 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:27:01.0207 7232 ose - ok
19:27:01.0362 7232 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
19:27:01.0515 7232 osppsvc - ok
19:27:01.0550 7232 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
19:27:01.0581 7232 p2pimsvc - ok
19:27:01.0597 7232 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll
19:27:01.0632 7232 p2psvc - ok
19:27:01.0661 7232 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys
19:27:01.0687 7232 Parport - ok
19:27:01.0715 7232 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys
19:27:01.0730 7232 partmgr - ok
19:27:01.0745 7232 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
19:27:01.0770 7232 Parvdm - ok
19:27:01.0790 7232 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll
19:27:01.0823 7232 PcaSvc - ok
19:27:01.0837 7232 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys
19:27:01.0854 7232 pci - ok
19:27:01.0884 7232 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys
19:27:01.0899 7232 pciide - ok
19:27:01.0927 7232 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
19:27:01.0945 7232 pcmcia - ok
19:27:01.0958 7232 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys
19:27:01.0975 7232 pcw - ok
19:27:02.0008 7232 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys
19:27:02.0060 7232 PEAUTH - ok
19:27:02.0107 7232 [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
19:27:02.0158 7232 PeerDistSvc - ok
19:27:02.0264 7232 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll
19:27:02.0429 7232 pla - ok
19:27:02.0462 7232 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
19:27:02.0512 7232 PlugPlay - ok
19:27:02.0538 7232 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
19:27:02.0561 7232 PNRPAutoReg - ok
19:27:02.0589 7232 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
19:27:02.0608 7232 PNRPsvc - ok
19:27:02.0640 7232 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
19:27:02.0682 7232 PolicyAgent - ok
19:27:02.0717 7232 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll
19:27:02.0749 7232 Power - ok
19:27:02.0781 7232 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
19:27:02.0813 7232 PptpMiniport - ok
19:27:02.0831 7232 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys
19:27:02.0857 7232 Processor - ok
19:27:02.0883 7232 [ 43CA4CCC22D52FB58E8988F0198851D0 ] ProfSvc C:\Windows\system32\profsvc.dll
19:27:02.0926 7232 ProfSvc - ok
19:27:02.0939 7232 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
19:27:02.0954 7232 ProtectedStorage - ok
19:27:02.0966 7232 PS3 Media Server - ok
19:27:02.0998 7232 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys
19:27:03.0044 7232 Psched - ok
19:27:03.0095 7232 [ 50B5B13DDDC8775E03C4408817757213 ] PSINAflt C:\Windows\system32\DRIVERS\PSINAflt.sys
19:27:03.0109 7232 PSINAflt - ok
19:27:03.0161 7232 [ E339A77ADA178CB428168DF06F20CFB6 ] PSINFile C:\Windows\system32\DRIVERS\PSINFile.sys
19:27:03.0173 7232 PSINFile - ok
19:27:03.0218 7232 [ B1447062C65829066BB1C526DAEEB2DF ] PSINKNC C:\Windows\system32\DRIVERS\psinknc.sys
19:27:03.0233 7232 PSINKNC - ok
19:27:03.0262 7232 [ A44A3B9F7BCB58BC6601874F514A12B0 ] PSINProc C:\Windows\system32\DRIVERS\PSINProc.sys
19:27:03.0274 7232 PSINProc - ok
19:27:03.0300 7232 [ DE283A666A070ACC371BFBCEA07DA024 ] PSINProt C:\Windows\system32\DRIVERS\PSINProt.sys
19:27:03.0314 7232 PSINProt - ok
19:27:03.0372 7232 [ 4FC535D04017B42778FF51E57564E16F ] PSKMAD C:\Windows\system32\DRIVERS\PSKMAD.sys
19:27:03.0384 7232 PSKMAD - ok
19:27:03.0412 7232 [ 650F1D071C4420FD2B8FA465027510A8 ] PSUAService C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe
19:27:03.0424 7232 PSUAService - ok
19:27:03.0479 7232 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
19:27:03.0525 7232 ql2300 - ok
19:27:03.0546 7232 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
19:27:03.0562 7232 ql40xx - ok
19:27:03.0598 7232 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll
19:27:03.0631 7232 QWAVE - ok
19:27:03.0654 7232 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
19:27:03.0672 7232 QWAVEdrv - ok
19:27:03.0715 7232 [ 8F97D374AD1857E1EED85A79F29A1D3D ] RapiMgr C:\Windows\WindowsMobile\rapimgr.dll
19:27:03.0730 7232 RapiMgr - ok
19:27:03.0746 7232 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
19:27:03.0790 7232 RasAcd - ok
19:27:03.0825 7232 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
19:27:03.0854 7232 RasAgileVpn - ok
19:27:03.0880 7232 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll
19:27:03.0912 7232 RasAuto - ok
19:27:03.0923 7232 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
19:27:03.0960 7232 Rasl2tp - ok
19:27:03.0979 7232 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll
19:27:04.0013 7232 RasMan - ok
19:27:04.0048 7232 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
19:27:04.0094 7232 RasPppoe - ok
19:27:04.0119 7232 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
19:27:04.0155 7232 RasSstp - ok
19:27:04.0171 7232 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
19:27:04.0208 7232 rdbss - ok
19:27:04.0228 7232 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
19:27:04.0246 7232 rdpbus - ok
19:27:04.0268 7232 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
19:27:04.0311 7232 RDPCDD - ok
19:27:04.0341 7232 [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
19:27:04.0367 7232 RDPDR - ok
19:27:04.0402 7232 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
19:27:04.0441 7232 RDPENCDD - ok
19:27:04.0457 7232 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
19:27:04.0501 7232 RDPREFMP - ok
19:27:04.0527 7232 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
19:27:04.0566 7232 RDPWD - ok
19:27:04.0600 7232 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
19:27:04.0618 7232 rdyboost - ok
19:27:04.0650 7232 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll
19:27:04.0687 7232 RemoteAccess - ok
19:27:04.0726 7232 [ 7553D60B85AC53BD4486C418A0FBFCDF ] RemoteControl-USBLAN C:\Windows\system32\DRIVERS\rcblan.sys
19:27:04.0738 7232 RemoteControl-USBLAN - ok
19:27:04.0772 7232 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll
19:27:04.0806 7232 RemoteRegistry - ok
19:27:04.0835 7232 [ CB928D9E6DAF51879DD6BA8D02F01321 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
19:27:04.0854 7232 RFCOMM - ok
19:27:04.0875 7232 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
19:27:04.0919 7232 RpcEptMapper - ok
19:27:04.0951 7232 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe
19:27:04.0978 7232 RpcLocator - ok
19:27:05.0010 7232 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll
19:27:05.0045 7232 RpcSs - ok
19:27:05.0081 7232 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
19:27:05.0126 7232 rspndr - ok
19:27:05.0169 7232 [ D5EDE44CA85899E0478208C8413C1C31 ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys
19:27:05.0185 7232 RTL8167 - ok
19:27:05.0203 7232 [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
19:27:05.0234 7232 s3cap - ok
19:27:05.0246 7232 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe
19:27:05.0261 7232 SamSs - ok
19:27:05.0278 7232 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
19:27:05.0294 7232 sbp2port - ok
19:27:05.0318 7232 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll
19:27:05.0364 7232 SCardSvr - ok
19:27:05.0376 7232 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
19:27:05.0413 7232 scfilter - ok
19:27:05.0454 7232 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll
19:27:05.0508 7232 Schedule - ok
19:27:05.0532 7232 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll
19:27:05.0562 7232 SCPolicySvc - ok
19:27:05.0582 7232 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll
19:27:05.0624 7232 SDRSVC - ok
19:27:05.0663 7232 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
19:27:05.0704 7232 secdrv - ok
19:27:05.0729 7232 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll
19:27:05.0768 7232 seclogon - ok
19:27:05.0779 7232 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\System32\sens.dll
19:27:05.0817 7232 SENS - ok
19:27:05.0832 7232 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll
19:27:05.0852 7232 SensrSvc - ok
19:27:05.0886 7232 [ A59E73BCB63F4F30183CF0A22C29FAF5 ] Ser2pl C:\Windows\system32\DRIVERS\ser2pl.sys
19:27:05.0899 7232 Ser2pl ( UnsignedFile.Multi.Generic ) - warning
19:27:05.0899 7232 Ser2pl - detected UnsignedFile.Multi.Generic (1)
19:27:05.0915 7232 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
19:27:05.0944 7232 Serenum - ok
19:27:05.0969 7232 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys
19:27:05.0986 7232 Serial - ok
19:27:05.0997 7232 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
19:27:06.0026 7232 sermouse - ok
19:27:06.0053 7232 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll
19:27:06.0092 7232 SessionEnv - ok
19:27:06.0109 7232 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
19:27:06.0132 7232 sffdisk - ok
19:27:06.0151 7232 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
19:27:06.0169 7232 sffp_mmc - ok
19:27:06.0177 7232 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
19:27:06.0202 7232 sffp_sd - ok
19:27:06.0229 7232 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
19:27:06.0297 7232 sfloppy - ok
19:27:06.0352 7232 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll
19:27:06.0423 7232 SharedAccess - ok
19:27:06.0445 7232 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:27:06.0481 7232 ShellHWDetection - ok
19:27:06.0506 7232 [ EB39983C7D31407425A892F2839E38DD ] SIoctl c:\windows\system32\drivers\sioctl.sys
19:27:06.0512 7232 SIoctl ( UnsignedFile.Multi.Generic ) - warning
19:27:06.0512 7232 SIoctl - detected UnsignedFile.Multi.Generic (1)
19:27:06.0530 7232 [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp C:\Windows\system32\drivers\sisagp.sys
19:27:06.0546 7232 sisagp - ok
19:27:06.0586 7232 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
19:27:06.0601 7232 SiSRaid2 - ok
19:27:06.0614 7232 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
19:27:06.0630 7232 SiSRaid4 - ok
19:27:06.0656 7232 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys
19:27:06.0694 7232 Smb - ok
19:27:06.0744 7232 [ BCC773872041AA59BC9A6CF770FB32E2 ] snapman C:\Windows\system32\DRIVERS\snapman.sys
19:27:06.0758 7232 snapman - ok
19:27:06.0794 7232 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
19:27:06.0811 7232 SNMPTRAP - ok
19:27:06.0841 7232 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys
19:27:06.0856 7232 spldr - ok
19:27:06.0884 7232 [ 866A43013535DC8587C258E43579C764 ] Spooler C:\Windows\System32\spoolsv.exe
19:27:06.0935 7232 Spooler - ok
19:27:07.0026 7232 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe
19:27:07.0149 7232 sppsvc - ok
19:27:07.0166 7232 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll
19:27:07.0206 7232 sppuinotify - ok
19:27:07.0258 7232 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\Windows\system32\Drivers\sptd.sys
19:27:07.0259 7232 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: CDDDEC541BC3C96F91ECB48759673505
19:27:07.0261 7232 sptd ( LockedFile.Multi.Generic ) - warning
19:27:07.0261 7232 sptd - detected LockedFile.Multi.Generic (1)
19:27:07.0296 7232 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys
19:27:07.0341 7232 srv - ok
19:27:07.0363 7232 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
19:27:07.0397 7232 srv2 - ok
19:27:07.0413 7232 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
19:27:07.0445 7232 srvnet - ok
19:27:07.0469 7232 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
19:27:07.0503 7232 SSDPSRV - ok
19:27:07.0514 7232 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll
19:27:07.0560 7232 SstpSvc - ok
19:27:07.0588 7232 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
19:27:07.0602 7232 stexstor - ok
19:27:07.0641 7232 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll
19:27:07.0684 7232 StiSvc - ok
19:27:07.0703 7232 [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
19:27:07.0717 7232 storflt - ok
19:27:07.0742 7232 [ 0BF669F0A910BEDA4A32258D363AF2A5 ] StorSvc C:\Windows\system32\storsvc.dll
19:27:07.0764 7232 StorSvc - ok
19:27:07.0795 7232 [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys
19:27:07.0810 7232 storvsc - ok
19:27:07.0823 7232 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys
19:27:07.0837 7232 swenum - ok
19:27:07.0855 7232 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll
19:27:07.0900 7232 swprv - ok
19:27:07.0947 7232 [ 70534D1E4F9AC990536D5FB5B550B3DE ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
19:27:07.0963 7232 SynTP - ok
19:27:08.0013 7232 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll
19:27:08.0052 7232 SysMain - ok
19:27:08.0079 7232 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
19:27:08.0109 7232 TabletInputService - ok
19:27:08.0146 7232 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll
19:27:08.0180 7232 TapiSrv - ok
19:27:08.0204 7232 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll
19:27:08.0249 7232 TBS - ok
19:27:08.0305 7232 [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
19:27:08.0347 7232 Tcpip - ok
19:27:08.0394 7232 [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
19:27:08.0429 7232 TCPIP6 - ok
19:27:08.0459 7232 [ CCA24162E055C3714CE5A88B100C64ED ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
19:27:08.0502 7232 tcpipreg - ok
19:27:08.0535 7232 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
19:27:08.0575 7232 TDPIPE - ok
19:27:08.0626 7232 [ 3B7B6779EB231F731BBA8F9FE67AADFC ] tdrpman C:\Windows\system32\DRIVERS\tdrpman.sys
19:27:08.0644 7232 tdrpman - ok
19:27:08.0668 7232 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
19:27:08.0699 7232 TDTCP - ok
19:27:08.0718 7232 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
19:27:08.0758 7232 tdx - ok
19:27:08.0777 7232 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys
19:27:08.0793 7232 TermDD - ok
19:27:08.0822 7232 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll
19:27:08.0868 7232 TermService - ok
19:27:08.0889 7232 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll
19:27:08.0910 7232 Themes - ok
19:27:08.0925 7232 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll
19:27:08.0956 7232 THREADORDER - ok
19:27:08.0979 7232 [ B0B3122BFF3910E0BA97014045467778 ] tifsfilter C:\Windows\system32\DRIVERS\tifsfilt.sys
19:27:08.0990 7232 tifsfilter - ok
19:27:09.0008 7232 [ 13BFE330880AC0CE8672D00AA5AFF738 ] timounter C:\Windows\system32\DRIVERS\timntr.sys
19:27:09.0028 7232 timounter - ok
19:27:09.0057 7232 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll
19:27:09.0095 7232 TrkWks - ok
19:27:09.0141 7232 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:27:09.0172 7232 TrustedInstaller - ok
19:27:09.0258 7232 [ 2B4B8D71EF06083517A38939F38438DC ] TryAndDecideService C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
19:27:09.0277 7232 TryAndDecideService - ok
19:27:09.0307 7232 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
19:27:09.0348 7232 tssecsrv - ok
19:27:09.0384 7232 [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
19:27:09.0426 7232 TsUsbFlt - ok
19:27:09.0486 7232 [ FAF93BB76E9334A2901D7657C193BE08 ] TuneUp.Defrag C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
19:27:09.0505 7232 TuneUp.Defrag - ok
19:27:09.0581 7232 [ 0351843ED98271993C83A5E4407F17FF ] TuneUp.UtilitiesSvc C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
19:27:09.0612 7232 TuneUp.UtilitiesSvc - ok
19:27:09.0660 7232 [ F2107C9D85EC0DF116939CCCE06AE697 ] TuneUpUtilitiesDrv C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys
19:27:09.0670 7232 TuneUpUtilitiesDrv - ok
19:27:09.0719 7232 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
19:27:09.0748 7232 tunnel - ok
19:27:09.0781 7232 [ 792A8B80F8188ABA4B2BE271583F3E46 ] TVALZ C:\Windows\system32\DRIVERS\TVALZ_O.SYS
19:27:09.0793 7232 TVALZ - ok
19:27:09.0815 7232 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
19:27:09.0831 7232 uagp35 - ok
19:27:09.0845 7232 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys
19:27:09.0886 7232 udfs - ok
19:27:09.0915 7232 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
19:27:09.0946 7232 UI0Detect - ok
19:27:09.0984 7232 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
19:27:09.0999 7232 uliagpkx - ok
19:27:10.0031 7232 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys
19:27:10.0054 7232 umbus - ok
19:27:10.0081 7232 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
19:27:10.0110 7232 UmPass - ok
19:27:10.0136 7232 [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService C:\Windows\System32\umrdp.dll
19:27:10.0169 7232 UmRdpService - ok
19:27:10.0201 7232 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll
19:27:10.0248 7232 upnphost - ok
19:27:10.0305 7232 [ 73B41F4EAD65F355962168D766AF0F2E ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
19:27:10.0325 7232 USBAAPL ( UnsignedFile.Multi.Generic ) - warning
19:27:10.0325 7232 USBAAPL - detected UnsignedFile.Multi.Generic (1)
19:27:10.0348 7232 [ 7E72E7D7E0757D59481D530FD2B0BFAE ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
19:27:10.0371 7232 usbccgp - ok
19:27:10.0408 7232 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys
19:27:10.0426 7232 usbcir - ok
19:27:10.0452 7232 [ 1C333BFD60F2FED2C7AD5DAF533CB742 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
19:27:10.0468 7232 usbehci - ok
19:27:10.0511 7232 [ 9D22AAD9AC6A07C691A1113E5F860868 ] usbhub C:\Windows\system32\drivers\usbhub.sys
19:27:10.0546 7232 usbhub - ok
19:27:10.0562 7232 [ A6FB7957EA7AFB1165991E54CE934B74 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
19:27:10.0591 7232 usbohci - ok
19:27:10.0608 7232 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
19:27:10.0626 7232 usbprint - ok
19:27:10.0666 7232 [ 576096CCBC07E7C4EA4F5E6686D6888F ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
19:27:10.0691 7232 usbscan - ok
19:27:10.0717 7232 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:27:10.0742 7232 USBSTOR - ok
19:27:10.0755 7232 [ 78780C3EBCE17405B1CCD07A3A8A7D72 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
19:27:10.0784 7232 usbuhci - ok
19:27:10.0800 7232 [ D82F43D15FDAA666856C0190CB73E7C9 ] usb_rndisx C:\Windows\system32\DRIVERS\usb8023x.sys
19:27:10.0818 7232 usb_rndisx - ok
19:27:10.0838 7232 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll
19:27:10.0868 7232 UxSms - ok
19:27:10.0934 7232 [ 8CA0D9B6EF65CD01831C2EEDA63BBE52 ] UxTuneUp C:\Windows\System32\uxtuneup.dll
19:27:10.0946 7232 UxTuneUp - ok
19:27:10.0963 7232 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe
19:27:10.0978 7232 VaultSvc - ok
19:27:11.0017 7232 [ 352385F05C1C4770447D5D3FA0438627 ] VBoxNetAdp C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
19:27:11.0032 7232 VBoxNetAdp - ok
19:27:11.0059 7232 VBoxNetFlt - ok
19:27:11.0080 7232 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
19:27:11.0095 7232 vdrvroot - ok
19:27:11.0119 7232 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe
19:27:11.0172 7232 vds - ok
19:27:11.0212 7232 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
19:27:11.0229 7232 vga - ok
19:27:11.0239 7232 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys
19:27:11.0269 7232 VgaSave - ok
19:27:11.0302 7232 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
19:27:11.0352 7232 vhdmp - ok
19:27:11.0394 7232 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys
19:27:11.0409 7232 viaagp - ok
19:27:11.0430 7232 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys
19:27:11.0455 7232 ViaC7 - ok
19:27:11.0492 7232 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys
19:27:11.0506 7232 viaide - ok
19:27:11.0534 7232 [ C2F2911156FDC7817C52829C86DA494E ] vmbus C:\Windows\system32\drivers\vmbus.sys
19:27:11.0552 7232 vmbus - ok
19:27:11.0582 7232 [ D4D77455211E204F370D08F4963063CE ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
19:27:11.0606 7232 VMBusHID - ok
19:27:11.0651 7232 [ 817DA66B1B889FAD1DBF669E0E2F3228 ] vmm C:\Windows\system32\Drivers\vmm.sys
19:27:11.0667 7232 vmm - ok
19:27:11.0672 7232 VMnetAdapter - ok
19:27:11.0685 7232 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys
19:27:11.0701 7232 volmgr - ok
19:27:11.0725 7232 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
19:27:11.0745 7232 volmgrx - ok
19:27:11.0769 7232 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
19:27:11.0788 7232 volsnap - ok
19:27:11.0819 7232 [ 2ABE8281DB609D8BB1BD1B2F93800D5F ] VPCNetS2 C:\Windows\system32\DRIVERS\VMNetSrv.sys
19:27:11.0833 7232 VPCNetS2 - ok
19:27:11.0851 7232 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
19:27:11.0868 7232 vsmraid - ok
19:27:11.0921 7232 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe
19:27:11.0982 7232 VSS - ok
19:27:11.0998 7232 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
19:27:12.0029 7232 vwifibus - ok
19:27:12.0061 7232 [ 7090D3436EEB4E7DA3373090A23448F7 ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
19:27:12.0081 7232 vwififlt - ok
19:27:12.0107 7232 [ A3F04CBEA6C2A10E6CB01F8B47611882 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
19:27:12.0125 7232 vwifimp - ok
19:27:12.0163 7232 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll
19:27:12.0208 7232 W32Time - ok
19:27:12.0247 7232 [ 57C8C20BFA5BEF6BD851EBAC67A8CED0 ] W3SVC C:\Windows\system32\inetsrv\iisw3adm.dll
19:27:12.0269 7232 W3SVC - ok
19:27:12.0279 7232 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
19:27:12.0301 7232 WacomPen - ok
19:27:12.0330 7232 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
19:27:12.0369 7232 WANARP - ok
19:27:12.0373 7232 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
19:27:12.0402 7232 Wanarpv6 - ok
19:27:12.0418 7232 [ 57C8C20BFA5BEF6BD851EBAC67A8CED0 ] WAS C:\Windows\system32\inetsrv\iisw3adm.dll
19:27:12.0437 7232 WAS - ok
19:27:12.0498 7232 [ 353A04C273EC58475D8633E75CCD5604 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
19:27:12.0542 7232 WatAdminSvc - ok
19:27:12.0590 7232 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe
19:27:12.0645 7232 wbengine - ok
19:27:12.0684 7232 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
19:27:12.0711 7232 WbioSrvc - ok
19:27:12.0750 7232 [ 59E19BD13C3BDB857646B9E436BA27F7 ] WcesComm C:\Windows\WindowsMobile\wcescomm.dll
19:27:12.0767 7232 WcesComm - ok
19:27:12.0801 7232 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll
19:27:12.0824 7232 wcncsvc - ok
19:27:12.0842 7232 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:27:12.0879 7232 WcsPlugInService - ok
19:27:12.0910 7232 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys
19:27:12.0925 7232 Wd - ok
19:27:12.0952 7232 [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
19:27:12.0976 7232 Wdf01000 - ok
19:27:13.0005 7232 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll
19:27:13.0057 7232 WdiServiceHost - ok
19:27:13.0061 7232 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll
19:27:13.0081 7232 WdiSystemHost - ok
19:27:13.0107 7232 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll
19:27:13.0139 7232 WebClient - ok
19:27:13.0159 7232 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll
19:27:13.0192 7232 Wecsvc - ok
19:27:13.0204 7232 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll
19:27:13.0244 7232 wercplsupport - ok
19:27:13.0263 7232 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll
19:27:13.0295 7232 WerSvc - ok
19:27:13.0310 7232 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
19:27:13.0352 7232 WfpLwf - ok
19:27:13.0382 7232 [ 090A2B8F055343815556A01F725F6C35 ] WimFltr C:\Windows\system32\DRIVERS\wimfltr.sys
19:27:13.0398 7232 WimFltr - ok
19:27:13.0408 7232 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys
19:27:13.0423 7232 WIMMount - ok
19:27:13.0480 7232 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
19:27:13.0524 7232 WinDefend - ok
19:27:13.0533 7232 WinHttpAutoProxySvc - ok
19:27:13.0579 7232 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
19:27:13.0610 7232 Winmgmt - ok
19:27:13.0655 7232 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll
19:27:13.0720 7232 WinRM - ok
19:27:13.0768 7232 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys
19:27:13.0795 7232 WinUsb - ok
19:27:13.0833 7232 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll
19:27:13.0876 7232 Wlansvc - ok
19:27:13.0954 7232 [ D9250B31B353EE3322C1CAD411997E38 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:27:13.0998 7232 wlidsvc - ok
19:27:14.0024 7232 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
19:27:14.0040 7232 WmiAcpi - ok
19:27:14.0076 7232 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
19:27:14.0093 7232 wmiApSrv - ok
19:27:14.0157 7232 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
19:27:14.0203 7232 WMPNetworkSvc - ok
19:27:14.0228 7232 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll
19:27:14.0271 7232 WPCSvc - ok
19:27:14.0292 7232 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
19:27:14.0321 7232 WPDBusEnum - ok
19:27:14.0343 7232 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
19:27:14.0388 7232 ws2ifsl - ok
19:27:14.0413 7232 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\System32\wscsvc.dll
19:27:14.0442 7232 wscsvc - ok
19:27:14.0447 7232 WSearch - ok
19:27:14.0505 7232 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
19:27:14.0561 7232 wuauserv - ok
19:27:14.0584 7232 [ E714A1C0354636837E20CCBF00888EE7 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
19:27:14.0625 7232 WudfPf - ok
19:27:14.0652 7232 [ 1023EE888C9B47178C5293ED5336AB69 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
19:27:14.0683 7232 WUDFRd - ok
19:27:14.0726 7232 [ 8D1E1E529A2C9E9B6A85B55A345F7629 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
19:27:14.0770 7232 wudfsvc - ok
19:27:14.0805 7232 [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc C:\Windows\System32\wwansvc.dll
19:27:14.0827 7232 WwanSvc - ok
19:27:14.0920 7232 ================ Scan global ===============================
19:27:14.0943 7232 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
19:27:14.0966 7232 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
19:27:14.0975 7232 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
19:27:15.0004 7232 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
19:27:15.0032 7232 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
19:27:15.0038 7232 [Global] - ok
19:27:15.0038 7232 ================ Scan MBR ==================================
19:27:15.0044 7232 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
19:27:15.0468 7232 \Device\Harddisk0\DR0 - ok
19:27:15.0469 7232 ================ Scan VBR ==================================
19:27:15.0472 7232 [ 8F9E7FA80E2336F8093F894A798B8422 ] \Device\Harddisk0\DR0\Partition1
19:27:15.0473 7232 \Device\Harddisk0\DR0\Partition1 - ok
19:27:15.0503 7232 [ 27FE366BD04DC904B2B349E2762CAE46 ] \Device\Harddisk0\DR0\Partition2
19:27:15.0505 7232 \Device\Harddisk0\DR0\Partition2 - ok
19:27:15.0519 7232 [ 919A1077626CF377D59754105093C90B ] \Device\Harddisk0\DR0\Partition3
19:27:15.0521 7232 \Device\Harddisk0\DR0\Partition3 - ok
19:27:15.0521 7232 ============================================================
19:27:15.0521 7232 Scan finished
19:27:15.0521 7232 ============================================================
19:27:15.0533 6704 Detected object count: 9
19:27:15.0534 6704 Actual detected object count: 9
19:27:55.0661 6704 AcronisOSSReinstallSvc ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0661 6704 AcronisOSSReinstallSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0665 6704 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0666 6704 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0666 6704 FsUsbExService ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0667 6704 FsUsbExService ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0669 6704 libusb0 ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0669 6704 libusb0 ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0673 6704 Netaapl ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0673 6704 Netaapl ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0675 6704 Ser2pl ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0676 6704 Ser2pl ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0677 6704 SIoctl ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0678 6704 SIoctl ( UnsignedFile.Multi.Generic ) - User select action: Skip
19:27:55.0680 6704 sptd ( LockedFile.Multi.Generic ) - skipped by user
19:27:55.0680 6704 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
19:27:55.0683 6704 USBAAPL ( UnsignedFile.Multi.Generic ) - skipped by user
19:27:55.0683 6704 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg 12.03.2013 20:04
hi,
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

aoxo 13.03.2013 00:00
Code:
ComboFix 13-03-12.01 - Didi 12.03.2013  23:46:03.1.2 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3062.1578 [GMT 1:00]
ausgeführt von:: c:\users\Didi\Desktop\ComboFix.exe
AV: Panda Cloud Antivirus *Disabled/Updated* {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
FW: Cloud Antivirus Firewall *Disabled* {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}
SP: Panda Cloud Antivirus *Disabled/Updated* {8F3797EF-DB90-F073-3C72-40C753554CD1}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-02-12 bis 2013-03-12  ))))))))))))))))))))))))))))))
.
.
2013-03-12 22:55 . 2013-03-12 22:55        --------        d-----w-        c:\users\DefaultAppPool\AppData\Local\temp
2013-03-12 22:55 . 2013-03-12 22:55        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-03-09 14:21 . 2013-02-08 00:45        6954968        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7A713F1C-9CF3-4381-BE6F-8A175E8E9167}\mpengine.dll
2013-03-08 08:49 . 2013-03-08 08:49        --------        d-----w-        c:\users\Didi\AppData\Roaming\Malwarebytes
2013-03-08 08:48 . 2013-03-08 08:48        --------        d-----w-        c:\programdata\Malwarebytes
2013-03-08 08:48 . 2013-03-08 08:48        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2013-03-08 08:48 . 2012-12-14 15:49        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-03-08 08:43 . 2013-03-08 08:43        --------        d-----w-        c:\users\Didi\AppData\Roaming\GoforFiles
2013-03-08 08:11 . 2013-03-08 08:11        --------        d-----w-        C:\_OTL
2013-03-07 13:45 . 2013-03-07 14:40        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2013-03-07 13:44 . 2013-03-08 10:46        --------        d-----w-        c:\program files\Spybot - Search & Destroy 2
2013-03-07 13:44 . 2013-03-07 13:44        --------        d-----w-        c:\users\Didi\AppData\Local\Programs
2013-03-07 13:09 . 2013-03-07 13:09        --------        d-----w-        c:\program files\Enigma Software Group
2013-03-07 13:08 . 2013-03-07 13:08        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2013-03-07 10:45 . 2013-03-07 10:45        94112        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2013-03-07 10:40 . 2013-03-07 10:40        --------        d-----w-        c:\users\Didi\AppData\Roaming\QuickScan
2013-02-19 12:53 . 2013-02-19 12:53        --------        d-----w-        c:\users\Didi\.gstreamer-0.10
2013-02-19 12:45 . 2013-02-19 13:17        --------        d-----w-        c:\users\Didi\.dreamstream
2013-02-19 12:45 . 2013-02-19 12:45        --------        d-----w-        c:\program files\DreamStream-E2
2013-02-15 22:04 . 2013-02-15 22:04        208448        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
2013-02-14 05:35 . 2013-01-04 03:00        2347008        ----a-w-        c:\windows\system32\win32k.sys
2013-02-14 05:33 . 2012-12-26 04:49        760320        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 18:48 . 2013-01-04 04:50        169984        ----a-w-        c:\windows\system32\winsrv.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-07 10:44 . 2012-07-12 09:04        861088        ----a-w-        c:\windows\system32\npDeployJava1.dll
2013-03-07 10:44 . 2010-05-11 18:37        782240        ----a-w-        c:\windows\system32\deployJava1.dll
2013-01-17 00:28 . 2009-10-03 07:49        232336        ------w-        c:\windows\system32\MpSigStub.exe
2013-01-09 20:45 . 2013-01-09 20:45        95584        ----a-w-        c:\windows\system32\drivers\NNSHttps.sys
2012-12-16 14:13 . 2012-12-25 07:24        295424        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-25 07:24        34304        ----a-w-        c:\windows\system32\atmlib.dll
2013-03-09 14:17 . 2013-03-09 14:17        263064        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-08-06 381440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2011-07-31 189808]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"PSUAMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe" [2013-01-27 32480]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 02:12        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"Google Update"="c:\users\Didi\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CloneCDTray"="c:\program files\CloneCD\CloneCDTray.exe" /s
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"AcronisTimounterMonitor"=c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;c:\windows\system32\DRIVERS\NNSNAHSL.sys [x]
R2 MoboroboDeviceService;Moborobo Device Service;c:\program files\Moborobo\MoboroboDeviceService.exe [x]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 PS3 Media Server;PS3 Media Server;c:\program files\PS3 Media Server\win32\service\wrapper.exe [x]
R3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\DRIVERS\rcblan.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
R3 SIoctl;SIoctl;c:\windows\system32\drivers\sioctl.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NNSPIHSW;NNSPIHSW;c:\windows\system32\DRIVERS\NNSPihsw.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 NNSALPC;NNSALPC;c:\windows\system32\DRIVERS\NNSAlpc.sys [x]
S1 NNSHTTP;NNSHTTP;c:\windows\system32\DRIVERS\NNSHttp.sys [x]
S1 NNSHTTPS;NNSHTTPS;c:\windows\system32\DRIVERS\NNSHttps.sys [x]
S1 NNSIDS;NNSIDS;c:\windows\system32\DRIVERS\NNSIds.sys [x]
S1 NNSPICC;NNSPICC;c:\windows\system32\DRIVERS\NNSPicc.sys [x]
S1 NNSPOP3;NNSPOP3;c:\windows\system32\DRIVERS\NNSPop3.sys [x]
S1 NNSPROT;NNSPROT;c:\windows\system32\DRIVERS\NNSProt.sys [x]
S1 NNSPRV;NNSPRV;c:\windows\system32\DRIVERS\NNSPrv.sys [x]
S1 NNSSMTP;NNSSMTP;c:\windows\system32\DRIVERS\NNSSmtp.sys [x]
S1 NNSSTRM;NNSSTRM;c:\windows\system32\DRIVERS\NNSStrm.sys [x]
S1 NNSTLSC;NNSTLSC;c:\windows\system32\DRIVERS\NNSTlsc.sys [x]
S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [x]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [x]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [x]
S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [x]
S2 ogmservice;Online Games Manager;c:\program files\Online Games Manager\ogmservice.exe [x]
S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [x]
S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [x]
S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [x]
S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [x]
S2 PSUAService;Panda Product Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSUAService.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [x]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 67035283
*NewlyCreated* - FSUSBEXDISK
*Deregistered* - 67035283
*Deregistered* - PSKMAD
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs        REG_MULTI_SZ          w3svc was
apphost        REG_MULTI_SZ          apphostsvc
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 15:39]
.
2013-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 15:39]
.
2013-03-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001Core.job
- c:\users\Didi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-25 07:19]
.
2013-03-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1392898032-1716291131-2285585058-1001UA.job
- c:\users\Didi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-25 07:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = local;*.local;192.168.*.*
IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Didi\AppData\Roaming\Mozilla\Firefox\Profiles\tcyumvmt.default\
.
.
------- Dateityp-Verknüpfung -------
.
.txt=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{c840e246-6b95-475e-9bd7-caa1c7eca9f2} - (no file)
MSConfigStartUp-BDRegion - c:\program files\Cyberlink\Shared Files\brs.exe
MSConfigStartUp-PDVD9LanguageShortcut - c:\program files\CyberLink\PowerDVD9\Language\Language.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(1520)
c:\windows\system32\relog_ap.DLL
.
Zeit der Fertigstellung: 2013-03-12  23:58:10
ComboFix-quarantined-files.txt  2013-03-12 22:58
.
Vor Suchlauf: 9.335.279.616 Bytes frei
Nach Suchlauf: 9.109.065.728 Bytes frei
.
- - End Of File - - 322E02209AD8C851808B4DB1BEA0E54B

markusg 13.03.2013 18:42
Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131