Windows Dienste werden "unerwartet beendet" obwohl System neu Aufgesetzt
Aloah,
bin gerade am verzweifeln.
Vor ca 2 Monaten habe ich mein System neu aufgestzt.
Es besteht aus:
Phenom II X4 BE @ 3,6 GHZ
Gigabyte MA790GP-UD4H
4Gig DDR2 800 Ram (2 Riegel)
Asus HD7870 DC II
In dieser Konfiguration läuft das System (ausser Graka) seit Jahren ohne Probleme und Stabil. Zuvor lief eine GTX470 drin.
Das Problem besteht nu laso darin, daß sich seit dem letzten Aufsetzen des Systems immer wieder, ohne irgendwelche Regelmässigkeiten, diverse Windows Dienste verabschieden.
Die Nachricht lautet immer : Windows muss heruntergefahren werden weil Dienst XY sich verabschiedet hat.
Habe mich natürlich im Netz schlau gemacht, auch verschiedene Hilfestellungen wie z.B. webkit/rootkit-scanner drüber laufen lassen, verschiedene Virenscanner, aber nie kam etwas bei rum.
Nun habe ich heute mein System aus lauter Frust neu aufgestzt, das Problem blieb allerdings.
Vorhin hat sich dann glaube der USB Dienst verabschiedet.
Da ich nun gar keine Ahnung mehr habe wende ich mich mal hoffnungsvoll an euch.
Hab auch mal ein OTL Scan gemacht.
Dies ist das Ergebnis :OTL Logfile:
OTL EXTRAS Logfile: Code:
OTL logfile created on: 04.05.2013 00:44:41 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,67 Gb Available Physical Memory | 66,68% Memory free
7,99 Gb Paging File | 5,88 Gb Available in Paging File | 73,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 85,59 Gb Free Space | 71,84% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 50,17 Gb Free Space | 51,38% Space Free | Partition Type: NTFS
Drive E: | 97,66 Gb Total Space | 45,90 Gb Free Space | 47,00% Space Free | Partition Type: NTFS
Drive F: | 102,77 Gb Total Space | 61,30 Gb Free Space | 59,65% Space Free | Partition Type: NTFS
Computer Name: VEKT-PC | User Name: Vekt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Razer\Naga\NagaTray.exe (Razer USA Ltd)
========== Modules (No Company Name) ==========
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll ()
MOD - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Users\Vekt\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RzSynapse) -- C:\Windows\SysNative\drivers\RzSynapse.sys (Razer USA Ltd)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 75 7E A8 6F 33 48 CE 01 [binary data]
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-414264832-2720229266-3161670481-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - Extension: Google Docs = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Mail = C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga\NagaTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{304A4617-0092-456B-9A2E-6106B7026458}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.05.03 22:08:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DEFIANCE
[2013.05.03 22:08:22 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Defiance
[2013.05.03 21:48:11 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\AMD
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\ATI
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\ATI
[2013.05.03 21:48:05 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.05.03 21:47:04 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2013.05.03 21:47:04 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2013.05.03 21:47:04 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2013.05.03 21:47:04 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2013.05.03 21:47:04 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2013.05.03 21:47:04 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2013.05.03 21:47:03 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2013.05.03 21:47:03 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2013.05.03 21:47:03 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2013.05.03 21:47:03 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2013.05.03 21:47:03 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2013.05.03 21:47:03 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2013.05.03 21:47:03 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2013.05.03 21:47:03 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2013.05.03 21:47:03 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2013.05.03 21:47:03 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2013.05.03 21:47:03 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2013.05.03 21:47:03 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2013.05.03 21:47:03 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2013.05.03 21:47:03 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2013.05.03 21:47:03 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2013.05.03 21:47:03 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2013.05.03 21:47:03 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2013.05.03 21:47:03 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2013.05.03 21:47:02 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll
[2013.05.03 21:47:02 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll
[2013.05.03 21:47:02 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll
[2013.05.03 21:47:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2013.05.03 21:47:02 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll
[2013.05.03 21:47:02 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll
[2013.05.03 21:47:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll
[2013.05.03 21:47:02 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2013.05.03 21:47:02 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll
[2013.05.03 21:47:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll
[2013.05.03 21:47:02 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll
[2013.05.03 21:47:02 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll
[2013.05.03 21:47:01 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll
[2013.05.03 21:47:01 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll
[2013.05.03 21:47:01 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll
[2013.05.03 21:47:01 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll
[2013.05.03 21:47:01 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.05.03 21:47:01 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll
[2013.05.03 21:47:01 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll
[2013.05.03 21:47:01 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll
[2013.05.03 21:47:01 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll
[2013.05.03 21:47:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll
[2013.05.03 21:47:01 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll
[2013.05.03 21:47:01 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll
[2013.05.03 21:47:01 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll
[2013.05.03 21:47:01 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll
[2013.05.03 21:47:01 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll
[2013.05.03 21:47:01 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll
[2013.05.03 21:47:00 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll
[2013.05.03 21:47:00 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2013.05.03 21:47:00 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll
[2013.05.03 21:47:00 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll
[2013.05.03 21:47:00 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll
[2013.05.03 21:47:00 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll
[2013.05.03 21:47:00 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll
[2013.05.03 21:47:00 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll
[2013.05.03 21:47:00 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll
[2013.05.03 21:47:00 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll
[2013.05.03 21:47:00 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll
[2013.05.03 21:47:00 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll
[2013.05.03 21:46:59 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll
[2013.05.03 21:46:59 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll
[2013.05.03 21:46:59 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll
[2013.05.03 21:46:59 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll
[2013.05.03 21:46:59 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll
[2013.05.03 21:46:59 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll
[2013.05.03 21:46:59 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll
[2013.05.03 21:46:59 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll
[2013.05.03 21:46:59 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll
[2013.05.03 21:46:59 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll
[2013.05.03 21:46:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll
[2013.05.03 21:46:59 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll
[2013.05.03 21:46:59 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll
[2013.05.03 21:46:59 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll
[2013.05.03 21:46:59 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll
[2013.05.03 21:46:59 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll
[2013.05.03 21:46:59 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll
[2013.05.03 21:46:59 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll
[2013.05.03 21:46:58 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll
[2013.05.03 21:46:58 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll
[2013.05.03 21:46:58 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll
[2013.05.03 21:46:58 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll
[2013.05.03 21:46:58 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll
[2013.05.03 21:46:58 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll
[2013.05.03 21:46:58 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll
[2013.05.03 21:46:58 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll
[2013.05.03 21:46:58 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll
[2013.05.03 21:46:58 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll
[2013.05.03 21:46:57 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll
[2013.05.03 21:46:57 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll
[2013.05.03 21:46:57 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll
[2013.05.03 21:46:57 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll
[2013.05.03 21:46:57 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll
[2013.05.03 21:46:57 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll
[2013.05.03 21:46:57 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll
[2013.05.03 21:46:57 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll
[2013.05.03 21:46:57 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll
[2013.05.03 21:46:57 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll
[2013.05.03 21:46:57 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll
[2013.05.03 21:46:57 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll
[2013.05.03 21:46:57 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll
[2013.05.03 21:46:57 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll
[2013.05.03 21:46:56 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll
[2013.05.03 21:46:56 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll
[2013.05.03 21:46:56 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll
[2013.05.03 21:46:56 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll
[2013.05.03 21:46:56 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll
[2013.05.03 21:46:56 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll
[2013.05.03 21:46:56 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll
[2013.05.03 21:46:56 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll
[2013.05.03 21:46:56 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll
[2013.05.03 21:46:56 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll
[2013.05.03 21:46:56 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll
[2013.05.03 21:46:56 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll
[2013.05.03 21:46:55 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll
[2013.05.03 21:46:55 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll
[2013.05.03 21:46:55 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2013.05.03 21:46:55 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2013.05.03 21:46:55 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll
[2013.05.03 21:46:55 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll
[2013.05.03 21:46:55 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll
[2013.05.03 21:46:55 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll
[2013.05.03 21:46:55 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll
[2013.05.03 21:46:55 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll
[2013.05.03 21:46:55 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll
[2013.05.03 21:46:55 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll
[2013.05.03 21:46:55 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll
[2013.05.03 21:46:55 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll
[2013.05.03 21:46:54 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll
[2013.05.03 21:46:54 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll
[2013.05.03 21:46:54 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll
[2013.05.03 21:46:54 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll
[2013.05.03 21:46:54 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll
[2013.05.03 21:46:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll
[2013.05.03 21:46:54 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll
[2013.05.03 21:46:54 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll
[2013.05.03 21:46:54 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll
[2013.05.03 21:46:54 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll
[2013.05.03 21:46:54 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll
[2013.05.03 21:46:54 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll
[2013.05.03 21:46:53 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll
[2013.05.03 21:46:53 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll
[2013.05.03 21:46:53 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll
[2013.05.03 21:46:53 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2013.05.03 21:46:53 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll
[2013.05.03 21:46:53 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll
[2013.05.03 21:46:53 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll
[2013.05.03 21:46:53 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll
[2013.05.03 21:46:53 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll
[2013.05.03 21:46:53 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll
[2013.05.03 21:46:53 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll
[2013.05.03 21:46:53 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll
[2013.05.03 21:46:53 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll
[2013.05.03 21:46:53 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll
[2013.05.03 21:46:52 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll
[2013.05.03 21:46:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll
[2013.05.03 21:46:52 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll
[2013.05.03 21:46:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll
[2013.05.03 21:46:52 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll
[2013.05.03 21:46:52 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll
[2013.05.03 21:46:51 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll
[2013.05.03 21:46:51 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll
[2013.05.03 21:46:51 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll
[2013.05.03 21:46:51 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll
[2013.05.03 21:46:51 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.05.03 21:46:51 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll
[2013.05.03 21:46:51 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll
[2013.05.03 21:46:51 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll
[2013.05.03 21:46:51 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll
[2013.05.03 21:46:51 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll
[2013.05.03 21:46:51 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll
[2013.05.03 21:46:51 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll
[2013.05.03 21:46:50 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll
[2013.05.03 21:46:50 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll
[2013.05.03 21:46:50 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll
[2013.05.03 21:46:50 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll
[2013.05.03 21:46:50 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll
[2013.05.03 21:46:50 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll
[2013.05.03 21:45:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2013.05.03 21:45:43 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
[2013.05.03 21:45:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSI Afterburner
[2013.05.03 21:43:00 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Avira
[2013.05.03 21:41:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.05.03 21:36:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.05.03 21:36:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamSpeak 3 Client
[2013.05.03 21:35:57 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
[2013.05.03 21:35:54 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\IrfanView
[2013.05.03 21:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView
[2013.05.03 21:35:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
[2013.05.03 21:35:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer
[2013.05.03 21:34:27 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Dropbox
[2013.05.03 21:32:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.05.03 21:32:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.05.03 21:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.05.03 21:32:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2013.05.03 21:32:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.05.03 21:32:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.05.03 21:32:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.05.03 21:32:04 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.05.03 21:32:02 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.05.03 21:31:43 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Dropbox
[2013.05.03 21:31:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.05.03 21:31:30 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.05.03 21:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.05.03 21:30:50 | 000,000,000 | ---D | C] -- C:\AMD
[2013.05.03 21:27:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.05.03 21:27:37 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.03 21:27:37 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.03 21:27:37 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.03 21:27:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.05.03 21:27:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.05.03 21:27:00 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.05.03 21:23:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.05.03 21:22:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.05.03 21:22:50 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Google
[2013.05.03 21:22:46 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Deployment
[2013.05.03 21:22:46 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Apps
[2013.05.03 21:22:22 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2013.05.03 21:22:22 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2013.05.03 21:22:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Diagnostics
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Searches
[2013.05.03 21:20:13 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.05.03 21:20:10 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.05.03 21:20:10 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.05.03 21:20:10 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.05.03 21:20:09 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.05.03 21:20:09 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.05.03 21:20:09 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.05.03 21:20:08 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.05.03 21:20:08 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.05.03 21:20:08 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Identities
[2013.05.03 21:20:06 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Contacts
[2013.05.03 21:20:05 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\VirtualStore
[2013.05.03 21:20:03 | 000,000,000 | --SD | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Videos
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Saved Games
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Pictures
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Music
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Links
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Favorites
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Downloads
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Documents
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\Desktop
[2013.05.03 21:20:03 | 000,000,000 | R--D | C] -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Vorlagen
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Verlauf
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Temporary Internet Files
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Startmenü
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\SendTo
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Recent
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Netzwerkumgebung
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Lokale Einstellungen
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Videos
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Musik
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Eigene Dateien
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Documents\Eigene Bilder
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Druckumgebung
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Cookies
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\AppData\Local\Anwendungsdaten
[2013.05.03 21:20:03 | 000,000,000 | -HSD | C] -- C:\Users\Vekt\Anwendungsdaten
[2013.05.03 21:20:03 | 000,000,000 | -H-D | C] -- C:\Users\Vekt\AppData
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Temp
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Local\Microsoft
[2013.05.03 21:20:03 | 000,000,000 | ---D | C] -- C:\Users\Vekt\AppData\Roaming\Media Center Programs
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.05.03 21:19:56 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.05.03 21:19:54 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.05.03 20:33:33 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.05.03 20:33:24 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.05.04 00:27:46 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.04 00:27:46 | 000,698,688 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.04 00:27:46 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.04 00:27:46 | 000,148,828 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.04 00:27:46 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.04 00:27:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.04 00:23:20 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.04 00:23:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.04 00:23:16 | 3219,251,200 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.04 00:22:38 | 000,016,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 00:22:38 | 000,016,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.03 22:08:23 | 000,001,041 | ---- | M] () -- C:\Users\Vekt\Desktop\DEFIANCE.lnk
[2013.05.03 21:45:43 | 000,001,086 | ---- | M] () -- C:\Users\Vekt\Desktop\MSI Afterburner.lnk
[2013.05.03 21:41:24 | 001,558,224 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.03 21:40:14 | 000,001,047 | ---- | M] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.03 21:40:02 | 000,001,013 | ---- | M] () -- C:\Users\Vekt\Desktop\Dropbox.lnk
[2013.05.03 21:37:52 | 000,275,904 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.03 21:36:20 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.05.03 21:35:57 | 000,000,998 | ---- | M] () -- C:\Users\Vekt\Desktop\IrfanView.lnk
[2013.05.03 21:35:41 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.05.03 21:33:35 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.05.03 20:35:53 | 000,177,271 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.05.03 20:35:53 | 000,177,271 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.05.03 22:08:23 | 000,001,041 | ---- | C] () -- C:\Users\Vekt\Desktop\DEFIANCE.lnk
[2013.05.03 21:45:43 | 000,001,086 | ---- | C] () -- C:\Users\Vekt\Desktop\MSI Afterburner.lnk
[2013.05.03 21:41:24 | 001,558,224 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.03 21:36:20 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.05.03 21:35:57 | 000,000,998 | ---- | C] () -- C:\Users\Vekt\Desktop\IrfanView.lnk
[2013.05.03 21:35:41 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.05.03 21:34:28 | 000,001,013 | ---- | C] () -- C:\Users\Vekt\Desktop\Dropbox.lnk
[2013.05.03 21:33:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.05.03 21:32:19 | 000,001,047 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.03 21:22:51 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.03 21:22:51 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.03 21:20:16 | 000,001,405 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2013.05.03 21:20:14 | 000,001,439 | ---- | C] () -- C:\Users\Vekt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.05.03 20:35:36 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.05.03 20:35:34 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.05.03 20:33:24 | 3219,251,200 | -HS- | C] () -- C:\hiberfil.sys
[2013.03.29 04:13:14 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.03.29 04:13:12 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.03.29 03:38:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.03.29 03:38:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 01:18:46 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.09.28 21:45:06 | 000,247,296 | ---- | C] () -- C:\Windows\SysWow64\rtvcvfw32.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010.11.21 05:23:55 | 014,174,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.11.21 05:24:02 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013.05.04 00:46:49 | 000,000,000 | ---D | M] -- C:\Users\Vekt\AppData\Roaming\Dropbox
[2013.05.03 21:35:54 | 000,000,000 | ---D | M] -- C:\Users\Vekt\AppData\Roaming\IrfanView
========== Purity Check ==========
< End of report >
--- --- ---
--- --- ---OTL EXTRAS Logfile: Code:
OTL Extras logfile created on: 04.05.2013 00:44:41 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,67 Gb Available Physical Memory | 66,68% Memory free
7,99 Gb Paging File | 5,88 Gb Available in Paging File | 73,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 85,59 Gb Free Space | 71,84% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 50,17 Gb Free Space | 51,38% Space Free | Partition Type: NTFS
Drive E: | 97,66 Gb Total Space | 45,90 Gb Free Space | 47,00% Space Free | Partition Type: NTFS
Drive F: | 102,77 Gb Total Space | 61,30 Gb Free Space | 59,65% Space Free | Partition Type: NTFS
Computer Name: VEKT-PC | User Name: Vekt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{21B2E81D-D55C-4D15-A863-3BC254ED613A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{360C46D4-1BE9-4480-B5D4-A825CD050281}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3E08830C-4B1A-40FD-A476-DF090889265F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3E403F00-1544-4932-B537-F7B9E644BF8C}" = rport=137 | protocol=17 | dir=out | app=system |
"{4548C37C-837D-462A-8ED9-6EC8347EAF19}" = lport=445 | protocol=6 | dir=in | app=system |
"{4EDF809D-7490-4012-9C2E-9FFF28F0E8FF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6F8AA8A7-A5C3-49D9-AB1A-09FB5C55D5D9}" = rport=445 | protocol=6 | dir=out | app=system |
"{7AB59707-E5CC-428E-884A-6EE29699BDFB}" = lport=139 | protocol=6 | dir=in | app=system |
"{80B9320D-32C0-47D7-B957-1BD8D33A956A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{815ED569-603B-4446-BC6F-D970DED33058}" = rport=139 | protocol=6 | dir=out | app=system |
"{871CA8E1-80A7-4664-837C-38DDF6216CEB}" = lport=137 | protocol=17 | dir=in | app=system |
"{AC85248B-0913-44C8-90BD-559CC89FDFC0}" = rport=138 | protocol=17 | dir=out | app=system |
"{B46AEF33-6936-43CD-97FF-7CC1D15F3A68}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{C2408342-BDB8-403B-8639-7F9C24643197}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CA1AF24A-F67D-4971-AA5A-2636AA9D8A88}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DAD2F28A-EAFC-4831-9E91-668E169ED0CC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EB0EBB50-E34E-4176-A7B7-3969DD11526A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F5960683-416B-4428-B295-98D7793DFA39}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F8D8A26A-B3C0-4A45-9787-327E93037F72}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F8ED36A8-99F7-4483-8919-91F2FC9436A4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FBFE2EF1-0EE1-4FCF-B548-71C53075B243}" = lport=138 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AA9B22C-7611-4E75-B141-3B663B6656AE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{39EFBFF7-C38A-488F-9074-320CC7808B6C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4612564D-7D93-4813-927A-5334E6AA4C4E}" = protocol=6 | dir=out | app=system |
"{4C1964D9-C20B-4AA0-BC03-BC61EFEFDE36}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{54802692-A5ED-4057-9B92-7EAF63A15A3E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{54C2E3E3-829A-42F6-8B62-28A103DAD8B9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{56AB1CDB-7E17-4D7A-9CE8-9E472E777A23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{60D0859F-D926-4A12-9B8A-4D43E6D5C87D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{67E23298-99AD-4A73-9C66-F1A310AB1F77}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{72027A1D-5C76-4FC7-80ED-FCD178D667D5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{880CF5B4-4051-4087-A6CC-5647AD5F2EC3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9C375D34-8453-4781-B002-A2362A43A782}" = protocol=17 | dir=in | app=c:\users\vekt\appdata\roaming\dropbox\bin\dropbox.exe |
"{A29B828C-C3B1-4737-8B63-716C87A689F2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A43DDCBD-20E4-4157-A95A-548924F928F4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{B08DDCD6-3318-41BC-9A47-278368B92600}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BAE89A95-B343-4F97-B807-18079D685FA1}" = protocol=6 | dir=in | app=c:\users\vekt\appdata\roaming\dropbox\bin\dropbox.exe |
"{DF991CFB-2155-480D-9057-FCD99BD43E8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EBEF5B7E-B9C9-4A4C-AE5C-D1E38D4D340E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F01E6DBA-88BB-4584-963C-FC4F79FE061B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F2B27940-9F3C-4B76-B267-311615CD6651}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F3CF5B38-283D-4597-AE3B-979ACC1C32D2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003B37AE-21F5-5BC5-F5EB-CD60A8928696}" = AMD Accelerated Video Transcoding
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{35D00343-3BFA-46A1-C6DD-FFD770501E0B}" = AMD Drag and Drop Transcoding
"{408DD513-C71C-EF6C-1456-247DD8403E18}" = AMD Steady Video Plug-In
"{6397820D-9FC6-774C-1EF5-CBA09049E426}" = AMD Fuel
"{653B9326-BD45-53BE-681A-A49CAAEE8A3C}" = ccc-utility64
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}" = AMD Catalyst Install Manager
"{AAFE68DD-A2D5-BDBF-E1B2-CB01DEFD6EB0}" = AMD Media Foundation Decoders
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{13464292-6666-B2DB-1B0C-A3FE14DAD1F9}" = CCC Help Dutch
"{338CD56F-1CDC-CF32-33F6-DED2DF92284E}" = CCC Help French
"{46458556-5C46-79A9-A6FF-81DF1F8B2729}" = CCC Help Hungarian
"{519D68B8-A768-4CDC-E4C9-B115D49CED93}" = CCC Help Norwegian
"{51D383BC-D988-8C1E-FAA1-BC5260A32A87}" = CCC Help Polish
"{58C7728C-D226-41B9-AA52-39CCC3ADB65F}_is1" = DEFIANCE
"{5A883D2B-D279-0D01-6E62-B810AFD8CC62}" = Catalyst Control Center InstallProxy
"{67A4760F-9804-CCF6-C319-27840ED77924}" = CCC Help Korean
"{6BE5E4A9-D88B-532D-26E6-883C32BF098A}" = CCC Help Thai
"{6E0D26C1-4265-1D02-4D19-D0A8F6A463F8}" = AMD VISION Engine Control Center
"{79B1FF35-9EA8-48ED-98D6-19ABE004BE89}" = DefianceRuntimes
"{7DD62206-7B6C-E32E-BD11-B49B3B089D16}" = CCC Help Danish
"{9739158D-EDED-D628-9865-1460B5A7FAE3}" = CCC Help Portuguese
"{9809124C-0C4C-2367-7889-1E16D8EF1AAF}" = CCC Help Chinese Standard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A6E1EE9D-01DD-82FD-BDBC-193BCEF9FD5C}" = CCC Help Greek
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB13F192-49FC-A065-F15C-746B10CC43C8}" = CCC Help Japanese
"{AE548812-D611-608D-61C6-7E40F28573A2}" = CCC Help Russian
"{BC63AEF9-1367-9F7C-5926-52E56450EDCD}" = CCC Help Spanish
"{C1E2D27F-B363-588E-8859-9EF7F4EBF418}" = CCC Help Chinese Traditional
"{D76AC809-CCC1-6198-4970-A63FA5CF7DCB}" = CCC Help Swedish
"{DA675EE2-4C04-9699-0EE2-7EF9FE7AB870}" = CCC Help German
"{E06F7C95-4D68-63D9-2231-AA5F8E186FCB}" = CCC Help English
"{E21A8F3C-1ACB-46B1-CE72-E9CF09549DED}" = Catalyst Control Center Localization All
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E2F52AC2-B925-C18F-E1AE-42FBD46ECAC7}" = CCC Help Czech
"{E649AC39-69C0-C6FE-0A54-4752DB5D1FD2}" = Catalyst Control Center Graphics Previews Common
"{E9463114-898C-7C2A-2C47-E9ABC63F5D43}" = CCC Help Finnish
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F3CC3463-C6C2-4667-BDAC-BC517A11628F}" = Razer Naga
"{FF10AC4D-3349-99DA-3E58-5197CEA1D833}" = CCC Help Italian
"{FFEC93FF-C162-C0C3-B5E7-01214B0E5F2D}" = CCC Help Turkish
"Afterburner" = MSI Afterburner 2.3.1
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"IrfanView" = IrfanView (remove only)
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-414264832-2720229266-3161670481-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 03.05.2013 16:04:54 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.05.2013 16:23:04 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 03.05.2013 16:23:15 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 03.05.2013 16:23:16 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 03.05.2013 16:23:18 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 03.05.2013 16:23:25 | Computer Name = Vekt-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 03.05.2013 18:01:34 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe_PlugPlay, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc3c1 Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce7c96e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000026687
ID
des fehlerhaften Prozesses: 0x288 Startzeit der fehlerhaften Anwendung: 0x01ce484984405501
Pfad
der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften
Moduls: C:\Windows\system32\RPCRT4.dll Berichtskennung: cbe5feaa-b43f-11e2-b76a-00241d126209
Error - 03.05.2013 18:22:01 | Computer Name = Vekt-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Patcher.exe, Version: 2.0.0.0, Zeitstempel:
0x517a215d Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.1, Zeitstempel:
0x4d5f0c22 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00001f68 ID des fehlerhaften Prozesses:
0xa08 Startzeit der fehlerhaften Anwendung: 0x01ce484a3fec407f Pfad der fehlerhaften
Anwendung: C:\Users\Vekt\AppData\Local\Defiance\Patcher.exe Pfad des fehlerhaften
Moduls: C:\Windows\system32\MSVCR100.dll Berichtskennung: dfecd7c9-b43f-11e2-b76a-00241d126209
Error - 03.05.2013 18:25:10 | Computer Name = Vekt-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 03.05.2013 16:05:03 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 03.05.2013 16:05:10 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 03.05.2013 16:05:18 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 03.05.2013 16:05:25 | Computer Name = Vekt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 03.05.2013 17:59:43 | Computer Name = Vekt-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?03.?05.?2013 um 23:58:14 unerwartet heruntergefahren.
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "DCOM-Server-Prozessstart" wurde unerwartet beendet. Dies
ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
durchgeführt: Neustart des Computers.
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Plug & Play" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
Neustart des Computers.
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Stromversorgung" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
Neustart des Computers.
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "DCOM-Server-Prozessstart" Korrekturmaßnahmen (Neustart des Computers)
durchzuführen, ist fehlgeschlagen. Fehler: %%1190
Error - 03.05.2013 18:21:28 | Computer Name = Vekt-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Plug & Play" Korrekturmaßnahmen (Neustart des Computers) durchzuführen,
ist fehlgeschlagen. Fehler: %%1190
< End of report >
--- --- ---
und hier noch ein Log von Gmer:
GMER Logfile: Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-04 01:20:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 M4-CT128M4SSD2 rev.0309 119,24GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Vekt\AppData\Local\Temp\kxldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe[2176] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Users\Vekt\AppData\Roaming\Dropbox\bin\Dropbox.exe[2176] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [1648] entry point in ".rdata" section 000000006c6671e6
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076fef9a1 7 bytes {MOV EDX, 0xf64e28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076fefbe5 7 bytes {MOV EDX, 0xf64e68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076fefc15 7 bytes {MOV EDX, 0xf64da8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076fefc2d 7 bytes {MOV EDX, 0xf64d28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076fefc45 7 bytes {MOV EDX, 0xf64f28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076fefc75 7 bytes {MOV EDX, 0xf64f68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076fefcf5 7 bytes {MOV EDX, 0xf64ee8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076fefd0d 7 bytes {MOV EDX, 0xf64ea8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076fefd59 7 bytes {MOV EDX, 0xf64c68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076fefe51 7 bytes {MOV EDX, 0xf64ca8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ff00a9 7 bytes {MOV EDX, 0xf64c28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ff10b5 7 bytes {MOV EDX, 0xf64de8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ff112d 7 bytes {MOV EDX, 0xf64d68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ff1331 7 bytes {MOV EDX, 0xf64ce8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076fef9a1 7 bytes {MOV EDX, 0x66aa28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076fefbe5 7 bytes {MOV EDX, 0x66aa68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076fefc15 7 bytes {MOV EDX, 0x66a9a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076fefc2d 7 bytes {MOV EDX, 0x66a928; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076fefc45 7 bytes {MOV EDX, 0x66ab28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076fefc75 7 bytes {MOV EDX, 0x66ab68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076fefcf5 7 bytes {MOV EDX, 0x66aae8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076fefd0d 7 bytes {MOV EDX, 0x66aaa8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076fefd59 7 bytes {MOV EDX, 0x66a868; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076fefe51 7 bytes {MOV EDX, 0x66a8a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ff00a9 7 bytes {MOV EDX, 0x66a828; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ff10b5 7 bytes {MOV EDX, 0x66a9e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ff112d 7 bytes {MOV EDX, 0x66a968; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ff1331 7 bytes {MOV EDX, 0x66a8e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076fef9a1 7 bytes {MOV EDX, 0x37ba28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076fefbe5 7 bytes {MOV EDX, 0x37ba68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076fefc15 7 bytes {MOV EDX, 0x37b9a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076fefc2d 7 bytes {MOV EDX, 0x37b928; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076fefc45 7 bytes {MOV EDX, 0x37bb28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076fefc75 7 bytes {MOV EDX, 0x37bb68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076fefcf5 7 bytes {MOV EDX, 0x37bae8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076fefd0d 7 bytes {MOV EDX, 0x37baa8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076fefd59 7 bytes {MOV EDX, 0x37b868; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076fefe51 7 bytes {MOV EDX, 0x37b8a8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ff00a9 7 bytes {MOV EDX, 0x37b828; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ff10b5 7 bytes {MOV EDX, 0x37b9e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ff112d 7 bytes {MOV EDX, 0x37b968; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ff1331 7 bytes {MOV EDX, 0x37b8e8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076fef9a1 7 bytes {MOV EDX, 0x465e28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076fefbe5 7 bytes {MOV EDX, 0x465e68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076fefc15 7 bytes {MOV EDX, 0x465da8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076fefc2d 7 bytes {MOV EDX, 0x465d28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076fefc45 7 bytes {MOV EDX, 0x465f28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076fefc75 7 bytes {MOV EDX, 0x465f68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076fefcf5 7 bytes {MOV EDX, 0x465ee8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076fefd0d 7 bytes {MOV EDX, 0x465ea8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076fefd59 7 bytes {MOV EDX, 0x465c68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076fefe51 7 bytes {MOV EDX, 0x465ca8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ff00a9 7 bytes {MOV EDX, 0x465c28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ff10b5 7 bytes {MOV EDX, 0x465de8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ff112d 7 bytes {MOV EDX, 0x465d68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ff1331 7 bytes {MOV EDX, 0x465ce8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076fef9a1 7 bytes {MOV EDX, 0xfb0e28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076fefbe5 7 bytes {MOV EDX, 0xfb0e68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076fefc15 7 bytes {MOV EDX, 0xfb0da8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076fefc2d 7 bytes {MOV EDX, 0xfb0d28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076fefc45 7 bytes {MOV EDX, 0xfb0f28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076fefc75 7 bytes {MOV EDX, 0xfb0f68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076fefcf5 7 bytes {MOV EDX, 0xfb0ee8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076fefd0d 7 bytes {MOV EDX, 0xfb0ea8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076fefd59 7 bytes {MOV EDX, 0xfb0c68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076fefe51 7 bytes {MOV EDX, 0xfb0ca8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ff00a9 7 bytes {MOV EDX, 0xfb0c28; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ff10b5 7 bytes {MOV EDX, 0xfb0de8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ff112d 7 bytes {MOV EDX, 0xfb0d68; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ff1331 7 bytes {MOV EDX, 0xfb0ce8; JMP RDX}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076261465 2 bytes [26, 76]
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762614bb 2 bytes [26, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\mmc.exe [2456:2324] 000007fee9c3472c
Thread C:\Windows\system32\mmc.exe [2456:2040] 000007fee9d780ec
Thread C:\Windows\system32\mmc.exe [2456:3524] 000007fefb2f2ab8
Thread C:\Windows\system32\mmc.exe [2456:2508] 000007fee9d780ec
Thread C:\Windows\system32\mmc.exe [2456:4016] 000007fee9d81cfc
Thread C:\Windows\system32\mmc.exe [2456:3420] 000007fee9d780ec
Thread C:\Windows\system32\mmc.exe [2456:712] 000007fee9d780ec
Thread C:\Windows\system32\mmc.exe [2456:2148] 000007fee9c61564
Thread C:\Windows\system32\mmc.exe [2456:1884] 000007fee9d780ec
---- Files - GMER 2.1 ----
File C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005d 0 bytes
File C:\Users\Vekt\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000c8 0 bytes
---- EOF - GMER 2.1 ----
--- --- ---
Hoffnungsvoll
Dremor |
