Trojaner-Board - Schon wieder GVU Virus

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Schon wieder GVU Virus (https://www.trojaner-board.de/135078-schon-gvu-virus.html)

Schon wieder GVU Virus

Hallo,

ich hatte schon mal den GVU und konnte diesen mit der Rescue Disk 10 von Kaspersky entfernen.
Jetzt hab ich ihn nach 2 Monaten erneut aber Kaspersky schafft keine Abhilfe mehr!
Ja, ich habe die neueste Rescue Disk erst heut direkt von deren HP geladen.

Ich habe Windows 7 64 bit

was kann ich noch probieren?

Gruß

Hi
kommst du an nen pc mit brenner?
download:
http://filepony.de/download-otlpe/
und brenne es mit ISOBurner auf eine CD.
ISO Burner - Download - Filepony
isoburner anleitung:
http://www.trojaner-board.de/83208-b...ei-cd-dvd.html
• Wenn der Download fertig ist mache ein doppel Klick auf die OTLPENet.exe, was ISOBurner öffnet um es auf die CD zu brennen.
Starte dein System neu und boote von der CD die du gerade erstellt hast.
Wenn du nicht weist wie du deinen Computer dazu bringst von der CD zu booten,
http://www.trojaner-board.de/81857-c...cd-booten.html

• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs

Ok danke, ich probier das mal aus!

Gruss

lass solche zwischenposts bitte weg, danke

Hi,

"• Mache einen doppel Klick auf das OTLPE Icon."

danach werde ich aufgefordert ein Verzeichnis auszuwählen "Browse for folder"

egal was ich mache:
RunScanner Error
Target is not windows 2000 or later

Was nun?

Gruß

Hi
alles aufklappen, ordner Windows suchen, draufklicken und ab gehts

Ok, gemacht und funktioniert.

Nächstes Problem:
der infizierte Rechner erkennt keinen USBstick, hab schon mehrere probiert.
DSen code abschreiben is etwas mühsam, Internet geht leider auch nicht.
Was kann ich jetzt machen?

Ok, bei einem Neustart erkennt der Rechner den USBstick.

Nun das Log:OTL Logfile:

Code:

OTL logfile created on: 5/19/2013 10:47:20 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System

Internet Explorer (Version = 9.10.9200.16540)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = I: | %SystemRoot% = I:\Windows | %ProgramFiles% = I:\Program Files (x86)

Drive C: | 100.00 Mb Total Space | 74.32 Mb Free Space | 74.32% Space Free | Partition Type: NTFS

Drive D: | 3.60 Gb Total Space | 3.60 Gb Free Space | 100.00% Space Free | Partition Type: FAT32

Drive I: | 921.17 Gb Total Space | 442.72 Gb Free Space | 48.06% Space Free | Partition Type: NTFS

Drive J: | 10.24 Gb Total Space | 1.92 Gb Free Space | 18.72% Space Free | Partition Type: NTFS

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2013/01/27 06:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- I:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV:64bit: - [2013/01/27 06:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2013/05/15 14:28:24 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- I:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013/02/25 18:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto] -- I:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2013/02/23 11:54:28 | 000,805,752 | ---- | M] (Spigot, Inc.) [Auto] -- I:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)

SRV - [2013/01/18 02:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto] -- I:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012/12/10 06:11:44 | 001,342,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- I:\Program Files (x86)\AVG\AVG2013\avgfws.exe -- (avgfws)

SRV - [2012/11/15 18:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- I:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012/10/22 08:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- I:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)

SRV - [2012/07/13 07:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- I:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012/05/29 07:09:52 | 002,143,072 | ---- | M] (TuneUp Software) [Auto] -- I:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)

SRV - [2012/03/21 13:24:04 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand] -- I:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012/03/03 17:39:57 | 000,076,888 | ---- | M] () [Auto] -- I:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)

SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- I:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009/06/04 13:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- I:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013/01/20 10:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- I:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012/11/15 18:33:24 | 000,111,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- I:\Windows\System32\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2012/10/22 08:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- I:\Windows\System32\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2012/10/14 22:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- I:\Windows\System32\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012/10/01 22:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- I:\Windows\System32\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012/09/20 22:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- I:\Windows\System32\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012/09/20 22:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot] -- I:\Windows\System32\drivers\avgloga.sys -- (Avgloga)

DRV:64bit: - [2012/09/13 22:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- I:\Windows\System32\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2012/09/04 05:39:32 | 000,050,296 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- I:\Windows\System32\drivers\avgfwd6a.sys -- (Avgfwfd)

DRV:64bit: - [2011/05/10 02:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011/01/03 04:38:36 | 000,177,128 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)

DRV:64bit: - [2011/01/03 04:38:36 | 000,157,160 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)

DRV:64bit: - [2011/01/03 04:38:36 | 000,145,384 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)

DRV:64bit: - [2011/01/03 04:38:36 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)

DRV:64bit: - [2010/12/21 01:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand] -- I:\Windows\System32\drivers\ssadadb.sys -- (androidusb)

DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010/07/20 14:37:23 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- I:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2009/12/02 16:56:38 | 000,314,016 | ---- | M] () [Kernel | Auto] -- I:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2009/12/02 16:56:38 | 000,043,680 | ---- | M] () [Kernel | Auto] -- I:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2009/07/13 10:31:42 | 000,233,472 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- I:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- I:\Windows\System32\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/05/19 17:48:42 | 000,702,976 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\netr28x.sys -- (netr28x)

DRV - [2012/05/08 09:21:42 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand] -- I:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\Sentencer_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

IE - HKU\Sentencer_ON_I\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

IE - HKU\Sentencer_ON_I\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - Reg Error: Key error. File not found

IE - HKU\Sentencer_ON_I\..\URLSearchHook: {238d4b4c-d63c-42a7-b6d8-dc96c8c0f5b9} - Reg Error: Key error. File not found

IE - HKU\Sentencer_ON_I\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - Reg Error: Key error. File not found

IE - HKU\Sentencer_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Sentencer_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

IE - HKU\UpdatusUser_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

IE - HKU\UpdatusUser_ON_I\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome_first&locale=de_DE&c=94&bd=Pavilion&pf=cndt

IE - HKU\UpdatusUser_ON_I\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\System32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: I:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: I:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.110.0:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.122.0: I:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.138.0: I:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: I:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: I:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nexon.net/NxGame: I:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: I:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: I:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: I:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: I:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/26 09:56:22 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/02 06:44:02 | 000,000,000 | ---D | M]

 

[2011/12/26 18:02:43 | 000,000,000 | ---D | M] (No name found) -- I:\Program Files (x86)\Mozilla Firefox\extensions

[2011/08/24 14:20:10 | 000,000,000 | ---D | M] (Click to call with Skype) -- I:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2010/12/31 12:22:58 | 000,000,000 | ---D | M] (Java Console) -- I:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011/05/25 15:38:57 | 000,000,000 | ---D | M] (Java Console) -- I:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}

[2011/04/13 23:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- I:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010/03/31 12:53:33 | 000,238,776 | ---- | M] (Pando Networks) -- I:\Program Files (x86)\mozilla firefox\plugins\npPandoWebInst.dll

[2009/12/02 04:31:53 | 000,001,392 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2009/12/02 04:31:53 | 000,002,344 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2009/12/02 04:31:53 | 000,006,805 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2009/12/02 04:31:53 | 000,001,178 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2009/12/02 04:31:53 | 000,000,801 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - I:\Windows\System32\drivers\etc\hosts

O2 - BHO: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - I:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

O2 - BHO: (YouTubeAnywhere) - {8015C430-448C-4003-A969-274F7F0F2D9C} - I:\Users\Sentencer\AppData\LocalLow\YouTubeAnywhere\IE\YouTubeAnywhere.dll (Diego Casorran)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - I:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - I:\Program Files (x86)\pdfforge Toolbar\IE\7.0\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O3 - HKLM\..\Toolbar: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - I:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - I:\Program Files (x86)\pdfforge Toolbar\IE\7.0\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKU\Sentencer_ON_I\..\Toolbar\WebBrowser: (DVDVideoSoftTB DE Toolbar) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - I:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

O4:64bit: - HKLM..\Run: [IAAnotif] I:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] I:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [SmartMenu] I:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [APSDaemon] I:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [AVG_UI] I:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [BATINDICATOR] I:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe (Hewlett-Packard)

O4 - HKLM..\Run: [HP Remote Solution] I:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()

O4 - HKLM..\Run: [hpsysdrv] I:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)

O4 - HKLM..\Run: [LaunchHPOSIAPP] I:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe (Hewlett-Packard)

O4 - HKLM..\Run: [SearchSettings] I:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [UpdatePRCShortCut] I:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKU\LocalService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\Sentencer_ON_I..\Run: [DAEMON Tools Lite] I:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\Sentencer_ON_I..\Run: [KiesHelper] I:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)

O4 - HKU\Sentencer_ON_I..\Run: [KiesPDLR] I:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

O4 - HKU\Sentencer_ON_I..\Run: [KiesTrayAgent] I:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKU\Sentencer_ON_I..\Run: [Pando Media Booster] I:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()

O4 - HKU\Sentencer_ON_I..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] I:\Users\Sentencer\Documents\4848370d.exe ()

O4 - HKU\Sentencer_ON_I..\Run: [Steam] I:\games\Steam\Steam.exe (Valve Corporation)

O4 - HKU\UpdatusUser_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\LocalService_ON_I..\RunOnce: [mctadmin]  File not found

O4 - HKU\NetworkService_ON_I..\RunOnce: [mctadmin]  File not found

O4 - HKU\Sentencer_ON_I..\RunOnce: [osk.exe] I:\Windows\SysWow64\osk.exe (Microsoft Corporation)

O4 - HKU\UpdatusUser_ON_I..\RunOnce: [mctadmin]  File not found

O4 - Startup: Error locating startup folders.

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 41975 = C:\PROGRA~3\LOCALS~1\Temp\msuouoxqc.pif

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\Sentencer_ON_I\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - I:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - I:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - I:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\Sentencer_ON_I Winlogon: Shell - (Explorer.exe) - I:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

 

 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013/05/15 17:53:49 | 000,000,000 | -HSD | C] -- I:\found.000

[2012/10/01 18:08:49 | 000,044,544 | ---- | C] (Microsoft Corporation) -- I:\ProgramData\lsass.exe

[1 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013/05/16 16:45:16 | 000,067,584 | --S- | M] () -- I:\Windows\bootstat.dat

[2013/05/16 16:44:16 | 000,001,112 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013/05/16 16:44:06 | 529,854,463 | -HS- | M] () -- I:\hiberfil.sys

[2013/05/16 16:28:00 | 000,000,884 | ---- | M] () -- I:\Windows\tasks\Adobe Flash Player Updater.job

[2013/05/16 00:18:00 | 000,001,116 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013/05/15 17:56:12 | 000,003,480 | ---- | M] () -- I:\bootsqm.dat

[2013/05/15 16:20:28 | 000,163,070 | ---- | M] () -- I:\Users\Sentencer\AppData\Roaming\2433f433

[2013/05/15 16:20:28 | 000,163,019 | ---- | M] () -- I:\ProgramData\2433f433

[2013/05/15 16:20:28 | 000,162,993 | ---- | M] () -- I:\Users\Sentencer\AppData\Local\2433f433

[2013/05/15 16:20:26 | 000,025,088 | ---- | M] () -- I:\Users\Sentencer\Documents\4848370d.exe

[2013/05/15 14:28:24 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- I:\Windows\SysWow64\FlashPlayerApp.exe

[2013/05/15 14:28:24 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- I:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2013/05/13 14:22:41 | 000,710,854 | ---- | M] () -- I:\Windows\System32\perfh007.dat

[2013/05/13 14:22:41 | 000,663,876 | ---- | M] () -- I:\Windows\System32\perfh009.dat

[2013/05/13 14:22:41 | 000,153,964 | ---- | M] () -- I:\Windows\System32\perfc007.dat

[2013/05/13 14:22:41 | 000,126,006 | ---- | M] () -- I:\Windows\System32\perfc009.dat

[2013/05/08 10:58:58 | 000,015,792 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013/05/08 10:58:58 | 000,015,792 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013/04/30 12:10:29 | 000,000,552 | ---- | M] () -- I:\Windows\tasks\PCDRScheduledMaintenance.job

[2013/04/21 08:03:53 | 000,000,004 | ---- | M] () -- I:\Users\Sentencer\AppData\Roaming\skype.ini

[1 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013/05/15 17:56:12 | 000,003,480 | ---- | C] () -- I:\bootsqm.dat

[2013/05/15 16:20:28 | 000,163,070 | ---- | C] () -- I:\Users\Sentencer\AppData\Roaming\2433f433

[2013/05/15 16:20:28 | 000,163,019 | ---- | C] () -- I:\ProgramData\2433f433

[2013/05/15 16:20:28 | 000,162,993 | ---- | C] () -- I:\Users\Sentencer\AppData\Local\2433f433

[2013/05/15 16:20:26 | 000,025,088 | ---- | C] () -- I:\Users\Sentencer\Documents\4848370d.exe

[2013/04/21 08:03:29 | 000,000,004 | ---- | C] () -- I:\Users\Sentencer\AppData\Roaming\skype.ini

[2013/03/29 07:12:27 | 000,000,004 | ---- | C] () -- I:\Users\Sentencer\AppData\Roaming\AltShell.ini

[2012/10/01 18:08:50 | 083,023,306 | ---- | C] () -- I:\ProgramData\dsgsdgdsgdsgw.pad

[2012/09/03 16:31:09 | 083,023,306 | ---- | C] () -- I:\ProgramData\nud0repor.pad

[2012/08/31 03:48:12 | 004,503,728 | ---- | C] () -- I:\ProgramData\ism_0_llatsni.pad

[2012/03/22 15:09:46 | 000,007,604 | ---- | C] () -- I:\Users\Sentencer\AppData\Local\Resmon.ResmonCfg

[2011/07/03 15:05:51 | 000,114,180 | -H-- | C] () -- I:\Windows\SysWow64\mlfcache.dat

[2011/06/08 17:23:54 | 000,252,928 | ---- | C] () -- I:\Windows\SysWow64\DShowRdpFilter.dll

[2011/06/07 05:13:38 | 000,974,848 | ---- | C] () -- I:\Windows\SysWow64\cis-2.4.dll

[2011/06/07 05:13:38 | 000,081,920 | ---- | C] () -- I:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011/06/07 05:13:38 | 000,065,536 | ---- | C] () -- I:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011/06/07 05:13:38 | 000,057,344 | ---- | C] () -- I:\Windows\SysWow64\issacapi_se-2.3.dll

[2011/06/07 05:13:38 | 000,030,568 | ---- | C] () -- I:\Windows\MusiccityDownload.exe

[2010/09/25 15:34:24 | 000,006,144 | ---- | C] () -- I:\Users\Sentencer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/09/16 22:03:59 | 002,601,752 | R--- | C] () -- I:\Windows\SysWow64\pbsvc_moh.exe

[2010/07/20 14:43:25 | 000,000,400 | ---- | C] () -- I:\Windows\ODBC.INI

[2010/04/08 14:22:43 | 002,434,856 | ---- | C] () -- I:\Windows\SysWow64\pbsvc_bc2.exe

[2010/01/27 15:40:04 | 000,000,228 | ---- | C] () -- I:\Users\Sentencer\AppData\Roaming\wklnhst.dat

[2010/01/15 16:17:20 | 000,015,873 | ---- | C] () -- I:\Windows\SysWow64\Inetde.dll

[2010/01/11 01:13:33 | 000,000,097 | ---- | C] () -- I:\Users\Sentencer\AppData\Local\fusioncache.dat

[2010/01/10 11:18:20 | 001,670,454 | ---- | C] () -- I:\Windows\SysWow64\PerfStringBackup.INI

[2010/01/10 11:14:11 | 000,281,520 | ---- | C] () -- I:\Windows\SysWow64\PnkBstrB.exe

[2010/01/10 11:14:10 | 000,669,184 | ---- | C] () -- I:\Windows\SysWow64\pbsvc.exe

[2010/01/10 11:14:10 | 000,076,888 | ---- | C] () -- I:\Windows\SysWow64\PnkBstrA.exe

[2009/12/29 19:48:49 | 000,000,056 | -H-- | C] () -- I:\Windows\SysWow64\ezsidmv.dat

[2009/12/28 12:47:01 | 000,000,281 | ---- | C] () -- I:\Windows\game.ini

[2009/12/25 13:50:20 | 000,000,000 | ---- | C] () -- I:\Windows\nsreg.dat

[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- I:\Windows\bootstat.dat

[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- I:\Windows\SysWow64\NOISE.DAT

[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- I:\Windows\SysWow64\dssec.dat

[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- I:\Windows\mib.bin

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- I:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- I:\Windows\SysWow64\ir32_32.dll

[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- I:\Windows\SysWow64\msjetoledb40.dll

[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- I:\Windows\SysWow64\mlang.dat

[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- I:\Windows\SysWow64\OUTLPERF.INI

[1999/12/31 20:00:00 | 000,000,023 | RHS- | C] () -- I:\Windows\mtlid64s2.dat

 
 ========== LOP Check ==========

 

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\ProgramData\Anwendungsdaten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Application Data

[2013/03/29 07:32:38 | 000,000,000 | ---D | M] -- I:\ProgramData\AVG2013

[2012/08/03 15:43:08 | 000,000,000 | -H-D | M] -- I:\ProgramData\Common Files

[2010/07/20 14:37:04 | 000,000,000 | ---D | M] -- I:\ProgramData\DAEMON Tools Lite

[2010/07/20 14:36:12 | 000,000,000 | ---D | M] -- I:\ProgramData\DAEMON Tools Pro

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Desktop

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Documents

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\ProgramData\Dokumente

[2010/11/03 16:37:07 | 000,000,000 | -HSD | M] -- I:\ProgramData\DSS

[2011/11/26 13:18:56 | 000,000,000 | ---D | M] -- I:\ProgramData\EA Core

[2012/03/03 17:32:17 | 000,000,000 | ---D | M] -- I:\ProgramData\EA Logs

[2011/11/26 13:18:58 | 000,000,000 | ---D | M] -- I:\ProgramData\Electronic Arts

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favoriten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favorites

[2012/01/03 12:49:49 | 000,000,000 | ---D | M] -- I:\ProgramData\Firefly Studios

[2012/03/03 10:21:52 | 000,000,000 | ---D | M] -- I:\ProgramData\Local Settings

[2013/05/11 03:16:40 | 000,000,000 | ---D | M] -- I:\ProgramData\MFAData

[2010/03/31 13:31:51 | 000,000,000 | ---D | M] -- I:\ProgramData\NexonUS

[2012/10/12 14:07:43 | 000,000,000 | ---D | M] -- I:\ProgramData\Origin

[2009/09/22 11:36:00 | 000,000,000 | ---D | M] -- I:\ProgramData\PC-Doctor for Windows

[2010/03/31 12:54:20 | 000,000,000 | ---D | M] -- I:\ProgramData\PMB Files

[2012/11/03 20:53:45 | 000,000,000 | ---D | M] -- I:\ProgramData\Recovery

[2011/06/26 05:06:35 | 000,000,000 | ---D | M] -- I:\ProgramData\Samsung

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Start Menu

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\ProgramData\Startmenü

[2009/12/02 16:58:31 | 000,000,000 | ---D | M] -- I:\ProgramData\Tages

[2009/09/22 11:40:35 | 000,000,000 | ---D | M] -- I:\ProgramData\Temp

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Templates

[2012/10/15 03:57:56 | 000,000,000 | ---D | M] -- I:\ProgramData\tmp

[2012/08/03 15:43:59 | 000,000,000 | ---D | M] -- I:\ProgramData\TuneUp Software

[2009/12/30 06:47:49 | 000,000,000 | ---D | M] -- I:\ProgramData\Ubisoft

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\ProgramData\Vorlagen

[2012/10/01 18:14:43 | 000,000,000 | -HSD | M] -- I:\ProgramData\x0daD6zqzvw

[2012/08/03 15:43:08 | 000,000,000 | -HSD | M] -- I:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}

[2011/12/26 16:42:21 | 000,000,000 | ---D | M] -- I:\ProgramData\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}

[2011/07/02 14:12:19 | 000,000,000 | ---D | M] -- I:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2009/09/22 11:25:00 | 000,000,000 | -H-D | M] -- I:\ProgramData\{ADCBF7A8-716E-4B21-AF03-E3F11C06C309}

[2013/04/30 12:10:29 | 000,000,552 | ---- | M] () -- I:\Windows\Tasks\PCDRScheduledMaintenance.job

[2013/04/10 21:27:14 | 000,032,632 | ---- | M] () -- I:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2013/03/29 07:30:34 | 000,000,000 | -H-D | M] -- I:\$AVG

[2011/07/03 15:07:18 | 000,000,000 | -HSD | M] -- I:\$Recycle.Bin

[2010/07/18 11:53:31 | 000,000,000 | ---D | M] -- I:\Alte Kamerakarte

[2013/05/08 14:58:03 | 000,000,000 | ---D | M] -- I:\data

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\Documents and Settings

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\Dokumente und Einstellungen

[2013/05/15 17:53:49 | 000,000,000 | -HSD | M] -- I:\found.000

[2013/01/15 16:03:05 | 000,000,000 | ---D | M] -- I:\games

[2012/09/11 14:56:56 | 000,000,000 | ---D | M] -- I:\Hasi

[2010/02/28 05:20:07 | 000,000,000 | -H-D | M] -- I:\hp

[2009/09/22 11:25:10 | 000,000,000 | ---D | M] -- I:\Intel

[2013/02/08 04:27:56 | 000,000,000 | ---D | M] -- I:\Kamera 8.2.13

[2013/05/16 18:40:02 | 000,000,000 | ---D | M] -- I:\Kaspersky Rescue Disk 10.0

[2010/07/20 14:40:46 | 000,000,000 | RH-D | M] -- I:\MSOCache

[2013/02/02 06:44:13 | 000,000,000 | ---D | M] -- I:\music

[2011/11/27 15:20:51 | 000,000,000 | ---D | M] -- I:\NVIDIA

[2010/04/13 12:36:32 | 000,000,000 | ---D | M] -- I:\PerfLogs

[2012/03/22 14:58:47 | 000,000,000 | R--D | M] -- I:\Program Files

[2013/05/03 21:13:48 | 000,000,000 | ---D | M] -- I:\Program Files (x86)

[2013/05/15 16:20:28 | 000,000,000 | -H-D | M] -- I:\ProgramData

[2009/12/01 17:13:54 | 000,000,000 | -HSD | M] -- I:\Programme

[2010/09/07 04:01:16 | 000,000,000 | ---D | M] -- I:\Sicherung Bilder 7.9

[2010/08/23 17:33:45 | 000,000,000 | ---D | M] -- I:\Sicherung Photo 23_08_10

[2013/05/15 14:30:21 | 000,000,000 | -HSD | M] -- I:\System Volume Information

[2013/04/14 21:07:23 | 000,000,000 | ---D | M] -- I:\Temp

[2010/11/03 09:53:33 | 000,000,000 | ---D | M] -- I:\torrents

[2010/07/12 07:02:57 | 000,000,000 | ---D | M] -- I:\Urlaub 2009

[2011/11/27 16:05:37 | 000,000,000 | R--D | M] -- I:\Users

[2013/04/18 13:30:13 | 000,000,000 | ---D | M] -- I:\Windows

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\drivers\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\drivers\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\SysWOW64\cngaudit.dll

[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\System32\cngaudit.dll

[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007/05/17 15:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- I:\Program Files (x86)\Cyberlink\PowerDirector\EventLog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe

[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- I:\Windows\explorer.exe

[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2009/08/03 02:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe

[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- I:\Windows\SysWOW64\explorer.exe

[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe

[2009/08/03 01:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe

[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe

[2009/08/03 01:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe

[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe

[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

[2009/08/03 02:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- I:\hp\drivers\Intel_Storage\IaStor.sys

[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- I:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- I:\Windows\System32\drivers\iaStor.sys

[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- I:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a012329c4d1be4fd\iaStor.sys

[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- I:\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_023f2cfe3fa02200\iaStor.sys

[2009/06/04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- I:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- I:\Windows\System32\drivers\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- I:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- I:\Windows\System32\netlogon.dll

[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- I:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- I:\Windows\SysWOW64\netlogon.dll

[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- I:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- I:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- I:\Windows\System32\drivers\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- I:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- I:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- I:\Windows\SysWOW64\scecli.dll

[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- I:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- I:\Windows\System32\scecli.dll

[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- I:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- I:\Windows\SysWOW64\user32.dll

[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- I:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- I:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- I:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- I:\Windows\System32\user32.dll

[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- I:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- I:\Windows\SysWOW64\userinit.exe

[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- I:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- I:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- I:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- I:\Windows\System32\userinit.exe

[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- I:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- I:\Windows\System32\winlogon.exe

[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\System32\drivers\ws2ifsl.sys

[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 

Invalid Environment Variable: %USERPROFILE%\*.*

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

 

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 5120 bytes -> I:\Users\Sentencer\AppData\Local:gs5sys

@Alternate Data Stream - 5120 bytes -> I:\ProgramData:gs5sys

@Alternate Data Stream - 4096 bytes -> I:\Users\Public\Documents\desktop.ini:gs5sys

@Alternate Data Stream - 1536 bytes -> I:\Users\Sentencer\Documents\desktop.ini:gs5sys

@Alternate Data Stream - 1536 bytes -> I:\Users\Sentencer\Desktop\desktop.ini:gs5sys

@Alternate Data Stream - 1536 bytes -> I:\Users\Sentencer\AppData\Roaming:gs5sys

< End of report >

--- --- ---

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

:OTL

O4 - HKU\Sentencer_ON_I..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] I:\Users\Sentencer\Documents\4848370d.exe ()

[2012/10/01 18:08:49 | 000,044,544 | ---- | C] (Microsoft Corporation) -- I:\ProgramData\lsass.exe

[2013/05/15 16:20:28 | 000,163,070 | ---- | M] () -- I:\Users\Sentencer\AppData\Roaming\2433f433

[2013/05/15 16:20:28 | 000,163,019 | ---- | M] () -- I:\ProgramData\2433f433

:Files

:Commands

[EMPTYFLASH] 

[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Hi,

hat alles wunderbar geklappt, wie gehts jetzt weiter?
Die Sachen in euren Channel noch hochladen und das wars?

Hmm ich hab noch das Problem, dass meine Maus nicht erkannt wird,
ist dies Problem bekannt?

========== OTL ==========
Registry key HKEY_USERS\Sentencer_ON_I\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
I:\Users\Sentencer\Documents\4848370d.exe moved successfully.
I:\ProgramData\lsass.exe moved successfully.
I:\Users\Sentencer\AppData\Roaming\2433f433 moved successfully.
I:\ProgramData\2433f433 moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Sentencer

User: UpdatusUser

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default

User: Default User

User: Public

User: Sentencer

User: UpdatusUser

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 87487693 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 78140 bytes

Total Files Cleaned = 84.00 mb

OTLPE by OldTimer - Version 3.1.48.0 log created on 05252013_204233

versuch mal nach neustart ob sie wieder geht.
Funkmaus? dann mal evtl. baterieen wechseln.
bzw gucken ob richtig angeschlossen.
Nach upload haben wir noch arbeit.
evtl. mal ne andere Maus zur hand, um zu gucken ob das Problem an der Maus selbst liegt?

Datei: MovedFiles.zip_1 empfangen
Datei: fix2.log empfangen

Vorgang erfolgreich abgeschlossen.
---
Nochmal zur Maus, kein Funk, zwei Neustarts und sie bekommt nicht mal Strom.
Am Laptop geht sie und bis zum Fix ja auch.
Andere Maus geht, ich verstehs net ;)

ok wir schaun erst mal weiter.
ists ne usb maus? dann mal anderen Port probieren.
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Ist ne USB, ja.
Kein anderer Port geht, bei der Ersatzmaus jeder :(

Ok, hier das log:

21:38:17.0721 1700 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:38:17.0850 1700 ============================================================
21:38:17.0850 1700 Current date / time: 2013/05/25 21:38:17.0850
21:38:17.0850 1700 SystemInfo:
21:38:17.0850 1700
21:38:17.0850 1700 OS Version: 6.1.7601 ServicePack: 1.0
21:38:17.0850 1700 Product type: Workstation
21:38:17.0850 1700 ComputerName: BULLSHIT
21:38:17.0850 1700 UserName: Sentencer
21:38:17.0850 1700 Windows directory: C:\Windows
21:38:17.0850 1700 System windows directory: C:\Windows
21:38:17.0850 1700 Running under WOW64
21:38:17.0850 1700 Processor architecture: Intel x64
21:38:17.0850 1700 Number of processors: 4
21:38:17.0850 1700 Page size: 0x1000
21:38:17.0850 1700 Boot type: Normal boot
21:38:17.0850 1700 ============================================================
21:38:18.0423 1700 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:38:18.0501 1700 Drive \Device\Harddisk5\DR5 - Size: 0xE7400000 (3.61 Gb), SectorSize: 0x200, Cylinders: 0x1D7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:38:18.0503 1700 ============================================================
21:38:18.0503 1700 \Device\Harddisk0\DR0:
21:38:18.0503 1700 MBR partitions:
21:38:18.0503 1700 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:38:18.0503 1700 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x73259800
21:38:18.0503 1700 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x7328C000, BlocksNum 0x147A000
21:38:18.0503 1700 \Device\Harddisk5\DR5:
21:38:18.0504 1700 MBR partitions:
21:38:18.0504 1700 \Device\Harddisk5\DR5\Partition1: MBR, Type 0xB, StartLBA 0x2678, BlocksNum 0x737988
21:38:18.0504 1700 ============================================================
21:38:18.0571 1700 C: <-> \Device\Harddisk0\DR0\Partition2
21:38:18.0622 1700 D: <-> \Device\Harddisk0\DR0\Partition3
21:38:18.0622 1700 ============================================================
21:38:18.0622 1700 Initialize success
21:38:18.0622 1700 ============================================================
21:38:59.0355 1476 ============================================================
21:38:59.0355 1476 Scan started
21:38:59.0355 1476 Mode: Manual; SigCheck; TDLFS;
21:38:59.0355 1476 ============================================================
21:38:59.0474 1476 ================ Scan system memory ========================
21:38:59.0474 1476 System memory - ok
21:38:59.0474 1476 ================ Scan services =============================
21:38:59.0630 1476 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
21:38:59.0693 1476 1394ohci - ok
21:38:59.0749 1476 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
21:38:59.0762 1476 ACPI - ok
21:38:59.0812 1476 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
21:38:59.0873 1476 AcpiPmi - ok
21:39:00.0006 1476 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:39:00.0016 1476 AdobeFlashPlayerUpdateSvc - ok
21:39:00.0059 1476 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
21:39:00.0075 1476 adp94xx - ok
21:39:00.0104 1476 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
21:39:00.0118 1476 adpahci - ok
21:39:00.0142 1476 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
21:39:00.0154 1476 adpu320 - ok
21:39:00.0186 1476 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
21:39:00.0333 1476 AeLookupSvc - ok
21:39:00.0416 1476 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
21:39:00.0475 1476 AFD - ok
21:39:00.0515 1476 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
21:39:00.0525 1476 agp440 - ok
21:39:00.0541 1476 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
21:39:00.0593 1476 ALG - ok
21:39:00.0639 1476 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
21:39:00.0648 1476 aliide - ok
21:39:00.0658 1476 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
21:39:00.0667 1476 amdide - ok
21:39:00.0681 1476 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
21:39:00.0702 1476 AmdK8 - ok
21:39:00.0719 1476 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
21:39:00.0745 1476 AmdPPM - ok
21:39:00.0785 1476 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
21:39:00.0795 1476 amdsata - ok
21:39:00.0821 1476 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
21:39:00.0832 1476 amdsbs - ok
21:39:00.0842 1476 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
21:39:00.0851 1476 amdxata - ok
21:39:00.0910 1476 [ 4DE0D5D747A73797C95A97DCCE5018B5 ] androidusb C:\Windows\system32\Drivers\ssadadb.sys
21:39:00.0971 1476 androidusb - ok
21:39:01.0027 1476 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
21:39:01.0167 1476 AppID - ok
21:39:01.0203 1476 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
21:39:01.0253 1476 AppIDSvc - ok
21:39:01.0322 1476 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
21:39:01.0363 1476 Appinfo - ok
21:39:01.0500 1476 [ 3DEBBECF665DCDDE3A95D9B902010817 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:39:01.0509 1476 Apple Mobile Device - ok
21:39:01.0560 1476 [ 5234837DFEC4092E235594B25CF02865 ] Application Updater C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
21:39:01.0575 1476 Application Updater - ok
21:39:01.0599 1476 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
21:39:01.0610 1476 arc - ok
21:39:01.0621 1476 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
21:39:01.0631 1476 arcsas - ok
21:39:01.0752 1476 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:39:01.0760 1476 aspnet_state - ok
21:39:01.0784 1476 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
21:39:01.0824 1476 AsyncMac - ok
21:39:01.0880 1476 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
21:39:01.0890 1476 atapi - ok
21:39:01.0933 1476 [ FC0E8778C000291CAF60EB88C011E931 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
21:39:01.0945 1476 atksgt - ok
21:39:02.0006 1476 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
21:39:02.0055 1476 AudioEndpointBuilder - ok
21:39:02.0065 1476 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
21:39:02.0094 1476 AudioSrv - ok
21:39:02.0164 1476 [ 3D1FFAA3358CA0D8A298DEA8BECFC468 ] Avgfwfd C:\Windows\system32\DRIVERS\avgfwd6a.sys
21:39:02.0172 1476 Avgfwfd - ok
21:39:02.0286 1476 [ D0BE22C910E46550C6308D50DDA76B94 ] avgfws C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
21:39:02.0307 1476 avgfws - ok
21:39:02.0385 1476 [ 4AFC14AFA58878FAA1D249E7E90EA54B ] AVGIDSAgent C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
21:39:02.0447 1476 AVGIDSAgent - ok
21:39:02.0493 1476 [ 388056EBD5FE6718FE669078DBE37897 ] AVGIDSDriver C:\Windows\system32\DRIVERS\avgidsdrivera.sys
21:39:02.0502 1476 AVGIDSDriver - ok
21:39:02.0549 1476 [ 550E981747D6A6C55078C77346FFC2C6 ] AVGIDSHA C:\Windows\system32\DRIVERS\avgidsha.sys
21:39:02.0558 1476 AVGIDSHA - ok
21:39:02.0615 1476 [ 5989592A91A17587799792A81E1541D4 ] Avgldx64 C:\Windows\system32\DRIVERS\avgldx64.sys
21:39:02.0624 1476 Avgldx64 - ok
21:39:02.0693 1476 [ 3FC43AA02545FCDDC22817829114DEC8 ] Avgloga C:\Windows\system32\DRIVERS\avgloga.sys
21:39:02.0703 1476 Avgloga - ok
21:39:02.0750 1476 [ 841C40C193889730848849AC220D9242 ] Avgmfx64 C:\Windows\system32\DRIVERS\avgmfx64.sys
21:39:02.0760 1476 Avgmfx64 - ok
21:39:02.0817 1476 [ FE4F444DBE4BBBDFD8FECF49398DEFC7 ] Avgrkx64 C:\Windows\system32\DRIVERS\avgrkx64.sys
21:39:02.0825 1476 Avgrkx64 - ok
21:39:02.0870 1476 [ 6E634525613D48A1D1657FB21F21F3B2 ] Avgtdia C:\Windows\system32\DRIVERS\avgtdia.sys
21:39:02.0880 1476 Avgtdia - ok
21:39:02.0920 1476 [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
21:39:02.0931 1476 avgwd - ok
21:39:02.0984 1476 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
21:39:03.0041 1476 AxInstSV - ok
21:39:03.0056 1476 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
21:39:03.0102 1476 b06bdrv - ok
21:39:03.0144 1476 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
21:39:03.0171 1476 b57nd60a - ok
21:39:03.0205 1476 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
21:39:03.0242 1476 BDESVC - ok
21:39:03.0257 1476 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
21:39:03.0294 1476 Beep - ok
21:39:03.0368 1476 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
21:39:03.0407 1476 BFE - ok
21:39:03.0462 1476 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
21:39:03.0511 1476 BITS - ok
21:39:03.0523 1476 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
21:39:03.0544 1476 blbdrive - ok
21:39:03.0655 1476 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
21:39:03.0668 1476 Bonjour Service - ok
21:39:03.0722 1476 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
21:39:03.0772 1476 bowser - ok
21:39:03.0790 1476 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:39:03.0850 1476 BrFiltLo - ok
21:39:03.0868 1476 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:39:03.0880 1476 BrFiltUp - ok
21:39:03.0928 1476 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
21:39:03.0953 1476 Browser - ok
21:39:03.0966 1476 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
21:39:03.0998 1476 Brserid - ok
21:39:04.0020 1476 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
21:39:04.0043 1476 BrSerWdm - ok
21:39:04.0061 1476 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
21:39:04.0100 1476 BrUsbMdm - ok
21:39:04.0121 1476 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
21:39:04.0133 1476 BrUsbSer - ok
21:39:04.0146 1476 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
21:39:04.0175 1476 BTHMODEM - ok
21:39:04.0210 1476 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
21:39:04.0259 1476 bthserv - ok
21:39:04.0293 1476 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
21:39:04.0342 1476 cdfs - ok
21:39:04.0377 1476 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\drivers\cdrom.sys
21:39:04.0415 1476 cdrom - ok
21:39:04.0484 1476 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
21:39:04.0510 1476 CertPropSvc - ok
21:39:04.0520 1476 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
21:39:04.0550 1476 circlass - ok
21:39:04.0585 1476 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
21:39:04.0599 1476 CLFS - ok
21:39:04.0655 1476 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:39:04.0664 1476 clr_optimization_v2.0.50727_32 - ok
21:39:04.0699 1476 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:39:04.0707 1476 clr_optimization_v2.0.50727_64 - ok
21:39:04.0826 1476 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:39:04.0835 1476 clr_optimization_v4.0.30319_32 - ok
21:39:04.0850 1476 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:39:04.0860 1476 clr_optimization_v4.0.30319_64 - ok
21:39:04.0881 1476 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
21:39:04.0907 1476 CmBatt - ok
21:39:04.0958 1476 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
21:39:04.0969 1476 cmdide - ok
21:39:05.0024 1476 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
21:39:05.0044 1476 CNG - ok
21:39:05.0047 1476 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
21:39:05.0056 1476 Compbatt - ok
21:39:05.0113 1476 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
21:39:05.0149 1476 CompositeBus - ok
21:39:05.0176 1476 COMSysApp - ok
21:39:05.0189 1476 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
21:39:05.0198 1476 crcdisk - ok
21:39:05.0261 1476 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
21:39:05.0289 1476 CryptSvc - ok
21:39:05.0344 1476 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
21:39:05.0390 1476 DcomLaunch - ok
21:39:05.0447 1476 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
21:39:05.0496 1476 defragsvc - ok
21:39:05.0532 1476 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
21:39:05.0568 1476 DfsC - ok
21:39:05.0648 1476 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
21:39:05.0714 1476 Dhcp - ok
21:39:05.0743 1476 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
21:39:05.0769 1476 discache - ok
21:39:05.0796 1476 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
21:39:05.0806 1476 Disk - ok
21:39:05.0855 1476 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
21:39:05.0882 1476 Dnscache - ok
21:39:05.0920 1476 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
21:39:05.0966 1476 dot3svc - ok
21:39:06.0035 1476 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
21:39:06.0070 1476 DPS - ok
21:39:06.0132 1476 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
21:39:06.0144 1476 drmkaud - ok
21:39:06.0194 1476 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
21:39:06.0213 1476 DXGKrnl - ok
21:39:06.0246 1476 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
21:39:06.0280 1476 EapHost - ok
21:39:06.0355 1476 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
21:39:06.0461 1476 ebdrv - ok
21:39:06.0507 1476 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
21:39:06.0563 1476 EFS - ok
21:39:06.0600 1476 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
21:39:06.0640 1476 ehRecvr - ok
21:39:06.0682 1476 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
21:39:06.0717 1476 ehSched - ok
21:39:06.0748 1476 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
21:39:06.0767 1476 elxstor - ok
21:39:06.0812 1476 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
21:39:06.0838 1476 ErrDev - ok
21:39:06.0858 1476 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
21:39:06.0886 1476 EventSystem - ok
21:39:06.0921 1476 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
21:39:06.0949 1476 exfat - ok
21:39:06.0970 1476 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
21:39:07.0013 1476 fastfat - ok
21:39:07.0064 1476 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
21:39:07.0124 1476 Fax - ok
21:39:07.0141 1476 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
21:39:07.0152 1476 fdc - ok
21:39:07.0170 1476 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
21:39:07.0210 1476 fdPHost - ok
21:39:07.0221 1476 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
21:39:07.0254 1476 FDResPub - ok
21:39:07.0273 1476 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
21:39:07.0282 1476 FileInfo - ok
21:39:07.0298 1476 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
21:39:07.0346 1476 Filetrace - ok
21:39:07.0373 1476 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
21:39:07.0399 1476 flpydisk - ok
21:39:07.0447 1476 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
21:39:07.0459 1476 FltMgr - ok
21:39:07.0520 1476 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll
21:39:07.0552 1476 FontCache - ok
21:39:07.0618 1476 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:39:07.0625 1476 FontCache3.0.0.0 - ok
21:39:07.0643 1476 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
21:39:07.0653 1476 FsDepends - ok
21:39:07.0677 1476 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
21:39:07.0686 1476 Fs_Rec - ok
21:39:07.0730 1476 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
21:39:07.0744 1476 fvevol - ok
21:39:07.0770 1476 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
21:39:07.0780 1476 gagp30kx - ok
21:39:07.0829 1476 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:39:07.0836 1476 GEARAspiWDM - ok
21:39:07.0887 1476 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
21:39:07.0926 1476 gpsvc - ok
21:39:08.0016 1476 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:39:08.0024 1476 gupdate - ok
21:39:08.0034 1476 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:39:08.0041 1476 gupdatem - ok
21:39:08.0050 1476 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
21:39:08.0093 1476 hcw85cir - ok
21:39:08.0143 1476 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
21:39:08.0164 1476 HDAudBus - ok
21:39:08.0167 1476 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
21:39:08.0179 1476 HidBatt - ok
21:39:08.0202 1476 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
21:39:08.0216 1476 HidBth - ok
21:39:08.0224 1476 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
21:39:08.0261 1476 HidIr - ok
21:39:08.0290 1476 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
21:39:08.0336 1476 hidserv - ok
21:39:08.0408 1476 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
21:39:08.0426 1476 HidUsb - ok
21:39:08.0469 1476 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
21:39:08.0514 1476 hkmsvc - ok
21:39:08.0555 1476 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
21:39:08.0606 1476 HomeGroupListener - ok
21:39:08.0651 1476 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
21:39:08.0674 1476 HomeGroupProvider - ok
21:39:08.0729 1476 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
21:39:08.0739 1476 HpSAMD - ok
21:39:08.0791 1476 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
21:39:08.0835 1476 HTTP - ok
21:39:08.0878 1476 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
21:39:08.0888 1476 hwpolicy - ok
21:39:08.0950 1476 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
21:39:08.0961 1476 i8042prt - ok
21:39:09.0050 1476 [ 7548066DF68A8A1A56B043359F915F37 ] IAANTMON C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
21:39:09.0062 1476 IAANTMON - ok
21:39:09.0069 1476 [ 1D004CB1DA6323B1F55CAEF7F94B61D9 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
21:39:09.0079 1476 iaStor - ok
21:39:09.0101 1476 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
21:39:09.0116 1476 iaStorV - ok
21:39:09.0163 1476 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:39:09.0182 1476 idsvc - ok
21:39:09.0195 1476 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
21:39:09.0205 1476 iirsp - ok
21:39:09.0229 1476 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
21:39:09.0286 1476 IKEEXT - ok
21:39:09.0348 1476 [ 31C32BC56D85D109EBB0C526BE5CACA7 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
21:39:09.0372 1476 IntcAzAudAddService - ok
21:39:09.0425 1476 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
21:39:09.0434 1476 intelide - ok
21:39:09.0456 1476 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
21:39:09.0480 1476 intelppm - ok
21:39:09.0515 1476 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
21:39:09.0557 1476 IPBusEnum - ok
21:39:09.0604 1476 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:39:09.0644 1476 IpFilterDriver - ok
21:39:09.0729 1476 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
21:39:09.0775 1476 iphlpsvc - ok
21:39:09.0823 1476 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
21:39:09.0834 1476 IPMIDRV - ok
21:39:09.0863 1476 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
21:39:09.0898 1476 IPNAT - ok
21:39:09.0980 1476 [ 46D249F9DB7844CC01050A9345F0F61B ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
21:39:09.0999 1476 iPod Service - ok
21:39:10.0034 1476 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
21:39:10.0087 1476 IRENUM - ok
21:39:10.0131 1476 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
21:39:10.0140 1476 isapnp - ok
21:39:10.0189 1476 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
21:39:10.0202 1476 iScsiPrt - ok
21:39:10.0221 1476 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
21:39:10.0231 1476 kbdclass - ok
21:39:10.0279 1476 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
21:39:10.0290 1476 kbdhid - ok
21:39:10.0306 1476 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
21:39:10.0317 1476 KeyIso - ok
21:39:10.0355 1476 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
21:39:10.0365 1476 KSecDD - ok
21:39:10.0413 1476 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
21:39:10.0424 1476 KSecPkg - ok
21:39:10.0434 1476 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
21:39:10.0471 1476 ksthunk - ok
21:39:10.0503 1476 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
21:39:10.0549 1476 KtmRm - ok
21:39:10.0605 1476 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
21:39:10.0646 1476 LanmanServer - ok
21:39:10.0700 1476 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
21:39:10.0740 1476 LanmanWorkstation - ok
21:39:10.0858 1476 [ 108333981C841EB0FF198AA5DFCF3D3B ] LightScribeService c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
21:39:10.0863 1476 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
21:39:10.0863 1476 LightScribeService - detected UnsignedFile.Multi.Generic (1)
21:39:10.0922 1476 [ 156AB2E56DC3CA0B582E3362E07CDED7 ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
21:39:10.0930 1476 lirsgt - ok
21:39:10.0952 1476 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
21:39:10.0992 1476 lltdio - ok
21:39:11.0030 1476 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
21:39:11.0077 1476 lltdsvc - ok
21:39:11.0113 1476 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
21:39:11.0138 1476 lmhosts - ok
21:39:11.0167 1476 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
21:39:11.0178 1476 LSI_FC - ok
21:39:11.0182 1476 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
21:39:11.0192 1476 LSI_SAS - ok
21:39:11.0199 1476 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:39:11.0209 1476 LSI_SAS2 - ok
21:39:11.0213 1476 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:39:11.0223 1476 LSI_SCSI - ok
21:39:11.0244 1476 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
21:39:11.0290 1476 luafv - ok
21:39:11.0330 1476 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
21:39:11.0352 1476 Mcx2Svc - ok
21:39:11.0377 1476 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
21:39:11.0386 1476 megasas - ok
21:39:11.0409 1476 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
21:39:11.0422 1476 MegaSR - ok
21:39:11.0442 1476 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
21:39:11.0496 1476 MMCSS - ok
21:39:11.0519 1476 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
21:39:11.0555 1476 Modem - ok
21:39:11.0564 1476 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
21:39:11.0591 1476 monitor - ok
21:39:11.0642 1476 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
21:39:11.0651 1476 mouclass - ok
21:39:11.0685 1476 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
21:39:11.0717 1476 mouhid - ok
21:39:11.0786 1476 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
21:39:11.0796 1476 mountmgr - ok
21:39:11.0882 1476 [ F8A10560B35C66F9DE212F03DAD5BFA7 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
21:39:11.0895 1476 MpFilter - ok
21:39:11.0946 1476 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
21:39:11.0957 1476 mpio - ok
21:39:11.0961 1476 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
21:39:11.0986 1476 mpsdrv - ok
21:39:12.0042 1476 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
21:39:12.0086 1476 MpsSvc - ok
21:39:12.0132 1476 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
21:39:12.0161 1476 MRxDAV - ok
21:39:12.0209 1476 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
21:39:12.0270 1476 mrxsmb - ok
21:39:12.0318 1476 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:39:12.0346 1476 mrxsmb10 - ok
21:39:12.0359 1476 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:39:12.0388 1476 mrxsmb20 - ok
21:39:12.0428 1476 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
21:39:12.0438 1476 msahci - ok
21:39:12.0489 1476 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
21:39:12.0500 1476 msdsm - ok
21:39:12.0517 1476 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
21:39:12.0531 1476 MSDTC - ok
21:39:12.0564 1476 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
21:39:12.0593 1476 Msfs - ok
21:39:12.0611 1476 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
21:39:12.0652 1476 mshidkmdf - ok
21:39:12.0697 1476 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
21:39:12.0707 1476 msisadrv - ok
21:39:12.0733 1476 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
21:39:12.0762 1476 MSiSCSI - ok
21:39:12.0764 1476 msiserver - ok
21:39:12.0825 1476 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
21:39:12.0868 1476 MSKSSRV - ok
21:39:12.0957 1476 [ E07DEC52FF801841BA9B6878A60304FB ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
21:39:12.0968 1476 MsMpSvc - ok
21:39:12.0987 1476 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
21:39:13.0035 1476 MSPCLOCK - ok
21:39:13.0058 1476 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
21:39:13.0096 1476 MSPQM - ok
21:39:13.0136 1476 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
21:39:13.0149 1476 MsRPC - ok
21:39:13.0165 1476 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
21:39:13.0174 1476 mssmbios - ok
21:39:13.0193 1476 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
21:39:13.0226 1476 MSTEE - ok
21:39:13.0245 1476 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
21:39:13.0256 1476 MTConfig - ok
21:39:13.0279 1476 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
21:39:13.0289 1476 Mup - ok
21:39:13.0337 1476 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
21:39:13.0368 1476 napagent - ok
21:39:13.0399 1476 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
21:39:13.0427 1476 NativeWifiP - ok
21:39:13.0493 1476 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
21:39:13.0514 1476 NDIS - ok
21:39:13.0532 1476 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
21:39:13.0558 1476 NdisCap - ok
21:39:13.0578 1476 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
21:39:13.0605 1476 NdisTapi - ok
21:39:13.0624 1476 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
21:39:13.0648 1476 Ndisuio - ok
21:39:13.0678 1476 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
21:39:13.0716 1476 NdisWan - ok
21:39:13.0733 1476 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
21:39:13.0781 1476 NDProxy - ok
21:39:13.0806 1476 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
21:39:13.0840 1476 NetBIOS - ok
21:39:13.0887 1476 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
21:39:13.0924 1476 NetBT - ok
21:39:13.0939 1476 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
21:39:13.0949 1476 Netlogon - ok
21:39:13.0983 1476 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
21:39:14.0027 1476 Netman - ok
21:39:14.0077 1476 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:39:14.0086 1476 NetMsmqActivator - ok
21:39:14.0118 1476 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:39:14.0126 1476 NetPipeActivator - ok
21:39:14.0148 1476 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
21:39:14.0194 1476 netprofm - ok
21:39:14.0227 1476 [ 44D4BD55191624C82A2745296BA42814 ] netr28x C:\Windows\system32\DRIVERS\netr28x.sys
21:39:14.0262 1476 netr28x - ok
21:39:14.0284 1476 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:39:14.0292 1476 NetTcpActivator - ok
21:39:14.0295 1476 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:39:14.0303 1476 NetTcpPortSharing - ok
21:39:14.0319 1476 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
21:39:14.0329 1476 nfrd960 - ok
21:39:14.0384 1476 [ 162100E0BC8377710F9D170631921C03 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
21:39:14.0396 1476 NisDrv - ok
21:39:14.0445 1476 [ C6E15F2F95F9C0A6098D43510B604E52 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
21:39:14.0461 1476 NisSrv - ok
21:39:14.0504 1476 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
21:39:14.0518 1476 NlaSvc - ok
21:39:14.0532 1476 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
21:39:14.0559 1476 Npfs - ok
21:39:14.0565 1476 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
21:39:14.0601 1476 nsi - ok
21:39:14.0615 1476 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
21:39:14.0651 1476 nsiproxy - ok
21:39:14.0717 1476 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
21:39:14.0759 1476 Ntfs - ok
21:39:14.0768 1476 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
21:39:14.0810 1476 Null - ok
21:39:15.0009 1476 [ FCBA1C22727939E7CFF9EB08FE9692AB ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:39:15.0123 1476 nvlddmkm - ok
21:39:15.0195 1476 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
21:39:15.0206 1476 nvraid - ok
21:39:15.0225 1476 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
21:39:15.0237 1476 nvstor - ok
21:39:15.0273 1476 [ 10C232F6CFFD51D2332898AE7AE0FF23 ] nvsvc C:\Windows\system32\nvvsvc.exe
21:39:15.0290 1476 nvsvc - ok
21:39:15.0409 1476 [ 4789E020D2617046862D1790FC235FF6 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
21:39:15.0434 1476 nvUpdatusService - ok
21:39:15.0485 1476 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
21:39:15.0496 1476 nv_agp - ok
21:39:15.0541 1476 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
21:39:15.0553 1476 ohci1394 - ok
21:39:15.0624 1476 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:39:15.0633 1476 ose - ok
21:39:15.0676 1476 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
21:39:15.0718 1476 p2pimsvc - ok
21:39:15.0745 1476 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
21:39:15.0777 1476 p2psvc - ok
21:39:15.0789 1476 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
21:39:15.0801 1476 Parport - ok
21:39:15.0856 1476 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
21:39:15.0866 1476 partmgr - ok
21:39:15.0875 1476 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
21:39:15.0905 1476 PcaSvc - ok
21:39:15.0954 1476 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
21:39:15.0966 1476 pci - ok
21:39:16.0010 1476 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
21:39:16.0020 1476 pciide - ok
21:39:16.0039 1476 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
21:39:16.0052 1476 pcmcia - ok
21:39:16.0068 1476 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
21:39:16.0078 1476 pcw - ok
21:39:16.0100 1476 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
21:39:16.0168 1476 PEAUTH - ok
21:39:16.0289 1476 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
21:39:16.0309 1476 PerfHost - ok
21:39:16.0370 1476 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
21:39:16.0412 1476 pla - ok
21:39:16.0504 1476 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
21:39:16.0548 1476 PlugPlay - ok
21:39:16.0577 1476 [ 64CA1485214340CACC315FFDFDED73EF ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
21:39:16.0600 1476 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:39:16.0600 1476 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:39:16.0619 1476 PnkBstrA - ok
21:39:16.0646 1476 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
21:39:16.0677 1476 PNRPAutoReg - ok
21:39:16.0709 1476 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
21:39:16.0722 1476 PNRPsvc - ok
21:39:16.0780 1476 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
21:39:16.0819 1476 PolicyAgent - ok
21:39:16.0879 1476 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
21:39:16.0914 1476 Power - ok
21:39:16.0965 1476 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
21:39:16.0991 1476 PptpMiniport - ok
21:39:17.0002 1476 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
21:39:17.0027 1476 Processor - ok
21:39:17.0079 1476 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
21:39:17.0126 1476 ProfSvc - ok
21:39:17.0139 1476 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
21:39:17.0150 1476 ProtectedStorage - ok
21:39:17.0210 1476 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
21:39:17.0235 1476 Psched - ok
21:39:17.0277 1476 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
21:39:17.0307 1476 ql2300 - ok
21:39:17.0323 1476 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
21:39:17.0333 1476 ql40xx - ok
21:39:17.0361 1476 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
21:39:17.0378 1476 QWAVE - ok
21:39:17.0390 1476 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
21:39:17.0405 1476 QWAVEdrv - ok
21:39:17.0412 1476 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
21:39:17.0454 1476 RasAcd - ok
21:39:17.0480 1476 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
21:39:17.0522 1476 RasAgileVpn - ok
21:39:17.0541 1476 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
21:39:17.0568 1476 RasAuto - ok
21:39:17.0613 1476 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
21:39:17.0653 1476 Rasl2tp - ok
21:39:17.0716 1476 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
21:39:17.0763 1476 RasMan - ok
21:39:17.0786 1476 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
21:39:17.0818 1476 RasPppoe - ok
21:39:17.0836 1476 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
21:39:17.0875 1476 RasSstp - ok
21:39:17.0932 1476 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
21:39:17.0975 1476 rdbss - ok
21:39:17.0991 1476 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
21:39:18.0004 1476 rdpbus - ok
21:39:18.0024 1476 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
21:39:18.0063 1476 RDPCDD - ok
21:39:18.0076 1476 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
21:39:18.0116 1476 RDPENCDD - ok
21:39:18.0126 1476 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
21:39:18.0152 1476 RDPREFMP - ok
21:39:18.0195 1476 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
21:39:18.0222 1476 RDPWD - ok
21:39:18.0267 1476 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
21:39:18.0279 1476 rdyboost - ok
21:39:18.0291 1476 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
21:39:18.0329 1476 RemoteAccess - ok
21:39:18.0354 1476 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
21:39:18.0396 1476 RemoteRegistry - ok
21:39:18.0408 1476 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
21:39:18.0435 1476 RpcEptMapper - ok
21:39:18.0466 1476 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
21:39:18.0503 1476 RpcLocator - ok
21:39:18.0543 1476 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
21:39:18.0572 1476 RpcSs - ok
21:39:18.0580 1476 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
21:39:18.0606 1476 rspndr - ok
21:39:18.0628 1476 [ 91296F0B2653281B2F11E0FCE56AA427 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
21:39:18.0677 1476 RTL8167 - ok
21:39:18.0695 1476 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
21:39:18.0703 1476 SamSs - ok
21:39:18.0752 1476 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
21:39:18.0762 1476 sbp2port - ok
21:39:18.0775 1476 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
21:39:18.0818 1476 SCardSvr - ok
21:39:18.0858 1476 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
21:39:18.0895 1476 scfilter - ok
21:39:18.0955 1476 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
21:39:19.0005 1476 Schedule - ok
21:39:19.0039 1476 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
21:39:19.0064 1476 SCPolicySvc - ok
21:39:19.0112 1476 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
21:39:19.0137 1476 SDRSVC - ok
21:39:19.0158 1476 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
21:39:19.0211 1476 secdrv - ok
21:39:19.0254 1476 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
21:39:19.0297 1476 seclogon - ok
21:39:19.0333 1476 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
21:39:19.0383 1476 SENS - ok
21:39:19.0386 1476 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
21:39:19.0434 1476 SensrSvc - ok
21:39:19.0474 1476 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
21:39:19.0486 1476 Serenum - ok
21:39:19.0515 1476 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
21:39:19.0545 1476 Serial - ok
21:39:19.0616 1476 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
21:39:19.0672 1476 sermouse - ok
21:39:19.0713 1476 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
21:39:19.0754 1476 SessionEnv - ok
21:39:19.0793 1476 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
21:39:19.0819 1476 sffdisk - ok
21:39:19.0868 1476 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
21:39:19.0891 1476 sffp_mmc - ok
21:39:19.0901 1476 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
21:39:19.0927 1476 sffp_sd - ok
21:39:19.0935 1476 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
21:39:19.0945 1476 sfloppy - ok
21:39:19.0971 1476 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
21:39:20.0014 1476 SharedAccess - ok
21:39:20.0093 1476 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
21:39:20.0121 1476 ShellHWDetection - ok
21:39:20.0187 1476 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:39:20.0197 1476 SiSRaid2 - ok
21:39:20.0200 1476 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
21:39:20.0210 1476 SiSRaid4 - ok
21:39:20.0335 1476 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
21:39:20.0345 1476 SkypeUpdate - ok
21:39:20.0380 1476 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
21:39:20.0426 1476 Smb - ok
21:39:20.0503 1476 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
21:39:20.0529 1476 SNMPTRAP - ok
21:39:20.0544 1476 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
21:39:20.0553 1476 spldr - ok
21:39:20.0602 1476 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
21:39:20.0650 1476 Spooler - ok
21:39:20.0733 1476 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
21:39:20.0849 1476 sppsvc - ok
21:39:20.0861 1476 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
21:39:20.0887 1476 sppuinotify - ok
21:39:20.0961 1476 [ 602884696850C86434530790B110E8EB ] sptd C:\Windows\system32\Drivers\sptd.sys
21:39:20.0961 1476 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850C86434530790B110E8EB
21:39:20.0962 1476 sptd ( LockedFile.Multi.Generic ) - warning
21:39:20.0962 1476 sptd - detected LockedFile.Multi.Generic (1)
21:39:21.0011 1476 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
21:39:21.0053 1476 srv - ok
21:39:21.0060 1476 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
21:39:21.0099 1476 srv2 - ok
21:39:21.0122 1476 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
21:39:21.0143 1476 srvnet - ok
21:39:21.0194 1476 [ D52282225D5BD73A9CBF420699D1A0FE ] ssadbus C:\Windows\system32\DRIVERS\ssadbus.sys
21:39:21.0218 1476 ssadbus - ok
21:39:21.0239 1476 [ F7936AC6E8437E10E1AE488CE21F3086 ] ssadmdfl C:\Windows\system32\DRIVERS\ssadmdfl.sys
21:39:21.0257 1476 ssadmdfl - ok
21:39:21.0267 1476 [ 1FE033372A58C67B3ECCA903FC637B36 ] ssadmdm C:\Windows\system32\DRIVERS\ssadmdm.sys
21:39:21.0299 1476 ssadmdm - ok
21:39:21.0321 1476 [ 5EB7DA2F72B90C8398DF9D7A82E43FCB ] ssadserd C:\Windows\system32\DRIVERS\ssadserd.sys
21:39:21.0347 1476 ssadserd - ok
21:39:21.0373 1476 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
21:39:21.0410 1476 SSDPSRV - ok
21:39:21.0426 1476 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
21:39:21.0452 1476 SstpSvc - ok
21:39:21.0483 1476 Steam Client Service - ok
21:39:21.0524 1476 [ 5A19667A580B1CE886EAF968B9743F45 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
21:39:21.0536 1476 Stereo Service - ok
21:39:21.0553 1476 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
21:39:21.0563 1476 stexstor - ok
21:39:21.0621 1476 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
21:39:21.0642 1476 stisvc - ok
21:39:21.0678 1476 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
21:39:21.0687 1476 swenum - ok
21:39:21.0705 1476 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
21:39:21.0750 1476 swprv - ok
21:39:21.0813 1476 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
21:39:21.0875 1476 SysMain - ok
21:39:21.0925 1476 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
21:39:21.0940 1476 TabletInputService - ok
21:39:21.0989 1476 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
21:39:22.0029 1476 TapiSrv - ok
21:39:22.0048 1476 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
21:39:22.0089 1476 TBS - ok
21:39:22.0156 1476 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
21:39:22.0196 1476 Tcpip - ok
21:39:22.0224 1476 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
21:39:22.0251 1476 TCPIP6 - ok
21:39:22.0296 1476 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
21:39:22.0322 1476 tcpipreg - ok
21:39:22.0354 1476 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
21:39:22.0369 1476 TDPIPE - ok
21:39:22.0409 1476 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
21:39:22.0419 1476 TDTCP - ok
21:39:22.0473 1476 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
21:39:22.0498 1476 tdx - ok
21:39:22.0541 1476 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
21:39:22.0550 1476 TermDD - ok
21:39:22.0604 1476 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
21:39:22.0636 1476 TermService - ok
21:39:22.0659 1476 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
21:39:22.0681 1476 Themes - ok
21:39:22.0709 1476 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
21:39:22.0735 1476 THREADORDER - ok
21:39:22.0783 1476 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
21:39:22.0811 1476 TrkWks - ok
21:39:22.0880 1476 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
21:39:22.0922 1476 TrustedInstaller - ok
21:39:22.0947 1476 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
21:39:22.0973 1476 tssecsrv - ok
21:39:23.0037 1476 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
21:39:23.0076 1476 TsUsbFlt - ok
21:39:23.0236 1476 [ 811A229718C85356BC81EB20F35EB7F6 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
21:39:23.0298 1476 TuneUp.UtilitiesSvc - ok
21:39:23.0356 1476 [ DCC94C51D27C7EC0DADECA8F64C94FCF ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys
21:39:23.0364 1476 TuneUpUtilitiesDrv - ok
21:39:23.0420 1476 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
21:39:23.0445 1476 tunnel - ok
21:39:23.0460 1476 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
21:39:23.0470 1476 uagp35 - ok
21:39:23.0511 1476 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
21:39:23.0552 1476 udfs - ok
21:39:23.0575 1476 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
21:39:23.0588 1476 UI0Detect - ok
21:39:23.0640 1476 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
21:39:23.0649 1476 uliagpkx - ok
21:39:23.0694 1476 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys
21:39:23.0714 1476 umbus - ok
21:39:23.0744 1476 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
21:39:23.0768 1476 UmPass - ok
21:39:23.0788 1476 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
21:39:23.0830 1476 upnphost - ok
21:39:23.0866 1476 [ AA33FC47ED58C34E6E9261E4F850B7EB ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
21:39:23.0927 1476 USBAAPL64 - ok
21:39:23.0955 1476 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
21:39:23.0990 1476 usbccgp - ok
21:39:24.0032 1476 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
21:39:24.0045 1476 usbcir - ok
21:39:24.0078 1476 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
21:39:24.0097 1476 usbehci - ok
21:39:24.0118 1476 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
21:39:24.0142 1476 usbhub - ok
21:39:24.0156 1476 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
21:39:24.0176 1476 usbohci - ok
21:39:24.0207 1476 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
21:39:24.0231 1476 usbprint - ok
21:39:24.0246 1476 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:39:24.0293 1476 USBSTOR - ok
21:39:24.0311 1476 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
21:39:24.0330 1476 usbuhci - ok
21:39:24.0364 1476 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
21:39:24.0409 1476 UxSms - ok
21:39:24.0429 1476 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
21:39:24.0439 1476 VaultSvc - ok
21:39:24.0443 1476 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
21:39:24.0452 1476 vdrvroot - ok
21:39:24.0505 1476 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
21:39:24.0551 1476 vds - ok
21:39:24.0588 1476 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
21:39:24.0600 1476 vga - ok
21:39:24.0612 1476 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
21:39:24.0653 1476 VgaSave - ok
21:39:24.0700 1476 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
21:39:24.0712 1476 vhdmp - ok
21:39:24.0756 1476 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
21:39:24.0765 1476 viaide - ok
21:39:24.0784 1476 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
21:39:24.0795 1476 volmgr - ok
21:39:24.0843 1476 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
21:39:24.0857 1476 volmgrx - ok
21:39:24.0908 1476 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
21:39:24.0921 1476 volsnap - ok
21:39:24.0933 1476 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
21:39:24.0944 1476 vsmraid - ok
21:39:25.0007 1476 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
21:39:25.0091 1476 VSS - ok
21:39:25.0109 1476 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
21:39:25.0143 1476 vwifibus - ok
21:39:25.0173 1476 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
21:39:25.0209 1476 vwififlt - ok
21:39:25.0248 1476 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
21:39:25.0279 1476 W32Time - ok
21:39:25.0300 1476 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
21:39:25.0338 1476 WacomPen - ok
21:39:25.0395 1476 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
21:39:25.0436 1476 WANARP - ok
21:39:25.0446 1476 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
21:39:25.0470 1476 Wanarpv6 - ok
21:39:25.0579 1476 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
21:39:25.0605 1476 WatAdminSvc - ok
21:39:25.0668 1476 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
21:39:25.0731 1476 wbengine - ok
21:39:25.0747 1476 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
21:39:25.0762 1476 WbioSrvc - ok
21:39:25.0811 1476 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
21:39:25.0855 1476 wcncsvc - ok
21:39:25.0885 1476 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
21:39:25.0907 1476 WcsPlugInService - ok
21:39:25.0932 1476 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
21:39:25.0942 1476 Wd - ok
21:39:25.0996 1476 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
21:39:26.0018 1476 Wdf01000 - ok
21:39:26.0029 1476 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
21:39:26.0120 1476 WdiServiceHost - ok
21:39:26.0123 1476 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
21:39:26.0138 1476 WdiSystemHost - ok
21:39:26.0188 1476 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
21:39:26.0214 1476 WebClient - ok
21:39:26.0225 1476 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
21:39:26.0255 1476 Wecsvc - ok
21:39:26.0305 1476 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
21:39:26.0361 1476 wercplsupport - ok
21:39:26.0394 1476 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
21:39:26.0438 1476 WerSvc - ok
21:39:26.0456 1476 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
21:39:26.0481 1476 WfpLwf - ok
21:39:26.0489 1476 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
21:39:26.0499 1476 WIMMount - ok
21:39:26.0504 1476 WinHttpAutoProxySvc - ok
21:39:26.0582 1476 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
21:39:26.0610 1476 Winmgmt - ok
21:39:26.0679 1476 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
21:39:26.0745 1476 WinRM - ok
21:39:26.0789 1476 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
21:39:26.0802 1476 WinUsb - ok
21:39:26.0827 1476 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
21:39:26.0867 1476 Wlansvc - ok
21:39:26.0908 1476 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
21:39:26.0931 1476 WmiAcpi - ok
21:39:26.0979 1476 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
21:39:27.0007 1476 wmiApSrv - ok
21:39:27.0030 1476 WMPNetworkSvc - ok
21:39:27.0046 1476 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
21:39:27.0062 1476 WPCSvc - ok
21:39:27.0113 1476 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
21:39:27.0126 1476 WPDBusEnum - ok
21:39:27.0132 1476 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
21:39:27.0170 1476 ws2ifsl - ok
21:39:27.0172 1476 WSearch - ok
21:39:27.0245 1476 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
21:39:27.0306 1476 wuauserv - ok
21:39:27.0348 1476 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
21:39:27.0371 1476 WudfPf - ok
21:39:27.0414 1476 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
21:39:27.0440 1476 WUDFRd - ok
21:39:27.0489 1476 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
21:39:27.0501 1476 wudfsvc - ok
21:39:27.0513 1476 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
21:39:27.0542 1476 WwanSvc - ok
21:39:27.0560 1476 ================ Scan global ===============================
21:39:27.0587 1476 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
21:39:27.0631 1476 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:39:27.0636 1476 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:39:27.0662 1476 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
21:39:27.0688 1476 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
21:39:27.0690 1476 [Global] - ok
21:39:27.0690 1476 ================ Scan MBR ==================================
21:39:27.0701 1476 [ C04E33E69EB86700BF694E83B8B0B6E6 ] \Device\Harddisk0\DR0
21:39:27.0988 1476 \Device\Harddisk0\DR0 - ok
21:39:27.0991 1476 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk5\DR5
21:39:29.0940 1476 \Device\Harddisk5\DR5 - ok
21:39:29.0941 1476 ================ Scan VBR ==================================
21:39:29.0943 1476 [ 5B5D2AF2D7E84C55CE8560C48CF5F12B ] \Device\Harddisk0\DR0\Partition1
21:39:29.0944 1476 \Device\Harddisk0\DR0\Partition1 - ok
21:39:29.0952 1476 [ DA3F112239BCDF911931C445BA3CDD20 ] \Device\Harddisk0\DR0\Partition2
21:39:29.0954 1476 \Device\Harddisk0\DR0\Partition2 - ok
21:39:29.0985 1476 [ D21B0DE9CF35D6A2FD4F5C7438F672E7 ] \Device\Harddisk0\DR0\Partition3
21:39:29.0987 1476 \Device\Harddisk0\DR0\Partition3 - ok
21:39:29.0990 1476 [ 04B0E294966D35AF3B9864B907E0769F ] \Device\Harddisk5\DR5\Partition1
21:39:29.0991 1476 \Device\Harddisk5\DR5\Partition1 - ok
21:39:29.0991 1476 ============================================================
21:39:29.0991 1476 Scan finished
21:39:29.0991 1476 ============================================================
21:39:29.0999 3436 Detected object count: 3
21:39:29.0999 3436 Actual detected object count: 3
21:39:47.0781 3436 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
21:39:47.0781 3436 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:39:47.0781 3436 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:39:47.0781 3436 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:39:47.0782 3436 sptd ( LockedFile.Multi.Generic ) - skipped by user
21:39:47.0782 3436 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
21:39:51.0715 0564 Deinitialize success

Hi
gabs zu der Maus software, dann evtl. mal neu instalieren.
Du bekommst aber diesen typischen Ton wenn du die Maus anschließt?
andere USB Geräte laufen?
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ich hatte bei MS sec essentials auf inaktiv gesetzt und er hat dennoch gemeckert und ich durfte "auf eigene Gefahr" weitermachen ;)

Combofix Logfile:

Code:

ComboFix 13-05-25.02 - Sentencer 25.05.2013  22:06:11.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6135.3120 [GMT 2:00]

ausgeführt von:: c:\users\Sentencer\Desktop\ComboFix.exe

AV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\programdata\dsgsdgdsgdsgw.pad

c:\programdata\ism_0_llatsni.pad

c:\programdata\nud0repor.pad

c:\users\SENTEN~1\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll

c:\users\Sentencer\4642959.exe

c:\users\Sentencer\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll

c:\users\Sentencer\AppData\Roaming\903014875.log

c:\users\Sentencer\AppData\Roaming\Help\coredb\storage

c:\users\Sentencer\AppData\Roaming\skype.ini

c:\windows\SysWow64\muzapp.exe

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-25 bis 2013-05-25  ))))))))))))))))))))))))))))))

.

.

2013-05-26 00:42 . 2013-05-25 19:18        --------        d-----w-        C:\_OTL

2013-05-25 20:13 . 2013-05-25 20:13        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-05-25 20:13 . 2013-05-25 20:13        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-25 19:21 . 2013-05-25 19:16        964552        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ECA71213-FE03-4179-A441-FDABF0F53B31}\gapaengine.dll

2013-05-25 19:17 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{96F2F94B-5B79-4811-900C-363EFF5CDE42}\mpengine.dll

2013-05-25 19:07 . 2013-05-25 19:07        --------        d-----w-        C:\9838ad918078db8f1d

2013-05-15 21:53 . 2013-05-15 21:53        --------        d-----w-        C:\found.000

2013-05-15 18:32 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-25 19:04 . 2010-10-07 18:57        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-15 18:28 . 2013-01-14 20:53        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-05-15 18:28 . 2011-07-19 18:31        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-02 15:29 . 2009-12-01 22:06        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-24 05:35 . 2012-06-13 18:06        905296        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2013-04-12 14:45 . 2013-04-24 16:56        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-04-05 01:07 . 2013-04-05 01:07        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-04-05 01:07 . 2013-04-05 01:07        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-04-05 01:07 . 2013-04-05 01:07        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-04-05 01:07 . 2013-04-05 01:07        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-04-05 01:07 . 2013-04-05 01:07        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-04-05 01:07 . 2013-04-05 01:07        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-04-05 01:07 . 2013-04-05 01:07        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-04-05 01:07 . 2013-04-05 01:07        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-04-05 01:07 . 2013-04-05 01:07        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-04-05 01:07 . 2013-04-05 01:07        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-04-05 01:07 . 2013-04-05 01:07        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-04-05 01:07 . 2013-04-05 01:07        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-04-05 01:07 . 2013-04-05 01:07        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-04-05 01:07 . 2013-04-05 01:07        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-04-05 01:07 . 2013-04-05 01:07        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-04-05 01:07 . 2013-04-05 01:07        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-04-05 01:07 . 2013-04-05 01:07        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-04-05 01:07 . 2013-04-05 01:07        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-04-05 01:07 . 2013-04-05 01:07        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-04-05 01:07 . 2013-04-05 01:07        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-04-05 01:07 . 2013-04-05 01:07        441856        ----a-w-        c:\windows\system32\html.iec

2013-04-05 01:07 . 2013-04-05 01:07        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-04-05 01:07 . 2013-04-05 01:07        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-04-05 01:07 . 2013-04-05 01:07        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-04-05 01:07 . 2013-04-05 01:07        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-04-05 01:07 . 2013-04-05 01:07        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-04-05 01:07 . 2013-04-05 01:07        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-04-05 01:07 . 2013-04-05 01:07        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-04-05 01:07 . 2013-04-05 01:07        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-04-05 01:07 . 2013-04-05 01:07        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-04-05 01:07 . 2013-04-05 01:07        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-04-05 01:07 . 2013-04-05 01:07        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-04-05 01:07 . 2013-04-05 01:07        235008        ----a-w-        c:\windows\system32\url.dll

2013-04-05 01:07 . 2013-04-05 01:07        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-04-05 01:07 . 2013-04-05 01:07        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-04-05 01:07 . 2013-04-05 01:07        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-04-05 01:07 . 2013-04-05 01:07        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-04-05 01:07 . 2013-04-05 01:07        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-04-05 01:07 . 2013-04-05 01:07        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-04-05 01:07 . 2013-04-05 01:07        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-04-05 01:07 . 2013-04-05 01:07        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-04-05 01:07 . 2013-04-05 01:07        149504        ----a-w-        c:\windows\system32\occache.dll

2013-04-05 01:07 . 2013-04-05 01:07        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-04-05 01:07 . 2013-04-05 01:07        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-04-05 01:07 . 2013-04-05 01:07        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-04-05 01:07 . 2013-04-05 01:07        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-04-05 01:07 . 2013-04-05 01:07        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-04-05 01:07 . 2013-04-05 01:07        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-04-05 01:07 . 2013-04-05 01:07        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-04-05 01:05 . 2013-04-05 01:05        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        364544        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2013-04-05 01:05 . 2013-04-05 01:05        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        2560        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        1682432        ----a-w-        c:\windows\system32\XpsPrint.dll

2013-04-05 01:05 . 2013-04-05 01:05        1158144        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2013-04-05 01:05 . 2013-04-05 01:05        10752        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        10752        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-04-05 01:05 . 2013-04-05 01:05        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2013-04-05 01:05 . 2013-04-05 01:05        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-04-05 01:05 . 2013-04-05 01:05        2284544        ----a-w-        c:\windows\SysWow64\msmpeg2vdec.dll

2013-04-05 01:05 . 2013-04-05 01:05        2776576        ----a-w-        c:\windows\system32\msmpeg2vdec.dll

2013-04-05 01:05 . 2013-04-05 01:05        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-04-05 01:05 . 2013-04-05 01:05        3928064        ----a-w-        c:\windows\system32\d2d1.dll

2013-04-05 01:05 . 2013-04-05 01:05        2565120        ----a-w-        c:\windows\system32\d3d10warp.dll

2013-04-05 01:05 . 2013-04-05 01:05        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll

2013-04-05 01:05 . 2013-04-05 01:05        363008        ----a-w-        c:\windows\system32\dxgi.dll

2013-04-05 01:05 . 2013-04-05 01:05        220160        ----a-w-        c:\windows\SysWow64\d3d10core.dll

2013-04-05 01:05 . 2013-04-05 01:05        1504768        ----a-w-        c:\windows\SysWow64\d3d11.dll

2013-04-05 01:05 . 2013-04-05 01:05        1080832        ----a-w-        c:\windows\SysWow64\d3d10.dll

2013-04-05 01:05 . 2013-04-05 01:05        1175552        ----a-w-        c:\windows\system32\FntCache.dll

2013-04-05 01:05 . 2013-04-05 01:05        207872        ----a-w-        c:\windows\SysWow64\WindowsCodecsExt.dll

2013-04-05 01:05 . 2013-04-05 01:05        1643520        ----a-w-        c:\windows\system32\DWrite.dll

2013-04-05 01:05 . 2013-04-05 01:05        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2013-04-05 01:05 . 2013-04-05 01:05        333312        ----a-w-        c:\windows\system32\d3d10_1core.dll

2013-04-05 01:05 . 2013-04-05 01:05        296960        ----a-w-        c:\windows\system32\d3d10core.dll

2013-04-05 01:05 . 2013-04-05 01:05        249856        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2013-04-05 01:05 . 2013-04-05 01:05        245248        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2013-04-05 01:05 . 2013-04-05 01:05        194560        ----a-w-        c:\windows\system32\d3d10_1.dll

2013-04-05 01:05 . 2013-04-05 01:05        1887232        ----a-w-        c:\windows\system32\d3d11.dll

2013-04-05 01:05 . 2013-04-05 01:05        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll

2013-04-05 01:05 . 2013-04-05 01:05        1238528        ----a-w-        c:\windows\system32\d3d10.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files (x86)\pdfforge Toolbar\IE\7.0\pdfforgeToolbarIE.dll" [2013-02-23 1352512]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

2011-05-09 09:49        176936        ----a-w-        c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{8015C430-448C-4003-A969-274F7F0F2D9C}]

2010-05-03 19:44        269824        ----a-w-        c:\users\Sentencer\AppData\LocalLow\YouTubeAnywhere\IE\YouTubeAnywhere.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]

2013-02-23 18:17        1352512        ----a-w-        c:\program files (x86)\pdfforge Toolbar\IE\7.0\pdfforgeToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll" [2011-05-09 176936]

"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files (x86)\pdfforge Toolbar\IE\7.0\pdfforgeToolbarIE.dll" [2013-02-23 1352512]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\games\Steam\Steam.exe" [2013-05-03 1635752]

"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2010-03-31 2937528]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-06-09 940944]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-06-09 3373968]

"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-06-09 20880]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]

"BATINDICATOR"="c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe" [2009-05-08 2068992]

"LaunchHPOSIAPP"="c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe" [2009-04-03 385024]

"HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-05-26 656896]

"UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2013-02-23 1297728]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Philips GoGear Spark Gere-Manager.lnk - c:\program files (x86)\Philips\GoGear Spark Device Manager\main.exe [2010-2-21 124784]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

.

R2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2013\avgfws.exe [2012-12-10 1342024]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 36328]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-01-03 157160]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-01-03 16872]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-01-03 177128]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-01-03 145384]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-16 1255736]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-20 834544]

S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [2012-09-04 50296]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]

S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2013-02-23 805752]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-05-29 2143072]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-05-19 702976]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-13 233472]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2012-05-08 11856]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-10 13:26        1642448        ----a-w-        c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-05-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-14 18:28]

.

2013-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-01 12:16]

.

2013-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-01 12:16]

.

2013-04-30 c:\windows\Tasks\PCDRScheduledMaintenance.job

- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2009-06-10 11:04]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-07-08 610360]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = https://www.google.de/

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: add to &BOM - c:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta

IE: Free YouTube to MP3 Converter - c:\users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\

FF - prefs.js: browser.startup.homepage - hxxp://de.ask.com/?l=dis&o=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{238d4b4c-d63c-42a7-b6d8-dc96c8c0f5b9} - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Wow6432Node-HKLM-Explorer_Run-41975 - c:\progra~3\LOCALS~1\Temp\msuouoxqc.pif

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)

WebBrowser-{238D4B4C-D63C-42A7-B6D8-DC96C8C0F5B9} - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

@Allowed: (Read) (RestrictedCode)

"??"=hex:73,21,69,18,9b,df,c3,1c,b6,5a,5f,e0,5b,ad,bd,e2,71,42,ee,7d,d2,33,42,

   6f,99,89,3b,1f,34,b4,16,37,7f,7c,eb,47,0e,b8,f4,19,5d,dd,3d,b1,d3,d9,7c,5e,\

"??"=hex:0f,e2,c5,fa,ef,c2,e6,8f,82,50,a2,66,1f,5c,1a,6a

.

[HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\Software\SecuROM\License information*]

"datasecu"=hex:58,35,eb,b2,17,fc,dc,99,12,66,67,d3,d2,16,ad,c0,d7,f3,fd,5f,af,

   bd,19,19,fa,4d,ef,29,4b,dc,25,31,ca,7e,bd,ca,5c,53,fa,09,7c,a9,d3,a4,50,47,\

"rkeysecu"=hex:23,1f,f6,ba,83,1b,ea,6a,16,bd,35,37,e1,04,aa,3d

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\windows\SysWOW64\PnkBstrA.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\CNYHKEY.exe

c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-05-25  22:26:56 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-05-25 20:26

.

Vor Suchlauf: 22 Verzeichnis(se), 480.448.561.152 Bytes frei

Nach Suchlauf: 28 Verzeichnis(se), 485.892.669.440 Bytes frei

.

- - End Of File - - A478D85100A39E2613024AEF304AAAC8

--- --- ---

Was empfiehlst Du mir in Zukunft eigentlich für einen Virenschutz?

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

erledigt:

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.28.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Sentencer :: BULLSHIT [Administrator]

Schutz: Aktiviert

28.05.2013 16:23:14
mbam-log-2013-05-28 (16-23-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 617979
Laufzeit: 1 Stunde(n), 36 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|41975 (Trojan.Agent) -> Daten: C:\PROGRA~3\LOCALS~1\Temp\msuouoxqc.pif -> Löschen bei Neustart.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Qoobox\Quarantine\C\Users\Sentencer\4642959.exe.vir (Trojan.Zbot.FV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles.zip (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05252013_204233\I_Users\Sentencer\Documents\4848370d.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Sentencer\AppData\Local\2433f433 (Trojan.Agent.TPL) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

hier bitte:

Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 15.05.2013 6,00MB 11.7.700.202 notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 15.05.2013 6,00MB 11.7.700.202 notwendig
Adobe Reader 9.4.4 - Deutsch Adobe Systems Incorporated 30.05.2011 168MB 9.4.4 notwendig
ANNO 1404 Ubisoft 10.12.2009 1.00.0000 notwendig
Apple Application Support Apple Inc. 26.12.2011 61,1MB 2.1.6 notwendig
Apple Mobile Device Support Apple Inc. 26.12.2011 24,4MB 4.0.0.97 notwendig
Apple Software Update Apple Inc. 02.07.2011 2,25MB 2.1.3.127 notwendig
AVG 2013 AVG Technologies 29.03.2013 2013.0.2904 notwendig
Battlefield 3™ Electronic Arts 12.10.2012 1.4.0.0 notwendig
Battlefield: Bad Company™ 2 Electronic Arts 08.04.2010 5,73GB 1.0.0.0 notwendig
Battlelog Web Plugins EA Digital Illusions CE AB 12.10.2012 1.138.0 notwendig
Biet-O-Matic v2.12.6 BOM Development Team 15.01.2010 Biet-O-Matic v2.12.6 notwendig
Bonjour Apple Inc. 26.12.2011 2,00MB 3.0.0.10 notwendig
Call of Duty(R) - World at War(TM) Activision 31.07.2010 6,61GB 1.0 notwendig
Call of Duty(R) 4 - Modern Warfare(TM) Activision 28.12.2009 6,22GB 1.00.0000 notwendig
Call of Duty: Black Ops Treyarch 26.11.2010 notwendig
Call of Duty: Black Ops - Multiplayer Treyarch 26.11.2010 notwendig
Call of Duty: Modern Warfare 2 Infinity Ward 10.12.2009 notwendig
Call of Duty: Modern Warfare 2 - Multiplayer Infinity Ward 10.12.2009 notwendig
Call of Duty: Modern Warfare 3 Infinity Ward - Sledgehammer Games 30.12.2011 notwendig
Call of Duty: Modern Warfare 3 - Dedicated Server Infinity Ward - Sledgehammer Games 30.12.2011 notwendig
Call of Duty: Modern Warfare 3 - Multiplayer Infinity Ward - Sledgehammer Games 30.12.2011 notwendig
CCleaner Piriform 24.05.2013 4.02 notwendig
Click to Call with Skype Skype Technologies S.A. 24.08.2011 11,9MB 5.5.8013 notwendig
Combat Arms 31.03.2010 unnötig
Command & Conquer 3 Ihr Firmenname 23.12.2010 13,1GB 1.00.0000 unnötig
Compatibility Pack für 2007 Office System Microsoft Corporation 10.01.2013 381MB 12.0.6612.1000 unbekannt
Crysis(R) Electronic Arts 10.01.2010 6,40GB 1.00.0000 unnötig
CyberLink DVD Suite Deluxe CyberLink Corp. 22.09.2009 16,4MB 6.0.3101 unnötig
dm Digi Foto Imaxel Lab S.L 06.08.2011 2.3.0.93 notwendig
dm Fotowelt 30.12.2009 notwendig
dm-Fotowelt 03.05.2010 notwendig
DVDVideoSoftTB DE Toolbar DVDVideoSoftTB DE 03.08.2012 6.9.0.16 unnötig
EAX4 Unified Redist Creative Labs 30.12.2009 168KB 4.001 unbekannt
ESN Sonar ESN Social Software AB 03.04.2012 0.70.4 unbekannt
Free M4a to MP3 Converter 7.0 ManiacTools.com 14.07.2012 3,95MB notwendig
Free YouTube to MP3 Converter version 3.11.33.1005 DVDVideoSoft Ltd. 12.10.2012 60,8MB 3.11.33.1005 notwendig
GameSpy Comrade GameSpy 10.01.2010 19,0MB 1.5.0.156 notwendig
GoGear Spark Device Manager Philips 21.02.2010 0.1 unbekannt
Google Chrome Google Inc. 01.04.2013 27.0.1453.94 unnötig
Hardwarediagnosetools PC-Doctor, Inc. 22.09.2009 6.0.5205.31 unnötig
HP Customer Experience Enhancements Hewlett-Packard 22.09.2009 5.7.0.3036 notwendig
HP MAINSTREAM KEYBOARD Hewlett-Packard 22.09.2009 1.4.3.0 alles HP unbekannt aber wohl nötig
HP MediaSmart DVD Hewlett-Packard 22.09.2009 101MB 3.0.3123
HP MediaSmart Movie Themes Hewlett-Packard 22.09.2009 399MB 3.0.3102
HP MediaSmart Music/Photo/Video Hewlett-Packard 22.09.2009 401MB 3.0.3205
HP MediaSmart SmartMenu Hewlett-Packard 22.09.2009 1,85MB 3.0.28.2
HP Odometer Hewlett-Packard 22.09.2009 48,0KB 2.10.0000
HP Remote Solution TopSeed 22.09.2009 1.1.9.0
HP Setup Hewlett-Packard 22.09.2009 1.2.3220.3079
HP Support Information Hewlett-Packard 22.09.2009 160KB 10.1.0002
HP Update Hewlett-Packard 22.09.2009 2,96MB 5.001.000.014
Intel® Matrix Storage Manager Intel Corporation 13.11.2009
iTunes Apple Inc. 26.12.2011 170MB 10.5.2.11
Java(TM) 6 Update 25 Oracle 31.12.2010 94,9MB 6.0.250
LabelPrint CyberLink Corp. 22.09.2009 230MB 2.5.1901
Left 4 Dead 2 Valve 17.10.2010 unnötig
LightScribe System Software LightScribe 22.09.2009 22,4MB 1.18.5.1 unnötig
Malwarebytes Anti-Malware Version 1.75.0.1300 Malwarebytes Corporation 28.05.2013 19,2MB 1.75.0.1300 notwendig
Medal of Honor (TM) Electronic Arts 03.11.2010 7,37GB 1.0.0.0 notwendig
Medal of Honor™ MP Open Beta Electronic Arts 07.10.2010 1,64GB 1.0.0.0 notwendig
Microsoft .NET Framework 1.1 Microsoft 10.01.2010 34,8MB 1.1.4322
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 26.06.2010 38,8MB 4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 26.06.2010 2,93MB 4.0.30319
Microsoft .NET Framework 4 Extended Microsoft Corporation 16.12.2011 51,9MB 4.0.30319
Microsoft Office File Validation Add-In Microsoft Corporation 06.10.2011 7,95MB 14.0.5130.5003
Microsoft Office Live Add-in 1.5 Microsoft Corporation 25.10.2012 508KB 2.0.4024.1
Microsoft Office PowerPoint Viewer 2007 (German) Microsoft Corporation 10.01.2013 125MB 12.0.6612.1000
Microsoft Office Professional Edition 2003 Microsoft Corporation 27.05.2013 1,38GB 11.0.8173.0
Microsoft Security Essentials Microsoft Corporation 17.02.2013 4.2.223.1
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Corporation 28.01.2010 260KB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 16.06.2011 300KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 22.09.2009 708KB 8.0.61000
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 Microsoft Corporation 28.01.2010 212KB 9.0.30729.4148
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 28.01.2010 200KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 22.09.2009 788KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 16.06.2011 788KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 03.01.2012 1,41MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 03.11.2010 598KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 22.09.2009 596KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 16.06.2011 600KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 28.11.2011 13,8MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 28.11.2011 12,2MB 10.0.40219
Microsoft Works Microsoft Corporation 11.10.2012 833MB 9.7.0621
Mozilla Firefox (3.5.6) Mozilla 25.12.2009 3.5.6 (de) notwendig
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 02.12.2009 1,27MB 4.20.9870.0 notwendig
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 02.12.2009 1,33MB 4.20.9876.0 notwendig
NVIDIA 3D Vision Controller-Treiber 285.62 NVIDIA Corporation 27.11.2011 285.62 notwendig
NVIDIA 3D Vision Treiber 311.06 NVIDIA Corporation 15.04.2013 311.06 notwendig
NVIDIA Grafiktreiber 311.06 NVIDIA Corporation 15.04.2013 311.06 notwendig
NVIDIA PhysX-Systemsoftware 9.11.0621 NVIDIA Corporation 27.11.2011 9.11.0621 notwendig
NVIDIA Update 1.11.3 NVIDIA Corporation 15.04.2013 1.11.3 notwendig
Opera 12.12 Opera Software ASA 17.01.2013 12.12.1707 notwendig
Origin Electronic Arts, Inc. 03.03.2012 8.5.0.4550 notwendig
Pando Media Booster Pando Networks Inc. 31.03.2010 5,46MB 2.3.3.6 unbekannt
PDFCreator Frank Heindörfer, Philip Chinery 17.01.2011 1.1.0 notwendig
pdfforge Toolbar v7.0 Spigot, Inc. 12.03.2013 24,9MB 7.0 unnötig
Power2Go CyberLink Corp. 22.09.2009 169MB 6.0.3101 unbekannt
PowerDirector CyberLink Corp. 22.09.2009 521MB 7.0.3101 unbekannt
PunkBuster Services Even Balance, Inc. 26.11.2011 0.991 notwendig
QuickTime Apple Inc. 26.12.2011 73,2MB 7.71.80.42 notwendig
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 22.09.2009 6.0.1.5882 notwendig
Samsung Kies Samsung Electronics Co., Ltd. 26.06.2011 184MB 2.0.1.11053_66 unnötig
Samsung Mobile phone USB driver Drive Software 17.02.2010 unnötig
Samsung PC Studio 3 USB Driver Installer Samsung Electronics Co., Ltd. 17.02.2010 3.2.0.70701 unnötig
SAMSUNG USB Driver for Mobile Phones SAMSUNG Electronics Co., Ltd. 26.06.2011 41,3MB 1.3.2300.0 unnötig
Skype™ 5.10 Skype Technologies S.A. 13.09.2012 19,4MB 5.10.116 notwendig
Star Wars: The Force Unleashed Activision 16.01.2010 1.0 unnötig
StarCraft II Blizzard Entertainment 14.01.2011 1.2.0.17326 unnötig
Steam Valve Corporation 01.12.2009 42,2MB 1.0.0.0 notwendig
Stronghold 3 Firefly Studios 16.12.2011 unnötig
Stronghold Kingdoms Firefly Studios 03.01.2012 125MB unnötig
TeamSpeak 3 Client TeamSpeak Systems GmbH 19.09.2010 notwendig
Tom Clancy's Splinter Cell Double Agent Ubisoft 30.12.2009 1.00.0000 unnötig
Torchlight 2 28.10.2012 1.1.1.1 unnötig
TuneUp Utilities 2012 TuneUp Software 21.08.2012 12.0.3600.73 notwendig
Visual Studio 2010 x64 Redistributables AVG Technologies 29.03.2013 12,4MB 13.0.0.1 notwendig
VLC media player 1.1.6 VideoLAN 31.01.2011 1.1.6 notwendig
WinRAR 26.12.2009 notwendig

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Combat
Command
Crysis
CyberLink
DVDVideoSoftTB
Google Chrome
Hardwarediagnosetools
Java
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
Left 4
LightScribe

Mozilla Firefox
Webbrowser Firefox auf Deutsch | Schneller, sicherer und anpassbar
neueste instalieren.

Deinstaliere:
pdfforge
Power2Go
PowerDirector
Samsung : alle
Star Wars:
StarCraft
Stronghold : beide
Tom
Torchlight
TuneUp : verzichte bitte auf solchen Unsinn, viele Funktionen können dem PC schaden, oder bringen nichts.

Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Ganz schöner Batzen zu tun diesmal ;)

Also ich hab alles deinstalliert aber beim Link zum Flashplayer hat der mir gleich wieder Google Chrome aufs Auge gedrückt :(
Nochmal deinstallieren?
AdwCleaner Logfile:

Code:

# AdwCleaner v2.301 - Datei am 31/05/2013 um 07:09:03 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Sentencer - BULLSHIT

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Sentencer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRABRNWJ\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\searchplugins\Askcom.xml

Datei Gelöscht : C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\searchplugins\daemon-search.xml

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files (x86)\Common Files\spigot

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Program Files (x86)\DAEMON Tools Toolbar

Ordner Gelöscht : C:\Users\Sentencer\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Sentencer\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Sentencer\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Sentencer\AppData\LocalLow\PriceGong

Ordner Gelöscht : C:\Users\Sentencer\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}

Ordner Gelöscht : C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\extensions\{238d4b4c-d63c-42a7-b6d8-dc96c8c0f5b9}

Ordner Gelöscht : C:\Users\Sentencer\AppData\Roaming\OpenCandy
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Search Settings

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\IM

Schlüssel Gelöscht : HKCU\Software\ImInstaller

Schlüssel Gelöscht : HKCU\Software\incredibar

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2625848

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3158970

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\14919ea49a8f3b4aa3cf1058d9a64cec

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16576
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v21.0 (de)
 

Datei : C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\prefs.js
 

C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\user.js ... Gelöscht !
 

Gelöscht : user_pref("CT2625848.autoDisableScopes", -1);

Gelöscht : user_pref("CT3158970.autoDisableScopes", 10);

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");

Gelöscht : user_pref("browser.search.order.1", "Ask.com");

Gelöscht : user_pref("browser.startup.homepage", "hxxp://de.ask.com/?l=dis&o=");
 

-\\ Google Chrome v27.0.1453.94
 

Datei : C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

-\\ Opera v12.12.1707.0
 

Datei : C:\Users\Sentencer\AppData\Roaming\Opera\Opera\operaprefs.ini
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [5777 octets] - [31/05/2013 07:09:03]
 

########## EOF - C:\AdwCleaner[S1].txt - [5837 octets] ##########

--- --- ---

kannst du, obwohl ich dir raten würde von Firefox auf chrome umzusteigen, da sicherer und meist auch schneller.

Hitmanpro laden:
HitmanPro - Download - Filepony

Nichts löschen.
Auf weiter, Log speichern unter, bzw als xml exportieren, dann posten, bzw packen und anhängen

bitte schön:

Code:

HitmanPro 3.7.5.199

www.hitmanpro.com
 

   Computer name . . . . : BULLSHIT

   Windows . . . . . . . : 6.1.1.7601.X64/4

   User name . . . . . . : Bullshit\Sentencer

   UAC . . . . . . . . . : Disabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2013-05-31 19:47:26

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 11m 22s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 265
 

   Objects scanned . . . : 1.770.902

   Files scanned . . . . : 26.231

   Remnants scanned  . . : 704.905 files / 1.039.766 keys
 

Suspicious files ____________________________________________________________
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002220.dll

      Size . . . . . . . : 899.576 bytes

      Age  . . . . . . . : 1128.9 days (2010-04-28 21:30:31)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : FC8930F99A9D1B394B5A55BD7D95306E4A6BD27F67A8A4768A875C48A1DCAD1E

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002261.dll

      Size . . . . . . . : 951.318 bytes

      Age  . . . . . . . : 889.9 days (2010-12-23 21:59:22)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 07F342FC49BF00281C514B364399E7FD98C36888DF680304C7807C827336E939

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002263.dll

      Size . . . . . . . : 944.298 bytes

      Age  . . . . . . . : 812.9 days (2011-03-10 21:28:41)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : E570C42135F4E074FEA64029B4F9923775EBB7BBB3276A02F212621D7660A506

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002267.dll

      Size . . . . . . . : 942.669 bytes

      Age  . . . . . . . : 766.0 days (2011-04-26 19:48:16)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : B7EC3BEE9879391E80F191AC1D91CB71FB681798E4A5AE1BA122F4DCDAC7B114

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002269.dll

      Size . . . . . . . : 952.683 bytes

      Age  . . . . . . . : 763.9 days (2011-04-28 21:05:29)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : A23DC409633A449EA2C5D0A79B9D0A01270F50000234FB540B20C5547E26AB5D

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002272.dll

      Size . . . . . . . : 953.145 bytes

      Age  . . . . . . . : 755.9 days (2011-05-06 22:24:04)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : E1C07F31EC35315E00F8AB0BE5C4F80DD9AAEBEE7E760BBF9AFCC02D35BEBF2F

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\dll\wc002277.dll

      Size . . . . . . . : 960.138 bytes

      Age  . . . . . . . : 643.9 days (2011-08-26 22:25:23)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 70053EEA7AC3C1427D779B3F258A13CF74B02980DCDDEFBC24B341CFFA1E4AA2

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\pbcl.dll

      Size . . . . . . . : 960.138 bytes

      Age  . . . . . . . : 566.0 days (2011-11-12 18:40:24)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 70053EEA7AC3C1427D779B3F258A13CF74B02980DCDDEFBC24B341CFFA1E4AA2

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BC2\pb\pbclold.dll

      Size . . . . . . . : 960.138 bytes

      Age  . . . . . . . : 1149.0 days (2010-04-08 20:28:04)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 70053EEA7AC3C1427D779B3F258A13CF74B02980DCDDEFBC24B341CFFA1E4AA2

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\dll\wc002288.dll

      Size . . . . . . . : 948.118 bytes

      Age  . . . . . . . : 453.8 days (2012-03-03 23:39:46)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 3192353354FE593051B33886088D4C312ACB9A653D874281B2EBF131B80415CB

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\dll\wc002292.dll

      Size . . . . . . . : 956.681 bytes

      Age  . . . . . . . : 420.3 days (2012-04-06 13:26:28)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 7218A15A9890CE82EB25F7AB5AC7AA60B4E3055C5574B70A6CABA4274D6DE493

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\dll\wc002317.dll

      Size . . . . . . . : 949.613 bytes

      Age  . . . . . . . : 230.9 days (2012-10-12 21:27:44)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 15059F09B1D62DEA6B5D22EF9E0D062411C167378D870AE339AAB50B0BDC7FC0

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.

      Forensic Cluster

         -0.2s C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\htm\wc002317.htm

         -0.2s C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\htm\wc002317.htm

          0.0s C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\dll\wc002317.dll
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\pbcl.dll

      Size . . . . . . . : 949.613 bytes

      Age  . . . . . . . : 217.0 days (2012-10-26 20:09:43)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 15059F09B1D62DEA6B5D22EF9E0D062411C167378D870AE339AAB50B0BDC7FC0

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\pbclold.dll

      Size . . . . . . . : 949.613 bytes

      Age  . . . . . . . : 552.0 days (2011-11-26 20:27:08)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 15059F09B1D62DEA6B5D22EF9E0D062411C167378D870AE339AAB50B0BDC7FC0

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\BF3\pb\PnkBstrK.sys

      Size . . . . . . . : 139.328 bytes

      Age  . . . . . . . : 552.0 days (2011-11-26 20:27:35)

      Entropy  . . . . . : 7.8

      SHA-256  . . . . . : F6552C37C04FD92554BD715F9E98B41E3D711C8AC37C757FBCFDDD69738FBE5E

      RSA Key Size . . . : 2048

      Authenticode . . . : Valid

      Fuzzy  . . . . . . : 22.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.

         The file is a device driver. Device drivers run as trusted (highly privileged) code.

         Program is code signed with a valid Authenticode certificate.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\dll\wc002246.dll

      Size . . . . . . . : 909.302 bytes

      Age  . . . . . . . : 920.1 days (2010-11-23 18:26:45)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 7D00D6C826ECB0EEA17D542E28D38593FEE279ED8AA801F08D0A58FEBE0F1F18

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\dll\wc002262.dll

      Size . . . . . . . : 942.784 bytes

      Age  . . . . . . . : 823.9 days (2011-02-27 21:01:46)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 316C5751F0AB84A097C72C0A2F9E79730A68285FD4075EFE8F47945648E0D24A

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\pbcl.dll

      Size . . . . . . . : 942.784 bytes

      Age  . . . . . . . : 756.0 days (2011-05-06 19:43:08)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 316C5751F0AB84A097C72C0A2F9E79730A68285FD4075EFE8F47945648E0D24A

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\pbclold.dll

      Size . . . . . . . : 942.784 bytes

      Age  . . . . . . . : 966.9 days (2010-10-07 21:29:11)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 316C5751F0AB84A097C72C0A2F9E79730A68285FD4075EFE8F47945648E0D24A

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\pbcls.dll

      Size . . . . . . . : 895.844 bytes

      Age  . . . . . . . : 934.8 days (2010-11-08 23:31:29)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : FC3B4CA8E757E4C9EE740E84419DDB76AE60D20711C49C993B74FCCFFB58F2F9

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 

   C:\Users\Sentencer\AppData\Local\PunkBuster\MOH\pb\PnkBstrK.sys

      Size . . . . . . . : 138.440 bytes

      Age  . . . . . . . : 966.9 days (2010-10-07 21:29:23)

      Entropy  . . . . . : 7.8

      SHA-256  . . . . . : D7DB2348D00FEF21B1064615ED21B4CEB8E3EB983460684ACD4AB0EBB9B98D7D

      RSA Key Size . . . : 1024

      Authenticode . . . : Valid

      Fuzzy  . . . . . . : 22.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.

         The file is a device driver. Device drivers run as trusted (highly privileged) code.

         Program is code signed with a valid Authenticode certificate.
 

   C:\Users\Sentencer\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll

      Size . . . . . . . : 55.816 bytes

      Age  . . . . . . . : 5.9 days (2013-05-25 22:19:19)

      Entropy  . . . . . : 7.0

      SHA-256  . . . . . : 4DBB532A9CDCF078E2A7F48A6E31F254119B8AE0F5140DE706BEDD79CFB79301

      Product

      Description

      Version  . . . . . : 5.2.0.2

      Copyright

      Fuzzy  . . . . . . : 26.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Program is running but currently exposes no human-computer interface (GUI).

         Authors name is missing in version info. This is not common to most programs.

         Time indicates that the file appeared recently on this computer.

         The file is in use by one or more active processes.

         Program contains PE structure anomalies. This is not typical for most programs.

      Forensic Cluster

         -0.0s C:\Users\Sentencer\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\

          0.0s C:\Users\Sentencer\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
 

   C:\Users\Sentencer\Documents\BFBC2\pb\pbcl.dll

      Size . . . . . . . : 891.962 bytes

      Age  . . . . . . . : 543.8 days (2011-12-04 23:34:52)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : A324BDA2B890227F72D9F12323AD3FF51582CE312286C296F6558BD3F3927616

      Fuzzy  . . . . . . : 29.0

         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Program contains PE structure anomalies. This is not typical for most programs.
 
 

Cookies _____________________________________________________________________
 

   C:\Users\Sentencer\AppData\Roaming\Microsoft\Windows\Cookies\4DX0ZSQM.txt

   C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\cookies.sqlite:doubleclick.net

   C:\Users\Sentencer\AppData\Roaming\Mozilla\Firefox\Profiles\uz0zf0kj.default\cookies.sqlite:serving-sys.com

alles was hitman als
Cookies _____________________________________________________________________
bezeichnet, kannst du löschen

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

C:\Windows\system32\*.tsp

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

OTL.txtOTL Logfile:

Code:

OTL logfile created on: 01.06.2013 00:09:18 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sentencer\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

5,99 Gb Total Physical Memory | 4,14 Gb Available Physical Memory | 69,14% Memory free

11,98 Gb Paging File | 10,19 Gb Available in Paging File | 85,06% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 921,17 Gb Total Space | 512,14 Gb Free Space | 55,60% Space Free | Partition Type: NTFS

Drive D: | 10,24 Gb Total Space | 1,91 Gb Free Space | 18,68% Space Free | Partition Type: NTFS

 

Computer Name: BULLSHIT | User Name: Sentencer | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Sentencer\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\games\Steam\Steam.exe (Valve Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()

PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

PRC - C:\Program Files (x86)\Philips\GoGear Spark Device Manager\main.exe (KeenHigh Tech.)

PRC - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

PRC - c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)

PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()

PRC - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe (Hewlett-Packard)

PRC - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\CNYHKEY.exe (Hewlett-Packard)

PRC - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe ()

PRC - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Users\Sentencer\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a9594959e951127f16eb49644ba92f79\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\7cfbbd029ef945fbcdaedd24b2b67a24\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\2f9e0112e10f9e70d3430d0be9863976\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\153143f74d840484b510d8cf5187796b\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\af18b8a8f56494da44cc448f3b9704a5\WindowsBase.ni.dll ()

MOD - C:\games\Steam\bin\chromehtml.dll ()

MOD - C:\games\Steam\SDL2.dll ()

MOD - C:\games\Steam\bin\libcef.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\dfeff31ab1e7cd3480c8942290c92f5d\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b573c6a62bb88df0ee2af59b6a8ca910\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\15872842e3e63ddf0f720f406706198e\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll ()

MOD - C:\games\Steam\bin\avcodec-53.dll ()

MOD - C:\games\Steam\bin\avformat-53.dll ()

MOD - C:\games\Steam\bin\avutil-51.dll ()

MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

MOD - C:\Program Files (x86)\Philips\GoGear Spark Device Manager\SigmaTel.dll ()

MOD - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()

MOD - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe ()

MOD - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\WMINPUT.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)

SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)

SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (IAANTMON) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()

DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()

DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{902D76CD-4644-4E24-B5B4-3F14BEC37261}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE:64bit: - HKLM\..\SearchScopes\{BAF60B34-BC2D-4D38-BF52-8D31949C6020}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{902D76CD-4644-4E24-B5B4-3F14BEC37261}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKLM\..\SearchScopes\{BAF60B34-BC2D-4D38-BF52-8D31949C6020}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes,DefaultScope = {5ED129F9-5087-4B0B-B242-6F8E17D74FEF}

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes\{5ED129F9-5087-4B0B-B242-6F8E17D74FEF}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes\{7F746C26-ECA1-48CC-AEF7-695CF98CE83F}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MNC&o=15092&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=MF&apn_dtid=YYYYYYYYDE&apn_uid=ba90a4ec-4449-4a1b-8e03-b133226c7a84&apn_sauid=F31FF262-BB98-436C-87F4-E3755D770BB7

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes\{902D76CD-4644-4E24-B5B4-3F14BEC37261}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes\{BAF60B34-BC2D-4D38-BF52-8D31949C6020}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1005\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome_first&locale=de_DE&c=94&bd=Pavilion&pf=cndt

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Yahoo"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..extensions.enabledAddons: addon%40youtubeanywhere.com:2.1.89

FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.138.0: C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.30 22:17:32 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.30 22:17:32 | 000,000,000 | ---D | M]

 

[2009.12.25 19:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sentencer\AppData\Roaming\mozilla\Extensions

[2013.05.31 07:09:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sentencer\AppData\Roaming\mozilla\Firefox\Profiles\uz0zf0kj.default\extensions

[2012.08.03 21:42:14 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Sentencer\AppData\Roaming\mozilla\Firefox\Profiles\uz0zf0kj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.10.25 21:44:08 | 000,000,000 | ---D | M] (YouTubeAnywhere) -- C:\Users\Sentencer\AppData\Roaming\mozilla\Firefox\Profiles\uz0zf0kj.default\extensions\addon@youtubeanywhere.com

[2013.05.31 06:55:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2011.08.24 20:20:10 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2013.05.31 06:55:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions

[2013.05.31 06:55:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2011.04.14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.31 18:53:33 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files (x86)\mozilla firefox\plugins\npPandoWebInst.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR - homepage: hxxp://www.google.com/

CHR - Extension: YouTubeAnywhere = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\acjncgbafaonlkolfjaaoolfoaechkpn\2.1.89_0\

CHR - Extension: YouTube = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: YouTube = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\

CHR - Extension: YouTube = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: Google-Suche = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Google-Suche = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\

CHR - Extension: Google-Suche = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: Google Mail = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

CHR - Extension: Google Mail = C:\Users\Sentencer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2013.05.25 22:18:06 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (YouTubeAnywhere) - {8015C430-448C-4003-A969-274F7F0F2D9C} - C:\Users\Sentencer\AppData\LocalLow\YouTubeAnywhere\IE\YouTubeAnywhere.dll (Diego Casorran)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [BATINDICATOR] C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe (Hewlett-Packard)

O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()

O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)

O4 - HKLM..\Run: [LaunchHPOSIAPP] C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe (Hewlett-Packard)

O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000..\Run: [Steam] C:\games\Steam\Steam.exe (Valve Corporation)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3902464133-3703953061-810384064-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 41975 = C:\PROGRA~3\LOCALS~1\Temp\msuouoxqc.pif

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-3902464133-3703953061-810384064-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EDAC4DA-541E-46A4-9A80-1D4ED613F74C}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - 

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

 

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.31 19:46:42 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2013.05.31 07:25:44 | 000,000,000 | ---D | C] -- C:\Users\Sentencer\AppData\Local\Macromedia

[2013.05.31 06:55:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2013.05.31 06:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2013.05.31 06:44:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2013.05.30 22:36:09 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2013.05.28 22:47:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2013.05.28 22:47:31 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2013.05.28 16:22:06 | 000,000,000 | ---D | C] -- C:\Users\Sentencer\AppData\Roaming\Malwarebytes

[2013.05.28 16:22:03 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2013.05.28 16:22:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.05.28 16:22:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2013.05.28 16:22:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.05.28 16:21:44 | 000,000,000 | ---D | C] -- C:\Users\Sentencer\AppData\Local\Programs

[2013.05.26 02:42:34 | 000,000,000 | ---D | C] -- C:\_OTL

[2013.05.25 22:26:57 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.05.25 22:18:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2013.05.25 22:04:11 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.05.25 22:04:11 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.05.25 22:04:11 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.05.25 22:01:08 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.05.25 22:00:57 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.05.25 21:59:49 | 005,071,432 | R--- | C] (Swearware) -- C:\Users\Sentencer\Desktop\ComboFix.exe

[2013.05.25 21:37:48 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Sentencer\Desktop\tdsskiller.exe

[2013.05.25 21:07:29 | 000,000,000 | ---D | C] -- C:\9838ad918078db8f1d

[2013.05.15 23:53:49 | 000,000,000 | ---D | C] -- C:\found.000

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.31 23:57:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.31 23:53:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.31 07:18:12 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.31 07:18:12 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.31 07:11:12 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.31 07:10:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.31 07:10:18 | 529,854,463 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.31 06:55:23 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2013.05.31 06:54:11 | 000,002,145 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.31 06:47:15 | 000,001,981 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.28 22:47:32 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.28 16:22:03 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.27 22:45:42 | 001,650,978 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.27 22:45:42 | 000,710,854 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.27 22:45:42 | 000,663,876 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.27 22:45:42 | 000,153,964 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.27 22:45:42 | 000,126,006 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.27 03:22:51 | 000,343,392 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.05.25 22:18:06 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2013.05.25 22:00:03 | 005,071,432 | R--- | M] (Swearware) -- C:\Users\Sentencer\Desktop\ComboFix.exe

[2013.05.25 21:37:48 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Sentencer\Desktop\tdsskiller.exe

 
 ========== Files Created - No Company Name ==========

 

[2013.05.31 07:25:37 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.31 06:55:23 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2013.05.31 06:55:23 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2013.05.31 06:47:15 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

[2013.05.31 06:47:15 | 000,001,981 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.31 06:44:03 | 000,002,145 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.31 06:43:48 | 000,001,116 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.31 06:43:48 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.28 22:47:32 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.28 16:22:03 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.25 22:04:11 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.05.25 22:04:11 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.05.25 22:04:11 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.05.25 22:04:11 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.05.25 22:04:11 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.03.29 13:12:27 | 000,000,004 | ---- | C] () -- C:\Users\Sentencer\AppData\Roaming\AltShell.ini

[2012.03.22 21:09:46 | 000,007,604 | ---- | C] () -- C:\Users\Sentencer\AppData\Local\Resmon.ResmonCfg

[2011.07.03 21:05:51 | 000,114,180 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat

[2011.06.07 11:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.06.07 11:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.06.07 11:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.06.07 11:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2011.06.07 11:13:38 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2010.09.25 21:34:24 | 000,006,144 | ---- | C] () -- C:\Users\Sentencer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.01.27 21:40:04 | 000,000,228 | ---- | C] () -- C:\Users\Sentencer\AppData\Roaming\wklnhst.dat

[2010.01.11 07:13:33 | 000,000,097 | ---- | C] () -- C:\Users\Sentencer\AppData\Local\fusioncache.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2013.03.29 13:37:42 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\AVG2013

[2010.07.31 21:48:23 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.07.23 21:44:30 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2013.05.31 06:59:53 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\DAEMON Tools Lite

[2010.07.20 20:36:12 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\DAEMON Tools Pro

[2012.10.12 20:53:37 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\DVDVideoSoft

[2012.01.03 18:52:09 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Firefly Studios

[2010.12.31 18:32:51 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\GetRightToGo

[2012.10.02 00:14:26 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Gutie

[2011.08.06 21:10:24 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Imaxel

[2010.12.31 18:33:55 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Opera

[2012.10.12 20:07:40 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Origin

[2011.06.26 11:05:28 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Samsung

[2012.03.20 21:49:14 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\TeamViewer

[2010.01.27 21:40:04 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Template

[2010.10.03 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\TS3Client

[2012.08.03 21:43:18 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\TuneUp Software

[2012.10.12 17:06:11 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Ubguvi

[2009.12.10 18:46:52 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Ubisoft

[2010.11.13 19:34:23 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\VSX

[2012.03.21 08:17:43 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Windows Desktop Search

[2012.10.07 01:50:10 | 000,000,000 | ---D | M] -- C:\Users\Sentencer\AppData\Roaming\Zealc

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2013.05.30 21:25:06 | 000,000,000 | ---D | M] -- C:\$AVG

[2013.05.25 22:18:38 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2013.05.25 21:07:31 | 000,000,000 | ---D | M] -- C:\9838ad918078db8f1d

[2010.07.18 17:53:31 | 000,000,000 | ---D | M] -- C:\Alte Kamerakarte

[2013.05.31 06:57:05 | 000,000,000 | ---D | M] -- C:\data

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2009.12.01 23:13:54 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2013.05.15 23:53:49 | 000,000,000 | ---D | M] -- C:\found.000

[2013.05.30 22:24:29 | 000,000,000 | ---D | M] -- C:\games

[2012.09.11 20:56:56 | 000,000,000 | ---D | M] -- C:\Hasi

[2010.02.28 11:20:07 | 000,000,000 | ---D | M] -- C:\hp

[2009.09.22 17:25:10 | 000,000,000 | ---D | M] -- C:\Intel

[2013.02.08 10:27:56 | 000,000,000 | ---D | M] -- C:\Kamera 8.2.13

[2013.05.17 00:40:02 | 000,000,000 | ---D | M] -- C:\Kaspersky Rescue Disk 10.0

[2010.07.20 20:40:46 | 000,000,000 | R--D | M] -- C:\MSOCache

[2013.02.02 12:44:13 | 000,000,000 | ---D | M] -- C:\music

[2011.11.27 21:20:51 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2010.04.13 18:36:32 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2013.05.30 22:36:09 | 000,000,000 | R--D | M] -- C:\Program Files

[2013.05.31 07:09:09 | 000,000,000 | ---D | M] -- C:\Program Files (x86)

[2013.05.31 19:46:42 | 000,000,000 | ---D | M] -- C:\ProgramData

[2009.12.01 23:13:54 | 000,000,000 | -HSD | M] -- C:\Programme

[2013.05.25 22:26:59 | 000,000,000 | ---D | M] -- C:\Qoobox

[2010.09.07 10:01:16 | 000,000,000 | ---D | M] -- C:\Sicherung Bilder 7.9

[2010.08.23 23:33:45 | 000,000,000 | ---D | M] -- C:\Sicherung Photo 23_08_10

[2013.06.01 00:10:20 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2013.04.15 03:07:23 | 000,000,000 | ---D | M] -- C:\Temp

[2010.11.03 15:53:33 | 000,000,000 | ---D | M] -- C:\torrents

[2010.07.12 13:02:57 | 000,000,000 | ---D | M] -- C:\Urlaub 2009

[2011.11.27 22:05:37 | 000,000,000 | R--D | M] -- C:\Users

[2013.05.31 07:01:49 | 000,000,000 | ---D | M] -- C:\Windows

[2013.05.28 20:46:45 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < C:\Windows\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2013.05.31 06:43:48 | 000,001,112 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2013.05.31 06:43:48 | 000,001,116 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2013.05.31 07:25:37 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\erdnt\cache86\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\erdnt\cache64\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\erdnt\cache86\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe

[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe

[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe

[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\hp\drivers\Intel_Storage\IaStor.sys

[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\drivers\iaStor.sys

[2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a012329c4d1be4fd\iaStor.sys

[2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_023f2cfe3fa02200\iaStor.sys

[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\erdnt\cache64\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\erdnt\cache86\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\erdnt\cache86\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\erdnt\cache64\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2013.04.04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2013.06.01 00:10:15 | 003,932,160 | -HS- | M] () -- C:\Users\Sentencer\NTUSER.DAT

[2013.05.26 02:39:05 | 000,008,192 | -H-- | M] () -- C:\Users\Sentencer\ntuser.dat.LOG

[2013.06.01 00:10:15 | 000,262,144 | -HS- | M] () -- C:\Users\Sentencer\ntuser.dat.LOG1

[2009.12.01 23:14:01 | 000,000,000 | -HS- | M] () -- C:\Users\Sentencer\ntuser.dat.LOG2

[2009.12.02 01:16:46 | 000,065,536 | -HS- | M] () -- C:\Users\Sentencer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2009.12.02 01:16:46 | 000,524,288 | -HS- | M] () -- C:\Users\Sentencer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2009.12.02 01:16:46 | 000,524,288 | -HS- | M] () -- C:\Users\Sentencer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2009.12.01 23:14:01 | 000,000,020 | -HS- | M] () -- C:\Users\Sentencer\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 5120 bytes -> C:\ProgramData:gs5sys

@Alternate Data Stream - 4096 bytes -> C:\Users\Public\Documents\desktop.ini:gs5sys

@Alternate Data Stream - 1536 bytes -> C:\Users\Sentencer\Documents\desktop.ini:gs5sys

@Alternate Data Stream - 1536 bytes -> C:\Users\Sentencer\Desktop\desktop.ini:gs5sys
 

< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 01.06.2013 00:09:18 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sentencer\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

5,99 Gb Total Physical Memory | 4,14 Gb Available Physical Memory | 69,14% Memory free

11,98 Gb Paging File | 10,19 Gb Available in Paging File | 85,06% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 921,17 Gb Total Space | 512,14 Gb Free Space | 55,60% Space Free | Partition Type: NTFS

Drive D: | 10,24 Gb Total Space | 1,91 Gb Free Space | 18,68% Space Free | Partition Type: NTFS

 

Computer Name: BULLSHIT | User Name: Sentencer | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)

http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Hasi\dm Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [dm Fotowelt] -- "C:\Hasi\dm Fotowelt\dm Fotowelt.exe" "%1" ()

Directory [dm-Fotowelt] -- "C:\Hasi\dm Fotowelt\dm-Fotowelt.exe" "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Hasi\dm Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [dm Fotowelt] -- "C:\Hasi\dm Fotowelt\dm Fotowelt.exe" "%1" ()

Directory [dm-Fotowelt] -- "C:\Hasi\dm Fotowelt\dm-Fotowelt.exe" "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07E18928-B735-4078-BE48-ABAC1623339E}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{08FDB852-4E0C-4CF0-A55D-61862AC1C47C}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{2507063A-62D6-45BB-9802-4B8CA3399F76}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{3A171D79-4457-4B30-9CB6-32AE7F06C83E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{49054B77-55F1-456A-A5E2-9444A9B99CBB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{4A992D73-4966-4109-8F56-16BFE77C1FC9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{8B2E93A9-3D20-4CCD-8104-A53DD3F13CB1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{903ED504-4A49-4703-8E2A-665A16FBE1A1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9F2E6A04-AB8A-47F2-8F6F-CC23A2BBDF5B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E2670D33-6422-4ADF-8EC8-C8229069847B}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{FD5A35F7-92A5-4B43-AB3D-7A4FBBD0C578}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00945D1B-0B4E-424E-BA17-DB86921DBAE3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{040BFC4C-82D7-4298-9C4A-3EA31D63B18B}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 

"{0867C3C7-683B-4BE0-A2AA-C2A6ECF5B863}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{097DF778-D5C7-47DA-A835-0FE29F096C59}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{0A096FB5-873E-4849-B4E3-46A107C87F55}" = protocol=17 | dir=in | app=c:\games\anno 1404\anno4.exe | 

"{0AFB6538-3C36-43EE-A514-990663663F88}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 

"{0C234A6E-B966-4DEE-A9BB-0E3B5C5CABE3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{0CFE6D9D-862B-4C7A-A97B-6B6B4B85C23C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{0E952B0F-EB0E-46E3-B989-889BDCA04AA4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{0ECB644B-53D3-4CEC-91A2-82D1FFE2A1F3}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{0FBCCDBA-C8DB-46FA-88A9-BB27995C3024}" = protocol=6 | dir=in | app=c:\games\fear\fear.exe | 

"{0FF14235-E4C1-434C-AEE5-0061CD3F464A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{103E15C6-6D2B-4D45-8E9F-ABE26CC268C6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{12725068-BBCA-4E80-A4E6-7BEC685B589D}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 

"{12FE4E93-E8DC-46EF-A244-B4296B842C06}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 

"{141DE573-030B-447D-B982-202D104AC1AC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{14B52E9E-C8BB-4989-B568-2C2E12CF61EF}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 

"{15F06B97-F116-42C3-9B0B-1FF7605A9208}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{17ACA385-608C-4A9E-A048-C6A2EF2D9F37}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{180D44B8-5B5C-4FE4-B108-82438ABA96ED}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{1A8CAA25-00EB-4F95-9FC6-EE3BFA7B9C34}" = dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 

"{1B24235A-2703-4CFB-AA5E-FDFF247CA66A}" = protocol=6 | dir=in | app=c:\games\crysis\bin32\crysis.exe | 

"{1C01AF83-4411-449A-94F1-F08C7C06BAAE}" = protocol=17 | dir=in | app=c:\games\crysis\bin32\crysis.exe | 

"{1D4E13CF-E18E-4DBA-81DD-C9113E164468}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 

"{1DCB5CE3-E439-4A99-8349-30D72E7529FC}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 

"{1E4A08AB-62C8-4C20-BACB-B53B9561F258}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 

"{240BC7B4-79DC-4477-B3CD-6EA7B04091B9}" = protocol=6 | dir=in | app=c:\games\cod4mw\iw3mp.exe | 

"{2442C5DF-73CC-486A-AEBD-B6E8898C08BF}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | 

"{26DFC5C3-FEF7-48D3-A7BF-611637B417CA}" = protocol=6 | dir=in | app=c:\games\anno 1404\anno4.exe | 

"{26E5673F-024C-48B0-B41D-F4B13827DBBB}" = protocol=17 | dir=in | app=c:\games\battlefield 3\battlefield 3\bf3.exe | 

"{2C030E2A-627D-4547-81B0-930E4C0A87B7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{2DC0D865-474A-4800-A2AF-827CAF53C61B}" = protocol=17 | dir=in | app=c:\games\torchlight 2\torchlight2.exe | 

"{2E9DF18F-BE76-41AB-A9C8-8A5FDE7A75FB}" = protocol=17 | dir=in | app=c:\games\fear\fearmp.exe | 

"{321F836A-5992-406A-900D-F20C87CDC752}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe | 

"{33796847-FD20-4737-82E9-6038A5D3894F}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{343C00A8-BE0A-481F-8379-9868348D68D4}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{360597FF-C395-485E-85B9-0863632F67D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{36C69EE4-43F9-4EC9-92B4-8BAF7F479285}" = protocol=17 | dir=in | app=c:\games\torchlight 2\tl2.runic.launcher.exe | 

"{37B22D1E-9680-4293-AF06-F3EB3E853CCA}" = protocol=6 | dir=out | app=system | 

"{396E029A-69F5-4692-8580-0912D38119C8}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{39B3C2A4-C240-4D33-9202-F0197749E813}" = protocol=6 | dir=in | app=c:\games\crysis\bin64\crysisdedicatedserver.exe | 

"{3D4CD4F9-08B9-48BB-B96B-2ED22C01389B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{3D975AA4-684A-4766-9849-EB837282918D}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{3E288462-8C2F-4411-AFA5-2984800F11F0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{3FEBE4D3-F565-48DA-B37E-E2F116F84E75}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{400D2541-2E2C-4D57-AB96-868BBCCABD82}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 

"{425139EF-5DC2-47B7-922A-24A46C438803}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 

"{450FEEB7-D2AC-4357-B7D3-1FA2245062EB}" = protocol=17 | dir=in | app=c:\games\starcraft ii\starcraft ii.exe | 

"{4AB30268-D499-46A1-85D0-214E50FE9ECA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{4AF22B24-BC79-450F-8758-04D589C126D4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{4D31048D-96BC-4A97-9AF6-883F76EB89BE}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{4D60A473-6B37-4B0C-B902-2F30209DDD39}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{4D6EEBF5-B892-44D9-8816-D731123B7F8E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{4E0AA013-2252-498D-95AE-9DE0D18C937E}" = protocol=6 | dir=in | app=c:\games\torchlight 2\torchlight2.exe | 

"{51A04899-5A55-46B3-956E-7FD043EA01EC}" = protocol=17 | dir=in | app=c:\games\steam\steam.exe | 

"{538F15BA-6AC1-44CB-8689-A23DF6B1CD34}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{546C54E4-F1A0-4DF2-B072-05AB74C6C362}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{5493E21C-616B-42EA-BF1A-15E7A17ACF1C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{551ED0BA-69A1-4034-8E6A-BA4C4E95B90B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{56562C1E-8A0D-4D04-9BE6-65410C15B8B1}" = protocol=6 | dir=in | app=c:\games\torchlight 2\tl2.runic.launcher.exe | 

"{5818489D-752F-482E-8798-5EF95CAE3CB9}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{58FAB0FC-4692-43C7-9628-DCB8A9DC3490}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 

"{596302B7-C403-461E-BF8F-484013B96EBC}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 

"{5AA6670C-BB24-4905-AA33-324C01CE9F70}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 

"{5B241A31-2040-4C2C-B33D-8A2E31AE8429}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{5E764A2B-1BD0-424F-95B5-4792733436A1}" = protocol=6 | dir=in | app=c:\games\anno 1404\tools\anno4web.exe | 

"{5ECF3A10-969A-47B7-8730-98054832F86A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{6161EFC0-6C69-4BD9-AC20-1AAC8F8693FD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{618CA5D7-2C0D-4966-B93F-489CEC42B385}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 

"{62D9733D-2D55-4617-9B7D-F96BADE823AC}" = protocol=6 | dir=in | app=c:\games\call of duty - world at war\codwawmp.exe | 

"{68F30845-1DE2-47C1-A16A-69798AB835D1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{6954527B-1768-4168-A625-9E3CEDF6CF15}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe | 

"{6A7018C7-4FDA-45EB-82EB-845B81CC9428}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{6EDC7182-6FB1-492E-9E5E-9C5B2C4394C9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{6F80FC63-F058-45DF-BF95-65691234F1C8}" = protocol=17 | dir=in | app=c:\games\crysis\bin64\crysis.exe | 

"{6FA64544-D699-496D-9C09-D5C314BB3311}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{73437F39-CCB9-401D-BD46-C46D332B4EDC}" = protocol=17 | dir=in | app=c:\games\battlefield bad company 2\bfbc2updater.exe | 

"{74B13FFD-2A35-4EE8-8317-C34A8A678293}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 

"{76F8146C-8322-46E1-B011-E533D2686BCC}" = protocol=6 | dir=in | app=c:\games\crysis\bin32\crysisdedicatedserver.exe | 

"{78B891DE-F4B8-4FB1-BD91-CD2769299889}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 

"{797AE015-3A7D-459F-A7AA-40DEB2148469}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 

"{7B6C2DB6-2A3C-4CFB-A8D7-C8A9B7B9E32B}" = protocol=17 | dir=in | app=c:\games\anno 1404\tools\anno4web.exe | 

"{7B986E8B-1206-404D-B33E-2B4224FFC1C9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{7C831E33-66BE-4971-A9E0-18E29F90B14C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{801CF24F-54EA-473E-A2BA-3DAC3E629EF7}" = protocol=6 | dir=in | app=c:\games\battlefield 3\battlefield 3\bf3.exe | 

"{810C7490-D55B-491E-936C-D60001C8C88B}" = protocol=6 | dir=in | app=c:\games\steam\steam.exe | 

"{843B34FF-2F79-48D6-BCB6-56E224E7099F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{883E42BF-74AA-4F8B-AC9C-0FCFB9970D54}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{89626932-2FA4-40A8-BFB2-1C764A6846FE}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | 

"{8CBAC44C-D2DE-42B2-8C73-8E695FBC5C5F}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{8EDA03DB-2353-47E0-8171-511EDC6FF090}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{8F00F74E-BE93-4243-9922-E739906BAF1E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{8F0FBBE3-5177-4A81-A794-4C1658F048E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{8F7B0D51-078E-4115-A445-92AE22F9521C}" = protocol=6 | dir=in | app=c:\games\battlefield bad company 2\bfbc2updater.exe | 

"{900779CE-465C-4FDE-BA91-F577A1B915D0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{90AFA69F-90D3-4C0C-9FAC-D4F53DD7C727}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{9159189B-6EB2-4428-BBE7-CBE38B2CA3B7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{92E994F7-DF26-4F48-A3E0-60B064641E51}" = protocol=17 | dir=in | app=c:\games\cod4mw\iw3mp.exe | 

"{93ED21A4-1FAF-496B-8751-D2D190EB3B05}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 

"{9DD0F75C-C0DE-4621-AACB-FE63918C121C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{A03BEFCB-53DD-42A3-B530-4F263073007D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{A0BFF9A7-D0EE-47C0-98A5-85A46DA3964F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{A1B6D4F1-C26D-482C-8407-F093A7AA4804}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 

"{A1DAED02-731F-437F-89A1-08D9E193AE2D}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 

"{A27430E1-7F54-4587-8059-D2EA38BC8C5B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{A2B16527-0599-4E65-B433-9CB5FD6A70A6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{A3A24D1A-63D9-43C8-A709-125B4A01AB70}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{A889D0D5-1194-4015-B78A-FE7973D79CBC}" = protocol=6 | dir=in | app=c:\program files (x86)\midway games\blacksite\binaries\blacksite.exe | 

"{A969F959-0DE6-49EF-9B19-A2507C056677}" = protocol=6 | dir=in | app=c:\games\starcraft ii\starcraft ii.exe | 

"{ABEB27A0-D7EC-4330-82A9-3AB0523B3B83}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{AD4D0D7C-EDCF-4FB1-9273-B06B5F9891F9}" = protocol=6 | dir=in | app=c:\games\starcraft ii\versions\base16939\sc2.exe | 

"{AEFDF64D-1F64-455E-863F-B0930F4C52FD}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 

"{AFBA1AD1-FFAD-4527-98DB-224C65AF08FC}" = protocol=17 | dir=in | app=c:\games\fear\fear.exe | 

"{B04D4801-B2E5-4ABF-83CA-B3A5BB947CF2}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 

"{B06CDF73-A5CC-4D0D-9DF9-50C847C8BE5E}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe | 

"{B1B75064-DBEE-4274-83E2-D22D771B617F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{B1F9D3C0-33C1-4B88-8B92-D0D898FF0F6B}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{B3831F0A-2D17-4BBD-9978-40570215B173}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{B63FB7AB-226A-45C0-8622-51DFC17F3FF7}" = protocol=17 | dir=in | app=c:\games\medal of honor mp open beta\mohmpupdater.exe | 

"{B69BDF41-F789-4DD9-BA7E-4BAB1F7936A1}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe | 

"{B7895670-76EE-4A18-A3CF-35A6DFD0D86D}" = protocol=17 | dir=in | app=c:\games\crysis\bin32\crysisdedicatedserver.exe | 

"{B7BBC2AE-0691-4027-AE89-8C2C229F8958}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 

"{B7C49FC4-C8D2-4F4D-8C89-48DC3D686E05}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 

"{B86F2661-1641-470D-8F27-29892380D175}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{B8F2851B-3503-44DA-B11A-D4F92C480938}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe | 

"{BC0B28DE-408A-495C-8137-726F9C7A2211}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 

"{BC569485-551D-41A6-87A7-A016E0FC1DC2}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{BE5717F8-5D37-4E02-BC2A-14E329113871}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{BEF4D7A8-5274-4134-92E2-EC8B388B7A2D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{C08928A1-0E97-4673-A218-9A9BD47A83A6}" = protocol=6 | dir=in | app=c:\games\call of duty - world at war\codwaw.exe | 

"{C3DD1A78-0598-40F2-B63B-CF45FAA5A439}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{C4D37148-EE24-4C17-99EF-6D39382F936F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{C54C8DC4-C61E-4826-A851-82FBF1287B0D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{C88012E4-6485-4E36-949F-8A874D34C77E}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 

"{CA859080-CF0E-4F9D-A1D8-F6ECBB96BC06}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{CBA2A7CF-63C0-48CD-82E5-C02A68F47AA7}" = protocol=17 | dir=in | app=c:\games\call of duty - world at war\codwaw.exe | 

"{CBD8E5E2-095B-4994-9238-022F2CD2A747}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{CF1EB7C6-C196-4B30-B691-E7751E5F7CDF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{D194EF6B-EFFC-4DD8-B0BE-C31258B7ED35}" = protocol=17 | dir=in | app=c:\program files (x86)\midway games\blacksite\binaries\blacksite.exe | 

"{D4C1B4DB-4150-4196-BEBB-53651FD6D498}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 

"{D9012252-4700-41E4-A1B6-4BDB8F2FD758}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 

"{DAF54B9B-3650-4EEC-8900-93FD297E3EDB}" = protocol=6 | dir=in | app=c:\games\fear\fearmp.exe | 

"{DB8B3194-37AC-4BEB-8893-700D12AFBDD5}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | 

"{DC50A8C3-0B9D-4B0C-8A62-D8080D6CE747}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{DD66E8A4-C72E-454B-B689-FB79E6FBD286}" = protocol=17 | dir=in | app=c:\games\crysis\bin64\crysisdedicatedserver.exe | 

"{DD7F33E5-7387-40BA-BCBB-CE2CE19A2366}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{DE86DA18-5B9C-498B-8794-FC67EF312E3F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{E233BE22-8FE9-45E6-9559-8FD4668214EE}" = protocol=6 | dir=in | app=c:\games\crysis\bin64\crysis.exe | 

"{E2B299E2-0CF1-4C16-8508-04E065E1A34D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{E48C1C41-512F-4555-B878-EC3A8CE66083}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{E4B5AC90-47E1-4A6C-BAD1-DD200608FA3E}" = protocol=6 | dir=in | app=c:\games\medal of honor mp open beta\mohmpupdater.exe | 

"{E59A0EEB-BC82-4AEF-9E6C-5744C11739EB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{E749F0C3-DDEC-4BDE-A551-1278677A8D29}" = protocol=17 | dir=in | app=c:\games\starcraft ii\versions\base16939\sc2.exe | 

"{E9CC5D7D-2263-4069-AE31-CA1454B1D29C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{EBD70542-127B-4B51-9C5B-DA0E94A307A0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{ECA74661-E726-40BA-B4BE-454BB4B75D71}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{ED04305B-CDF8-4C1F-B8C9-1577CAE1DFE8}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{F02FA094-2225-4225-8022-ECDAA5BF848A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{F04C6DE0-49C2-4AD0-9C03-04DEAEDADAD0}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 

"{F13C92AF-E281-4BCE-94B4-C05074DF2109}" = protocol=17 | dir=in | app=c:\games\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 

"{F5101C0A-3EBB-4093-A944-BBBD2C5E6F58}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 

"{F528D27E-4D3C-4036-BACD-EE18775F4D3F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{F5CFE65C-BBEE-41ED-AA3A-A3439CABAFA1}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{F812E372-053C-483C-9911-EC3F0C08F4AC}" = protocol=17 | dir=in | app=c:\games\call of duty - world at war\codwawmp.exe | 

"{F8CD8774-6D9E-4746-AE6C-437E069A2558}" = protocol=6 | dir=in | app=c:\games\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe | 

"{F92F9314-2D08-4150-8819-0F4ACEB77AAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{FA818267-C185-47EE-82B0-B3182D72AAEC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{FB7955CF-BC39-4E72-934D-B87CF919DF73}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{FC2F9789-F792-4EF3-8811-BA2472318430}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{FE9DB386-5EF9-4E6B-98EA-6331D9D905B4}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 

"TCP Query User{05B35CCD-FAD9-4043-9589-7419C3C213A7}C:\games\medal of honor mp open beta\mohmpgame.exe" = protocol=6 | dir=in | app=c:\games\medal of honor mp open beta\mohmpgame.exe | 

"TCP Query User{24D3E962-7D2E-4A45-9388-053F3383E181}C:\games\medal of honor\mp\mohmpgame.exe" = protocol=6 | dir=in | app=c:\games\medal of honor\mp\mohmpgame.exe | 

"TCP Query User{3DDFA99E-2E26-4DDE-9603-9D75B5065380}C:\games\medal of honor\binaries\moh.exe" = protocol=6 | dir=in | app=c:\games\medal of honor\binaries\moh.exe | 

"TCP Query User{40DDF994-2077-431F-94BC-6981235F41BC}C:\games\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\games\battlefield bad company 2\bfbc2game.exe | 

"TCP Query User{47B0B724-A50D-4A76-B21F-FC45FAC76B47}C:\games\anno 1404\tools\anno4web.exe" = protocol=6 | dir=in | app=c:\games\anno 1404\tools\anno4web.exe | 

"TCP Query User{5EE7E729-BE80-4AA1-9BDE-96A03DB760F9}C:\users\sentencer\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\sentencer\appdata\local\temp\electronicarts_patcher_000.exe | 

"TCP Query User{AD5AEAD8-0460-424C-95AF-BD6ADE2612B3}C:\games\medal of honor\mp\mohmpgame.exe" = protocol=6 | dir=in | app=c:\games\medal of honor\mp\mohmpgame.exe | 

"TCP Query User{B24E7043-3683-4DE2-9CB9-19EF9FD3C24C}C:\games\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\games\battlefield bad company 2\bfbc2game.exe | 

"UDP Query User{0B7DB09E-0363-4DDF-814F-5227955E10A9}C:\games\anno 1404\tools\anno4web.exe" = protocol=17 | dir=in | app=c:\games\anno 1404\tools\anno4web.exe | 

"UDP Query User{41AAE78D-3528-4EA8-B534-D3531458FB7B}C:\games\medal of honor\mp\mohmpgame.exe" = protocol=17 | dir=in | app=c:\games\medal of honor\mp\mohmpgame.exe | 

"UDP Query User{4F842298-E5EC-4027-8CDE-F8D3484DF4E2}C:\games\medal of honor\mp\mohmpgame.exe" = protocol=17 | dir=in | app=c:\games\medal of honor\mp\mohmpgame.exe | 

"UDP Query User{7CC37F39-01CA-49D0-AD88-2F1665CC17AC}C:\games\medal of honor mp open beta\mohmpgame.exe" = protocol=17 | dir=in | app=c:\games\medal of honor mp open beta\mohmpgame.exe | 

"UDP Query User{83FFF99B-3E21-45D4-9DE9-5C642289F119}C:\games\medal of honor\binaries\moh.exe" = protocol=17 | dir=in | app=c:\games\medal of honor\binaries\moh.exe | 

"UDP Query User{CB475941-E7B2-4FF5-B628-7D067C190B69}C:\games\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\games\battlefield bad company 2\bfbc2game.exe | 

"UDP Query User{D3E1F5CB-8CC9-48C2-A5EA-3461EF619466}C:\games\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\games\battlefield bad company 2\bfbc2game.exe | 

"UDP Query User{DED15A1F-5278-4E48-8B44-3837CE0C7DE6}C:\users\sentencer\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\sentencer\appdata\local\temp\electronicarts_patcher_000.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables

"{26280024-DFB7-4967-90DB-7F9C6660D01E}" = HP MediaSmart SmartMenu

"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)

"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{D66F0C3C-24F2-4463-9E2F-4381E5C40A26}" = iTunes

"{D954C6C2-544B-4091-A47F-11E77162883E}" = Microsoft Security Client

"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack

"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Security Client" = Microsoft Security Essentials

"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software

"WinRAR archiver" = WinRAR

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404

"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21

"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes

"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2

"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{415030B8-3E8B-462A-8C03-41D95AA3AB3B}" = Medal of Honor (TM)

"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = PowerRecover

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5B295588-59C1-4386-9F85-BB4BEDCB0D22}" = HP Customer Experience Enhancements

"{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}" = GameSpy Comrade

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{89661B04-C646-4412-B6D3-5E19F02F1F37}" = EAX4 Unified Redist

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch

"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}" = HP MAINSTREAM KEYBOARD

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype

"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer

"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information

"{C3C2983F-BF2E-431D-B140-C678B60A8FB7}" = GoGear Spark Device Manager

"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution

"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CCF22908-ECD2-4068-84F1-BA02DA1EC72D}" = GoGear Spark Device Manager

"{CF9041ED-60C9-36ED-9DB9-F55AAD993865}" = Visual C++ 9.0 ATL (x86) WinSXS MSM

"{D1D632A2-E249-466D-A094-B1B934D37645}_is1" = Stronghold Kingdoms

"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update

"{D5AED751-CD8F-43EF-8720-AD970CBEA741}" = Medal of Honor™ MP Open Beta

"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)

"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)

"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}" = HP Setup

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Battlelog Web Plugins" = Battlelog Web Plugins

"Biet-O-Matic v2.12.6" = Biet-O-Matic v2.12.6

"Combat Arms" = Combat Arms

"dm Digi Foto" = dm Digi Foto

"dm Fotowelt" = dm Fotowelt

"dm-Fotowelt" = dm-Fotowelt

"ESN Sonar-0.70.4" = ESN Sonar

"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.33.1005

"Google Chrome" = Google Chrome

"HP Remote Solution" = HP Remote Solution

"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)

"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300

"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Opera 12.12.1707" = Opera 12.12

"Origin" = Origin

"PunkBusterSvc" = PunkBuster Services

"Steam App 10180" = Call of Duty: Modern Warfare 2

"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer

"Steam App 42680" = Call of Duty: Modern Warfare 3

"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer

"Steam App 42700" = Call of Duty: Black Ops

"Steam App 42710" = Call of Duty: Black Ops - Multiplayer

"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server

"Steam App 47400" = Stronghold 3

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"VLC media player" = VLC media player 1.1.6

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{049FF5E4-EB02-4c42-8DB0-226E2F7A9E53}" = Torchlight 2

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 30.01.2013 20:27:19 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 9142

 

Error - 30.01.2013 20:27:19 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 9142

 

Error - 31.01.2013 04:13:09 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 31.01.2013 04:13:09 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 27959279

 

Error - 31.01.2013 04:13:09 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 27959279

 

Error - 31.01.2013 04:46:39 | Computer Name = Bullshit | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,

 Zeitstempel: 0x50a2f9e3  Name des fehlerhaften Moduls: D3D10Warp.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b7af  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0002b38f  ID des fehlerhaften

 Prozesses: 0x11c0  Startzeit der fehlerhaften Anwendung: 0x01cdf35ab2763143  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad

 des fehlerhaften Moduls: C:\Windows\system32\D3D10Warp.dll  Berichtskennung: b9c1e7af-6b82-11e2-8b92-40618648e226

 

Error - 31.01.2013 08:56:52 | Computer Name = Bullshit | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,

 Zeitstempel: 0x50a2f9e3  Name des fehlerhaften Moduls: jvm.dll, Version: 20.0.0.11,

 Zeitstempel: 0x4da6f198  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0005e6b2  ID des fehlerhaften

 Prozesses: 0x138c  Startzeit der fehlerhaften Anwendung: 0x01cdf35ecd2df655  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad

 des fehlerhaften Moduls: C:\PROGRA~2\Java\jre6\bin\client\jvm.dll  Berichtskennung:

 ae9389d6-6ba5-11e2-8b92-40618648e226

 

Error - 31.01.2013 18:55:58 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 31.01.2013 18:55:58 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 1014

 

Error - 31.01.2013 18:55:58 | Computer Name = Bullshit | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 1014

 

[ System Events ]

Error - 29.05.2013 12:58:48 | Computer Name = Bullshit | Source = volsnap | ID = 393230

Description = Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers

 auf Volume "C:" abgebrochen.

 

Error - 30.05.2013 15:33:00 | Computer Name = Bullshit | Source = volsnap | ID = 393230

Description = Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers

 auf Volume "C:" abgebrochen.

 

Error - 31.05.2013 00:34:43 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7038

Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"

 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern

 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft

 Management Console (MMC).

 

Error - 31.05.2013 00:34:43 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7000

Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden

 Fehlers nicht gestartet:   %%1069

 

Error - 31.05.2013 00:47:11 | Computer Name = Bullshit | Source = volsnap | ID = 393230

Description = Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers

 auf Volume "C:" abgebrochen.

 

Error - 31.05.2013 01:04:19 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7038

Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"

 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern

 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft

 Management Console (MMC).

 

Error - 31.05.2013 01:04:19 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7000

Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden

 Fehlers nicht gestartet:   %%1069

 

Error - 31.05.2013 01:11:45 | Computer Name = Bullshit | Source = DCOM | ID = 10010

Description = 

 

Error - 31.05.2013 01:13:03 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7038

Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"

 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern

 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft

 Management Console (MMC).

 

Error - 31.05.2013 01:13:03 | Computer Name = Bullshit | Source = Service Control Manager | ID = 7000

Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden

 Fehlers nicht gestartet:   %%1069

 

 

< End of report >

--- --- ---

Hi,

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found

IE - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\SearchScopes\{7F746C26-ECA1-48CC-AEF7-695CF98CE83F}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MNC&o=15092&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=MF&apn_dtid=YYYYYYYYDE&apn_uid=ba90a4ec-4449-4a1b-8e03-b133226c7a84&apn_sauid=F31FF262-BB98-436C-87F4-E3755D770BB7

O3 - HKU\S-1-5-21-3902464133-3703953061-810384064-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File

not found

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.

oh je nun is mein mp3 converter weg, böser Markus ;)
oder war dies die Wurzel des Übels??

Wie viel isses jetz noch, ich hatte im Glauben, dass wir fertig sind schon letzte Woche meine Spende getätigt ?!

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}\ not found.
Registry key HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Microsoft\Internet Explorer\SearchScopes\{7F746C26-ECA1-48CC-AEF7-695CF98CE83F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F746C26-ECA1-48CC-AEF7-695CF98CE83F}\ not found.
Registry value HKEY_USERS\S-1-5-21-3902464133-3703953061-810384064-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to MP3 Converter\ deleted successfully.
File C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to MP3 Converter\ not found.
File C:\Users\Sentencer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sentencer
->Temp folder emptied: 133456585 bytes
->Temporary Internet Files folder emptied: 11511726 bytes
->Java cache emptied: 860274 bytes
->FireFox cache emptied: 85124667 bytes
->Google Chrome cache emptied: 347593523 bytes
->Opera cache emptied: 6638261 bytes
->Flash cache emptied: 15859732 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 46820 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 413097 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 670 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 574,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06052013_222653

Files\Folders moved on Reboot...
C:\Users\Sentencer\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Sentencer\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

weg kann er eig nich sein, aber lad ihn zur not noch mal runter und instaliere ihn neu. schau dann mal obs geht, bzw welche Probleme es noch gibt

Keine Auffälligkeiten soweit.

Ich gehe davon aus wir sind durch?

Hi, otl öffnen, bereinigen, PC startet neu, remover werden gelöscht.
Lösche übrig gebliebene Logs, Setups von uns verwendete Programe.
PC absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.

Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten