| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Nod32 meldet Variante von Win32/Gataka.BWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.09.2012, 21:47
| #16 |
 |  Nod32 meldet Variante von Win32/Gataka.B Dieser Toolbar-Müll ist mir auch aufgefallen.... Hier die aktuelle Textdatei: Code:
ATTFilter # AdwCleaner v2.001 - Datei am 09/10/2012 um 22:43:22 erstellt
# Aktualisiert am 09/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : XXXXXXX - BLACK-RUNNER
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\XXXXXXX\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7601.17514
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v15.0 (de)
Profilname : default
Datei : C:\Users\XXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\36njkvcj.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Opera v12.1.1532.0
Datei : C:\Users\XXXXXXX\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [12300 octets] - [06/09/2012 13:57:27]
AdwCleaner[S1].txt - [12594 octets] - [06/09/2012 18:04:38]
AdwCleaner[R2].txt - [999 octets] - [10/09/2012 22:43:22]
########## EOF - C:\AdwCleaner[R2].txt - [1058 octets] ##########
|
|
10.09.2012, 22:09
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Nod32 meldet Variante von Win32/Gataka.BCode:
ATTFilter PRC - [2012.04.25 19:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
PRC - [2011.10.04 19:28:28 | 001,088,280 | ---- | M] (Mischel Internet Security) -- D:\Programme\TrojanHunter 5.5\THGuard.exe
PRC - [2011.09.22 12:03:30 | 000,974,944 | ---- | M] (ESET) -- C:\Programme\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
 Willst du dein System in die Knie zwingen? Zwei oder mehr solcher Virenscanner installiert man niemals parallel! Deinstalliere einen der beiden! Max. Malwarebytes kann man zu einem installierten Virenscanner benutzen. (die anderen Scanner die ich hier in der Bereinigung/Analyse verwende kommen den anderen auch nichts ins Gehege)
__________________ |
|
11.09.2012, 12:36
| #18 |
| | Nod32 meldet Variante von Win32/Gataka.B Normalerweise habe ich nur den Eset laufen, die anderen waren klägliche Versuche damit den Schädling loszuwerden. Ich habe jetzt nur den den Eset auf dem System, alles andere habe ich deinstalliert.
__________________Den adwcleaner habe ich noch einmal laufen lassen. Er zeigte an, dass alles sauber ist. Sollte ich jetzt noch einmal eines der anderen Programme laufen lassen, weil sie nach der Entfernung der zuviel installierten Virenscanner vielleicht andere Ergebnisse zeigen könnten? Viele Grüße Conny_Sch. |
|
11.09.2012, 16:55
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.09.2012, 17:39
| #20 |
| | Nod32 meldet Variante von Win32/Gataka.B Hier ist das Log: OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.09.2012 18:26:45 - Run 2 OTL by OldTimer - Version 3.2.61.3 Folder = C:\Users\XXXXX\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,98 Gb Total Physical Memory | 2,49 Gb Available Physical Memory | 62,54% Memory free 7,95 Gb Paging File | 6,29 Gb Available in Paging File | 79,05% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 116,21 Gb Total Space | 66,67 Gb Free Space | 57,37% Space Free | Partition Type: NTFS Drive D: | 584,83 Gb Total Space | 424,98 Gb Free Space | 72,67% Space Free | Partition Type: NTFS Drive E: | 346,68 Gb Total Space | 265,07 Gb Free Space | 76,46% Space Free | Partition Type: NTFS Drive F: | 100,00 Mb Total Space | 70,06 Mb Free Space | 70,07% Space Free | Partition Type: NTFS Drive G: | 244,14 Gb Total Space | 241,66 Gb Free Space | 98,99% Space Free | Partition Type: NTFS Drive H: | 351,93 Gb Total Space | 279,12 Gb Free Space | 79,31% Space Free | Partition Type: NTFS Drive I: | 3,03 Gb Total Space | 2,99 Gb Free Space | 98,59% Space Free | Partition Type: NTFS Drive O: | 7,46 Gb Total Space | 2,11 Gb Free Space | 28,34% Space Free | Partition Type: FAT32 Computer Name: BLACK-RUNNER | User Name: XXXXX | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found -- PRC - [2012.09.10 16:29:20 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\XXXXX\Desktop\OTL.exe PRC - [2012.08.22 15:46:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.08.22 06:16:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.04.12 11:11:34 | 000,404,880 | ---- | M] (H+H Software GmbH) -- C:\Program Files (x86)\Virtual CD v10\System\VC10Play.exe PRC - [2012.04.12 11:11:34 | 000,324,496 | ---- | M] (H+H Software GmbH) -- C:\Program Files (x86)\Virtual CD v10\System\VC10Tray.exe PRC - [2012.04.12 11:11:30 | 000,145,296 | ---- | M] (H+H Software GmbH) -- C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe PRC - [2011.09.22 12:03:30 | 000,974,944 | ---- | M] (ESET) -- C:\Programme\ESET\ESET NOD32 Antivirus\x86\ekrn.exe PRC - [2011.09.16 14:39:24 | 000,115,048 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2011.08.04 14:25:20 | 001,839,448 | ---- | M] (Crystal Rich Ltd) -- C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2011.04.30 00:32:50 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.11.23 18:33:22 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe PRC - [2010.09.02 10:59:16 | 002,158,592 | ---- | M] () -- C:\Program Files (x86)\Vtune\TBPANEL.exe PRC - [2009.09.23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- D:\Programme\Panda USB Vaccine\USBVaccine.exe PRC - [2008.04.23 03:08:13 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- D:\Programme\Adobe Acrobat\Distillr\acrotray.exe ========== Modules (No Company Name) ========== MOD - [2012.06.17 12:25:13 | 000,492,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\8036b60a803443f3c61c48b4959f722d\IAStorUtil.ni.dll MOD - [2012.06.15 15:40:26 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012.06.14 17:50:59 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012.05.11 17:00:33 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\d89ee849317b4d93ea78842dd78f79c0\IAStorCommon.ni.dll MOD - [2012.05.11 06:39:33 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll MOD - [2012.05.11 06:39:06 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll MOD - [2012.05.11 06:39:03 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012.05.11 06:39:01 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012.05.11 06:39:00 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012.05.11 06:38:57 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.09.02 10:59:16 | 002,158,592 | ---- | M] () -- C:\Program Files (x86)\Vtune\TBPANEL.exe MOD - [2009.07.14 19:58:10 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2008.08.18 16:11:24 | 001,237,504 | ---- | M] () -- C:\Program Files (x86)\Virtual CD v10\System\vorbis.dll MOD - [2008.08.18 16:08:10 | 000,050,688 | ---- | M] () -- C:\Program Files (x86)\Virtual CD v10\System\ogg.dll MOD - [2006.01.12 22:20:26 | 000,019,968 | ---- | M] () -- D:\Programme\Adobe Acrobat\Distillr\acrotray.DEU MOD - [2006.01.12 22:13:46 | 000,019,968 | ---- | M] () -- D:\Programme\Adobe Acrobat\Distillr\acrotray.FRA MOD - [1998.10.31 04:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\Vtune\TBManage.dll ========== Services (SafeList) ========== SRV:64bit: - [2010.05.07 05:16:22 | 000,078,848 | ---- | M] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) [Auto | Running] -- C:\Windows\SysNative\PrintCtrl.exe -- (Printer Control) SRV - [2012.09.08 11:07:45 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.22 15:46:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.08.22 06:16:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.04.12 11:11:30 | 000,145,296 | ---- | M] (H+H Software GmbH) [Auto | Running] -- C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe -- (VC10SecS) SRV - [2012.01.17 23:29:04 | 000,246,784 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\GSService.exe -- (GSService) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.09.22 12:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Running] -- C:\Programme\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn) SRV - [2011.08.04 14:25:22 | 000,551,352 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\USB Safely Remove\USBSRService.exe -- (USBSafelyRemoveService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.05.31 09:42:06 | 000,210,024 | ---- | M] (DTS) [Auto | Running] -- C:\Programme\Realtek\Audio\HDA\DTSAudioService64.exe -- (DTSAudioService) SRV - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.11.23 18:33:22 | 000,240,112 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe -- (CLKMSVC10_9EC60124) SRV - [2010.10.27 16:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.03 17:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.06.12 22:00:48 | 000,726,160 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.10.06 21:44:56 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.10.06 21:44:56 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.10.05 09:55:02 | 000,729,152 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364) DRV:64bit: - [2011.10.02 16:13:47 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2011.10.02 16:12:40 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2011.10.02 16:12:39 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2011.09.02 08:30:46 | 000,042,776 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LUsbFilt.sys -- (LUsbFilt) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.08.09 14:24:52 | 000,202,576 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm) DRV:64bit: - [2011.08.04 09:20:38 | 000,146,432 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:64bit: - [2011.08.04 09:20:38 | 000,137,144 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:64bit: - [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.04.19 08:53:32 | 000,223,256 | ---- | M] (H+H Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vdrv1000.sys -- (vdrv1000) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.12.24 11:43:40 | 000,029,288 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apowersoft_AudioDevice.sys -- (Apowersoft_AudioDevice) DRV:64bit: - [2010.11.22 09:09:06 | 000,303,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx) DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd) DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2010.10.27 15:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP) DRV:64bit: - [2010.10.27 15:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter) DRV:64bit: - [2010.10.27 15:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP) DRV:64bit: - [2010.10.27 15:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP) DRV:64bit: - [2010.10.27 15:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT) DRV:64bit: - [2010.10.27 15:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU) DRV:64bit: - [2010.10.27 15:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort) DRV:64bit: - [2010.10.27 15:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS) DRV:64bit: - [2010.10.19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.08.09 19:57:18 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1) DRV:64bit: - [2010.05.28 16:55:10 | 000,354,320 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.09 11:24:30 | 000,024,088 | ---- | M] (H+H Software GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HH10Help.sys -- (HH10Help.sys) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2008.06.17 09:22:24 | 000,040,464 | ---- | M] (H+H Software GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcd10bus.sys -- (vcd10bus) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B1 BD B0 89 46 CA CC 01 [binary data] IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E 2F 8B 15 5B 84 CC 01 [binary data] IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.openintab: true FF - prefs.js..browser.search.selectedEngine: "Ecosia" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://ecosia.de" FF - prefs.js..extensions.enabledAddons: {85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}:2.0 FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.14 FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0 FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:2.0 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.6 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.4 FF - prefs.js..extensions.enabledItems: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.8.5.8 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {5b1fdac4-a239-4933-9c52-b65a2a720b75}:2.3 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.80 FF - prefs.js..extensions.enabledItems: unplug@compunach:2.023 FF - prefs.js..extensions.enabledItems: videofinder@veoh.com:1.3 FF - prefs.js..extensions.enabledItems: {83D65D9A-9CCA-439B-9E4A-EC1FE481B443}:1.0.0.30 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{9193F654-D886-4fef-8894-A97EF6623104}: D:\Programme\AllMyTube\SVRFirefoxExt\ [2012.03.09 18:04:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 11:07:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.09.02 10:44:02 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 11:07:45 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.07 15:34:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\Extensions [2012.09.06 18:04:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\Firefox\Profiles\36njkvcj.default\extensions [2011.10.08 14:05:55 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\XXXXX\AppData\Roaming\mozilla\Firefox\Profiles\36njkvcj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.04.02 17:06:51 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\XXXXX\AppData\Roaming\mozilla\Firefox\Profiles\36njkvcj.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.08.12 20:11:06 | 000,145,972 | ---- | M] () (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\extensions\unplug@compunach.xpi [2012.02.07 16:24:23 | 000,020,591 | ---- | M] () (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012.08.09 13:09:04 | 000,011,801 | ---- | M] () (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\extensions\{85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}.xpi [2012.07.25 16:04:27 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.09.02 11:28:35 | 000,699,353 | ---- | M] () (No name found) -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.09.09 17:19:52 | 000,002,289 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\mozilla\firefox\profiles\36njkvcj.default\searchplugins\ecosia.xml [2012.09.08 11:07:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.03.09 18:04:21 | 000,000,000 | ---D | M] (Wondershare YouTube Downloader) -- D:\PROGRAMME\ALLMYTUBE\SVRFIREFOXEXT [2012.09.08 11:07:45 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.04 15:48:51 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Device Center\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [IntelliType Pro] C:\Program Files\Microsoft Device Center\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [PrintDisp] C:\Windows\SysNative\PrintDisp.exe (ActMask Co.,Ltd - hxxp://www.all2pdf.com) O4:64bit: - HKLM..\Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 7.0] D:\Programme\Adobe Acrobat\Distillr\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [iTunesHelper] "D:\Programme\iTunesHelper.exe" File not found O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MDS_Menu] C:\Program Files (x86)\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [VC10Player] C:\Program Files (x86)\Virtual CD v10\System\VC10Play.exe (H+H Software GmbH) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000..\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe () O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000..\Run: [updateMgr] D:\Programme\Adobe Acrobat\Acrobat\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000..\Run: [UpgradeChecker] C:\Users\XXXXX\AppData\Roaming\Windows Search\{331156C6-1C8E-436C-8B77-80126797842A}\UpgradeChecker.exe File not found O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000..\Run: [USB Safely Remove] C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe (Crystal Rich Ltd) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe () O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\Run: [updateMgr] D:\Programme\Adobe Acrobat\Acrobat\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\Run: [UpgradeChecker] C:\Users\UpdatusUser\AppData\Roaming\Windows Search\{331156C6-1C8E-436C-8B77-80126797842A}\UpgradeChecker.exe File not found O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\Run: [USB Safely Remove] C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe (Crystal Rich Ltd) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{46415E49-F5DC-4ED8-811F-8DE6D93EB11E}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EA53CA51-337B-42F7-9CFC-1D567C0EA20E}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Nvsetup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) MsConfig:64bit - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications) MsConfig:64bit - StartUpReg: BrMfcWnd - hkey= - key= - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) MsConfig:64bit - StartUpReg: ControlCenter3 - hkey= - key= - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) MsConfig:64bit - StartUpReg: LGODDFU - hkey= - key= - C:\Program Files (x86)\lg_fwupdate\fwupdate.exe (BitLeader) MsConfig:64bit - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company) MsConfig:64bit - StartUpReg: RemoteControl9 - hkey= - key= - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.) MsConfig:64bit - State: "startup" - Reg Error: Key error. SafeBootMin:64bit: AppMgmt - Service SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - Service SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player 5.2 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {605EFFF8-D34D-E319-904B-C1307716C733} - Internet Explorer ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: vidc.dvsd - C:\Windows\SysWow64\pdvcodec.dll (Matsushita Electric Industrial Co., Ltd.) Drivers32: vidc.i420 - C:\Windows\SysWow64\i420vfw.dll (www.helixcommunity.org) Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.09.10 16:29:15 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\XXXXX\Desktop\OTL.exe [2012.09.09 12:13:25 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\Documents\My Digital Editions [2012.09.09 12:12:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe [2012.09.08 11:07:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.07 17:17:49 | 000,000,000 | R--D | C] -- C:\Users\XXXXX\Documents\Scanned Documents [2012.09.07 17:17:49 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\Documents\Fax [2012.09.07 17:08:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tesseract-OCR [2012.09.05 19:43:15 | 000,905,216 | ---- | C] (ActMask hxxp://www.all2pdf.com) -- C:\Windows\SysWow64\SaveTo.dll [2012.09.05 19:43:09 | 003,821,568 | ---- | C] (DynaForms GmbH) -- C:\Windows\SysWow64\CPDF3.dll [2012.09.05 19:43:09 | 002,650,112 | ---- | C] (DynaForms GmbH) -- C:\Windows\SysWow64\CPDF.dll [2012.09.05 19:43:09 | 000,828,416 | ---- | C] (ActMask Co.,Ltd - hxxp://www.all2pdf.com) -- C:\Windows\SysNative\PrintDisp.exe [2012.09.05 19:43:09 | 000,078,848 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\SysNative\PrintCtrl.exe [2012.09.05 19:43:05 | 000,369,152 | ---- | C] (ActMask Co.,Ltd) -- C:\Windows\SysNative\ActPub.exe [2012.09.05 19:43:01 | 001,171,456 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\SysNative\PrtClient.exe [2012.09.05 19:43:01 | 000,740,864 | ---- | C] (ActMask - hxxp://www.all2pdf.com) -- C:\Windows\SysNative\PrtTools.exe [2012.09.05 19:43:01 | 000,526,848 | ---- | C] (ActMask Co.,Ltd - hxxp://www.all2pdf.com) -- C:\Windows\SysNative\PrtPass.exe [2012.09.05 19:43:01 | 000,377,344 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\SysWow64\SetPrinter.exe [2012.09.05 19:43:01 | 000,377,344 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\SysNative\SetPrinter.exe [2012.09.05 19:43:01 | 000,000,000 | ---D | C] -- C:\Windows\CleverPrint [2012.09.05 19:42:55 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Local\Abelssoft [2012.09.05 19:42:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleverPrint [2012.09.05 17:46:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.09.05 17:24:25 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\Malwarebytes [2012.09.05 17:24:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.05 17:24:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.05 17:24:16 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.05 17:24:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.05 17:17:58 | 002,322,184 | ---- | C] (ESET) -- C:\Users\XXXXX\Desktop\esetsmartinstaller_enu.exe [2012.09.04 20:02:11 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\TrojanHunter [2012.09.04 15:44:27 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\vlc [2012.09.04 15:21:58 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2012.09.02 11:25:12 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Local\ESET [2012.09.02 10:44:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET [2012.09.02 10:44:01 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET [2012.09.02 10:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2012.08.29 20:08:50 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2012.08.29 20:08:24 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll [2012.08.29 20:08:23 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2012.08.29 20:08:23 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2012.08.29 20:08:23 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2012.08.29 20:08:23 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2012.08.29 20:08:21 | 000,221,024 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFNHK64.dll [2012.08.29 20:08:21 | 000,081,248 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFCOM64.dll [2012.08.29 20:08:21 | 000,078,688 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFAPO64.dll [2012.08.29 20:08:21 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll [2012.08.29 20:08:19 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2012.08.29 20:08:19 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2012.08.29 20:08:19 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2012.08.29 20:08:19 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2012.08.29 20:08:18 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2012.08.29 20:08:18 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2012.08.29 20:08:17 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll [2012.08.29 20:08:17 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll [2012.08.29 20:08:17 | 000,141,152 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll [2012.08.29 20:08:17 | 000,123,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll [2012.08.29 20:08:17 | 000,074,592 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll [2012.08.29 20:08:16 | 008,363,864 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll [2012.08.29 20:08:16 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll [2012.08.29 20:08:16 | 001,345,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll [2012.08.29 20:08:16 | 000,396,632 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll [2012.08.29 20:08:15 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll [2012.08.29 20:08:15 | 000,603,984 | ---- | C] (Knowles Acoustics ) -- C:\Windows\SysNative\KAAPORT64.dll [2012.08.29 20:08:15 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll [2012.08.29 20:08:15 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2012.08.29 20:08:13 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2012.08.29 20:08:13 | 000,693,352 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll [2012.08.29 20:08:13 | 000,537,456 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PLFX64.dll [2012.08.29 20:08:13 | 000,449,392 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PREC64.dll [2012.08.29 20:08:12 | 001,756,264 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll [2012.08.29 20:08:12 | 001,568,360 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll [2012.08.29 20:08:12 | 001,486,952 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll [2012.08.29 20:08:12 | 000,712,296 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll [2012.08.29 20:08:12 | 000,524,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PGFX64.dll [2012.08.29 20:08:12 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll [2012.08.29 20:08:12 | 000,432,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll [2012.08.29 20:08:12 | 000,428,648 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll [2012.08.29 20:08:12 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll [2012.08.29 20:08:12 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll [2012.08.29 20:08:12 | 000,241,768 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll [2012.08.29 20:08:11 | 000,728,680 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll [2012.08.29 19:22:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.08.29 19:09:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations [2012.08.29 19:08:12 | 000,726,160 | ---- | C] (Realtek ) -- C:\Windows\SysNative\drivers\Rt64win7.sys [2012.08.29 17:30:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware [2012.08.29 17:30:45 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\Documents\Anti-Malware [2012.08.29 17:03:01 | 000,000,000 | ---D | C] -- C:\ProgramData\PLAV [2012.08.29 17:02:47 | 000,000,000 | ---D | C] -- C:\ProgramData\ParetoLogic Anti-Virus PLUS [2012.08.29 16:10:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security [2012.08.29 16:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security [2012.08.26 15:23:02 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\MOVAVI [2012.08.26 12:39:30 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\Help [2012.08.26 12:35:20 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\Windows Search [2012.08.26 12:35:20 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\TeamViewer [2012.08.26 12:11:10 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\Windows\SysWow64\devil.dll [2012.08.26 12:11:10 | 000,369,152 | ---- | C] (The Public) -- C:\Windows\SysWow64\avisynth.dll [2012.08.26 12:11:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2012.08.26 12:11:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\i420vfw.dll [2012.08.26 12:11:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5 [2012.08.26 12:08:29 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\Windows\SysWow64\nbDX.dll [2012.08.26 12:08:29 | 000,163,328 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\flvDX.dll [2012.08.26 12:08:29 | 000,092,672 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLVorbisDec.ax [2012.08.26 12:08:29 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSSplitter.ax [2012.08.26 12:08:29 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSDecoder.ax [2012.08.26 12:08:29 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\Windows\SysWow64\RLTheoraDec.ax [2012.08.26 12:08:29 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\Windows\SysWow64\msfDX.dll [2012.08.26 12:08:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPER © - by eRightSoft [2012.08.26 12:08:28 | 000,186,880 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLOgg.ax [2012.08.26 12:08:28 | 000,161,792 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\RealMediaDX.ax [2012.08.26 12:08:27 | 000,179,200 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\DiracSplitter.ax [2012.08.26 12:08:27 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\Windows\SysWow64\AVCDX.ax [2012.08.26 12:07:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft [2012.08.25 10:56:22 | 000,000,000 | ---D | C] -- C:\ProgramData\DVD Shrink [2012.08.25 10:47:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator [2012.08.25 10:47:07 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll [2012.08.25 10:47:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator [2012.08.22 14:29:47 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\XXXXX\AppData\Roaming\pcouffin.sys [2012.08.22 14:29:47 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\Documents\PcSetup [2012.08.22 14:29:35 | 000,626,688 | ---- | C] (On2.com) -- C:\Windows\SysWow64\vp7vfw.dll [2012.08.22 14:29:34 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\VSO [2012.08.22 14:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\VSO [2012.08.22 14:22:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSO [2012.08.19 12:47:11 | 000,000,000 | ---D | C] -- C:\ProgramData\xml_param [2012.08.18 20:10:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.08.18 20:10:11 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.08.18 20:10:11 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.08.18 12:51:56 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\portable [2012.08.14 15:53:36 | 000,000,000 | ---D | C] -- C:\Users\XXXXX\AppData\Roaming\Bildverkleinerer [2012.06.13 13:21:52 | 016,650,848 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\Flight.exe [2012.06.13 13:21:52 | 001,068,640 | ---- | C] (Firelight Technologies) -- C:\Program Files (x86)\fmodex.dll [2012.06.13 13:21:52 | 000,389,216 | ---- | C] (Firelight Technologies) -- C:\Program Files (x86)\fmod_event_net.dll [2012.06.13 13:21:52 | 000,352,864 | ---- | C] (Firelight Technologies) -- C:\Program Files (x86)\fmod_event.dll [2012.06.13 13:21:52 | 000,121,440 | ---- | C] (Valve Corporation) -- C:\Program Files (x86)\steam_api.dll [2012.03.21 14:20:20 | 000,196,416 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\sqmapi.dll ========== Files - Modified Within 30 Days ========== [2012.09.11 17:52:17 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.11 17:52:17 | 000,656,044 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.11 17:52:17 | 000,616,590 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.11 17:52:17 | 000,130,676 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.11 17:52:17 | 000,106,970 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.11 17:51:08 | 000,001,161 | ---- | M] () -- C:\Users\XXXXX\Desktop\Wechseldatenträger (O) 2,11 GB.lnk [2012.09.11 17:18:53 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.11 17:18:53 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.11 17:11:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.10 22:41:59 | 000,512,399 | ---- | M] () -- C:\Users\XXXXX\Desktop\adwcleaner.exe [2012.09.10 16:29:20 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\XXXXX\Desktop\OTL.exe [2012.09.09 17:28:47 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI [2012.09.09 12:12:14 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Digital Editions.lnk [2012.09.08 11:47:11 | 000,002,453 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk [2012.09.08 11:47:11 | 000,001,662 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat 7.0 Professional.lnk [2012.09.05 19:42:52 | 000,000,574 | ---- | M] () -- C:\Users\XXXXX\Desktop\CleverPrint.lnk [2012.09.04 18:52:33 | 000,059,392 | R--- | M] () -- C:\Windows\SysWow64\streamhlp.dll [2012.09.02 10:54:00 | 000,016,098 | ---- | M] () -- C:\Users\XXXXX\Documents\Methodenkompetenz.dotx [2012.09.02 10:41:20 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.08.29 20:07:47 | 000,153,053 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat [2012.08.29 20:07:47 | 000,107,384 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat [2012.08.26 17:32:32 | 000,099,384 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\inst.exe [2012.08.26 17:32:32 | 000,082,816 | ---- | M] (VSO Software) -- C:\Users\XXXXX\AppData\Roaming\pcouffin.sys [2012.08.26 17:32:32 | 000,007,859 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\pcouffin.cat [2012.08.26 17:32:32 | 000,001,167 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\pcouffin.inf [2012.08.26 12:08:29 | 000,000,636 | ---- | M] () -- C:\Users\Public\Desktop\SUPER ©.lnk [2012.08.25 20:12:03 | 000,001,057 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\vso_ts_preview.xml [2012.08.25 10:47:10 | 000,001,204 | ---- | M] () -- C:\Users\Public\Desktop\PDFArchitect.lnk [2012.08.25 10:47:10 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2012.08.22 15:46:00 | 000,016,366 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb [2012.08.22 14:29:45 | 000,000,785 | ---- | M] () -- C:\Users\XXXXX\Desktop\CopyTo Starter.lnk [2012.08.22 14:22:30 | 000,000,630 | ---- | M] () -- C:\Users\XXXXX\Desktop\VSO DivxToDVD.lnk [2012.08.22 14:17:27 | 003,492,915 | ---- | M] () -- C:\Windows\SysNative\nvcoproc.bin [2012.08.22 06:16:24 | 000,429,416 | ---- | M] () -- C:\Windows\SysWow64\nvStreaming.exe [2012.08.18 20:10:25 | 000,001,457 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.08.16 16:03:46 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\BD7010.DAT [2012.08.16 14:48:30 | 000,429,192 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.09.11 17:51:08 | 000,001,161 | ---- | C] () -- C:\Users\XXXXX\Desktop\Wechseldatenträger (O) 2,11 GB.lnk [2012.09.10 22:41:55 | 000,512,399 | ---- | C] () -- C:\Users\XXXXX\Desktop\adwcleaner.exe [2012.09.09 12:12:14 | 000,000,871 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Digital Editions.lnk [2012.09.09 12:12:14 | 000,000,871 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions.lnk [2012.09.08 11:47:11 | 000,001,662 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Acrobat 7.0 Professional.lnk [2012.09.05 19:43:09 | 001,391,616 | ---- | C] () -- C:\Windows\SysWow64\ActPDF.dll [2012.09.05 19:43:01 | 000,691,200 | ---- | C] () -- C:\Windows\SysNative\PrintLog.exe [2012.09.05 19:42:52 | 000,000,574 | ---- | C] () -- C:\Users\XXXXX\Desktop\CleverPrint.lnk [2012.09.04 18:52:23 | 000,059,392 | R--- | C] () -- C:\Windows\SysWow64\streamhlp.dll [2012.09.02 10:54:00 | 000,016,098 | ---- | C] () -- C:\Users\XXXXX\Documents\Methodenkompetenz.dotx [2012.08.29 20:08:18 | 000,293,889 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT [2012.08.29 19:20:57 | 003,492,915 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2012.08.29 17:40:33 | 000,153,053 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat [2012.08.29 17:40:33 | 000,107,384 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat [2012.08.26 12:11:10 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2012.08.26 12:08:29 | 000,121,344 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.ax [2012.08.26 12:08:29 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll [2012.08.26 12:08:29 | 000,051,712 | RHS- | C] () -- C:\Windows\SysWow64\RLSpeexDec.ax [2012.08.26 12:08:29 | 000,000,636 | ---- | C] () -- C:\Users\Public\Desktop\SUPER ©.lnk [2012.08.26 12:08:28 | 000,195,584 | RHS- | C] () -- C:\Windows\SysWow64\MatroskaDX.ax [2012.08.26 12:08:28 | 000,120,832 | RHS- | C] () -- C:\Windows\SysWow64\MPCDx.ax [2012.08.26 12:08:28 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\RLMPCDec.ax [2012.08.26 12:08:28 | 000,070,656 | RHS- | C] () -- C:\Windows\SysWow64\RLAPEDec.ax [2012.08.26 12:08:27 | 000,227,328 | RHS- | C] () -- C:\Windows\SysWow64\ac3DX.ax [2012.08.26 12:08:27 | 000,175,104 | RHS- | C] () -- C:\Windows\SysWow64\CoreAAC.ax [2012.08.26 12:08:27 | 000,097,280 | RHS- | C] () -- C:\Windows\SysWow64\FLACDX.ax [2012.08.26 12:08:27 | 000,081,920 | RHS- | C] () -- C:\Windows\SysWow64\aac_parser.ax [2012.08.25 20:03:10 | 000,001,057 | ---- | C] () -- C:\Users\XXXXX\AppData\Roaming\vso_ts_preview.xml [2012.08.25 10:47:10 | 000,001,204 | ---- | C] () -- C:\Users\Public\Desktop\PDFArchitect.lnk [2012.08.25 10:47:10 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2012.08.22 14:29:47 | 000,099,384 | ---- | C] () -- C:\Users\XXXXX\AppData\Roaming\inst.exe [2012.08.22 14:29:47 | 000,007,859 | ---- | C] () -- C:\Users\XXXXX\AppData\Roaming\pcouffin.cat [2012.08.22 14:29:47 | 000,001,167 | ---- | C] () -- C:\Users\XXXXX\AppData\Roaming\pcouffin.inf [2012.08.22 14:29:45 | 000,000,785 | ---- | C] () -- C:\Users\XXXXX\Desktop\CopyTo Starter.lnk [2012.08.22 14:22:30 | 000,000,630 | ---- | C] () -- C:\Users\XXXXX\Desktop\VSO DivxToDVD.lnk [2012.08.22 06:16:24 | 000,429,416 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2012.08.18 20:10:25 | 000,001,457 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.07.25 11:34:12 | 000,000,017 | ---- | C] () -- C:\Users\XXXXX\AppData\Local\resmon.resmoncfg [2012.06.18 16:53:02 | 000,113,644 | ---- | C] () -- C:\Program Files (x86)\Flight.exe.cat [2012.06.12 11:35:40 | 000,000,399 | ---- | C] () -- C:\Program Files (x86)\Flight.exe.cfg [2012.06.06 13:03:32 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll [2012.04.26 15:31:47 | 000,065,536 | -H-- | C] () -- C:\Windows\SysWow64\WebCamLib.dll [2012.04.12 12:39:32 | 000,000,702 | ---- | C] () -- C:\Windows\wiso.ini [2012.03.23 14:24:08 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\EMRegSys.dll [2012.03.21 11:43:58 | 000,002,904 | ---- | C] () -- C:\Program Files (x86)\FileLocator.config [2012.01.31 19:17:02 | 170,182,773 | ---- | C] () -- C:\Program Files (x86)\HawaiiContent.pak [2012.01.31 19:16:34 | 1886,268,046 | ---- | C] () -- C:\Program Files (x86)\CoreContent.pak [2012.01.31 19:11:04 | 000,784,634 | ---- | C] () -- C:\Program Files (x86)\CorePropDefs.pak [2012.01.23 17:53:56 | 000,246,784 | ---- | C] () -- C:\Windows\SysWow64\GSService.exe [2012.01.03 17:14:59 | 000,110,602 | ---- | C] () -- C:\Windows\SysWow64\xcdsfx32.bin [2011.11.22 17:47:27 | 000,158,720 | ---- | C] () -- C:\Windows\SysWow64\WS_VideoConverterContextMenu.dll [2011.10.20 15:59:44 | 000,003,584 | ---- | C] () -- C:\Users\XXXXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.07 16:16:11 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.10.07 16:16:11 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7010.DAT [2011.10.07 15:38:15 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.10.07 15:33:56 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011.10.06 21:16:05 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.10.06 20:17:21 | 000,000,371 | ---- | C] () -- C:\Windows\lgfwup.ini [2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat ========== LOP Check ========== [2012.04.26 15:31:47 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Apowersoft [2012.07.12 15:45:52 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\AV Burning Pro [2012.08.14 15:53:36 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Bildverkleinerer [2012.04.12 12:40:13 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Buhl Data Service [2012.05.18 12:33:17 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Digiarty [2012.08.25 09:39:08 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Engelmann Media [2011.10.21 16:19:05 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Fighters [2012.08.07 08:47:36 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\K-Meleon [2011.10.14 13:16:17 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Leadertech [2012.08.26 15:26:44 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\MOVAVI [2012.08.09 13:06:52 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Nuclear Coffee [2012.02.26 11:40:10 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Opera [2012.08.18 12:51:56 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\portable [2012.03.08 14:45:06 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\SoftOrbits [2012.08.26 12:35:20 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\TeamViewer [2012.09.04 20:02:11 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\TrojanHunter [2012.01.12 17:25:30 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\USBSafelyRemove [2012.06.06 14:54:32 | 000,000,000 | --SD | M] -- C:\Users\XXXXX\AppData\Roaming\Virtual CD v10 [2012.08.26 17:32:32 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\VSO [2012.08.26 12:35:20 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Windows Search [2012.06.06 15:04:18 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\WindSolutions [2012.03.09 18:04:33 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Wondershare [2012.04.10 11:39:39 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\YCanPDF [2012.08.01 16:33:42 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2012.09.09 12:18:09 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Adobe [2011.10.29 18:15:39 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\AdobeUM [2012.04.26 15:31:47 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Apowersoft [2012.06.06 14:15:51 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Apple Computer [2012.07.12 15:45:52 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\AV Burning Pro [2012.08.14 15:53:36 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Bildverkleinerer [2011.11.02 16:26:06 | 000,000,000 | R--D | M] -- C:\Users\XXXXX\AppData\Roaming\Brother [2012.04.12 12:40:13 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Buhl Data Service [2012.01.26 17:30:29 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\CyberLink [2012.05.18 12:33:17 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Digiarty [2012.08.25 09:39:08 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Engelmann Media [2011.10.21 16:19:05 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Fighters [2012.08.26 12:39:30 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Help [2012.09.03 16:29:32 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Identities [2011.10.06 21:42:46 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\InstallShield [2011.10.06 21:46:25 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Intel Corporation [2012.08.07 08:47:36 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\K-Meleon [2011.10.14 13:16:17 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Leadertech [2011.10.14 13:13:54 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Logishrd [2011.10.14 13:16:25 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Logitech [2011.10.09 08:22:50 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Macromedia [2012.09.05 17:24:25 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Malwarebytes [2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Media Center Programs [2012.09.09 16:49:50 | 000,000,000 | --SD | M] -- C:\Users\XXXXX\AppData\Roaming\Microsoft [2012.08.07 08:52:57 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Microsoft.Office.Editor.5EF9078C10B8CC37B607B43F3EA833CF52B262CC.1 [2012.08.26 15:26:44 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\MOVAVI [2011.10.07 15:34:14 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Mozilla [2012.08.25 20:07:02 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\NCH Software [2012.08.09 13:06:52 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Nuclear Coffee [2012.01.26 17:26:18 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\NVIDIA [2012.02.26 11:40:10 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Opera [2012.08.18 12:51:56 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\portable [2012.03.08 14:45:06 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\SoftOrbits [2012.08.26 12:35:20 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\TeamViewer [2012.09.04 20:02:11 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\TrojanHunter [2012.01.12 17:25:30 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\USBSafelyRemove [2012.06.06 14:54:32 | 000,000,000 | --SD | M] -- C:\Users\XXXXX\AppData\Roaming\Virtual CD v10 [2012.09.04 15:44:27 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\vlc [2012.08.26 17:32:32 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\VSO [2012.08.26 12:35:20 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Windows Search [2012.06.06 15:04:18 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\WindSolutions [2011.11.22 17:46:13 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\WinRAR [2012.03.09 18:04:33 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\Wondershare [2012.04.10 11:39:39 | 000,000,000 | ---D | M] -- C:\Users\XXXXX\AppData\Roaming\YCanPDF < %APPDATA%\*.exe /s > [2012.08.26 17:32:32 | 000,099,384 | ---- | M] () -- C:\Users\XXXXX\AppData\Roaming\inst.exe [2012.08.07 08:50:15 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\XXXXX\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2012.09.09 12:11:36 | 000,117,427 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\XXXXX\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\digitaleditions\digitaleditions.exe [2012.01.03 20:47:34 | 000,053,248 | ---- | M] (Acresso Software Inc.) -- C:\Users\XXXXX\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTOR.SYS > [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) MD5=26CF4275034214ECEDD8EC17B0A18A99 -- C:\Windows\SysNative\drivers\iaStor.sys [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) MD5=26CF4275034214ECEDD8EC17B0A18A99 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_16d1c1de1eca8452\iaStor.sys < MD5 for: IASTORV.SYS > [2011.10.02 16:12:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2011.10.02 16:12:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2011.10.02 16:13:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2011.10.02 16:13:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2011.10.02 16:13:13 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2011.10.02 16:13:13 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2011.10.02 16:12:40 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2011.10.02 16:12:40 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll [2011.10.02 16:12:52 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2011.10.02 16:12:52 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2011.10.02 16:13:45 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2011.10.02 16:13:45 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2011.10.02 16:13:34 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2011.10.02 16:13:34 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [2011.10.02 16:13:13 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2011.10.02 16:13:13 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2011.10.02 16:12:53 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2011.10.02 16:12:53 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2011.10.02 16:13:41 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2011.10.02 16:13:41 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2011.10.02 16:13:41 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2011.10.02 16:13:41 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < > ========== Alternate Data Streams ========== @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:47F1DFAC @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:CB0AACC9 < End of report > |
|
11.09.2012, 22:25
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
FF - user.js - File not found
O4 - HKLM..\Run: [iTunesHelper] "D:\Programme\iTunesHelper.exe" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Nvsetup.exe
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:47F1DFAC
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:CB0AACC9
:Files
D:\$RECYCLE.BIN\S-*
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ --> Nod32 meldet Variante von Win32/Gataka.B |
|
12.09.2012, 06:34
| #22 |
| | Nod32 meldet Variante von Win32/Gataka.B Hier ist der Log, der sich nach dem Fixen geöffnet hat: Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Toolbars\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1684251090-3011788876-2256450295-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9043bcc-f053-11e0-bfe4-806e6f6e6963}\ not found.
File D:\Nvsetup.exe not found.
ADS C:\ProgramData\Temp:47F1DFAC deleted successfully.
ADS C:\ProgramData\Temp:CB0AACC9 deleted successfully.
========== FILES ==========
D:\$RECYCLE.BIN\S-1-5-21-1684251090-3011788876-2256450295-1000 folder moved successfully.
D:\$RECYCLE.BIN\S-1-5-21-2494748497-341561-3864796203-1000 folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\XXXXXXX\Desktop\cmd.bat deleted successfully.
C:\Users\XXXXXXX\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: XXXXXXX
->Temp folder emptied: 242472185 bytes
->Temporary Internet Files folder emptied: 89267209 bytes
->FireFox cache emptied: 561682969 bytes
->Opera cache emptied: 52497333 bytes
->Flash cache emptied: 181221 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1207356053 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 8955236 bytes
Total Files Cleaned = 2.062,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.61.3 log created on 09122012_072750
Files\Folders moved on Reboot...
C:\Users\XXXXXXX\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
12.09.2012, 13:11
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs. Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten! 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.09.2012, 15:07
| #24 |
| | Nod32 meldet Variante von Win32/Gataka.B Hier ist der Log: Code:
ATTFilter 16:03:35.0370 2668 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
16:03:35.0928 2668 ============================================================
16:03:35.0928 2668 Current date / time: 2012/09/12 16:03:35.0928
16:03:35.0928 2668 SystemInfo:
16:03:35.0928 2668
16:03:35.0928 2668 OS Version: 6.1.7601 ServicePack: 1.0
16:03:35.0928 2668 Product type: Workstation
16:03:35.0928 2668 ComputerName: BLACK-RUNNER
16:03:35.0928 2668 UserName: XXXXXXX
16:03:35.0928 2668 Windows directory: C:\Windows
16:03:35.0928 2668 System windows directory: C:\Windows
16:03:35.0928 2668 Running under WOW64
16:03:35.0928 2668 Processor architecture: Intel x64
16:03:35.0928 2668 Number of processors: 4
16:03:35.0928 2668 Page size: 0x1000
16:03:35.0928 2668 Boot type: Normal boot
16:03:35.0928 2668 ============================================================
16:03:36.0425 2668 Drive \Device\Harddisk2\DR2 - Size: 0x1DCF856000 (119.24 Gb), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000048
16:03:36.0435 2668 Drive \Device\Harddisk0\DR0 - Size: 0x950AF4DE00 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:03:36.0435 2668 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:03:36.0454 2668 ============================================================
16:03:36.0454 2668 \Device\Harddisk2\DR2:
16:03:36.0454 2668 MBR partitions:
16:03:36.0454 2668 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xE86C000
16:03:36.0454 2668 \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0xE86C800, BlocksNum 0x60E800
16:03:36.0454 2668 \Device\Harddisk0\DR0:
16:03:36.0454 2668 MBR partitions:
16:03:36.0454 2668 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:03:36.0454 2668 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1E848000
16:03:36.0455 2668 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1E87A800, BlocksNum 0x2BFDC800
16:03:36.0455 2668 \Device\Harddisk1\DR1:
16:03:36.0455 2668 MBR partitions:
16:03:36.0455 2668 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x491A9800
16:03:36.0455 2668 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x491AA000, BlocksNum 0x2B55B800
16:03:36.0455 2668 ============================================================
16:03:36.0456 2668 C: <-> \Device\Harddisk2\DR2\Partition1
16:03:36.0922 2668 D: <-> \Device\Harddisk1\DR1\Partition1
16:03:36.0965 2668 E: <-> \Device\Harddisk1\DR1\Partition2
16:03:36.0973 2668 F: <-> \Device\Harddisk0\DR0\Partition1
16:03:37.0006 2668 G: <-> \Device\Harddisk0\DR0\Partition2
16:03:37.0045 2668 H: <-> \Device\Harddisk0\DR0\Partition3
16:03:37.0046 2668 I: <-> \Device\Harddisk2\DR2\Partition2
16:03:37.0046 2668 ============================================================
16:03:37.0046 2668 Initialize success
16:03:37.0046 2668 ============================================================
16:04:20.0403 5704 ============================================================
16:04:20.0403 5704 Scan started
16:04:20.0403 5704 Mode: Manual; SigCheck; TDLFS;
16:04:20.0403 5704 ============================================================
16:04:20.0702 5704 ================ Scan system memory ========================
16:04:20.0702 5704 System memory - ok
16:04:20.0703 5704 ================ Scan services =============================
16:04:20.0734 5704 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
16:04:20.0821 5704 1394ohci - ok
16:04:20.0826 5704 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\DRIVERS\ACPI.sys
16:04:20.0839 5704 ACPI - ok
16:04:20.0841 5704 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\DRIVERS\acpipmi.sys
16:04:20.0862 5704 AcpiPmi - ok
16:04:20.0866 5704 [ 6D182C31ACF16213407F2768F1107FE3 ] Adobe LM Service C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
16:04:20.0870 5704 Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
16:04:20.0870 5704 Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
16:04:20.0873 5704 [ 11A52CF7B265631DEEB24C6149309EFF ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:04:20.0880 5704 AdobeARMservice - ok
16:04:20.0886 5704 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
16:04:20.0900 5704 adp94xx - ok
16:04:20.0904 5704 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
16:04:20.0916 5704 adpahci - ok
16:04:20.0920 5704 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
16:04:20.0930 5704 adpu320 - ok
16:04:20.0933 5704 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
16:04:20.0977 5704 AeLookupSvc - ok
16:04:20.0983 5704 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
16:04:20.0998 5704 AFD - ok
16:04:21.0000 5704 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\DRIVERS\agp440.sys
16:04:21.0009 5704 agp440 - ok
16:04:21.0011 5704 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
16:04:21.0022 5704 ALG - ok
16:04:21.0024 5704 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\DRIVERS\aliide.sys
16:04:21.0032 5704 aliide - ok
16:04:21.0034 5704 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\DRIVERS\amdide.sys
16:04:21.0041 5704 amdide - ok
16:04:21.0044 5704 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
16:04:21.0055 5704 AmdK8 - ok
16:04:21.0057 5704 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
16:04:21.0067 5704 AmdPPM - ok
16:04:21.0070 5704 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
16:04:21.0079 5704 amdsata - ok
16:04:21.0082 5704 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
16:04:21.0091 5704 amdsbs - ok
16:04:21.0094 5704 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
16:04:21.0101 5704 amdxata - ok
16:04:21.0103 5704 [ AD12F5C7251BB8D575D560894E73CBBA ] Apowersoft_AudioDevice C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys
16:04:21.0121 5704 Apowersoft_AudioDevice - ok
16:04:21.0123 5704 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
16:04:21.0175 5704 AppID - ok
16:04:21.0178 5704 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
16:04:21.0205 5704 AppIDSvc - ok
16:04:21.0208 5704 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
16:04:21.0233 5704 Appinfo - ok
16:04:21.0237 5704 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
16:04:21.0244 5704 Apple Mobile Device - ok
16:04:21.0247 5704 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
16:04:21.0256 5704 arc - ok
16:04:21.0258 5704 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
16:04:21.0268 5704 arcsas - ok
16:04:21.0269 5704 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
16:04:21.0294 5704 AsyncMac - ok
16:04:21.0296 5704 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\DRIVERS\atapi.sys
16:04:21.0303 5704 atapi - ok
16:04:21.0306 5704 [ AAAE03F8EDA817EC28C5445193EA8BF3 ] AthBTPort C:\Windows\system32\DRIVERS\btath_flt.sys
16:04:21.0312 5704 AthBTPort - ok
16:04:21.0314 5704 [ 4ECC791539F23982411864037D1AC8FC ] ATHDFU C:\Windows\system32\Drivers\AthDfu.sys
16:04:21.0321 5704 ATHDFU - ok
16:04:21.0324 5704 [ C34B28D6285EAD94B3A2FABA84E90DA5 ] AtherosSvc C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
16:04:21.0329 5704 AtherosSvc - ok
16:04:21.0336 5704 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:04:21.0366 5704 AudioEndpointBuilder - ok
16:04:21.0373 5704 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
16:04:21.0400 5704 AudioSrv - ok
16:04:21.0404 5704 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
16:04:21.0418 5704 AxInstSV - ok
16:04:21.0423 5704 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
16:04:21.0437 5704 b06bdrv - ok
16:04:21.0442 5704 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
16:04:21.0454 5704 b57nd60a - ok
16:04:21.0458 5704 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
16:04:21.0468 5704 BDESVC - ok
16:04:21.0470 5704 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
16:04:21.0494 5704 Beep - ok
16:04:21.0501 5704 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
16:04:21.0532 5704 BFE - ok
16:04:21.0539 5704 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
16:04:21.0572 5704 BITS - ok
16:04:21.0574 5704 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
16:04:21.0584 5704 blbdrive - ok
16:04:21.0589 5704 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
16:04:21.0600 5704 Bonjour Service - ok
16:04:21.0603 5704 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
16:04:21.0613 5704 bowser - ok
16:04:21.0615 5704 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:04:21.0634 5704 BrFiltLo - ok
16:04:21.0636 5704 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:04:21.0647 5704 BrFiltUp - ok
16:04:21.0650 5704 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
16:04:21.0660 5704 Browser - ok
16:04:21.0664 5704 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
16:04:21.0677 5704 Brserid - ok
16:04:21.0680 5704 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
16:04:21.0691 5704 BrSerWdm - ok
16:04:21.0693 5704 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
16:04:21.0704 5704 BrUsbMdm - ok
16:04:21.0706 5704 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
16:04:21.0716 5704 BrUsbSer - ok
16:04:21.0720 5704 [ 3B1B573371B206D1D5F25E0EF5FCD6D6 ] BTATH_A2DP C:\Windows\system32\drivers\btath_a2dp.sys
16:04:21.0729 5704 BTATH_A2DP - ok
16:04:21.0731 5704 [ 2D0446336D9DB55A742B999EC16ADF15 ] BTATH_BUS C:\Windows\system32\DRIVERS\btath_bus.sys
16:04:21.0737 5704 BTATH_BUS - ok
16:04:21.0741 5704 [ 9A9694BBEB2849EAF95DFFCAE5DF02AD ] BTATH_HCRP C:\Windows\system32\DRIVERS\btath_hcrp.sys
16:04:21.0748 5704 BTATH_HCRP - ok
16:04:21.0750 5704 [ FC0A8075DDF2E9C66267AEC91E0676F9 ] BTATH_LWFLT C:\Windows\system32\DRIVERS\btath_lwflt.sys
16:04:21.0757 5704 BTATH_LWFLT - ok
16:04:21.0760 5704 [ 5EB4815CBDDBA4541F2380DAE6E269AB ] BTATH_RCP C:\Windows\system32\DRIVERS\btath_rcp.sys
16:04:21.0767 5704 BTATH_RCP - ok
16:04:21.0773 5704 [ 0ECEDE7B33CFD9A52A61220ABBD09A50 ] BtFilter C:\Windows\system32\DRIVERS\btfilter.sys
16:04:21.0781 5704 BtFilter - ok
16:04:21.0784 5704 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
16:04:21.0794 5704 BthEnum - ok
16:04:21.0796 5704 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
16:04:21.0808 5704 BTHMODEM - ok
16:04:21.0810 5704 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
16:04:21.0822 5704 BthPan - ok
16:04:21.0828 5704 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
16:04:21.0843 5704 BTHPORT - ok
16:04:21.0846 5704 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
16:04:21.0870 5704 bthserv - ok
16:04:21.0872 5704 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
16:04:21.0882 5704 BTHUSB - ok
16:04:21.0885 5704 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
16:04:21.0909 5704 cdfs - ok
16:04:21.0912 5704 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
16:04:21.0923 5704 cdrom - ok
16:04:21.0926 5704 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
16:04:21.0952 5704 CertPropSvc - ok
16:04:21.0954 5704 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
16:04:21.0966 5704 circlass - ok
16:04:21.0970 5704 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
16:04:21.0982 5704 CLFS - ok
16:04:21.0989 5704 [ 4642B5A3E0D2E61D08163DE95FC5B949 ] CLKMSVC10_9EC60124 C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe
16:04:21.0999 5704 CLKMSVC10_9EC60124 - ok
16:04:22.0005 5704 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:04:22.0013 5704 clr_optimization_v2.0.50727_32 - ok
16:04:22.0018 5704 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:04:22.0027 5704 clr_optimization_v2.0.50727_64 - ok
16:04:22.0033 5704 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:04:22.0045 5704 clr_optimization_v4.0.30319_32 - ok
16:04:22.0051 5704 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:04:22.0060 5704 clr_optimization_v4.0.30319_64 - ok
16:04:22.0062 5704 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
16:04:22.0072 5704 CmBatt - ok
16:04:22.0074 5704 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\DRIVERS\cmdide.sys
16:04:22.0082 5704 cmdide - ok
16:04:22.0087 5704 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
16:04:22.0105 5704 CNG - ok
16:04:22.0107 5704 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
16:04:22.0114 5704 Compbatt - ok
16:04:22.0117 5704 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
16:04:22.0128 5704 CompositeBus - ok
16:04:22.0130 5704 COMSysApp - ok
16:04:22.0133 5704 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
16:04:22.0141 5704 crcdisk - ok
16:04:22.0145 5704 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll
16:04:22.0156 5704 CryptSvc - ok
16:04:22.0162 5704 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
16:04:22.0191 5704 DcomLaunch - ok
16:04:22.0195 5704 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
16:04:22.0221 5704 defragsvc - ok
16:04:22.0224 5704 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
16:04:22.0248 5704 DfsC - ok
16:04:22.0253 5704 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
16:04:22.0279 5704 Dhcp - ok
16:04:22.0282 5704 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
16:04:22.0305 5704 discache - ok
16:04:22.0308 5704 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
16:04:22.0316 5704 Disk - ok
16:04:22.0319 5704 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
16:04:22.0330 5704 Dnscache - ok
16:04:22.0334 5704 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
16:04:22.0360 5704 dot3svc - ok
16:04:22.0363 5704 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
16:04:22.0387 5704 DPS - ok
16:04:22.0389 5704 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
16:04:22.0400 5704 drmkaud - ok
16:04:22.0404 5704 [ 44BB65B1D3827043978FC8E11CA7C0B4 ] DTSAudioService C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
16:04:22.0412 5704 DTSAudioService - ok
16:04:22.0421 5704 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
16:04:22.0437 5704 DXGKrnl - ok
16:04:22.0441 5704 [ 13533557D01B88C83110D5CF749F14D7 ] eamonm C:\Windows\system32\DRIVERS\eamonm.sys
16:04:22.0449 5704 eamonm - ok
16:04:22.0452 5704 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
16:04:22.0477 5704 EapHost - ok
16:04:22.0502 5704 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
16:04:22.0542 5704 ebdrv - ok
16:04:22.0545 5704 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
16:04:22.0554 5704 EFS - ok
16:04:22.0557 5704 [ E097728129E7B79BF1089D7AEF42332B ] ehdrv C:\Windows\system32\DRIVERS\ehdrv.sys
16:04:22.0565 5704 ehdrv - ok
16:04:22.0572 5704 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
16:04:22.0589 5704 ehRecvr - ok
16:04:22.0592 5704 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
16:04:22.0602 5704 ehSched - ok
16:04:22.0612 5704 [ C7BB95CF9631AA401E4ADED1648F6AF7 ] ekrn C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
16:04:22.0628 5704 ekrn - ok
16:04:22.0634 5704 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
16:04:22.0648 5704 elxstor - ok
16:04:22.0652 5704 [ 2380976CF8A4A56611F35633ACD2A74F ] epfwwfpr C:\Windows\system32\DRIVERS\epfwwfpr.sys
16:04:22.0659 5704 epfwwfpr - ok
16:04:22.0661 5704 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\DRIVERS\errdev.sys
16:04:22.0670 5704 ErrDev - ok
16:04:22.0677 5704 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
16:04:22.0705 5704 EventSystem - ok
16:04:22.0708 5704 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
16:04:22.0735 5704 exfat - ok
16:04:22.0738 5704 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
16:04:22.0764 5704 fastfat - ok
16:04:22.0771 5704 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
16:04:22.0786 5704 Fax - ok
16:04:22.0789 5704 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
16:04:22.0798 5704 fdc - ok
16:04:22.0800 5704 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
16:04:22.0824 5704 fdPHost - ok
16:04:22.0827 5704 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
16:04:22.0851 5704 FDResPub - ok
16:04:22.0853 5704 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
16:04:22.0861 5704 FileInfo - ok
16:04:22.0863 5704 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
16:04:22.0887 5704 Filetrace - ok
16:04:22.0889 5704 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
16:04:22.0898 5704 flpydisk - ok
16:04:22.0902 5704 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
16:04:22.0913 5704 FltMgr - ok
16:04:22.0922 5704 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
16:04:22.0942 5704 FontCache - ok
16:04:22.0945 5704 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:04:22.0952 5704 FontCache3.0.0.0 - ok
16:04:22.0954 5704 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
16:04:22.0963 5704 FsDepends - ok
16:04:22.0965 5704 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
16:04:22.0972 5704 Fs_Rec - ok
16:04:22.0976 5704 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
16:04:22.0988 5704 fvevol - ok
16:04:22.0991 5704 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
16:04:22.0999 5704 gagp30kx - ok
16:04:23.0002 5704 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
16:04:23.0008 5704 GEARAspiWDM - ok
16:04:23.0015 5704 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
16:04:23.0046 5704 gpsvc - ok
16:04:23.0062 5704 [ A319B63289458FA7D34C9409E45F0260 ] GSService C:\Windows\SysWOW64\GSService.exe
16:04:23.0067 5704 GSService ( UnsignedFile.Multi.Generic ) - warning
16:04:23.0067 5704 GSService - detected UnsignedFile.Multi.Generic (1)
16:04:23.0070 5704 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
16:04:23.0079 5704 hcw85cir - ok
16:04:23.0084 5704 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:04:23.0097 5704 HdAudAddService - ok
16:04:23.0101 5704 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
16:04:23.0112 5704 HDAudBus - ok
16:04:23.0115 5704 [ 62FB29642745DD290910BFD79537FCE0 ] HH10Help.sys C:\Windows\system32\drivers\HH10Help.sys
16:04:23.0121 5704 HH10Help.sys - ok
16:04:23.0123 5704 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
16:04:23.0133 5704 HidBatt - ok
16:04:23.0136 5704 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
16:04:23.0148 5704 HidBth - ok
16:04:23.0150 5704 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
16:04:23.0161 5704 HidIr - ok
16:04:23.0163 5704 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
16:04:23.0188 5704 hidserv - ok
16:04:23.0190 5704 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
16:04:23.0199 5704 HidUsb - ok
16:04:23.0202 5704 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
16:04:23.0227 5704 hkmsvc - ok
16:04:23.0231 5704 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:04:23.0242 5704 HomeGroupListener - ok
16:04:23.0246 5704 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:04:23.0257 5704 HomeGroupProvider - ok
16:04:23.0259 5704 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\DRIVERS\HpSAMD.sys
16:04:23.0268 5704 HpSAMD - ok
16:04:23.0275 5704 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
16:04:23.0306 5704 HTTP - ok
16:04:23.0308 5704 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
16:04:23.0315 5704 hwpolicy - ok
16:04:23.0318 5704 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
16:04:23.0328 5704 i8042prt - ok
16:04:23.0335 5704 [ 26CF4275034214ECEDD8EC17B0A18A99 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
16:04:23.0347 5704 iaStor - ok
16:04:23.0350 5704 [ E79A8E33BD136D14BAE1FA20EB2EF124 ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
16:04:23.0356 5704 IAStorDataMgrSvc - ok
16:04:23.0361 5704 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
16:04:23.0374 5704 iaStorV - ok
16:04:23.0383 5704 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:04:23.0400 5704 idsvc - ok
16:04:23.0402 5704 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
16:04:23.0410 5704 iirsp - ok
16:04:23.0418 5704 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
16:04:23.0450 5704 IKEEXT - ok
16:04:23.0480 5704 [ C2F868881D48A568B525255F084EF063 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
16:04:23.0526 5704 IntcAzAudAddService - ok
16:04:23.0532 5704 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\DRIVERS\intelide.sys
16:04:23.0540 5704 intelide - ok
16:04:23.0542 5704 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
16:04:23.0551 5704 intelppm - ok
16:04:23.0554 5704 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
16:04:23.0578 5704 IPBusEnum - ok
16:04:23.0581 5704 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:04:23.0604 5704 IpFilterDriver - ok
16:04:23.0610 5704 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
16:04:23.0638 5704 iphlpsvc - ok
16:04:23.0640 5704 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\DRIVERS\IPMIDrv.sys
16:04:23.0650 5704 IPMIDRV - ok
16:04:23.0653 5704 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
16:04:23.0678 5704 IPNAT - ok
16:04:23.0687 5704 [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
16:04:23.0704 5704 iPod Service - ok
16:04:23.0707 5704 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
16:04:23.0719 5704 IRENUM - ok
16:04:23.0725 5704 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\DRIVERS\isapnp.sys
16:04:23.0828 5704 isapnp - ok
16:04:23.0835 5704 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
16:04:23.0856 5704 iScsiPrt - ok
16:04:23.0860 5704 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
16:04:23.0869 5704 kbdclass - ok
16:04:23.0871 5704 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
16:04:23.0882 5704 kbdhid - ok
16:04:23.0884 5704 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
16:04:23.0894 5704 KeyIso - ok
16:04:23.0900 5704 [ 524503240D2BA280D97E2297102151CE ] kl1 C:\Windows\system32\DRIVERS\kl1.sys
16:04:23.0911 5704 kl1 - ok
16:04:23.0916 5704 [ 6AB7B4B65C5E201CB968DEC20AF10DCB ] KLIF C:\Windows\system32\DRIVERS\klif.sys
16:04:23.0925 5704 KLIF - ok
16:04:23.0928 5704 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
16:04:23.0937 5704 KSecDD - ok
16:04:23.0940 5704 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
16:04:23.0949 5704 KSecPkg - ok
16:04:23.0951 5704 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
16:04:23.0975 5704 ksthunk - ok
16:04:23.0979 5704 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
16:04:24.0007 5704 KtmRm - ok
16:04:24.0011 5704 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
16:04:24.0037 5704 LanmanServer - ok
16:04:24.0040 5704 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:04:24.0064 5704 LanmanWorkstation - ok
16:04:24.0070 5704 [ 7772DFAB22611050B79504E671B06E6E ] LBTServ C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
16:04:24.0081 5704 LBTServ - ok
16:04:24.0085 5704 [ 241F2648ADF090E2A10095BD6D6F5DCB ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
16:04:24.0092 5704 LHidFilt - ok
16:04:24.0095 5704 [ 17203D81A68D9162DB9022A1FC601778 ] LightScribeService C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
16:04:24.0099 5704 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
16:04:24.0099 5704 LightScribeService - detected UnsignedFile.Multi.Generic (1)
16:04:24.0101 5704 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
16:04:24.0126 5704 lltdio - ok
16:04:24.0130 5704 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
16:04:24.0157 5704 lltdsvc - ok
16:04:24.0159 5704 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
16:04:24.0183 5704 lmhosts - ok
16:04:24.0185 5704 [ 342ED5A4B3326014438F36D22D803737 ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
16:04:24.0192 5704 LMouFilt - ok
16:04:24.0196 5704 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
16:04:24.0205 5704 LSI_FC - ok
16:04:24.0207 5704 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
16:04:24.0216 5704 LSI_SAS - ok
16:04:24.0218 5704 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:04:24.0227 5704 LSI_SAS2 - ok
16:04:24.0229 5704 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:04:24.0238 5704 LSI_SCSI - ok
16:04:24.0241 5704 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
16:04:24.0265 5704 luafv - ok
16:04:24.0268 5704 [ 29C733E1DE824670DC9315CFC9BDBCD3 ] LUsbFilt C:\Windows\system32\Drivers\LUsbFilt.Sys
16:04:24.0275 5704 LUsbFilt - ok
16:04:24.0278 5704 [ DC8490812A3B72811AE534F423B4C206 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
16:04:24.0285 5704 MBAMProtector - ok
16:04:24.0292 5704 [ 43683E970F008C93C9429EF428147A54 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
16:04:24.0307 5704 MBAMService - ok
16:04:24.0309 5704 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
16:04:24.0320 5704 Mcx2Svc - ok
16:04:24.0322 5704 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
16:04:24.0330 5704 megasas - ok
16:04:24.0334 5704 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
16:04:24.0345 5704 MegaSR - ok
16:04:24.0347 5704 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
16:04:24.0354 5704 MEIx64 - ok
16:04:24.0356 5704 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
16:04:24.0381 5704 MMCSS - ok
16:04:24.0383 5704 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
16:04:24.0407 5704 Modem - ok
16:04:24.0409 5704 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
16:04:24.0419 5704 monitor - ok
16:04:24.0421 5704 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
16:04:24.0429 5704 mouclass - ok
16:04:24.0431 5704 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
16:04:24.0440 5704 mouhid - ok
16:04:24.0443 5704 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
16:04:24.0451 5704 mountmgr - ok
16:04:24.0454 5704 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:04:24.0463 5704 MozillaMaintenance - ok
16:04:24.0466 5704 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\DRIVERS\mpio.sys
16:04:24.0476 5704 mpio - ok
16:04:24.0478 5704 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
16:04:24.0502 5704 mpsdrv - ok
16:04:24.0510 5704 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
16:04:24.0559 5704 MpsSvc - ok
16:04:24.0562 5704 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
16:04:24.0576 5704 MRxDAV - ok
16:04:24.0579 5704 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
16:04:24.0590 5704 mrxsmb - ok
16:04:24.0594 5704 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:04:24.0606 5704 mrxsmb10 - ok
16:04:24.0609 5704 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:04:24.0618 5704 mrxsmb20 - ok
16:04:24.0620 5704 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\DRIVERS\msahci.sys
16:04:24.0628 5704 msahci - ok
16:04:24.0631 5704 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\DRIVERS\msdsm.sys
16:04:24.0640 5704 msdsm - ok
16:04:24.0643 5704 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
16:04:24.0654 5704 MSDTC - ok
16:04:24.0657 5704 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
16:04:24.0681 5704 Msfs - ok
16:04:24.0683 5704 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
16:04:24.0706 5704 mshidkmdf - ok
16:04:24.0708 5704 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\DRIVERS\msisadrv.sys
16:04:24.0715 5704 msisadrv - ok
16:04:24.0718 5704 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
16:04:24.0745 5704 MSiSCSI - ok
16:04:24.0747 5704 msiserver - ok
16:04:24.0749 5704 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
16:04:24.0773 5704 MSKSSRV - ok
16:04:24.0775 5704 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
16:04:24.0799 5704 MSPCLOCK - ok
16:04:24.0801 5704 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
16:04:24.0825 5704 MSPQM - ok
16:04:24.0829 5704 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
16:04:24.0841 5704 MsRPC - ok
16:04:24.0844 5704 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
16:04:24.0852 5704 mssmbios - ok
16:04:24.0854 5704 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
16:04:24.0877 5704 MSTEE - ok
16:04:24.0879 5704 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
16:04:24.0888 5704 MTConfig - ok
16:04:24.0891 5704 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
16:04:24.0898 5704 Mup - ok
16:04:24.0903 5704 [ 38B4C95E821528FB91DF16A78E04450F ] mv91xx C:\Windows\system32\DRIVERS\mv91xx.sys
16:04:24.0912 5704 mv91xx - ok
16:04:24.0917 5704 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
16:04:24.0945 5704 napagent - ok
16:04:24.0950 5704 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
16:04:24.0964 5704 NativeWifiP - ok
16:04:24.0972 5704 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
16:04:24.0992 5704 NDIS - ok
16:04:24.0994 5704 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
16:04:25.0018 5704 NdisCap - ok
16:04:25.0020 5704 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
16:04:25.0043 5704 NdisTapi - ok
16:04:25.0046 5704 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
16:04:25.0069 5704 Ndisuio - ok
16:04:25.0072 5704 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
16:04:25.0097 5704 NdisWan - ok
16:04:25.0099 5704 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
16:04:25.0123 5704 NDProxy - ok
16:04:25.0125 5704 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
16:04:25.0149 5704 NetBIOS - ok
16:04:25.0153 5704 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
16:04:25.0178 5704 NetBT - ok
16:04:25.0180 5704 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
16:04:25.0189 5704 Netlogon - ok
16:04:25.0193 5704 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
16:04:25.0221 5704 Netman - ok
16:04:25.0226 5704 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
16:04:25.0254 5704 netprofm - ok
16:04:25.0262 5704 [ F3A1D8B7317939813568992D1BFDDE37 ] netr7364 C:\Windows\system32\DRIVERS\netr7364.sys
16:04:25.0275 5704 netr7364 - ok
16:04:25.0278 5704 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:04:25.0285 5704 NetTcpPortSharing - ok
16:04:25.0288 5704 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
16:04:25.0296 5704 nfrd960 - ok
16:04:25.0300 5704 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll
16:04:25.0326 5704 NlaSvc - ok
16:04:25.0329 5704 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
16:04:25.0353 5704 Npfs - ok
16:04:25.0355 5704 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
16:04:25.0379 5704 nsi - ok
16:04:25.0381 5704 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
16:04:25.0405 5704 nsiproxy - ok
16:04:25.0419 5704 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
16:04:25.0446 5704 Ntfs - ok
16:04:25.0448 5704 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
16:04:25.0472 5704 Null - ok
16:04:25.0474 5704 [ 158AD24745BD85BA9BE3C51C38F48C32 ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
16:04:25.0483 5704 nusb3hub - ok
16:04:25.0486 5704 [ D40A13B2C0891E218F9523B376955DB6 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
16:04:25.0495 5704 nusb3xhc - ok
16:04:25.0499 5704 [ 1F07B814C0BB5AABA703ABFF1F31F2E8 ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys
16:04:25.0508 5704 NVHDA - ok
16:04:25.0660 5704 [ 79060E6631DC2C91DA8E601E2584A623 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
16:04:25.0801 5704 nvlddmkm - ok
16:04:25.0806 5704 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
16:04:25.0815 5704 nvraid - ok
16:04:25.0819 5704 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
16:04:25.0828 5704 nvstor - ok
16:04:25.0837 5704 [ BDBC8E51FF2F3B800FF7B90DCDA31B48 ] nvsvc C:\Windows\system32\nvvsvc.exe
16:04:25.0855 5704 nvsvc - ok
16:04:25.0865 5704 [ 55F03866A969A50CD1574B0F61ACEC1D ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
16:04:25.0884 5704 nvUpdatusService - ok
16:04:25.0887 5704 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\DRIVERS\nv_agp.sys
16:04:25.0897 5704 nv_agp - ok
16:04:25.0899 5704 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
16:04:25.0909 5704 ohci1394 - ok
16:04:25.0913 5704 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:04:25.0921 5704 ose - ok
16:04:25.0960 5704 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:04:26.0028 5704 osppsvc - ok
16:04:26.0034 5704 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
16:04:26.0047 5704 p2pimsvc - ok
16:04:26.0052 5704 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
16:04:26.0065 5704 p2psvc - ok
16:04:26.0068 5704 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
16:04:26.0077 5704 Parport - ok
16:04:26.0080 5704 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
16:04:26.0088 5704 partmgr - ok
16:04:26.0091 5704 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
16:04:26.0105 5704 PcaSvc - ok
16:04:26.0108 5704 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\DRIVERS\pci.sys
16:04:26.0118 5704 pci - ok
16:04:26.0120 5704 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\DRIVERS\pciide.sys
16:04:26.0127 5704 pciide - ok
16:04:26.0131 5704 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
16:04:26.0141 5704 pcmcia - ok
16:04:26.0144 5704 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
16:04:26.0151 5704 pcw - ok
16:04:26.0157 5704 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
16:04:26.0187 5704 PEAUTH - ok
16:04:26.0191 5704 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
16:04:26.0201 5704 PerfHost - ok
16:04:26.0215 5704 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
16:04:26.0252 5704 pla - ok
16:04:26.0257 5704 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
16:04:26.0269 5704 PlugPlay - ok
16:04:26.0272 5704 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
16:04:26.0282 5704 PNRPAutoReg - ok
16:04:26.0286 5704 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
16:04:26.0297 5704 PNRPsvc - ok
16:04:26.0303 5704 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
16:04:26.0331 5704 PolicyAgent - ok
16:04:26.0335 5704 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
16:04:26.0361 5704 Power - ok
16:04:26.0364 5704 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
16:04:26.0388 5704 PptpMiniport - ok
16:04:26.0390 5704 [ 4792EF6A10258014AB52EABA8CC43B3F ] Printer Control C:\Windows\system32\PrintCtrl.exe
16:04:26.0394 5704 Printer Control ( UnsignedFile.Multi.Generic ) - warning
16:04:26.0394 5704 Printer Control - detected UnsignedFile.Multi.Generic (1)
16:04:26.0397 5704 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
16:04:26.0407 5704 Processor - ok
16:04:26.0410 5704 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
16:04:26.0421 5704 ProfSvc - ok
16:04:26.0423 5704 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
16:04:26.0432 5704 ProtectedStorage - ok
16:04:26.0435 5704 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
16:04:26.0459 5704 Psched - ok
16:04:26.0472 5704 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
16:04:26.0498 5704 ql2300 - ok
16:04:26.0501 5704 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
16:04:26.0510 5704 ql40xx - ok
16:04:26.0513 5704 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
16:04:26.0528 5704 QWAVE - ok
16:04:26.0548 5704 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
16:04:26.0560 5704 QWAVEdrv - ok
16:04:26.0562 5704 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
16:04:26.0587 5704 RasAcd - ok
16:04:26.0589 5704 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
16:04:26.0613 5704 RasAgileVpn - ok
16:04:26.0616 5704 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
16:04:26.0641 5704 RasAuto - ok
16:04:26.0644 5704 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
16:04:26.0669 5704 Rasl2tp - ok
16:04:26.0673 5704 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
16:04:26.0700 5704 RasMan - ok
16:04:26.0703 5704 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
16:04:26.0728 5704 RasPppoe - ok
16:04:26.0730 5704 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
16:04:26.0755 5704 RasSstp - ok
16:04:26.0759 5704 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
16:04:26.0785 5704 rdbss - ok
16:04:26.0788 5704 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
16:04:26.0799 5704 rdpbus - ok
16:04:26.0801 5704 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
16:04:26.0825 5704 RDPCDD - ok
16:04:26.0828 5704 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
16:04:26.0851 5704 RDPENCDD - ok
16:04:26.0854 5704 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
16:04:26.0878 5704 RDPREFMP - ok
16:04:26.0881 5704 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
16:04:26.0892 5704 RDPWD - ok
16:04:26.0896 5704 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
16:04:26.0906 5704 rdyboost - ok
16:04:26.0909 5704 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
16:04:26.0934 5704 RemoteAccess - ok
16:04:26.0937 5704 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
16:04:26.0963 5704 RemoteRegistry - ok
16:04:26.0967 5704 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
16:04:26.0979 5704 RFCOMM - ok
16:04:26.0984 5704 [ F12A68ED55053940CADD59CA5E3468DD ] RichVideo C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
16:04:26.0991 5704 RichVideo ( UnsignedFile.Multi.Generic ) - warning
16:04:26.0991 5704 RichVideo - detected UnsignedFile.Multi.Generic (1)
16:04:26.0993 5704 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
16:04:27.0019 5704 RpcEptMapper - ok
16:04:27.0021 5704 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
16:04:27.0031 5704 RpcLocator - ok
16:04:27.0037 5704 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
16:04:27.0064 5704 RpcSs - ok
16:04:27.0067 5704 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
16:04:27.0092 5704 rspndr - ok
16:04:27.0099 5704 [ 3713DACCA1025B05A6343104112708D9 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
16:04:27.0112 5704 RTL8167 - ok
16:04:27.0115 5704 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
16:04:27.0123 5704 SamSs - ok
16:04:27.0126 5704 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\DRIVERS\sbp2port.sys
16:04:27.0135 5704 sbp2port - ok
16:04:27.0138 5704 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
16:04:27.0164 5704 SCardSvr - ok
16:04:27.0166 5704 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
16:04:27.0190 5704 scfilter - ok
16:04:27.0199 5704 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
16:04:27.0233 5704 Schedule - ok
16:04:27.0236 5704 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
16:04:27.0259 5704 SCPolicySvc - ok
16:04:27.0262 5704 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
16:04:27.0273 5704 SDRSVC - ok
16:04:27.0275 5704 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
16:04:27.0298 5704 secdrv - ok
16:04:27.0301 5704 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
16:04:27.0325 5704 seclogon - ok
16:04:27.0327 5704 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
16:04:27.0351 5704 SENS - ok
16:04:27.0354 5704 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
16:04:27.0363 5704 SensrSvc - ok
16:04:27.0365 5704 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
16:04:27.0374 5704 Serenum - ok
16:04:27.0377 5704 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
16:04:27.0386 5704 Serial - ok
16:04:27.0389 5704 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
16:04:27.0398 5704 sermouse - ok
16:04:27.0404 5704 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
16:04:27.0429 5704 SessionEnv - ok
16:04:27.0431 5704 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys
16:04:27.0442 5704 sffdisk - ok
16:04:27.0444 5704 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\DRIVERS\sffp_mmc.sys
16:04:27.0455 5704 sffp_mmc - ok
16:04:27.0457 5704 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys
16:04:27.0467 5704 sffp_sd - ok
16:04:27.0469 5704 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
16:04:27.0479 5704 sfloppy - ok
16:04:27.0483 5704 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
16:04:27.0511 5704 SharedAccess - ok
16:04:27.0515 5704 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:04:27.0561 5704 ShellHWDetection - ok
16:04:27.0563 5704 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:04:27.0572 5704 SiSRaid2 - ok
16:04:27.0574 5704 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
16:04:27.0583 5704 SiSRaid4 - ok
16:04:27.0585 5704 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
16:04:27.0610 5704 Smb - ok
16:04:27.0614 5704 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
16:04:27.0624 5704 SNMPTRAP - ok
16:04:27.0626 5704 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
16:04:27.0634 5704 spldr - ok
16:04:27.0640 5704 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
16:04:27.0654 5704 Spooler - ok
16:04:27.0680 5704 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
16:04:27.0738 5704 sppsvc - ok
16:04:27.0741 5704 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
16:04:27.0766 5704 sppuinotify - ok
16:04:27.0771 5704 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
16:04:27.0785 5704 srv - ok
16:04:27.0790 5704 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
16:04:27.0802 5704 srv2 - ok
16:04:27.0806 5704 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
16:04:27.0815 5704 srvnet - ok
16:04:27.0819 5704 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
16:04:27.0845 5704 SSDPSRV - ok
16:04:27.0847 5704 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
16:04:27.0872 5704 SstpSvc - ok
16:04:27.0877 5704 [ 4A566EB1ABCD229B3F8D67F3C4224897 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
16:04:27.0887 5704 Stereo Service - ok
16:04:27.0890 5704 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
16:04:27.0898 5704 stexstor - ok
16:04:27.0904 5704 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
16:04:27.0922 5704 stisvc - ok
16:04:27.0924 5704 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
16:04:27.0932 5704 swenum - ok
16:04:27.0937 5704 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
16:04:27.0966 5704 swprv - ok
16:04:27.0980 5704 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
16:04:28.0010 5704 SysMain - ok
16:04:28.0013 5704 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:04:28.0026 5704 TabletInputService - ok
16:04:28.0031 5704 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
16:04:28.0058 5704 TapiSrv - ok
16:04:28.0059 5704 TBPanel - ok
16:04:28.0062 5704 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
16:04:28.0087 5704 TBS - ok
16:04:28.0102 5704 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys
16:04:28.0133 5704 Tcpip - ok
16:04:28.0148 5704 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
16:04:28.0174 5704 TCPIP6 - ok
16:04:28.0178 5704 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
16:04:28.0201 5704 tcpipreg - ok
16:04:28.0205 5704 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
16:04:28.0214 5704 TDPIPE - ok
16:04:28.0216 5704 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
16:04:28.0225 5704 TDTCP - ok
16:04:28.0227 5704 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
16:04:28.0252 5704 tdx - ok
16:04:28.0254 5704 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
16:04:28.0262 5704 TermDD - ok
16:04:28.0268 5704 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
16:04:28.0298 5704 TermService - ok
16:04:28.0301 5704 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
16:04:28.0314 5704 Themes - ok
16:04:28.0316 5704 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
16:04:28.0340 5704 THREADORDER - ok
16:04:28.0342 5704 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
16:04:28.0369 5704 TrkWks - ok
16:04:28.0373 5704 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:04:28.0398 5704 TrustedInstaller - ok
16:04:28.0401 5704 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
16:04:28.0425 5704 tssecsrv - ok
16:04:28.0428 5704 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
16:04:28.0437 5704 TsUsbFlt - ok
16:04:28.0439 5704 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\DRIVERS\TsUsbGD.sys
16:04:28.0447 5704 TsUsbGD - ok
16:04:28.0451 5704 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
16:04:28.0475 5704 tunnel - ok
16:04:28.0478 5704 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
16:04:28.0487 5704 uagp35 - ok
16:04:28.0491 5704 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
16:04:28.0517 5704 udfs - ok
16:04:28.0539 5704 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
16:04:28.0549 5704 UI0Detect - ok
16:04:28.0552 5704 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\DRIVERS\uliagpkx.sys
16:04:28.0561 5704 uliagpkx - ok
16:04:28.0563 5704 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
16:04:28.0573 5704 umbus - ok
16:04:28.0575 5704 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
16:04:28.0584 5704 UmPass - ok
16:04:28.0589 5704 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
16:04:28.0616 5704 upnphost - ok
16:04:28.0619 5704 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
16:04:28.0628 5704 USBAAPL64 - ok
16:04:28.0630 5704 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
16:04:28.0640 5704 usbccgp - ok
16:04:28.0642 5704 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\DRIVERS\usbcir.sys
16:04:28.0654 5704 usbcir - ok
16:04:28.0656 5704 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
16:04:28.0665 5704 usbehci - ok
16:04:28.0670 5704 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
16:04:28.0682 5704 usbhub - ok
16:04:28.0684 5704 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
16:04:28.0693 5704 usbohci - ok
16:04:28.0695 5704 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
16:04:28.0706 5704 usbprint - ok
16:04:28.0713 5704 [ 04E794C9FDAADF021A1B0FFCD814E880 ] USBSafelyRemoveService C:\Program Files (x86)\USB Safely Remove\USBSRService.exe
16:04:28.0726 5704 USBSafelyRemoveService - ok
16:04:28.0728 5704 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
16:04:28.0739 5704 usbscan - ok
16:04:28.0742 5704 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:04:28.0751 5704 USBSTOR - ok
16:04:28.0754 5704 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
16:04:28.0763 5704 usbuhci - ok
16:04:28.0765 5704 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
16:04:28.0790 5704 UxSms - ok
16:04:28.0792 5704 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
16:04:28.0801 5704 VaultSvc - ok
16:04:28.0806 5704 [ B0D52CFC975220321D3960073BE3EEE7 ] VC10SecS C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe
16:04:28.0814 5704 VC10SecS - ok
16:04:28.0816 5704 [ F0FAF3FB9B138F8CAFB65ECFFE9F4AB6 ] vcd10bus C:\Windows\system32\DRIVERS\vcd10bus.sys
16:04:28.0828 5704 vcd10bus - ok
16:04:28.0829 5704 Suspicious service (NoAccess): vdrv1000
16:04:28.0845 5704 [ F0ECF990B3DE8842E948279AF31CC4E5 ] vdrv1000 C:\Windows\system32\DRIVERS\vdrv1000.sys
16:04:28.0847 5704 vdrv1000 ( LockedService.Multi.Generic ) - warning
16:04:28.0847 5704 vdrv1000 - detected LockedService.Multi.Generic (1)
16:04:28.0857 5704 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\DRIVERS\vdrvroot.sys
16:04:28.0919 5704 vdrvroot - ok
16:04:28.0925 5704 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
16:04:28.0954 5704 vds - ok
16:04:28.0957 5704 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
16:04:28.0968 5704 vga - ok
16:04:28.0970 5704 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
16:04:28.0994 5704 VgaSave - ok
16:04:28.0998 5704 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\DRIVERS\vhdmp.sys
16:04:29.0008 5704 vhdmp - ok
16:04:29.0011 5704 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\DRIVERS\viaide.sys
16:04:29.0019 5704 viaide - ok
16:04:29.0022 5704 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\DRIVERS\volmgr.sys
16:04:29.0030 5704 volmgr - ok
16:04:29.0035 5704 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
16:04:29.0046 5704 volmgrx - ok
16:04:29.0051 5704 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\DRIVERS\volsnap.sys
16:04:29.0062 5704 volsnap - ok
16:04:29.0066 5704 [ B4A73CA4EF9A02B9738CEA9AD5FE5917 ] vpcbus C:\Windows\system32\DRIVERS\vpchbus.sys
16:04:29.0075 5704 vpcbus - ok
16:04:29.0078 5704 [ E675FB2B48C54F09895482E2253B289C ] vpcnfltr C:\Windows\system32\DRIVERS\vpcnfltr.sys
16:04:29.0088 5704 vpcnfltr - ok
16:04:29.0091 5704 [ 5FB42082B0D19A0268705F1DD343DF20 ] vpcusb C:\Windows\system32\DRIVERS\vpcusb.sys
16:04:29.0100 5704 vpcusb - ok
16:04:29.0102 5704 [ 63F4E10873BEB4124028C6D1A66B0968 ] vpcuxd C:\Windows\system32\DRIVERS\vpcuxd.sys
16:04:29.0111 5704 vpcuxd - ok
16:04:29.0117 5704 [ 207B6539799CC1C112661A9B620DD233 ] vpcvmm C:\Windows\system32\drivers\vpcvmm.sys
16:04:29.0127 5704 vpcvmm - ok
16:04:29.0131 5704 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
16:04:29.0141 5704 vsmraid - ok
16:04:29.0154 5704 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
16:04:29.0193 5704 VSS - ok
16:04:29.0195 5704 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
16:04:29.0206 5704 vwifibus - ok
16:04:29.0208 5704 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
16:04:29.0220 5704 vwififlt - ok
16:04:29.0223 5704 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
16:04:29.0234 5704 vwifimp - ok
16:04:29.0239 5704 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
16:04:29.0267 5704 W32Time - ok
16:04:29.0270 5704 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
16:04:29.0279 5704 WacomPen - ok
16:04:29.0282 5704 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
16:04:29.0306 5704 WANARP - ok
16:04:29.0308 5704 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
16:04:29.0331 5704 Wanarpv6 - ok
16:04:29.0343 5704 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
16:04:29.0367 5704 wbengine - ok
16:04:29.0371 5704 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
16:04:29.0385 5704 WbioSrvc - ok
16:04:29.0389 5704 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
16:04:29.0406 5704 wcncsvc - ok
16:04:29.0408 5704 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:04:29.0418 5704 WcsPlugInService - ok
16:04:29.0421 5704 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
16:04:29.0428 5704 Wd - ok
16:04:29.0435 5704 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
16:04:29.0450 5704 Wdf01000 - ok
16:04:29.0453 5704 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
16:04:29.0467 5704 WdiServiceHost - ok
16:04:29.0469 5704 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
16:04:29.0482 5704 WdiSystemHost - ok
16:04:29.0487 5704 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
16:04:29.0503 5704 WebClient - ok
16:04:29.0507 5704 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
16:04:29.0533 5704 Wecsvc - ok
16:04:29.0536 5704 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
16:04:29.0562 5704 wercplsupport - ok
16:04:29.0564 5704 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
16:04:29.0589 5704 WerSvc - ok
16:04:29.0591 5704 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
16:04:29.0615 5704 WfpLwf - ok
16:04:29.0617 5704 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
16:04:29.0625 5704 WIMMount - ok
16:04:29.0626 5704 WinDefend - ok
16:04:29.0629 5704 WinHttpAutoProxySvc - ok
16:04:29.0637 5704 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
16:04:29.0663 5704 Winmgmt - ok
16:04:29.0679 5704 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
16:04:29.0723 5704 WinRM - ok
16:04:29.0733 5704 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
16:04:29.0754 5704 Wlansvc - ok
16:04:29.0774 5704 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:04:29.0808 5704 wlidsvc - ok
16:04:29.0811 5704 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
16:04:29.0820 5704 WmiAcpi - ok
16:04:29.0824 5704 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
16:04:29.0836 5704 wmiApSrv - ok
16:04:29.0838 5704 WMPNetworkSvc - ok
16:04:29.0840 5704 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
16:04:29.0850 5704 WPCSvc - ok
16:04:29.0853 5704 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
16:04:29.0864 5704 WPDBusEnum - ok
16:04:29.0866 5704 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
16:04:29.0890 5704 ws2ifsl - ok
16:04:29.0893 5704 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
16:04:29.0907 5704 wscsvc - ok
16:04:29.0908 5704 WSearch - ok
16:04:29.0928 5704 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
16:04:29.0966 5704 wuauserv - ok
16:04:29.0969 5704 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
16:04:29.0993 5704 WudfPf - ok
16:04:29.0997 5704 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
16:04:30.0021 5704 WUDFRd - ok
16:04:30.0023 5704 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
16:04:30.0047 5704 wudfsvc - ok
16:04:30.0051 5704 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
16:04:30.0066 5704 WwanSvc - ok
16:04:30.0074 5704 ================ Scan global ===============================
16:04:30.0076 5704 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
16:04:30.0079 5704 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
16:04:30.0084 5704 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
16:04:30.0088 5704 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
16:04:30.0092 5704 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
16:04:30.0095 5704 [Global] - ok
16:04:30.0095 5704 ================ Scan MBR ==================================
16:04:30.0096 5704 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
16:04:30.0119 5704 \Device\Harddisk2\DR2 - ok
16:04:30.0132 5704 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:04:30.0385 5704 \Device\Harddisk0\DR0 - ok
16:04:30.0388 5704 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
16:04:30.0885 5704 \Device\Harddisk1\DR1 - ok
16:04:30.0886 5704 ================ Scan VBR ==================================
16:04:30.0888 5704 [ BC61E875E4016B80E6443C790F9CA20D ] \Device\Harddisk2\DR2\Partition1
16:04:30.0890 5704 \Device\Harddisk2\DR2\Partition1 - ok
16:04:30.0893 5704 [ D8094653628D98D82AF5E81AF32D12EF ] \Device\Harddisk2\DR2\Partition2
16:04:30.0894 5704 \Device\Harddisk2\DR2\Partition2 - ok
16:04:30.0897 5704 [ FD21A6A1C28DC528D8D63237839B1965 ] \Device\Harddisk0\DR0\Partition1
16:04:30.0899 5704 \Device\Harddisk0\DR0\Partition1 - ok
16:04:30.0923 5704 [ EAE81B70ECA2A9123363CF86506DCC95 ] \Device\Harddisk0\DR0\Partition2
16:04:30.0925 5704 \Device\Harddisk0\DR0\Partition2 - ok
16:04:30.0945 5704 [ E5F8D61A5D6174F1CA8B4ABE28031DFA ] \Device\Harddisk0\DR0\Partition3
16:04:30.0946 5704 \Device\Harddisk0\DR0\Partition3 - ok
16:04:30.0949 5704 [ 47984438567C637BB477A5844AFB0AE8 ] \Device\Harddisk1\DR1\Partition1
16:04:30.0951 5704 \Device\Harddisk1\DR1\Partition1 - ok
16:04:30.0953 5704 [ 58D1BB630614AF4A6A8DC08B4ABD5296 ] \Device\Harddisk1\DR1\Partition2
16:04:30.0955 5704 \Device\Harddisk1\DR1\Partition2 - ok
16:04:30.0955 5704 ============================================================
16:04:30.0955 5704 Scan finished
16:04:30.0955 5704 ============================================================
16:04:30.0965 4924 Detected object count: 6
16:04:30.0965 4924 Actual detected object count: 6
16:04:55.0711 4924 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
16:04:55.0711 4924 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:04:55.0711 4924 GSService ( UnsignedFile.Multi.Generic ) - skipped by user
16:04:55.0711 4924 GSService ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:04:55.0712 4924 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
16:04:55.0712 4924 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:04:55.0712 4924 Printer Control ( UnsignedFile.Multi.Generic ) - skipped by user
16:04:55.0712 4924 Printer Control ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:04:55.0713 4924 RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
16:04:55.0714 4924 RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:04:55.0715 4924 vdrv1000 ( LockedService.Multi.Generic ) - skipped by user
16:04:55.0715 4924 vdrv1000 ( LockedService.Multi.Generic ) - User select action: Skip
|
|
12.09.2012, 15:31
| #25 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.09.2012, 16:17
| #26 |
| | Nod32 meldet Variante von Win32/Gataka.B Hier ist der Log von ComboFix Code:
ATTFilter ComboFix 12-09-12.02 - XXXXXXX 12.09.2012 17:09:08.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4073.2505 [GMT 2:00]
ausgeführt von:: c:\users\XXXXXXX\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\XXXXXXX\AppData\Roaming\Help\coredb\storage
c:\users\XXXXXXX\AppData\Roaming\inst.exe
c:\users\XXXXXXX\AppData\Roaming\Microsoft\~DFK1b01b5.tmp
c:\users\XXXXXXX\AppData\Roaming\Microsoft\1eaadjc.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\bass.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\engine_vx.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\kfgresk.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\mjcriu.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\peaadje.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\qwadjb.dll
c:\users\XXXXXXX\AppData\Roaming\Microsoft\rsaadjd.dll
c:\users\XXXXXXX\AppData\Roaming\vso_ts_preview.xml
D:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-12 bis 2012-09-12 ))))))))))))))))))))))))))))))
.
.
2012-09-12 15:12 . 2012-09-12 15:12 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-09-12 15:12 . 2012-09-12 15:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-12 05:34 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 05:34 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-12 05:34 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2012-09-12 05:34 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 05:34 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 05:34 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 05:34 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-12 05:27 . 2012-09-12 05:27 -------- d-----w- C:\_OTL
2012-09-11 11:27 . 2012-08-27 23:49 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{38C47F89-B33C-4CB8-921D-EF1AA363DAC9}\mpengine.dll
2012-09-05 17:42 . 2012-09-06 14:09 -------- d-----w- c:\users\XXXXXXX\AppData\Local\Abelssoft
2012-09-05 15:46 . 2012-09-05 15:46 -------- d-----w- c:\program files (x86)\ESET
2012-09-05 15:24 . 2012-09-05 15:24 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\Malwarebytes
2012-09-05 15:24 . 2012-09-05 15:24 -------- d-----w- c:\programdata\Malwarebytes
2012-09-05 15:24 . 2012-09-05 15:24 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-05 15:24 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-04 18:02 . 2012-09-04 18:02 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\TrojanHunter
2012-09-04 13:44 . 2012-09-04 13:44 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\vlc
2012-09-04 13:21 . 2012-09-07 14:22 -------- d-----w- c:\programdata\SecTaskMan
2012-09-02 09:25 . 2012-09-02 09:25 -------- d-----w- c:\users\XXXXXXX\AppData\Local\ESET
2012-09-02 08:44 . 2012-09-02 08:44 -------- d-----w- c:\program files\ESET
2012-08-31 14:32 . 2012-08-31 14:32 2295408 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2012-08-31 14:31 . 2012-08-31 14:31 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2012-08-29 17:20 . 2012-08-22 12:17 3492915 ----a-w- c:\windows\system32\nvcoproc.bin
2012-08-29 17:09 . 2012-08-29 17:09 -------- d-----w- c:\programdata\Downloaded Installations
2012-08-29 17:08 . 2012-06-12 20:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2012-08-29 17:08 . 2012-06-12 20:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2012-08-29 15:30 . 2012-08-30 13:34 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2012-08-29 15:03 . 2012-08-30 15:03 -------- d-----w- c:\programdata\PLAV
2012-08-29 15:02 . 2012-08-29 15:02 -------- d-----w- c:\programdata\ParetoLogic Anti-Virus PLUS
2012-08-29 14:10 . 2012-08-29 14:10 -------- d-----w- c:\programdata\Panda Security
2012-08-26 15:42 . 2012-08-26 15:42 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-08-26 15:41 . 2012-08-26 15:41 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-08-26 15:41 . 2012-08-26 15:41 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-08-26 13:23 . 2012-08-26 13:26 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\MOVAVI
2012-08-26 10:35 . 2012-08-26 10:35 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\Windows Search
2012-08-26 10:35 . 2012-08-26 10:35 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\TeamViewer
2012-08-26 10:11 . 2009-09-27 07:39 369152 ----a-w- c:\windows\SysWow64\avisynth.dll
2012-08-26 10:11 . 2005-07-14 10:31 32256 ----a-w- c:\windows\SysWow64\AVSredirect.dll
2012-08-26 10:11 . 2004-02-22 08:11 719872 ----a-w- c:\windows\SysWow64\devil.dll
2012-08-26 10:11 . 2004-01-24 22:00 70656 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2012-08-26 10:11 . 2004-01-24 22:00 70656 ----a-w- c:\windows\SysWow64\i420vfw.dll
2012-08-26 10:11 . 2012-08-26 10:11 -------- d-----w- c:\program files (x86)\AviSynth 2.5
2012-08-26 10:07 . 2012-08-26 10:07 -------- d-----w- c:\program files (x86)\eRightSoft
2012-08-25 08:56 . 2012-08-25 08:56 -------- d-----w- c:\programdata\DVD Shrink
2012-08-25 08:47 . 2012-06-30 06:46 95744 ----a-w- c:\windows\system32\pdfcmon.dll
2012-08-25 08:47 . 2012-05-05 09:54 662288 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
2012-08-25 08:47 . 2012-05-05 09:54 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
2012-08-25 08:47 . 2012-05-05 09:54 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
2012-08-25 08:47 . 1998-07-06 16:56 125712 ----a-w- c:\windows\SysWow64\VB6DE.DLL
2012-08-25 08:47 . 1998-07-06 16:55 158208 ----a-w- c:\windows\SysWow64\MSCMCDE.DLL
2012-08-25 08:47 . 1998-07-06 16:55 64512 ----a-w- c:\windows\SysWow64\MSCC2DE.DLL
2012-08-25 08:47 . 2012-08-25 08:47 -------- d-----w- c:\program files (x86)\PDFCreator
2012-08-22 12:29 . 2012-08-26 15:32 82816 ----a-w- c:\users\XXXXXXX\AppData\Roaming\pcouffin.sys
2012-08-22 12:29 . 2010-04-30 10:26 65602 ----a-w- c:\windows\SysWow64\cook3260.dll
2012-08-22 12:29 . 2010-04-30 10:26 626688 ----a-w- c:\windows\SysWow64\vp7vfw.dll
2012-08-22 12:29 . 2010-04-30 10:26 217127 ----a-w- c:\windows\SysWow64\drv43260.dll
2012-08-22 12:29 . 2010-04-30 10:26 208935 ----a-w- c:\windows\SysWow64\drv33260.dll
2012-08-22 12:29 . 2010-04-30 10:26 176165 ----a-w- c:\windows\SysWow64\drv23260.dll
2012-08-22 12:29 . 2010-04-30 10:26 102439 ----a-w- c:\windows\SysWow64\sipr3260.dll
2012-08-22 12:29 . 2010-04-30 10:26 1184984 ----a-w- c:\windows\SysWow64\wvc1dmod.dll
2012-08-22 12:29 . 2012-08-26 15:32 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\VSO
2012-08-22 12:29 . 2012-08-22 12:29 -------- d-----w- c:\programdata\VSO
2012-08-22 04:16 . 2012-08-22 04:16 429416 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-08-19 11:08 . 2012-08-19 11:08 -------- d-----w- c:\users\Public\CyberLink
2012-08-19 10:47 . 2012-08-22 11:44 -------- d-----w- c:\programdata\xml_param
2012-08-18 18:10 . 2012-08-18 18:10 -------- d-----w- c:\program files\iTunes
2012-08-18 18:10 . 2012-08-18 18:10 -------- d-----w- c:\program files\iPod
2012-08-18 10:51 . 2012-08-18 10:51 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\portable
2012-08-15 14:38 . 2012-07-06 20:07 552960 ----a-w- c:\windows\system32\drivers\bthport.sys
2012-08-14 13:53 . 2012-08-14 13:53 -------- d-----w- c:\users\XXXXXXX\AppData\Roaming\Bildverkleinerer
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-12 05:46 . 2011-10-06 18:32 64462936 ----a-w- c:\windows\system32\MRT.exe
2012-09-01 07:56 . 2012-04-03 13:07 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-01 07:56 . 2011-10-09 06:22 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-22 13:46 . 2012-02-09 20:43 971624 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-08-22 13:46 . 2012-02-09 20:43 15291752 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-08-22 13:46 . 2012-01-03 18:50 1763688 ----a-w- c:\windows\system32\nvdispco64.dll
2012-08-22 13:46 . 2011-05-21 04:01 2725224 ----a-w- c:\windows\system32\nvapi64.dll
2012-08-22 13:46 . 2011-05-21 04:01 2422120 ----a-w- c:\windows\SysWow64\nvapi.dll
2012-08-22 13:46 . 2011-05-21 04:01 14879080 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-08-22 12:17 . 2011-10-06 18:09 891240 ----a-w- c:\windows\system32\nvvsvc.exe
2012-08-22 12:17 . 2011-10-06 18:09 63336 ----a-w- c:\windows\system32\nvshext.dll
2012-08-22 12:17 . 2011-10-06 18:09 118120 ----a-w- c:\windows\system32\nvmctray.dll
2012-08-22 12:17 . 2011-10-06 18:09 2557800 ----a-w- c:\windows\system32\nvsvcr.dll
2012-08-22 12:17 . 2011-10-06 18:09 3266920 ----a-w- c:\windows\system32\nvsvc64.dll
2012-08-22 12:17 . 2011-10-06 18:09 6198120 ----a-w- c:\windows\system32\nvcpl.dll
2012-08-09 09:07 . 2011-10-14 11:16 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2012-06-26 19:38 . 2012-06-26 19:38 827728 ----a-w- c:\windows\system32\msvcr100.dll
2012-06-26 19:38 . 2012-06-26 19:38 607568 ----a-w- c:\windows\system32\msvcp100.dll
2012-06-13 11:21 . 2012-06-13 11:21 389216 ----a-w- c:\program files (x86)\fmod_event_net.dll
2012-06-13 11:21 . 2012-06-13 11:21 352864 ----a-w- c:\program files (x86)\fmod_event.dll
2012-06-13 11:21 . 2012-06-13 11:21 16650848 ----a-w- c:\program files (x86)\Flight.exe
2012-06-13 11:21 . 2012-06-13 11:21 121440 ----a-w- c:\program files (x86)\steam_api.dll
2012-06-13 11:21 . 2012-06-13 11:21 1068640 ----a-w- c:\program files (x86)\fmodex.dll
2012-03-21 12:20 . 2012-03-21 12:20 196416 ----a-w- c:\program files (x86)\sqmapi.dll
2006-05-03 10:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TBPanel"="c:\program files (x86)\Vtune\TBPanel.exe" [2010-09-02 2158592]
"updateMgr"="d:\programme\Adobe Acrobat\Acrobat\AdobeUpdateManager.exe" [2006-03-30 313472]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
"USB Safely Remove"="c:\program files (x86)\USB Safely Remove\USBSafelyRemove.exe" [2011-08-04 1839448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"MDS_Menu"="c:\program files (x86)\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-11-23 75048]
"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2010-06-02 222504]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]
"Acrobat Assistant 7.0"="d:\programme\Adobe Acrobat\Distillr\Acrotray.exe" [2008-04-23 483328]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"VC10Player"="c:\program files (x86)\Virtual CD v10\System\VC10Play.exe" [2012-04-12 404880]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2011-10-29 25214]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Audible Download Manager.lnk - d:\programme\Audible\Bin\AudibleDownloadHelper.exe [2011-3-14 2125472]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2012\mshaktuell.exe [2012-4-12 1380504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 CLKMSVC10_9EC60124;CyberLink Product - 2012/02/26 11:59;c:\program files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-11-23 240112]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [2010-10-27 55336]
R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R3 GSService;GSService;c:\windows\SysWOW64\GSService.exe [2012-01-17 246784]
R3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [2009-07-09 24088]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2011-10-02 59392]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\DRIVERS\TsUsbGD.sys [2011-10-02 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\DRIVERS\vpcuxd.sys [2010-11-20 16384]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2010-11-22 303408]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
S1 vdrv1000;vdrv1000;c:\windows\system32\DRIVERS\vdrv1000.sys [2011-04-19 223256]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-10-27 52896]
S2 DTSAudioService;DTSAudioService;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe [2011-05-31 210024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 137144]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-08-22 1258856]
S2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [2010-05-07 78848]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-08-22 382312]
S2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\program files (x86)\USB Safely Remove\USBSRService.exe [2011-08-04 551352]
S2 VC10SecS;Virtual CD v10 Management Service;c:\program files (x86)\Virtual CD v10\System\VC10SecS.exe [2012-04-12 145296]
S3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2010-12-24 29288]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-10-27 38248]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-10-27 301680]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-10-27 31080]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-10-27 203624]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-10-27 58992]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-10-27 156520]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-10-27 279152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [2011-10-05 729152]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-10-06 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-10-06 181248]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-07-03 189288]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-06-12 726160]
S3 vcd10bus;Virtual CD v10 Bus Enumerator;c:\windows\system32\DRIVERS\vcd10bus.sys [2008-06-17 40464]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - CLKMDRV10_9EC60124
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-04-22 11:09 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"IntelliType Pro"="c:\program files\Microsoft Device Center\itype.exe" [2012-06-26 1464928]
"IntelliPoint"="c:\program files\Microsoft Device Center\ipoint.exe" [2012-06-26 2004584]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]
"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-13 1212560]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 4035152]
"PrintDisp"="c:\windows\system32\PrintDisp.exe" [2011-08-08 828416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - d:\programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\XXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\36njkvcj.default\
FF - prefs.js: browser.search.selectedEngine - Amazon.de
FF - prefs.js: browser.startup.homepage - hxxp://ecosia.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-UpgradeChecker - c:\users\XXXXXXX\AppData\Roaming\Windows Search\{331156C6-1C8E-436C-8B77-80126797842A}\UpgradeChecker.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrv1000]
"ImagePath"="system32\DRIVERS\vdrv1000.sys"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrv1000\Enum]
@DACL=(02 0000)
"0"="{C317464A-8106-4e30-83E6-1825448A5FC3}\\VDRV1_HWID\\1&21a742e4&1&01"
"Count"=dword:00000001
"NextInstance"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrv1000\parameters]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrv1000\security]
@DACL=(02 0000)
.
Zeit der Fertigstellung: 2012-09-12 17:13:51
ComboFix-quarantined-files.txt 2012-09-12 15:13
.
Vor Suchlauf: 11 Verzeichnis(se), 71.957.008.384 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 71.586.406.400 Bytes frei
.
- - End Of File - - FB7EDAE6152CDF6769CB16F6620646E5
|
|
12.09.2012, 19:43
| #27 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.09.2012, 13:28
| #28 |
| | Nod32 meldet Variante von Win32/Gataka.B Hier ist der Log von Gmer: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-13 14:17:44
Windows 6.1.7601 Service Pack 1
Running: nxql8k39.exe
---- Services - GMER 1.0.15 ----
Service system32\DRIVERS\vdrv1000.sys (*** hidden *** ) [SYSTEM] vdrv1000 <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683139b45
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683139b45@ac932f2e2b8b 0x2D 0x2A 0x70 0x62 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@ServiceBinary C:\Windows\system32\drivers\VDRV1000.SYS
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@Group SCSI Miniport
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@ImagePath system32\DRIVERS\vdrv1000.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000@Tag 68
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\Enum
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\Enum@0 {C317464A-8106-4e30-83E6-1825448A5FC3}\VDRV1_HWID\1&21a742e4&1&01
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\Enum@Count 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\Enum@NextInstance 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\parameters\pnpinterface
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\parameters\pnpinterface@0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\vdrv1000\security
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683139b45 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683139b45@ac932f2e2b8b 0x2D 0x2A 0x70 0x62 ...
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@ServiceBinary C:\Windows\system32\drivers\VDRV1000.SYS
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@ImagePath system32\DRIVERS\vdrv1000.sys
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000@Tag 68
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\Enum@0 {C317464A-8106-4e30-83E6-1825448A5FC3}\VDRV1_HWID\1&21a742e4&1&01
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\parameters\pnpinterface@0 1
Reg HKLM\SYSTEM\ControlSet002\services\vdrv1000\security (not active ControlSet)
---- EOF - GMER 1.0.15 ----
Hier ist der Log von Osam: OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 14:23:46 on 13.09.2012 OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit Default Browser: Mozilla Corporation Firefox 15.0.1 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLCFG32.CPL [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Apowersoft_AudioDevice" (Apowersoft_AudioDevice) - "Wondershare" - C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys "catchme" (catchme) - ? - C:\ComboFix\catchme.sys (File not found) "HH10Help.sys" (HH10Help.sys) - "H+H Software GmbH" - C:\Windows\system32\drivers\HH10Help.sys "Kaspersky Lab Driver" (KLIF) - "Kaspersky Lab" - C:\Windows\System32\DRIVERS\klif.sys "kl1" (kl1) - "Kaspersky Lab ZAO" - C:\Windows\System32\DRIVERS\kl1.sys "MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys "TBPanel" (TBPanel) - ? - C:\Windows\system32\drivers\TBPanel.sys (File not found) "vdrv1000" (vdrv1000) - "H+H Software GmbH" - C:\Windows\System32\DRIVERS\vdrv1000.sys (Hidden registry entry, rootkit activity) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {16148659-720A-457d-850B-2DBD87BB129D} "AudibleShlExt Class" - "Audible, Inc." - D:\Programme\Audible\Bin\AudibleExt.dll {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - D:\Programme\Adobe Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - D:\Programme\Adobe Acrobat\Acrobat Elements\ContextMenu.dll {16148659-720A-457d-850B-2DBD87BB129D} "AudibleShlExt Class" - "Audible, Inc." - D:\Programme\Audible\Bin\AudibleExt.dll {D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL {568EA264-B78A-495C-BF35-79EA7530C5B2} "Context Menu Shell Extension" - ? - C:\Windows\SysWow64\WS_VideoConverterContextMenu.dll (File found, but it contains no detailed information) {B089FE88-FB52-11D3-BDF1-0050DA34150D} "ESET Smart Security - Context Menu Shell Extension" - "ESET" - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\shellExt.dll {506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll {0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL {00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLSHEXT.DLL {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL {A45CC9E4-123E-4F9F-9581-F3D41942B7E9} "Virtual CD v10 Drive" - "H+H Software GmbH" - C:\Program Files (x86)\Virtual CD v10\System\vc10extse.dll {ADCFF5F9-7724-4243-B236-9B1C3619C891} "Virtual CD v10 Image" - "H+H Software GmbH" - C:\Program Files (x86)\Virtual CD v10\System\vc10extse.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "Adobe PDF" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} "ClsidExtension" - "Atheros Commnucations" - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - D:\PROGRA~1\OFFICE11\REFIEBAR.DLL {FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "Adobe PDF" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\Acrobat\AcroIEFavClient.dll {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\ActiveX\AcroIEHelper.dll {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} "CIESpeechBHO Class" - "Atheros Commnucations" - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll {B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [LSA Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )----- "Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Corina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "Adobe Acrobat - Schnellstart.lnk" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\Acrobat\acrobat_sl.exe (Shortcut exists | File exists) "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "TBPanel" - ? - C:\Program Files (x86)\Vtune\TBPanel.exe /A "updateMgr" - "Adobe Systems Incorporated" - D:\Programme\Adobe Acrobat\Acrobat\AdobeUpdateManager.exe AcPro7_0_0 -reboot 1 "USB Safely Remove" - "Crystal Rich Ltd" - C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe /startup -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Acrobat Assistant 7.0" - "Adobe Systems Inc." - "D:\Programme\Adobe Acrobat\Distillr\Acrotray.exe" "APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" "BDRegion" - "cyberlink" - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe "IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe "Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray "MDS_Menu" - "CyberLink Corp." - "C:\Program Files (x86)\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\MediaShow4" UpdateWithCreateOnce "Software\CyberLink\MediaShow\4.1" "NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" "UpdateLBPShortCut" - "CyberLink Corp." - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" "UpdateP2GoShortCut" - "CyberLink Corp." - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" "UpdatePPShortCut" - "CyberLink Corp." - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" "UpdatePSTShortCut" - "CyberLink Corp." - "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" "VC10Player" - "H+H Software GmbH" - C:\Program Files (x86)\Virtual CD v10\System\VC10Play.exe [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "pdfcmon" - "pdfforge GbR" - C:\Windows\system32\pdfcmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll (File not found) "Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "AtherosSvc" (AtherosSvc) - "Atheros Commnucations" - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe "CyberLink Product - 2012/02/26 11:59:57" (CLKMSVC10_9EC60124) - "CyberLink" - C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe "Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "ESET Service" (ekrn) - "ESET" - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe "GSService" (GSService) - ? - C:\Windows\SysWOW64\GSService.exe (File found, but it contains no detailed information) "Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe "Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe "MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe "Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe "NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE "Printer Control" (Printer Control) - "ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM" - C:\Windows\system32\PrintCtrl.exe "USB Safely Remove Assistant" (USBSafelyRemoveService) - ? - C:\Program Files (x86)\USB Safely Remove\USBSRService.exe (File found, but it contains no detailed information) "Virtual CD v10 Management Service" (VC10SecS) - "H+H Software GmbH" - C:\Program Files (x86)\Virtual CD v10\System\VC10SecS.exe "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll "WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL "WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL ===[ Logfile end ]=========================================[ Logfile end ]=== Jetzt noch die txt von aswMBR: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-13 14:33:22
-----------------------------
14:33:22.922 OS Version: Windows x64 6.1.7601 Service Pack 1
14:33:22.922 Number of processors: 4 586 0x2A07
14:33:22.923 ComputerName: BLACK-RUNNER UserName: XXXXXXX
14:33:23.057 Initialize success
14:33:27.200 AVAST engine defs: 12091300
14:33:38.264 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:33:38.266 Disk 0 Vendor: WDC_WD64 01.0 Size: 610479MB BusType: 3
14:33:38.269 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
14:33:38.271 Disk 1 Vendor: WDC_WD10 80.0 Size: 953869MB BusType: 3
14:33:38.274 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Scsi\mv91xx1Port1Path0Target0Lun0
14:33:38.277 Disk 2 Vendor: M4-CT128 0009 Size: 122104MB BusType: 11
14:33:38.282 Disk 2 MBR read successfully
14:33:38.286 Disk 2 MBR scan
14:33:38.291 Disk 2 Windows 7 default MBR code
14:33:38.294 Disk 2 Partition 1 80 (A) 07 HPFS/NTFS NTFS 119000 MB offset 2048
14:33:38.300 Disk 2 Partition 2 00 07 HPFS/NTFS NTFS 3101 MB offset 243714048
14:33:38.310 Disk 2 scanning C:\Windows\system32\drivers
14:33:41.186 Service scanning
14:33:45.873 Service vdrv1000 C:\Windows\system32\DRIVERS\vdrv1000.sys **LOCKED**
14:33:47.041 Modules scanning
14:33:47.047 Disk 2 trace - called modules:
14:33:47.055 ntoskrnl.exe CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll mv91xx.sys
14:33:47.060 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa80065f8060]
14:33:47.065 3 CLASSPNP.SYS[fffff8800181743f] -> nt!IofCallDriver -> \Device\Scsi\mv91xx1Port1Path0Target0Lun0[0xfffffa8006404050]
14:33:47.071 Scan finished successfully
14:34:23.539 Disk 2 MBR has been saved successfully to "C:\Users\XXXXXXX\Desktop\MBR.dat"
14:34:23.542 The log file has been saved successfully to "C:\Users\XXXXXXX\Desktop\aswMBR.txt"
Geändert von Conny_Sch (13.09.2012 um 13:38 Uhr) |
|
13.09.2012, 20:30
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nod32 meldet Variante von Win32/Gataka.B Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.09.2012, 14:55
| #30 |
| | Nod32 meldet Variante von Win32/Gataka.B Hallo, hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.0.1400 Malwarebytes : Free Anti-Malware download Datenbank Version: v2012.09.14.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 XXXXXXX :: BLACK-RUNNER [Administrator] Schutz: Aktiviert 14.09.2012 13:58:20 mbam-log-2012-09-14 (13-58-20).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 378483 Laufzeit: 11 Minute(n), 46 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 09/14/2012 at 03:01 PM
Application Version : 5.5.1016
Core Rules Database Version : 9227
Trace Rules Database Version: 7039
Scan type : Complete Scan
Total Scan Time : 00:15:48
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 626
Memory threats detected : 0
Registry items scanned : 70472
Registry threats detected : 1
File items scanned : 51239
File threats detected : 69
Adware.Tracking Cookie
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\KOBSCOIL.txt [ /doubleclick.net ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\GWOWPFI2.txt [ /track.adform.net ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\VOYAXFXR.txt [ /myroitracking.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\VSIZ4SI5.txt [ /adform.net ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\T8EVOR76.txt [ /ad4.adfarm1.adition.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\OU07Q82A.txt [ /serving-sys.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\ZRB9Y3SF.txt [ /ad.yieldmanager.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\2U2GIW62.txt [ /adfarm1.adition.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\BUO95MQX.txt [ /tracking.quisma.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\DT3ZMIZT.txt [ /ad3.adfarm1.adition.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\BI8B348D.txt [ /smartadserver.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\GN43IS27.txt [ /eas.apm.emediate.eu ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\XJIAIPMO.txt [ /statcounter.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\CZ400MDD.txt [ /clicksor.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\M8O19X6B.txt [ /invitemedia.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\N61RL7IT.txt [ /ad2.adfarm1.adition.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\MEAZGW3B.txt [ /2o7.net ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\106EZTG0.txt [ /ad1.adfarm1.adition.com ]
C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\U5ZWH45U.txt [ /ad.zanox.com ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\8STX66U2.txt [ Cookie:XXXXXX@doubleclick.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\EH03BEU5.txt [ Cookie:XXXXXX@clkads.com/adServe ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\G077P34B.txt [ Cookie:XXXXXX@edge.jeetyetmedia.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\CHJMEKJW.txt [ Cookie:XXXXXX@www.zanox-affiliate.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\6UF4QJZ3.txt [ Cookie:XXXXXX@zanox.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\N5ZPUB1E.txt [ Cookie:XXXXXX@media-addicted.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\S0CT5D7S.txt [ Cookie:XXXXXX@imrworldwide.com/cgi-bin ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\34LKK4QK.txt [ Cookie:XXXXXX@ru4.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\PSPOV8GG.txt [ Cookie:XXXXXX@tradedoubler.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\UTRBWVUV.txt [ Cookie:XXXXXX@zbox.zanox.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\CV4P8EYA.txt [ Cookie:XXXXXX@serving-sys.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\KMQT1M9Q.txt [ Cookie:XXXXXX@fastclick.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\ESDH3NTY.txt [ Cookie:XXXXXX@ad.yieldmanager.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\2BP2IO2W.txt [ Cookie:XXXXXX@traffictrack.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\JOQF0G8V.txt [ Cookie:XXXXXX@www.googleadservices.com/pagead/conversion/1021415196/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\MG06KC6G.txt [ Cookie:XXXXXX@atdmt.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\G3RK2J48.txt [ Cookie:XXXXXX@adfarm1.adition.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\INWI5IFR.txt [ Cookie:XXXXXX@adtech.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\45POZYX0.txt [ Cookie:XXXXXX@ads.quartermedia.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\01GHTZ3O.txt [ Cookie:XXXXXX@ad3.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\104N43F3.txt [ Cookie:XXXXXX@unitymedia.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XPBG81JB.txt [ Cookie:XXXXXX@zanox-affiliate.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XNCODUJW.txt [ Cookie:XXXXXX@collective-media.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZPV7H1T0.txt [ Cookie:XXXXXX@adviva.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\HBEHFPH2.txt [ Cookie:XXXXXX@revsci.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\OQBD769S.txt [ Cookie:XXXXXX@adbrite.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\AERD6OUM.txt [ Cookie:XXXXXX@ww251.smartadserver.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\7WGL75U4.txt [ Cookie:XXXXXX@adx.chip.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\2IPXNGL6.txt [ Cookie:XXXXXX@media6degrees.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\3T4X2QL4.txt [ Cookie:XXXXXX@openx.jeetyetmedia.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\OLHD3ZV4.txt [ Cookie:XXXXXX@ad2.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\5Z1940SC.txt [ Cookie:XXXXXX@mediaplex.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\TFPMMAFM.txt [ Cookie:XXXXXX@2o7.net/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\YJXQA844.txt [ Cookie:XXXXXX@webmasterplan.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\HTA68GG2.txt [ Cookie:XXXXXX@ad.dyntracker.de/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\OZZZ5VBP.txt [ Cookie:XXXXXX@ad1.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\28GTIO1M.txt [ Cookie:XXXXXX@zedo.com/ ]
C:\USERS\XXXXXX\Cookies\KOBSCOIL.txt [ Cookie:XXXXXX@doubleclick.net/ ]
C:\USERS\XXXXXX\Cookies\GWOWPFI2.txt [ Cookie:XXXXXX@track.adform.net/ ]
C:\USERS\XXXXXX\Cookies\T8EVOR76.txt [ Cookie:XXXXXX@ad4.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\Cookies\OU07Q82A.txt [ Cookie:XXXXXX@serving-sys.com/ ]
C:\USERS\XXXXXX\Cookies\ZRB9Y3SF.txt [ Cookie:XXXXXX@ad.yieldmanager.com/ ]
C:\USERS\XXXXXX\Cookies\2U2GIW62.txt [ Cookie:XXXXXX@adfarm1.adition.com/ ]
C:\USERS\XXXXXX\Cookies\DT3ZMIZT.txt [ Cookie:XXXXXX@ad3.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\Cookies\GN43IS27.txt [ Cookie:XXXXXX@eas.apm.emediate.eu/ ]
C:\USERS\XXXXXX\Cookies\XJIAIPMO.txt [ Cookie:XXXXXX@statcounter.com/ ]
C:\USERS\XXXXXX\Cookies\N61RL7IT.txt [ Cookie:XXXXXX@ad2.adfarm1.adition.com/ ][IMG][/IMG]
C:\USERS\XXXXXX\Cookies\MEAZGW3B.txt [ Cookie:XXXXXX@2o7.net/ ]
C:\USERS\XXXXXX\Cookies\106EZTG0.txt [ Cookie:XXXXXX@ad1.adfarm1.adition.com/ ]
C:\USERS\XXXXXX\Cookies\U5ZWH45U.txt [ Cookie:XXXXXX@ad.zanox.com/ ]
PUP.BabylonToolbar
(x86) HKU\S-1-5-21-1684251090-3011788876-2256450295-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Bei dem Log von GMER wird ein Rootkit angezeigt - ist das ohne Bedeutung? Dann hat mein Virenprogramm in seiner Quarantäne 4 Dateien - eine ist dieser Trojaner, wegen dem ich das Posting eröffnet habe. Wie soll ich mich bei diesen, von Nod als Schädlinge erkannten, Dateien verhalten? Die Videokonverter.exe ist ok, aber die anderen? (abgesehen vom Trojaner) Ich habe einen Screenshot von der Quarantäne gemacht: [IMG]  [/IMG] |
|
| Themen zu Nod32 meldet Variante von Win32/Gataka.B |
| arbeitsspeicher, dateien, infos, melde, meldet, meldung, nicht möglich, nichts, nod32, programm, prüfung, rechner, runter, scan, scanner, suche, tipps, trojaner, variante, versucht, virenscan, virenscanner, warnmeldung, win, wirklich |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
