| |
| |||||||
Log-Analyse und Auswertung: AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
20.11.2012, 21:31
| #1 |
 |  AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Heute vormittag flackerte eine Meldung des AntiVir-Echtzeit-Scanners auf, dass er in meinem Steam-Verzeichnis in einer *.dll von Bloodbowl einen Trojaner gefunden habe. Der direkt im Anschluss durchgeführte Scan (Admin-Berechtigung) des gesamten Steam-Verzeichnis ergab nichts. Kein Fund. AntiVir arbeitet grundsätzlich ohne Einschränkung der Rekursionstiefe und mit Erkennungsstufe "hoch". Um sicher zu gehen, habe ich anschließend einen vollständigen Systemscan mit Malwarebytes Anti-Malware sowie einen Rootkit-Scan und danach noch einen vollständigen System-Scan mit AntiVir durchführen lassen, immer mit Administrator-Berechtigung. Abschließend noch einen OTL-Scan. Betriebssystem ist Win7, 64bit. Laufwerk "N" ist mit Truecrypt verschlüsselt. Vielleicht ist es nur ein Fehlalarm, aber ich wäre mir gerne sicher, dass das System sauber ist. Deshalb nachfolgend noch die Scan-Logs. Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.20.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Thomas :: BEHEMOTH [Administrator] 20.11.2012 12:41:45 mbam-log-2012-11-20 (12-41-45).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|K:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 570014 Laufzeit: 1 Stunde(n), 54 Minute(n), Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Thomas\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt. D:\Downloads\coretemp_1236.exe (PUP.BundleOffers.IIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 20. November 2012 14:43
Es wird nach 4534557 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Thomas
Computername : BEHEMOTH
Versionsinformationen:
BUILD.DAT : 12.1.9.1236 40872 Bytes 11.10.2012 15:29:00
AVSCAN.EXE : 12.3.0.48 468256 Bytes 14.11.2012 22:57:07
AVSCAN.DLL : 12.3.0.15 66256 Bytes 02.05.2012 00:02:50
LUKE.DLL : 12.3.0.15 68304 Bytes 01.05.2012 23:31:47
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 01.05.2012 22:13:36
AVREG.DLL : 12.3.0.17 232200 Bytes 21.05.2012 15:57:51
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:22:12
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 23:31:36
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 09:58:50
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 10:43:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 19:40:34
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 21:53:44
VBASE007.VDF : 7.11.45.207 2363904 Bytes 11.10.2012 21:06:52
VBASE008.VDF : 7.11.45.208 2048 Bytes 11.10.2012 21:06:52
VBASE009.VDF : 7.11.45.209 2048 Bytes 11.10.2012 21:06:52
VBASE010.VDF : 7.11.45.210 2048 Bytes 11.10.2012 21:06:52
VBASE011.VDF : 7.11.45.211 2048 Bytes 11.10.2012 21:06:52
VBASE012.VDF : 7.11.45.212 2048 Bytes 11.10.2012 21:06:52
VBASE013.VDF : 7.11.45.213 2048 Bytes 11.10.2012 21:06:52
VBASE014.VDF : 7.11.46.65 220160 Bytes 16.10.2012 07:35:23
VBASE015.VDF : 7.11.46.153 173568 Bytes 18.10.2012 08:02:49
VBASE016.VDF : 7.11.46.223 162304 Bytes 19.10.2012 09:53:20
VBASE017.VDF : 7.11.47.35 126464 Bytes 22.10.2012 10:51:38
VBASE018.VDF : 7.11.47.95 175616 Bytes 24.10.2012 10:51:39
VBASE019.VDF : 7.11.47.177 164352 Bytes 26.10.2012 12:48:50
VBASE020.VDF : 7.11.47.229 143360 Bytes 28.10.2012 22:27:18
VBASE021.VDF : 7.11.48.47 138240 Bytes 30.10.2012 07:43:29
VBASE022.VDF : 7.11.48.135 122880 Bytes 01.11.2012 07:43:29
VBASE023.VDF : 7.11.48.209 142848 Bytes 05.11.2012 15:45:12
VBASE024.VDF : 7.11.48.243 119296 Bytes 05.11.2012 15:44:54
VBASE025.VDF : 7.11.49.47 136704 Bytes 07.11.2012 15:44:54
VBASE026.VDF : 7.11.49.135 194560 Bytes 09.11.2012 15:44:57
VBASE027.VDF : 7.11.49.209 188416 Bytes 12.11.2012 22:03:52
VBASE028.VDF : 7.11.50.27 212992 Bytes 14.11.2012 22:57:06
VBASE029.VDF : 7.11.50.105 200704 Bytes 18.11.2012 11:11:54
VBASE030.VDF : 7.11.50.164 340992 Bytes 20.11.2012 13:41:26
VBASE031.VDF : 7.11.50.168 15872 Bytes 20.11.2012 13:41:54
Engineversion : 8.2.10.202
AEVDF.DLL : 8.1.2.10 102772 Bytes 10.07.2012 20:55:19
AESCRIPT.DLL : 8.1.4.66 463227 Bytes 12.11.2012 22:03:54
AESCN.DLL : 8.1.9.4 131445 Bytes 15.11.2012 22:57:06
AESBX.DLL : 8.2.5.12 606578 Bytes 20.06.2012 06:47:25
AERDL.DLL : 8.2.0.74 643445 Bytes 07.11.2012 15:44:58
AEPACK.DLL : 8.3.0.40 815479 Bytes 12.11.2012 22:03:54
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 05.11.2012 15:45:15
AEHEUR.DLL : 8.1.4.138 5542265 Bytes 15.11.2012 22:57:06
AEHELP.DLL : 8.1.25.2 258423 Bytes 11.10.2012 21:06:44
AEGEN.DLL : 8.1.6.10 438646 Bytes 15.11.2012 22:57:04
AEEXP.DLL : 8.2.0.10 119158 Bytes 05.11.2012 15:45:15
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 20:55:18
AECORE.DLL : 8.1.29.2 201079 Bytes 07.11.2012 15:44:54
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 15:45:12
AVWINLL.DLL : 12.3.0.15 27344 Bytes 01.05.2012 22:59:21
AVPREF.DLL : 12.3.0.32 50720 Bytes 14.11.2012 22:57:07
AVREP.DLL : 12.3.0.15 179208 Bytes 01.05.2012 22:13:35
AVARKT.DLL : 12.3.0.33 209696 Bytes 14.11.2012 22:57:07
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 01.05.2012 22:28:49
SQLITE3.DLL : 3.7.0.1 398288 Bytes 16.04.2012 21:11:02
AVSMTP.DLL : 12.3.0.32 63480 Bytes 08.08.2012 19:29:26
NETNT.DLL : 12.3.0.15 17104 Bytes 01.05.2012 23:33:29
RCIMAGE.DLL : 12.3.0.31 4444408 Bytes 08.08.2012 19:29:17
RCTEXT.DLL : 12.3.0.32 98848 Bytes 14.11.2012 22:57:06
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: aus
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +JOKE,
Beginn des Suchlaufs: Dienstag, 20. November 2012 14:43
Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Fuel Caste Constructor ProcTime
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Platform Caste Constructor ProcTime
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\ATI\ACE\Settings\Runtime\Runtime Platform Caste Constructor ProcTime
Versteckter Treiber
[HINWEIS] Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerofa.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'razertra.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerhid.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Windows\Sysnative\drivers\sptd.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Die Registry wurde durchsucht ( '3452' Dateien ).
Ende des Suchlaufs: Dienstag, 20. November 2012 14:53
Benötigte Zeit: 09:12 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
4334 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
4333 Dateien ohne Befall
15 Archive wurden durchsucht
1 Warnungen
3 Hinweise
1150516 Objekte wurden beim Rootkitscan durchsucht
4 Versteckte Objekte wurden gefunden
Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 20. November 2012 14:54
Es wird nach 4534557 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Thomas
Computername : BEHEMOTH
Versionsinformationen:
BUILD.DAT : 12.1.9.1236 40872 Bytes 11.10.2012 15:29:00
AVSCAN.EXE : 12.3.0.48 468256 Bytes 14.11.2012 22:57:07
AVSCAN.DLL : 12.3.0.15 66256 Bytes 02.05.2012 00:02:50
LUKE.DLL : 12.3.0.15 68304 Bytes 01.05.2012 23:31:47
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 01.05.2012 22:13:36
AVREG.DLL : 12.3.0.17 232200 Bytes 21.05.2012 15:57:51
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:22:12
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 23:31:36
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 09:58:50
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 10:43:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 19:40:34
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 21:53:44
VBASE007.VDF : 7.11.45.207 2363904 Bytes 11.10.2012 21:06:52
VBASE008.VDF : 7.11.45.208 2048 Bytes 11.10.2012 21:06:52
VBASE009.VDF : 7.11.45.209 2048 Bytes 11.10.2012 21:06:52
VBASE010.VDF : 7.11.45.210 2048 Bytes 11.10.2012 21:06:52
VBASE011.VDF : 7.11.45.211 2048 Bytes 11.10.2012 21:06:52
VBASE012.VDF : 7.11.45.212 2048 Bytes 11.10.2012 21:06:52
VBASE013.VDF : 7.11.45.213 2048 Bytes 11.10.2012 21:06:52
VBASE014.VDF : 7.11.46.65 220160 Bytes 16.10.2012 07:35:23
VBASE015.VDF : 7.11.46.153 173568 Bytes 18.10.2012 08:02:49
VBASE016.VDF : 7.11.46.223 162304 Bytes 19.10.2012 09:53:20
VBASE017.VDF : 7.11.47.35 126464 Bytes 22.10.2012 10:51:38
VBASE018.VDF : 7.11.47.95 175616 Bytes 24.10.2012 10:51:39
VBASE019.VDF : 7.11.47.177 164352 Bytes 26.10.2012 12:48:50
VBASE020.VDF : 7.11.47.229 143360 Bytes 28.10.2012 22:27:18
VBASE021.VDF : 7.11.48.47 138240 Bytes 30.10.2012 07:43:29
VBASE022.VDF : 7.11.48.135 122880 Bytes 01.11.2012 07:43:29
VBASE023.VDF : 7.11.48.209 142848 Bytes 05.11.2012 15:45:12
VBASE024.VDF : 7.11.48.243 119296 Bytes 05.11.2012 15:44:54
VBASE025.VDF : 7.11.49.47 136704 Bytes 07.11.2012 15:44:54
VBASE026.VDF : 7.11.49.135 194560 Bytes 09.11.2012 15:44:57
VBASE027.VDF : 7.11.49.209 188416 Bytes 12.11.2012 22:03:52
VBASE028.VDF : 7.11.50.27 212992 Bytes 14.11.2012 22:57:06
VBASE029.VDF : 7.11.50.105 200704 Bytes 18.11.2012 11:11:54
VBASE030.VDF : 7.11.50.164 340992 Bytes 20.11.2012 13:41:26
VBASE031.VDF : 7.11.50.168 15872 Bytes 20.11.2012 13:41:54
Engineversion : 8.2.10.202
AEVDF.DLL : 8.1.2.10 102772 Bytes 10.07.2012 20:55:19
AESCRIPT.DLL : 8.1.4.66 463227 Bytes 12.11.2012 22:03:54
AESCN.DLL : 8.1.9.4 131445 Bytes 15.11.2012 22:57:06
AESBX.DLL : 8.2.5.12 606578 Bytes 20.06.2012 06:47:25
AERDL.DLL : 8.2.0.74 643445 Bytes 07.11.2012 15:44:58
AEPACK.DLL : 8.3.0.40 815479 Bytes 12.11.2012 22:03:54
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 05.11.2012 15:45:15
AEHEUR.DLL : 8.1.4.138 5542265 Bytes 15.11.2012 22:57:06
AEHELP.DLL : 8.1.25.2 258423 Bytes 11.10.2012 21:06:44
AEGEN.DLL : 8.1.6.10 438646 Bytes 15.11.2012 22:57:04
AEEXP.DLL : 8.2.0.10 119158 Bytes 05.11.2012 15:45:15
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 20:55:18
AECORE.DLL : 8.1.29.2 201079 Bytes 07.11.2012 15:44:54
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 15:45:12
AVWINLL.DLL : 12.3.0.15 27344 Bytes 01.05.2012 22:59:21
AVPREF.DLL : 12.3.0.32 50720 Bytes 14.11.2012 22:57:07
AVREP.DLL : 12.3.0.15 179208 Bytes 01.05.2012 22:13:35
AVARKT.DLL : 12.3.0.33 209696 Bytes 14.11.2012 22:57:07
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 01.05.2012 22:28:49
SQLITE3.DLL : 3.7.0.1 398288 Bytes 16.04.2012 21:11:02
AVSMTP.DLL : 12.3.0.32 63480 Bytes 08.08.2012 19:29:26
NETNT.DLL : 12.3.0.15 17104 Bytes 01.05.2012 23:33:29
RCIMAGE.DLL : 12.3.0.31 4444408 Bytes 08.08.2012 19:29:17
RCTEXT.DLL : 12.3.0.32 98848 Bytes 14.11.2012 22:57:06
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: D:\Programme\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, K:, N:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +JOKE,
Beginn des Suchlaufs: Dienstag, 20. November 2012 14:54
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD4
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD5
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'K:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'N:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
[HINWEIS] Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerofa.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'razertra.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerhid.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Windows\Sysnative\drivers\sptd.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Die Registry wurde durchsucht ( '3452' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Windows>
Beginne mit der Suche in 'D:\' <Multimedia>
Beginne mit der Suche in 'K:\' <Extern>
K:\Images Programme\Adobe CS4\Adobe CS4 Premium.7z.001
[WARNUNG] Die Datei konnte nicht gelesen werden!
Beginne mit der Suche in 'N:\'
Der zu durchsuchende Pfad N:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.
Ende des Suchlaufs: Dienstag, 20. November 2012 18:51
Benötigte Zeit: 3:57:29 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
48422 Verzeichnisse wurden überprüft
2304815 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
2304814 Dateien ohne Befall
32023 Archive wurden durchsucht
2 Warnungen
1 Hinweise
895499 Objekte wurden beim Rootkitscan durchsucht
1 Versteckte Objekte wurden gefunden
Code:
ATTFilter OTL logfile created on: 20.11.2012 21:06:52 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = D:\Downloads\Antimalware 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy 4.00 Gb Total Physical Memory | 1.89 Gb Available Physical Memory | 47.25% Memory free 8.00 Gb Paging File | 5.84 Gb Available in Paging File | 72.99% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 99.90 Gb Total Space | 60.48 Gb Free Space | 60.53% Space Free | Partition Type: NTFS Drive D: | 272.61 Gb Total Space | 26.58 Gb Free Space | 9.75% Space Free | Partition Type: NTFS Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive K: | 891.51 Gb Total Space | 181.59 Gb Free Space | 20.37% Space Free | Partition Type: NTFS Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.20 21:04:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Downloads\Antimalware\OTL.exe PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- D:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe PRC - [2012.08.08 20:29:23 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.08.02 08:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd) -- D:\Programme\DAEMON Tools Lite\DTLite.exe PRC - [2009.10.09 19:11:38 | 000,226,816 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe PRC - [2009.03.05 15:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- D:\Programme\Spybot\TeaTimer.exe PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Programme\Spybot\SDWinSec.exe PRC - [2007.02.14 10:11:18 | 000,163,840 | ---- | M] (Razer Inc.) -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerofa.exe PRC - [2007.02.07 15:00:02 | 000,131,072 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe ========== Modules (No Company Name) ========== MOD - [2012.02.20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.02.20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2009.10.09 19:11:38 | 000,226,816 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe MOD - [2007.02.07 15:00:02 | 000,131,072 | ---- | M] () -- D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe ========== Services (SafeList) ========== SRV:64bit: - [2012.09.28 02:38:16 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.10.25 06:41:39 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.10.10 07:02:51 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- D:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe -- (MBAMService) SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.04 14:15:25 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012.05.21 22:41:01 | 000,025,832 | ---- | M] (BioWare) [Auto | Running] -- D:\Spiele\Steam\SteamApps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc) SRV - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.21 02:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.08.18 11:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.08.10 15:01:06 | 000,206,880 | ---- | M] () [Auto | Running] -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp) SRV - [2009.08.10 15:01:04 | 000,626,208 | ---- | M] () [Auto | Running] -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Programme\Spybot\SDWinSec.exe -- (SBSDWSCService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.09.28 03:21:20 | 010,697,216 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.09.28 02:12:52 | 000,460,288 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.06.24 10:20:54 | 000,303,616 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2012.06.24 10:20:54 | 000,035,328 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2012.05.21 16:44:28 | 000,526,392 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2012.05.14 07:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.05.02 14:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.04.27 09:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.04.24 23:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.04.20 02:07:48 | 001,930,240 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.01.15 00:19:10 | 001,101,600 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux) DRV:64bit: - [2009.11.11 14:47:18 | 000,348,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET) DRV:64bit: - [2009.08.21 00:52:10 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2005.11.07 13:33:12 | 000,021,120 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Razerlow.sys -- (Razerlow) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1C A8 96 AF 82 A8 CD 01 [binary data] IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: firefox@ghostery.com:2.8.3 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: D:\Programme\Java\64bit\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Programme\Java\32bit\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2012.05.21 19:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Extensions [2012.10.24 17:16:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions [2012.09.20 09:47:35 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions\firefox@ghostery.com [2012.07.24 23:43:18 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\ot4iz9jl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi O1 HOSTS File: ([2012.07.13 13:00:07 | 000,443,522 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 www.123fporn.info O1 - Hosts: 15233 more lines... O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\64bit\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\64bit\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\32bit\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\32bit\bin\jp2ssv.dll (Oracle Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [NVRaidService] C:\Programme\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Diamondback] D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [DAEMON Tools Lite] D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [Steam] D:\Spiele\Steam\steam.exe (Valve Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Thomas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..Trusted Domains: blank ([]about in Computer) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D798FFB-EC8F-413C-BC0C-E9CA871D27A4}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D45DA220-C9FD-4A87-88B3-1EB6143DA571}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.10.23 07:14:18 | 000,000,107 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\RunGame.exe -- [2004.10.23 07:14:18 | 000,192,512 | R--- | M] (Electronic Arts Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan [2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan [2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp [2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\Program Files\Core Temp [2012.11.18 16:55:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPU-Z [2012.11.15 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\4A Games [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\ATI [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\ATI [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.11.15 16:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD [2012.11.15 16:00:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT [2012.11.15 16:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2012.11.15 16:00:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2012.11.15 15:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2012.11.15 15:58:53 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.11.15 15:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.11.15 15:57:33 | 000,000,000 | ---D | C] -- C:\AMD [2012.11.15 14:41:32 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\4a games [2012.11.12 12:33:34 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Diagnostics [2012.11.08 16:40:07 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Electronic Arts [2012.11.08 16:39:58 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electronic Arts [2012.11.08 16:39:20 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electrontic Arts [2012.11.06 19:50:18 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2012.11.01 10:51:50 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\NFS Underground 2 [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.20 20:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.20 14:46:51 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.20 14:46:51 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.20 14:38:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.20 14:38:42 | 3220,074,496 | -HS- | M] () -- C:\hiberfil.sys [2012.11.20 12:27:42 | 000,000,741 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.18 18:09:15 | 440,077,062 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.11.18 17:45:46 | 000,000,672 | ---- | M] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk [2012.11.18 17:45:45 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo [2012.11.18 16:59:32 | 000,001,387 | ---- | M] () -- C:\Users\Thomas\Desktop\Core Temp.lnk [2012.11.15 16:11:50 | 000,001,017 | ---- | M] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk [2012.11.15 16:07:53 | 000,000,208 | ---- | M] () -- C:\Users\Thomas\Desktop\Metro 2033.url [2012.11.15 16:02:18 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2012.11.15 15:30:08 | 002,274,000 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.15 15:24:39 | 001,663,204 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.11.15 15:24:39 | 000,707,300 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.11.15 15:24:39 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.11.15 15:24:39 | 000,152,892 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.11.15 15:24:39 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.11.08 00:32:40 | 000,000,218 | ---- | M] () -- C:\Users\Thomas\.recently-used.xbel [2012.11.01 10:50:09 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.18 17:45:46 | 000,000,672 | ---- | C] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk [2012.11.18 17:45:45 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo [2012.11.18 16:59:32 | 000,001,387 | ---- | C] () -- C:\Users\Thomas\Desktop\Core Temp.lnk [2012.11.15 16:11:50 | 000,001,017 | ---- | C] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk [2012.11.15 16:07:53 | 000,000,208 | ---- | C] () -- C:\Users\Thomas\Desktop\Metro 2033.url [2012.11.15 16:02:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.11.15 15:22:59 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.15 15:15:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.08 00:32:40 | 000,000,218 | ---- | C] () -- C:\Users\Thomas\.recently-used.xbel [2012.11.06 19:50:12 | 440,077,062 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.11.01 10:50:09 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk [2012.10.21 00:16:44 | 000,001,148 | ---- | C] () -- C:\Users\Thomas\AppData\Roaming\EasyToolz.ini [2012.09.28 02:29:54 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.09.28 02:29:54 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.09.10 08:32:05 | 001,618,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2011.09.28 16:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.08.03 09:04:24 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.minecraft [2012.07.11 19:00:56 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.Nitrous [2012.11.20 13:42:03 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\.purple [2012.08.23 14:19:19 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\DAEMON Tools Lite [2012.11.20 14:39:29 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Dropbox [2012.11.19 00:31:04 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\gtk-2.0 [2012.08.31 06:59:48 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\ICQ [2012.09.14 19:55:01 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\ImgBurn [2012.10.21 01:17:45 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Kalypso Media [2012.05.21 16:43:10 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Opera [2012.07.10 09:51:16 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\pdfforge [2012.09.12 15:21:33 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\runic games [2012.08.31 09:03:26 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\Trillian [2012.09.25 23:44:08 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\wargaming.net [2012.10.18 10:25:09 | 000,000,000 | ---D | M] -- C:\Users\Thomas\AppData\Roaming\WOT Statistics ========== Purity Check ========== < End of report > |
|
21.11.2012, 19:41
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Hallo und
__________________ Zitat:
__________________ |
|
21.11.2012, 19:43
| #3 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Das ist das Image von Photoshop, was ich von der Uni so erhalten habe, aufgeteilt in mehrere Container, inklusive Key für die Nutzung zuhause. Den werde ich hier aber nicht zur Kontrolle reinschreiben.
__________________ Ich dachte mir schon, dass das Fragen aufwerfen würde, konnte den Post aber nicht mehr editieren. Mittlerweile bin ich fertig mit dem Studium, nutze Photoshop privat auch nicht, das Image ist aber nach wie vor noch existent. Geändert von Dirtbag (21.11.2012 um 19:51 Uhr) |
|
21.11.2012, 21:10
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehrZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
21.11.2012, 21:39
| #5 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Das ist mir bewusst. Ich habe es von einem CIP-Pool-Betreuer bekommen, genutzt habe ich es nicht. Mir reichte immer der Vorgänger. Wo er es her hat, weiß ich nicht, habe nie gefragt. Ich wusste ja, dass dieses Image noch irgendwo auf meinem PC rumfliegt - hätte ich es als illegal eingestuft, hätte ich vermutlich meine Log-Files vorher gründlich durchgelesen und dann editiert. So sah ich keine Notwendigkeit dazu und hab sie direkt hochgeladen. Wie dem auch sei: Aufgrund der zugegebenermaßen zweifelhaften Datei fällt mein Post wohl unter die Kategorie "ohne Diskussion Einstellung der Hilfe". Denn schreiben und erzählen kann ich hier viel. Mein Fehler, akzeptiere ich, verstehe ich. Und um ähnliche Vorkommnisse in Zukunft zu vermeiden, ist das Image jetzt außerdem gelöscht. Nichtsdestotrotz würde ich mich freuen, zumindest ein kurzes Statement zu bekommen, ob mein System nun sauber oder nicht sauber ist. Das reicht mir schon. Wenn nicht sauber, setze ich einfach das System neu auf. Danke. |
|
22.11.2012, 12:16
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Ich drück ausnahmsweise nochmal ein Auge zu, schließlich kannst du es ja wirklich "offiziell" von der Uni bekommen haben Zitat:
 Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Note: Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread. Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards. 1. aswMBR Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop. Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button. 2. TDSS-Killer Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs. Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten! 
__________________ --> AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr |
|
22.11.2012, 13:36
| #7 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Danke! Und hier sind die gewünschten Logs. aswMBR Scan-Log: Code:
ATTFilter aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-22 13:16:52
-----------------------------
13:16:52.989 OS Version: Windows x64 6.1.7601 Service Pack 1
13:16:52.989 Number of processors: 4 586 0xF0B
13:16:52.989 ComputerName: BEHEMOTH UserName: Thomas
13:16:53.332 Initialize success
13:16:58.761 AVAST engine defs: 12112200
13:17:08.994 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000063
13:17:08.994 Disk 0 Vendor: WDC_WD40 01.0 Size: 381554MB BusType: 3
13:17:09.010 Disk 0 MBR read successfully
13:17:09.010 Disk 0 MBR scan
13:17:09.010 Disk 0 Windows 7 default MBR code
13:17:09.026 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
13:17:09.041 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 102300 MB offset 206848
13:17:09.057 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 279152 MB offset 209717248
13:17:09.072 Disk 0 scanning C:\Windows\system32\drivers
13:17:18.198 Service scanning
13:17:33.814 Modules scanning
13:17:33.814 Disk 0 trace - called modules:
13:17:33.830 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80048e92c0]<<sptd.sys storport.sys hal.dll nvstor64.sys
13:17:33.830 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c36060]
13:17:33.845 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8003ff5d30]
13:17:33.845 5 ACPI.sys[fffff88000eef7a1] -> nt!IofCallDriver -> \Device\00000063[0xfffffa8003ff49c0]
13:17:33.845 \Driver\nvstor64[0xfffffa80049de9e0] -> IRP_MJ_CREATE -> 0xfffffa80048e92c0
13:17:34.235 AVAST engine scan C:\Windows
13:17:35.514 AVAST engine scan C:\Windows\system32
13:20:07.708 AVAST engine scan C:\Windows\system32\drivers
13:20:16.007 AVAST engine scan C:\Users\Thomas
13:22:41.446 AVAST engine scan C:\ProgramData
13:23:06.827 Scan finished successfully
13:23:34.595 Disk 0 MBR has been saved successfully to "D:\Dokumente\Scan-Logs\MBR.dat"
13:23:34.595 The log file has been saved successfully to "D:\Dokumente\Scan-Logs\aswMBR_scanlog_22112012.txt"
TDSSKiller Scan-Log: Code:
ATTFilter 13:26:00.0726 3952 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 13:26:00.0742 3952 ============================================================ 13:26:00.0742 3952 Current date / time: 2012/11/22 13:26:00.0742 13:26:00.0742 3952 SystemInfo: 13:26:00.0742 3952 13:26:00.0742 3952 OS Version: 6.1.7601 ServicePack: 1.0 13:26:00.0742 3952 Product type: Workstation 13:26:00.0742 3952 ComputerName: BEHEMOTH 13:26:00.0742 3952 UserName: Thomas 13:26:00.0742 3952 Windows directory: C:\Windows 13:26:00.0742 3952 System windows directory: C:\Windows 13:26:00.0742 3952 Running under WOW64 13:26:00.0742 3952 Processor architecture: Intel x64 13:26:00.0742 3952 Number of processors: 4 13:26:00.0742 3952 Page size: 0x1000 13:26:00.0742 3952 Boot type: Normal boot 13:26:00.0742 3952 ============================================================ 13:26:01.0506 3952 Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xC9E1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040 13:26:01.0537 3952 Drive \Device\Harddisk5\DR5 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 13:26:01.0537 3952 ============================================================ 13:26:01.0537 3952 \Device\Harddisk0\DR0: 13:26:01.0553 3952 MBR partitions: 13:26:01.0553 3952 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 13:26:01.0553 3952 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC7CE000 13:26:01.0553 3952 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0xC800800, BlocksNum 0x22138000 13:26:01.0553 3952 \Device\Harddisk5\DR5: 13:26:01.0553 3952 MBR partitions: 13:26:01.0553 3952 \Device\Harddisk5\DR5\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x6F7057F8 13:26:01.0553 3952 \Device\Harddisk5\DR5\Partition2: MBR, Type 0x7, StartLBA 0x6F706000, BlocksNum 0x4FFF800 13:26:01.0553 3952 ============================================================ 13:26:01.0584 3952 C: <-> \Device\Harddisk0\DR0\Partition2 13:26:01.0600 3952 D: <-> \Device\Harddisk0\DR0\Partition3 13:26:01.0600 3952 K: <-> \Device\Harddisk5\DR5\Partition1 13:26:01.0600 3952 ============================================================ 13:26:01.0600 3952 Initialize success 13:26:01.0600 3952 ============================================================ 13:26:28.0260 2924 ============================================================ 13:26:28.0260 2924 Scan started 13:26:28.0260 2924 Mode: Manual; SigCheck; TDLFS; 13:26:28.0260 2924 ============================================================ 13:26:28.0900 2924 ================ Scan system memory ======================== 13:26:28.0900 2924 System memory - ok 13:26:28.0900 2924 ================ Scan services ============================= 13:26:29.0040 2924 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 13:26:29.0118 2924 1394ohci - ok 13:26:29.0181 2924 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 13:26:29.0196 2924 ACPI - ok 13:26:29.0227 2924 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 13:26:29.0290 2924 AcpiPmi - ok 13:26:29.0399 2924 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 13:26:29.0399 2924 AdobeARMservice - ok 13:26:29.0508 2924 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 13:26:29.0508 2924 AdobeFlashPlayerUpdateSvc - ok 13:26:29.0555 2924 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys 13:26:29.0571 2924 adp94xx - ok 13:26:29.0602 2924 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys 13:26:29.0617 2924 adpahci - ok 13:26:29.0617 2924 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys 13:26:29.0633 2924 adpu320 - ok 13:26:29.0649 2924 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 13:26:29.0773 2924 AeLookupSvc - ok 13:26:29.0820 2924 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 13:26:29.0867 2924 AFD - ok 13:26:29.0898 2924 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 13:26:29.0914 2924 agp440 - ok 13:26:29.0929 2924 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 13:26:29.0992 2924 ALG - ok 13:26:29.0992 2924 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 13:26:30.0007 2924 aliide - ok 13:26:30.0039 2924 [ 4C1E3649C89C7D542CD18ECC5210099D ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe 13:26:30.0117 2924 AMD External Events Utility - ok 13:26:30.0132 2924 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 13:26:30.0148 2924 amdide - ok 13:26:30.0148 2924 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys 13:26:30.0195 2924 AmdK8 - ok 13:26:30.0475 2924 [ A3C0A15B39F979E8F3EABA901D72ECD7 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys 13:26:30.0787 2924 amdkmdag - ok 13:26:30.0850 2924 [ 20F3CD38B107C1BD747C0EA37D450165 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys 13:26:30.0881 2924 amdkmdap - ok 13:26:30.0897 2924 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 13:26:30.0928 2924 AmdPPM - ok 13:26:30.0943 2924 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 13:26:30.0959 2924 amdsata - ok 13:26:30.0990 2924 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys 13:26:30.0990 2924 amdsbs - ok 13:26:31.0006 2924 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 13:26:31.0021 2924 amdxata - ok 13:26:31.0068 2924 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService D:\Programme\Avira\AntiVir Desktop\sched.exe 13:26:31.0099 2924 AntiVirSchedulerService - ok 13:26:31.0115 2924 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService D:\Programme\Avira\AntiVir Desktop\avguard.exe 13:26:31.0131 2924 AntiVirService - ok 13:26:31.0162 2924 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 13:26:31.0333 2924 AppID - ok 13:26:31.0349 2924 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 13:26:31.0380 2924 AppIDSvc - ok 13:26:31.0411 2924 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 13:26:31.0458 2924 Appinfo - ok 13:26:31.0489 2924 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 13:26:31.0489 2924 Apple Mobile Device - ok 13:26:31.0536 2924 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll 13:26:31.0599 2924 AppMgmt - ok 13:26:31.0614 2924 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys 13:26:31.0630 2924 arc - ok 13:26:31.0645 2924 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys 13:26:31.0645 2924 arcsas - ok 13:26:31.0723 2924 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 13:26:31.0786 2924 aspnet_state - ok 13:26:31.0801 2924 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 13:26:31.0848 2924 AsyncMac - ok 13:26:31.0879 2924 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 13:26:31.0879 2924 atapi - ok 13:26:31.0973 2924 [ EA0AF9B866DF07E8FE6C2342585788B0 ] athur C:\Windows\system32\DRIVERS\athurx.sys 13:26:32.0067 2924 athur - ok 13:26:32.0129 2924 [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys 13:26:32.0160 2924 AtiHDAudioService - ok 13:26:32.0207 2924 [ 4AEF9EC86818375495FB78CA58DF4E18 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys 13:26:32.0223 2924 atksgt ( UnsignedFile.Multi.Generic ) - warning 13:26:32.0223 2924 atksgt - detected UnsignedFile.Multi.Generic (1) 13:26:32.0285 2924 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 13:26:32.0363 2924 AudioEndpointBuilder - ok 13:26:32.0394 2924 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 13:26:32.0425 2924 AudioSrv - ok 13:26:32.0457 2924 [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys 13:26:32.0472 2924 avgntflt - ok 13:26:32.0472 2924 [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys 13:26:32.0488 2924 avipbb - ok 13:26:32.0503 2924 [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys 13:26:32.0519 2924 avkmgr - ok 13:26:32.0550 2924 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 13:26:32.0613 2924 AxInstSV - ok 13:26:32.0659 2924 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys 13:26:32.0691 2924 b06bdrv - ok 13:26:32.0722 2924 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 13:26:32.0753 2924 b57nd60a - ok 13:26:32.0784 2924 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 13:26:32.0800 2924 BDESVC - ok 13:26:32.0815 2924 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 13:26:32.0847 2924 Beep - ok 13:26:32.0925 2924 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 13:26:32.0971 2924 BFE - ok 13:26:33.0034 2924 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll 13:26:33.0096 2924 BITS - ok 13:26:33.0127 2924 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 13:26:33.0143 2924 blbdrive - ok 13:26:33.0205 2924 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 13:26:33.0221 2924 Bonjour Service - ok 13:26:33.0252 2924 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 13:26:33.0299 2924 bowser - ok 13:26:33.0315 2924 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys 13:26:33.0361 2924 BrFiltLo - ok 13:26:33.0377 2924 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys 13:26:33.0393 2924 BrFiltUp - ok 13:26:33.0424 2924 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 13:26:33.0439 2924 Browser - ok 13:26:33.0455 2924 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 13:26:33.0517 2924 Brserid - ok 13:26:33.0517 2924 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 13:26:33.0549 2924 BrSerWdm - ok 13:26:33.0549 2924 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 13:26:33.0580 2924 BrUsbMdm - ok 13:26:33.0595 2924 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 13:26:33.0611 2924 BrUsbSer - ok 13:26:33.0611 2924 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys 13:26:33.0642 2924 BTHMODEM - ok 13:26:33.0658 2924 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 13:26:33.0705 2924 bthserv - ok 13:26:33.0720 2924 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 13:26:33.0767 2924 cdfs - ok 13:26:33.0814 2924 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\drivers\cdrom.sys 13:26:33.0845 2924 cdrom - ok 13:26:33.0876 2924 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 13:26:33.0923 2924 CertPropSvc - ok 13:26:33.0939 2924 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys 13:26:33.0954 2924 circlass - ok 13:26:33.0970 2924 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 13:26:33.0985 2924 CLFS - ok 13:26:34.0032 2924 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 13:26:34.0032 2924 clr_optimization_v2.0.50727_32 - ok 13:26:34.0079 2924 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 13:26:34.0079 2924 clr_optimization_v2.0.50727_64 - ok 13:26:34.0141 2924 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 13:26:34.0266 2924 clr_optimization_v4.0.30319_32 - ok 13:26:34.0282 2924 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 13:26:34.0297 2924 clr_optimization_v4.0.30319_64 - ok 13:26:34.0329 2924 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 13:26:34.0329 2924 CmBatt - ok 13:26:34.0344 2924 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 13:26:34.0360 2924 cmdide - ok 13:26:34.0391 2924 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 13:26:34.0438 2924 CNG - ok 13:26:34.0453 2924 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 13:26:34.0469 2924 Compbatt - ok 13:26:34.0500 2924 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 13:26:34.0516 2924 CompositeBus - ok 13:26:34.0547 2924 COMSysApp - ok 13:26:34.0547 2924 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys 13:26:34.0563 2924 crcdisk - ok 13:26:34.0578 2924 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll 13:26:34.0625 2924 CryptSvc - ok 13:26:34.0687 2924 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys 13:26:34.0719 2924 CSC - ok 13:26:34.0765 2924 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll 13:26:34.0797 2924 CscService - ok 13:26:34.0906 2924 [ 914A7156B0C0F10BE645A02E13F576B2 ] DAUpdaterSvc D:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe 13:26:34.0921 2924 DAUpdaterSvc - ok 13:26:34.0968 2924 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 13:26:35.0015 2924 DcomLaunch - ok 13:26:35.0062 2924 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 13:26:35.0109 2924 defragsvc - ok 13:26:35.0140 2924 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 13:26:35.0187 2924 DfsC - ok 13:26:35.0202 2924 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 13:26:35.0249 2924 Dhcp - ok 13:26:35.0265 2924 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 13:26:35.0296 2924 discache - ok 13:26:35.0311 2924 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys 13:26:35.0327 2924 Disk - ok 13:26:35.0343 2924 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 13:26:35.0389 2924 Dnscache - ok 13:26:35.0421 2924 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 13:26:35.0452 2924 dot3svc - ok 13:26:35.0483 2924 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 13:26:35.0530 2924 DPS - ok 13:26:35.0545 2924 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 13:26:35.0577 2924 drmkaud - ok 13:26:35.0639 2924 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 13:26:35.0670 2924 DXGKrnl - ok 13:26:35.0701 2924 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 13:26:35.0733 2924 EapHost - ok 13:26:35.0826 2924 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys 13:26:35.0935 2924 ebdrv - ok 13:26:35.0982 2924 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 13:26:36.0029 2924 EFS - ok 13:26:36.0076 2924 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 13:26:36.0123 2924 ehRecvr - ok 13:26:36.0154 2924 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 13:26:36.0185 2924 ehSched - ok 13:26:36.0232 2924 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys 13:26:36.0263 2924 elxstor - ok 13:26:36.0263 2924 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 13:26:36.0279 2924 ErrDev - ok 13:26:36.0310 2924 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 13:26:36.0357 2924 EventSystem - ok 13:26:36.0372 2924 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 13:26:36.0403 2924 exfat - ok 13:26:36.0419 2924 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 13:26:36.0466 2924 fastfat - ok 13:26:36.0528 2924 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 13:26:36.0575 2924 Fax - ok 13:26:36.0575 2924 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys 13:26:36.0606 2924 fdc - ok 13:26:36.0606 2924 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 13:26:36.0653 2924 fdPHost - ok 13:26:36.0669 2924 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 13:26:36.0700 2924 FDResPub - ok 13:26:36.0715 2924 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 13:26:36.0715 2924 FileInfo - ok 13:26:36.0731 2924 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 13:26:36.0778 2924 Filetrace - ok 13:26:36.0840 2924 [ 227846995AFEEFA70D328BF5334A86A5 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 13:26:36.0871 2924 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning 13:26:36.0871 2924 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1) 13:26:36.0887 2924 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 13:26:36.0887 2924 flpydisk - ok 13:26:36.0918 2924 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 13:26:36.0934 2924 FltMgr - ok 13:26:36.0996 2924 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 13:26:37.0059 2924 FontCache - ok 13:26:37.0105 2924 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 13:26:37.0105 2924 FontCache3.0.0.0 - ok 13:26:37.0183 2924 [ 52B58A46BEEFB238C580B69FD051CB5B ] ForceWare Intelligent Application Manager (IAM) D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe 13:26:37.0215 2924 ForceWare Intelligent Application Manager (IAM) - ok 13:26:37.0230 2924 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 13:26:37.0246 2924 FsDepends - ok 13:26:37.0261 2924 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 13:26:37.0277 2924 Fs_Rec - ok 13:26:37.0308 2924 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 13:26:37.0324 2924 fvevol - ok 13:26:37.0339 2924 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys 13:26:37.0355 2924 gagp30kx - ok 13:26:37.0371 2924 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 13:26:37.0386 2924 GEARAspiWDM - ok 13:26:37.0449 2924 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 13:26:37.0495 2924 gpsvc - ok 13:26:37.0542 2924 [ C1B577B2169900F4CF7190C39F085794 ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe 13:26:37.0542 2924 gusvc - ok 13:26:37.0558 2924 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 13:26:37.0605 2924 hcw85cir - ok 13:26:37.0651 2924 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 13:26:37.0683 2924 HdAudAddService - ok 13:26:37.0714 2924 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys 13:26:37.0729 2924 HDAudBus - ok 13:26:37.0745 2924 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys 13:26:37.0761 2924 HidBatt - ok 13:26:37.0776 2924 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys 13:26:37.0792 2924 HidBth - ok 13:26:37.0807 2924 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys 13:26:37.0823 2924 HidIr - ok 13:26:37.0839 2924 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll 13:26:37.0885 2924 hidserv - ok 13:26:37.0948 2924 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\drivers\hidusb.sys 13:26:37.0948 2924 HidUsb - ok 13:26:37.0979 2924 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 13:26:38.0026 2924 hkmsvc - ok 13:26:38.0057 2924 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 13:26:38.0104 2924 HomeGroupListener - ok 13:26:38.0119 2924 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 13:26:38.0151 2924 HomeGroupProvider - ok 13:26:38.0182 2924 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 13:26:38.0197 2924 HpSAMD - ok 13:26:38.0275 2924 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 13:26:38.0322 2924 HTTP - ok 13:26:38.0338 2924 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 13:26:38.0353 2924 hwpolicy - ok 13:26:38.0385 2924 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 13:26:38.0400 2924 i8042prt - ok 13:26:38.0416 2924 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 13:26:38.0431 2924 iaStorV - ok 13:26:38.0494 2924 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 13:26:38.0525 2924 idsvc - ok 13:26:38.0541 2924 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys 13:26:38.0556 2924 iirsp - ok 13:26:38.0603 2924 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 13:26:38.0650 2924 IKEEXT - ok 13:26:38.0775 2924 [ A5F7CEF8A939EBE270462EDEFD629F20 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys 13:26:38.0884 2924 IntcAzAudAddService - ok 13:26:38.0884 2924 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 13:26:38.0899 2924 intelide - ok 13:26:38.0915 2924 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 13:26:38.0946 2924 intelppm - ok 13:26:38.0962 2924 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 13:26:39.0009 2924 IPBusEnum - ok 13:26:39.0040 2924 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 13:26:39.0071 2924 IpFilterDriver - ok 13:26:39.0133 2924 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 13:26:39.0196 2924 iphlpsvc - ok 13:26:39.0211 2924 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 13:26:39.0227 2924 IPMIDRV - ok 13:26:39.0243 2924 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 13:26:39.0274 2924 IPNAT - ok 13:26:39.0336 2924 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 13:26:39.0383 2924 iPod Service - ok 13:26:39.0399 2924 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 13:26:39.0477 2924 IRENUM - ok 13:26:39.0492 2924 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 13:26:39.0508 2924 isapnp - ok 13:26:39.0523 2924 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 13:26:39.0539 2924 iScsiPrt - ok 13:26:39.0570 2924 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 13:26:39.0570 2924 kbdclass - ok 13:26:39.0601 2924 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 13:26:39.0617 2924 kbdhid - ok 13:26:39.0633 2924 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 13:26:39.0648 2924 KeyIso - ok 13:26:39.0664 2924 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 13:26:39.0679 2924 KSecDD - ok 13:26:39.0711 2924 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 13:26:39.0726 2924 KSecPkg - ok 13:26:39.0742 2924 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 13:26:39.0773 2924 ksthunk - ok 13:26:39.0804 2924 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 13:26:39.0851 2924 KtmRm - ok 13:26:39.0851 2924 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll 13:26:39.0898 2924 LanmanServer - ok 13:26:39.0929 2924 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 13:26:39.0976 2924 LanmanWorkstation - ok 13:26:40.0007 2924 [ B658B7076B1ACAA5876524595630F183 ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys 13:26:40.0023 2924 lirsgt ( UnsignedFile.Multi.Generic ) - warning 13:26:40.0023 2924 lirsgt - detected UnsignedFile.Multi.Generic (1) 13:26:40.0038 2924 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 13:26:40.0069 2924 lltdio - ok 13:26:40.0101 2924 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 13:26:40.0163 2924 lltdsvc - ok 13:26:40.0179 2924 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 13:26:40.0210 2924 lmhosts - ok 13:26:40.0225 2924 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys 13:26:40.0241 2924 LSI_FC - ok 13:26:40.0241 2924 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys 13:26:40.0257 2924 LSI_SAS - ok 13:26:40.0272 2924 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys 13:26:40.0272 2924 LSI_SAS2 - ok 13:26:40.0288 2924 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys 13:26:40.0303 2924 LSI_SCSI - ok 13:26:40.0319 2924 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 13:26:40.0350 2924 luafv - ok 13:26:40.0397 2924 [ A8FE8F2783B2929B56F5370A89356CE9 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys 13:26:40.0413 2924 MBAMProtector - ok 13:26:40.0475 2924 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler D:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe 13:26:40.0491 2924 MBAMScheduler - ok 13:26:40.0553 2924 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService D:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe 13:26:40.0569 2924 MBAMService - ok 13:26:40.0600 2924 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 13:26:40.0631 2924 Mcx2Svc - ok 13:26:40.0693 2924 [ 7CF1B716372B89568AE4C0FE769F5869 ] MDM C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe 13:26:40.0709 2924 MDM ( UnsignedFile.Multi.Generic ) - warning 13:26:40.0709 2924 MDM - detected UnsignedFile.Multi.Generic (1) 13:26:40.0709 2924 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys 13:26:40.0725 2924 megasas - ok 13:26:40.0740 2924 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys 13:26:40.0756 2924 MegaSR - ok 13:26:40.0787 2924 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 13:26:40.0818 2924 MMCSS - ok 13:26:40.0834 2924 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 13:26:40.0865 2924 Modem - ok 13:26:40.0896 2924 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 13:26:40.0927 2924 monitor - ok 13:26:40.0943 2924 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 13:26:40.0959 2924 mouclass - ok 13:26:40.0990 2924 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 13:26:41.0005 2924 mouhid - ok 13:26:41.0037 2924 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 13:26:41.0052 2924 mountmgr - ok 13:26:41.0083 2924 [ 96AA8BA23142CC8E2B30F3CAE0C80254 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 13:26:41.0083 2924 MozillaMaintenance - ok 13:26:41.0115 2924 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 13:26:41.0115 2924 mpio - ok 13:26:41.0130 2924 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 13:26:41.0177 2924 mpsdrv - ok 13:26:41.0239 2924 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 13:26:41.0286 2924 MpsSvc - ok 13:26:41.0317 2924 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 13:26:41.0349 2924 MRxDAV - ok 13:26:41.0380 2924 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 13:26:41.0411 2924 mrxsmb - ok 13:26:41.0427 2924 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 13:26:41.0458 2924 mrxsmb10 - ok 13:26:41.0473 2924 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 13:26:41.0489 2924 mrxsmb20 - ok 13:26:41.0505 2924 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 13:26:41.0520 2924 msahci - ok 13:26:41.0536 2924 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 13:26:41.0551 2924 msdsm - ok 13:26:41.0551 2924 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 13:26:41.0583 2924 MSDTC - ok 13:26:41.0614 2924 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 13:26:41.0629 2924 Msfs - ok 13:26:41.0645 2924 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 13:26:41.0676 2924 mshidkmdf - ok 13:26:41.0707 2924 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 13:26:41.0723 2924 msisadrv - ok 13:26:41.0754 2924 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 13:26:41.0785 2924 MSiSCSI - ok 13:26:41.0785 2924 msiserver - ok 13:26:41.0817 2924 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 13:26:41.0848 2924 MSKSSRV - ok 13:26:41.0863 2924 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 13:26:41.0895 2924 MSPCLOCK - ok 13:26:41.0910 2924 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 13:26:41.0941 2924 MSPQM - ok 13:26:41.0973 2924 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 13:26:41.0988 2924 MsRPC - ok 13:26:42.0004 2924 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 13:26:42.0019 2924 mssmbios - ok 13:26:42.0019 2924 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 13:26:42.0066 2924 MSTEE - ok 13:26:42.0066 2924 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys 13:26:42.0082 2924 MTConfig - ok 13:26:42.0097 2924 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 13:26:42.0113 2924 Mup - ok 13:26:42.0160 2924 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 13:26:42.0207 2924 napagent - ok 13:26:42.0222 2924 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 13:26:42.0253 2924 NativeWifiP - ok 13:26:42.0316 2924 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 13:26:42.0363 2924 NDIS - ok 13:26:42.0378 2924 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 13:26:42.0409 2924 NdisCap - ok 13:26:42.0425 2924 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 13:26:42.0456 2924 NdisTapi - ok 13:26:42.0487 2924 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 13:26:42.0519 2924 Ndisuio - ok 13:26:42.0534 2924 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 13:26:42.0581 2924 NdisWan - ok 13:26:42.0612 2924 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 13:26:42.0659 2924 NDProxy - ok 13:26:42.0675 2924 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 13:26:42.0721 2924 NetBIOS - ok 13:26:42.0753 2924 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 13:26:42.0784 2924 NetBT - ok 13:26:42.0799 2924 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 13:26:42.0815 2924 Netlogon - ok 13:26:42.0846 2924 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 13:26:42.0877 2924 Netman - ok 13:26:42.0940 2924 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 13:26:42.0940 2924 NetMsmqActivator - ok 13:26:42.0971 2924 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 13:26:42.0971 2924 NetPipeActivator - ok 13:26:43.0002 2924 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 13:26:43.0033 2924 netprofm - ok 13:26:43.0096 2924 [ E005682AE8F8EC4EB05F2A70A16EA1C5 ] netr28ux C:\Windows\system32\DRIVERS\netr28ux.sys 13:26:43.0143 2924 netr28ux - ok 13:26:43.0158 2924 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 13:26:43.0174 2924 NetTcpActivator - ok 13:26:43.0174 2924 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 13:26:43.0189 2924 NetTcpPortSharing - ok 13:26:43.0189 2924 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys 13:26:43.0205 2924 nfrd960 - ok 13:26:43.0236 2924 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll 13:26:43.0252 2924 NlaSvc - ok 13:26:43.0283 2924 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 13:26:43.0299 2924 Npfs - ok 13:26:43.0314 2924 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 13:26:43.0361 2924 nsi - ok 13:26:43.0377 2924 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 13:26:43.0408 2924 nsiproxy - ok 13:26:43.0439 2924 [ 20E179A7FE78B37A02D30C4D34C870E7 ] nSvcIp D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe 13:26:43.0455 2924 nSvcIp - ok 13:26:43.0533 2924 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 13:26:43.0595 2924 Ntfs - ok 13:26:43.0611 2924 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 13:26:43.0642 2924 Null - ok 13:26:43.0689 2924 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys 13:26:43.0720 2924 NVENETFD - ok 13:26:43.0735 2924 nvlddmkm - ok 13:26:43.0767 2924 [ C42C32BF90A78D72D4B7C144FF907FB6 ] NVNET C:\Windows\system32\DRIVERS\nvmf6264.sys 13:26:43.0782 2924 NVNET - ok 13:26:43.0829 2924 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 13:26:43.0829 2924 nvraid - ok 13:26:43.0860 2924 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 13:26:43.0860 2924 nvstor - ok 13:26:43.0876 2924 [ 71B6ECD3C56FBF12FB1968DA3953B703 ] nvstor64 C:\Windows\system32\DRIVERS\nvstor64.sys 13:26:43.0891 2924 nvstor64 - ok 13:26:43.0907 2924 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 13:26:43.0907 2924 nv_agp - ok 13:26:43.0969 2924 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 13:26:43.0985 2924 odserv - ok 13:26:44.0016 2924 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 13:26:44.0032 2924 ohci1394 - ok 13:26:44.0063 2924 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 13:26:44.0079 2924 ose - ok 13:26:44.0094 2924 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 13:26:44.0125 2924 p2pimsvc - ok 13:26:44.0157 2924 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 13:26:44.0172 2924 p2psvc - ok 13:26:44.0188 2924 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 13:26:44.0203 2924 Parport - ok 13:26:44.0235 2924 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 13:26:44.0235 2924 partmgr - ok 13:26:44.0266 2924 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 13:26:44.0281 2924 PcaSvc - ok 13:26:44.0297 2924 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 13:26:44.0313 2924 pci - ok 13:26:44.0344 2924 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 13:26:44.0344 2924 pciide - ok 13:26:44.0375 2924 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys 13:26:44.0391 2924 pcmcia - ok 13:26:44.0391 2924 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 13:26:44.0406 2924 pcw - ok 13:26:44.0453 2924 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 13:26:44.0500 2924 PEAUTH - ok 13:26:44.0562 2924 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll 13:26:44.0656 2924 PeerDistSvc - ok 13:26:44.0718 2924 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 13:26:44.0734 2924 PerfHost - ok 13:26:44.0812 2924 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 13:26:44.0890 2924 pla - ok 13:26:44.0968 2924 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 13:26:44.0983 2924 PlugPlay - ok 13:26:44.0999 2924 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 13:26:45.0030 2924 PNRPAutoReg - ok 13:26:45.0046 2924 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 13:26:45.0061 2924 PNRPsvc - ok 13:26:45.0093 2924 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 13:26:45.0139 2924 PolicyAgent - ok 13:26:45.0155 2924 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 13:26:45.0202 2924 Power - ok 13:26:45.0217 2924 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 13:26:45.0249 2924 PptpMiniport - ok 13:26:45.0264 2924 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys 13:26:45.0280 2924 Processor - ok 13:26:45.0295 2924 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 13:26:45.0342 2924 ProfSvc - ok 13:26:45.0358 2924 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 13:26:45.0358 2924 ProtectedStorage - ok 13:26:45.0405 2924 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 13:26:45.0436 2924 Psched - ok 13:26:45.0514 2924 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys 13:26:45.0576 2924 ql2300 - ok 13:26:45.0592 2924 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys 13:26:45.0607 2924 ql40xx - ok 13:26:45.0639 2924 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 13:26:45.0670 2924 QWAVE - ok 13:26:45.0685 2924 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 13:26:45.0701 2924 QWAVEdrv - ok 13:26:45.0732 2924 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 13:26:45.0763 2924 RasAcd - ok 13:26:45.0779 2924 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 13:26:45.0810 2924 RasAgileVpn - ok 13:26:45.0826 2924 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 13:26:45.0873 2924 RasAuto - ok 13:26:45.0904 2924 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 13:26:45.0935 2924 Rasl2tp - ok 13:26:45.0966 2924 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 13:26:46.0013 2924 RasMan - ok 13:26:46.0029 2924 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 13:26:46.0075 2924 RasPppoe - ok 13:26:46.0091 2924 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 13:26:46.0122 2924 RasSstp - ok 13:26:46.0153 2924 [ 81DDBF4FE998EF1F4BA230F7E8D8C67E ] Razerlow C:\Windows\system32\drivers\Razerlow.sys 13:26:46.0185 2924 Razerlow - ok 13:26:46.0216 2924 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 13:26:46.0247 2924 rdbss - ok 13:26:46.0263 2924 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 13:26:46.0278 2924 rdpbus - ok 13:26:46.0294 2924 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 13:26:46.0325 2924 RDPCDD - ok 13:26:46.0341 2924 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys 13:26:46.0387 2924 RDPDR - ok 13:26:46.0403 2924 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 13:26:46.0434 2924 RDPENCDD - ok 13:26:46.0450 2924 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 13:26:46.0481 2924 RDPREFMP - ok 13:26:46.0512 2924 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 13:26:46.0559 2924 RDPWD - ok 13:26:46.0575 2924 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 13:26:46.0590 2924 rdyboost - ok 13:26:46.0621 2924 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 13:26:46.0653 2924 RemoteAccess - ok 13:26:46.0684 2924 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 13:26:46.0731 2924 RemoteRegistry - ok 13:26:46.0746 2924 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 13:26:46.0793 2924 RpcEptMapper - ok 13:26:46.0809 2924 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 13:26:46.0840 2924 RpcLocator - ok 13:26:46.0887 2924 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 13:26:46.0918 2924 RpcSs - ok 13:26:46.0933 2924 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 13:26:46.0980 2924 rspndr - ok 13:26:46.0996 2924 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys 13:26:47.0027 2924 s3cap - ok 13:26:47.0043 2924 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 13:26:47.0058 2924 SamSs - ok 13:26:47.0074 2924 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 13:26:47.0089 2924 sbp2port - ok 13:26:47.0167 2924 [ 794D4B48DFB6E999537C7C3947863463 ] SBSDWSCService D:\Programme\Spybot\SDWinSec.exe 13:26:47.0199 2924 SBSDWSCService - ok 13:26:47.0230 2924 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 13:26:47.0277 2924 SCardSvr - ok 13:26:47.0292 2924 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 13:26:47.0339 2924 scfilter - ok 13:26:47.0401 2924 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 13:26:47.0464 2924 Schedule - ok 13:26:47.0479 2924 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 13:26:47.0511 2924 SCPolicySvc - ok 13:26:47.0542 2924 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 13:26:47.0589 2924 SDRSVC - ok 13:26:47.0604 2924 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 13:26:47.0651 2924 secdrv - ok 13:26:47.0667 2924 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 13:26:47.0698 2924 seclogon - ok 13:26:47.0729 2924 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll 13:26:47.0760 2924 SENS - ok 13:26:47.0760 2924 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 13:26:47.0791 2924 SensrSvc - ok 13:26:47.0807 2924 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 13:26:47.0807 2924 Serenum - ok 13:26:47.0838 2924 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 13:26:47.0838 2924 Serial - ok 13:26:47.0854 2924 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys 13:26:47.0869 2924 sermouse - ok 13:26:47.0901 2924 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 13:26:47.0947 2924 SessionEnv - ok 13:26:47.0963 2924 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 13:26:48.0010 2924 sffdisk - ok 13:26:48.0025 2924 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 13:26:48.0041 2924 sffp_mmc - ok 13:26:48.0041 2924 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 13:26:48.0072 2924 sffp_sd - ok 13:26:48.0088 2924 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys 13:26:48.0103 2924 sfloppy - ok 13:26:48.0135 2924 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 13:26:48.0181 2924 SharedAccess - ok 13:26:48.0213 2924 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 13:26:48.0244 2924 ShellHWDetection - ok 13:26:48.0259 2924 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys 13:26:48.0275 2924 SiSRaid2 - ok 13:26:48.0291 2924 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys 13:26:48.0291 2924 SiSRaid4 - ok 13:26:48.0337 2924 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate D:\Programme\Skype\Updater\Updater.exe 13:26:48.0353 2924 SkypeUpdate - ok 13:26:48.0369 2924 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 13:26:48.0415 2924 Smb - ok 13:26:48.0431 2924 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 13:26:48.0447 2924 SNMPTRAP - ok 13:26:48.0478 2924 [ 12583AF6CBE0050651EAF2723B3AD7B3 ] speedfan C:\Windows\syswow64\speedfan.sys 13:26:48.0493 2924 speedfan - ok 13:26:48.0509 2924 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 13:26:48.0525 2924 spldr - ok 13:26:48.0571 2924 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 13:26:48.0634 2924 Spooler - ok 13:26:48.0743 2924 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 13:26:48.0868 2924 sppsvc - ok 13:26:48.0883 2924 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 13:26:48.0915 2924 sppuinotify - ok 13:26:48.0977 2924 [ A6CFF1AF7664627A296B6A0A96CF876E ] sptd C:\Windows\System32\Drivers\sptd.sys 13:26:48.0977 2924 Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: A6CFF1AF7664627A296B6A0A96CF876E 13:26:48.0977 2924 sptd ( LockedFile.Multi.Generic ) - warning 13:26:48.0977 2924 sptd - detected LockedFile.Multi.Generic (1) 13:26:49.0024 2924 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 13:26:49.0055 2924 srv - ok 13:26:49.0086 2924 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 13:26:49.0102 2924 srv2 - ok 13:26:49.0133 2924 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 13:26:49.0164 2924 srvnet - ok 13:26:49.0180 2924 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 13:26:49.0211 2924 SSDPSRV - ok 13:26:49.0227 2924 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 13:26:49.0258 2924 SstpSvc - ok 13:26:49.0273 2924 Steam Client Service - ok 13:26:49.0289 2924 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys 13:26:49.0289 2924 stexstor - ok 13:26:49.0320 2924 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys 13:26:49.0336 2924 StillCam - ok 13:26:49.0398 2924 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 13:26:49.0445 2924 stisvc - ok 13:26:49.0461 2924 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys 13:26:49.0476 2924 storflt - ok 13:26:49.0492 2924 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll 13:26:49.0539 2924 StorSvc - ok 13:26:49.0554 2924 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys 13:26:49.0554 2924 storvsc - ok 13:26:49.0585 2924 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys 13:26:49.0601 2924 swenum - ok 13:26:49.0632 2924 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 13:26:49.0679 2924 swprv - ok 13:26:49.0773 2924 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 13:26:49.0851 2924 SysMain - ok 13:26:49.0866 2924 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 13:26:49.0897 2924 TabletInputService - ok 13:26:49.0929 2924 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 13:26:49.0960 2924 TapiSrv - ok 13:26:49.0975 2924 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 13:26:50.0038 2924 TBS - ok 13:26:50.0116 2924 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 13:26:50.0194 2924 Tcpip - ok 13:26:50.0256 2924 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 13:26:50.0287 2924 TCPIP6 - ok 13:26:50.0303 2924 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 13:26:50.0319 2924 tcpipreg - ok 13:26:50.0334 2924 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 13:26:50.0397 2924 TDPIPE - ok 13:26:50.0412 2924 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 13:26:50.0428 2924 TDTCP - ok 13:26:50.0459 2924 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 13:26:50.0490 2924 tdx - ok 13:26:50.0490 2924 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys 13:26:50.0506 2924 TermDD - ok 13:26:50.0553 2924 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 13:26:50.0615 2924 TermService - ok 13:26:50.0631 2924 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 13:26:50.0662 2924 Themes - ok 13:26:50.0677 2924 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 13:26:50.0709 2924 THREADORDER - ok 13:26:50.0724 2924 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 13:26:50.0755 2924 TrkWks - ok 13:26:50.0802 2924 [ 370A6907DDF79532A39319492B1FA38A ] truecrypt C:\Windows\system32\drivers\truecrypt.sys 13:26:50.0818 2924 truecrypt - ok 13:26:50.0865 2924 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 13:26:50.0896 2924 TrustedInstaller - ok 13:26:50.0927 2924 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 13:26:50.0958 2924 tssecsrv - ok 13:26:50.0989 2924 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 13:26:51.0005 2924 TsUsbFlt - ok 13:26:51.0036 2924 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 13:26:51.0083 2924 tunnel - ok 13:26:51.0099 2924 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys 13:26:51.0099 2924 uagp35 - ok 13:26:51.0130 2924 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 13:26:51.0177 2924 udfs - ok 13:26:51.0208 2924 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 13:26:51.0223 2924 UI0Detect - ok 13:26:51.0239 2924 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 13:26:51.0239 2924 uliagpkx - ok 13:26:51.0286 2924 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys 13:26:51.0301 2924 umbus - ok 13:26:51.0301 2924 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys 13:26:51.0317 2924 UmPass - ok 13:26:51.0348 2924 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll 13:26:51.0379 2924 UmRdpService - ok 13:26:51.0395 2924 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 13:26:51.0426 2924 upnphost - ok 13:26:51.0457 2924 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 13:26:51.0489 2924 usbccgp - ok 13:26:51.0520 2924 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 13:26:51.0551 2924 usbcir - ok 13:26:51.0567 2924 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 13:26:51.0582 2924 usbehci - ok 13:26:51.0598 2924 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 13:26:51.0645 2924 usbhub - ok 13:26:51.0660 2924 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys 13:26:51.0660 2924 usbohci - ok 13:26:51.0676 2924 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 13:26:51.0707 2924 usbprint - ok 13:26:51.0707 2924 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 13:26:51.0738 2924 USBSTOR - ok 13:26:51.0754 2924 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 13:26:51.0769 2924 usbuhci - ok 13:26:51.0785 2924 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 13:26:51.0816 2924 UxSms - ok 13:26:51.0816 2924 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 13:26:51.0832 2924 VaultSvc - ok 13:26:51.0832 2924 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 13:26:51.0847 2924 vdrvroot - ok 13:26:51.0894 2924 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 13:26:51.0957 2924 vds - ok 13:26:51.0988 2924 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 13:26:51.0988 2924 vga - ok 13:26:52.0003 2924 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 13:26:52.0050 2924 VgaSave - ok 13:26:52.0066 2924 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 13:26:52.0081 2924 vhdmp - ok 13:26:52.0113 2924 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 13:26:52.0128 2924 viaide - ok 13:26:52.0144 2924 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys 13:26:52.0175 2924 vmbus - ok 13:26:52.0191 2924 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys 13:26:52.0206 2924 VMBusHID - ok 13:26:52.0222 2924 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 13:26:52.0237 2924 volmgr - ok 13:26:52.0284 2924 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 13:26:52.0300 2924 volmgrx - ok 13:26:52.0315 2924 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 13:26:52.0331 2924 volsnap - ok 13:26:52.0362 2924 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys 13:26:52.0378 2924 vsmraid - ok 13:26:52.0440 2924 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 13:26:52.0518 2924 VSS - ok 13:26:52.0534 2924 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys 13:26:52.0565 2924 vwifibus - ok 13:26:52.0581 2924 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys 13:26:52.0612 2924 vwififlt - ok 13:26:52.0627 2924 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 13:26:52.0674 2924 W32Time - ok 13:26:52.0690 2924 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys 13:26:52.0705 2924 WacomPen - ok 13:26:52.0737 2924 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 13:26:52.0768 2924 WANARP - ok 13:26:52.0768 2924 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 13:26:52.0815 2924 Wanarpv6 - ok 13:26:52.0908 2924 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 13:26:52.0955 2924 WatAdminSvc - ok 13:26:53.0033 2924 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 13:26:53.0111 2924 wbengine - ok 13:26:53.0127 2924 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 13:26:53.0142 2924 WbioSrvc - ok 13:26:53.0173 2924 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 13:26:53.0205 2924 wcncsvc - ok 13:26:53.0236 2924 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 13:26:53.0251 2924 WcsPlugInService - ok 13:26:53.0267 2924 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys 13:26:53.0283 2924 Wd - ok 13:26:53.0329 2924 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 13:26:53.0376 2924 Wdf01000 - ok 13:26:53.0376 2924 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 13:26:53.0470 2924 WdiServiceHost - ok 13:26:53.0470 2924 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 13:26:53.0485 2924 WdiSystemHost - ok 13:26:53.0517 2924 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 13:26:53.0548 2924 WebClient - ok 13:26:53.0563 2924 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 13:26:53.0610 2924 Wecsvc - ok 13:26:53.0626 2924 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 13:26:53.0673 2924 wercplsupport - ok 13:26:53.0704 2924 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 13:26:53.0735 2924 WerSvc - ok 13:26:53.0766 2924 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 13:26:53.0797 2924 WfpLwf - ok 13:26:53.0797 2924 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 13:26:53.0813 2924 WIMMount - ok 13:26:53.0829 2924 WinDefend - ok 13:26:53.0829 2924 WinHttpAutoProxySvc - ok 13:26:53.0860 2924 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 13:26:53.0891 2924 Winmgmt - ok 13:26:53.0969 2924 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 13:26:54.0063 2924 WinRM - ok 13:26:54.0125 2924 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 13:26:54.0172 2924 Wlansvc - ok 13:26:54.0312 2924 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 13:26:54.0406 2924 wlidsvc - ok 13:26:54.0421 2924 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 13:26:54.0453 2924 WmiAcpi - ok 13:26:54.0484 2924 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 13:26:54.0499 2924 wmiApSrv - ok 13:26:54.0889 2924 WMPNetworkSvc - ok 13:26:54.0905 2924 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 13:26:54.0921 2924 WPCSvc - ok 13:26:54.0952 2924 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 13:26:54.0967 2924 WPDBusEnum - ok 13:26:54.0983 2924 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 13:26:55.0030 2924 ws2ifsl - ok 13:26:55.0045 2924 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll 13:26:55.0061 2924 wscsvc - ok 13:26:55.0077 2924 WSearch - ok 13:26:55.0170 2924 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 13:26:55.0248 2924 wuauserv - ok 13:26:55.0279 2924 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 13:26:55.0326 2924 WudfPf - ok 13:26:55.0342 2924 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 13:26:55.0373 2924 WUDFRd - ok 13:26:55.0404 2924 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 13:26:55.0420 2924 wudfsvc - ok 13:26:55.0435 2924 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 13:26:55.0451 2924 WwanSvc - ok 13:26:55.0482 2924 [ 2C6BC21B2D5B58D8B1D638C1704CB494 ] xusb21 C:\Windows\system32\DRIVERS\xusb21.sys 13:26:55.0482 2924 xusb21 - ok 13:26:55.0498 2924 ================ Scan global =============================== 13:26:55.0513 2924 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 13:26:55.0560 2924 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 13:26:55.0560 2924 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 13:26:55.0591 2924 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 13:26:55.0607 2924 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 13:26:55.0607 2924 [Global] - ok 13:26:55.0607 2924 ================ Scan MBR ================================== 13:26:55.0623 2924 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 13:26:56.0387 2924 \Device\Harddisk0\DR0 - ok 13:26:56.0403 2924 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk5\DR5 13:26:56.0496 2924 \Device\Harddisk5\DR5 - ok 13:26:56.0496 2924 ================ Scan VBR ================================== 13:26:56.0496 2924 [ 8392D3AEAF8D86C37912A0732F995857 ] \Device\Harddisk0\DR0\Partition1 13:26:56.0496 2924 \Device\Harddisk0\DR0\Partition1 - ok 13:26:56.0527 2924 [ A2D2950B658D5DC18742FA065D917704 ] \Device\Harddisk0\DR0\Partition2 13:26:56.0527 2924 \Device\Harddisk0\DR0\Partition2 - ok 13:26:56.0543 2924 [ 0B3E7C066D9C8741A236C2F5BD1B8472 ] \Device\Harddisk0\DR0\Partition3 13:26:56.0543 2924 \Device\Harddisk0\DR0\Partition3 - ok 13:26:56.0543 2924 [ 5E12B060BA736A1046DE72008453BE42 ] \Device\Harddisk5\DR5\Partition1 13:26:56.0543 2924 \Device\Harddisk5\DR5\Partition1 - ok 13:26:56.0543 2924 [ E66B21EADE3A447C549DDD2FF2AF6572 ] \Device\Harddisk5\DR5\Partition2 13:26:56.0543 2924 \Device\Harddisk5\DR5\Partition2 - ok 13:26:56.0543 2924 ============================================================ 13:26:56.0543 2924 Scan finished 13:26:56.0543 2924 ============================================================ 13:26:56.0559 2328 Detected object count: 5 13:26:56.0559 2328 Actual detected object count: 5 13:27:57.0726 2328 atksgt ( UnsignedFile.Multi.Generic ) - skipped by user 13:27:57.0726 2328 atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:27:57.0726 2328 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user 13:27:57.0726 2328 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:27:57.0726 2328 lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user 13:27:57.0726 2328 lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:27:57.0726 2328 MDM ( UnsignedFile.Multi.Generic ) - skipped by user 13:27:57.0726 2328 MDM ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:27:57.0726 2328 sptd ( LockedFile.Multi.Generic ) - skipped by user 13:27:57.0726 2328 sptd ( LockedFile.Multi.Generic ) - User select action: Skip |
|
22.11.2012, 14:11
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Ist unauffällig adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop. Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.11.2012, 14:24
| #9 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Das Scan-Log von adwCleaner: Code:
ATTFilter # AdwCleaner v2.008 - Datei am 22/11/2012 um 14:18:12 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Thomas - BEHEMOTH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Thomas\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\Users\Thomas\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v12.0 (de)
Profilname : default
Datei : C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\ot4iz9jl.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Opera v [Version kann nicht ermittelt werden]
Datei : C:\Users\Thomas\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [960 octets] - [22/11/2012 14:18:12]
########## EOF - C:\AdwCleaner[R1].txt - [1019 octets] ##########
|
|
22.11.2012, 14:39
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
Danach eine Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.11.2012, 15:16
| #11 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Delete-Log von adwCleaner: Code:
ATTFilter # AdwCleaner v2.008 - Datei am 22/11/2012 um 14:47:21 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Thomas - BEHEMOTH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Thomas\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Users\Thomas\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v12.0 (de)
Profilname : default
Datei : C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\ot4iz9jl.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Opera v [Version kann nicht ermittelt werden]
Datei : C:\Users\Thomas\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [1088 octets] - [22/11/2012 14:18:12]
AdwCleaner[S1].txt - [1022 octets] - [22/11/2012 14:47:21]
########## EOF - C:\AdwCleaner[S1].txt - [1082 octets] ##########
OTL Logfile: Code:
ATTFilter OTL logfile created on: 22.11.2012 14:52:32 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Thomas\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy 4.00 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 63.26% Memory free 8.00 Gb Paging File | 6.28 Gb Available in Paging File | 78.59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 99.90 Gb Total Space | 60.25 Gb Free Space | 60.31% Space Free | Partition Type: NTFS Drive D: | 272.61 Gb Total Space | 26.56 Gb Free Space | 9.74% Space Free | Partition Type: NTFS Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive K: | 891.51 Gb Total Space | 432.46 Gb Free Space | 48.51% Space Free | Partition Type: NTFS Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Thomas\Desktop\OTL.exe (OldTimer Tools) PRC - D:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) PRC - D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe () PRC - D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.) PRC - D:\Programme\Spybot\SDWinSec.exe (Safer Networking Ltd.) PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerofa.exe (Razer Inc.) PRC - D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe () MOD - D:\Programme\Razer\Diamondback\Razer\Diamondback\razertra.exe () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- D:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- D:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (SkypeUpdate) -- D:\Programme\Skype\Updater\Updater.exe (Skype Technologies) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (DAUpdaterSvc) -- D:\Spiele\Steam\SteamApps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe (BioWare) SRV - (AntiVirSchedulerService) -- D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (nSvcIp) -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe () SRV - (ForceWare Intelligent Application Manager (IAM) -- D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe () SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (SBSDWSCService) -- D:\Programme\Spybot\SDWinSec.exe (Safer Networking Ltd.) ========== Driver Services (SafeList) ========== DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (athur) -- C:\Windows\SysNative\drivers\athurx.sys (Atheros Communications, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.) DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation) DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (Razerlow) -- C:\Windows\SysNative\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1C A8 96 AF 82 A8 CD 01 [binary data] IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: firefox@ghostery.com:2.8.3 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: D:\Programme\Java\64bit\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Programme\Java\32bit\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.28 23:35:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2012.05.21 19:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Extensions [2012.11.22 12:19:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions [2012.09.20 09:47:35 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Thomas\AppData\Roaming\mozilla\Firefox\Profiles\ot4iz9jl.default\extensions\firefox@ghostery.com [2012.11.22 12:19:56 | 000,804,737 | ---- | M] () (No name found) -- C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\ot4iz9jl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi O1 HOSTS File: ([2012.11.21 12:13:33 | 000,444,833 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 www.123fporn.info O1 - Hosts: 15276 more lines... O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\64bit\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\64bit\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\32bit\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\32bit\bin\jp2ssv.dll (Oracle Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [NVRaidService] C:\Programme\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Diamondback] D:\Programme\Razer\Diamondback\Razer\Diamondback\razerhid.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [DAEMON Tools Lite] D:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000..\Run: [Steam] D:\Spiele\Steam\steam.exe (Valve Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Thomas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\Programme\nVidia\Network Manager\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2615511845-3995912360-3144667431-1000\..Trusted Domains: blank ([]about in Computer) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D798FFB-EC8F-413C-BC0C-E9CA871D27A4}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D45DA220-C9FD-4A87-88B3-1EB6143DA571}: DhcpNameServer = 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.10.23 07:14:18 | 000,000,107 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{500208c9-a34f-11e1-af0a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\RunGame.exe -- [2004.10.23 07:14:18 | 000,192,512 | R--- | M] (Electronic Arts Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.22 13:25:05 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Thomas\Desktop\tdsskiller.exe [2012.11.22 12:37:19 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\TrueCrypt [2012.11.22 12:35:54 | 000,231,376 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2012.11.22 12:35:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt [2012.11.22 12:25:27 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Thomas\Desktop\aswMBR.exe [2012.11.20 21:04:45 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Thomas\Desktop\OTL.exe [2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan [2012.11.18 17:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan [2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp [2012.11.18 16:59:04 | 000,000,000 | ---D | C] -- C:\Program Files\Core Temp [2012.11.18 16:55:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPU-Z [2012.11.15 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\4A Games [2012.11.15 16:18:49 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll [2012.11.15 16:18:49 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll [2012.11.15 16:18:49 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll [2012.11.15 16:18:49 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll [2012.11.15 16:18:49 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll [2012.11.15 16:18:49 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll [2012.11.15 16:18:49 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll [2012.11.15 16:18:49 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll [2012.11.15 16:18:48 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll [2012.11.15 16:18:48 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll [2012.11.15 16:18:48 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll [2012.11.15 16:18:48 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll [2012.11.15 16:18:46 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll [2012.11.15 16:18:46 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll [2012.11.15 16:18:45 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll [2012.11.15 16:18:45 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll [2012.11.15 16:18:44 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll [2012.11.15 16:18:44 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll [2012.11.15 16:18:42 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll [2012.11.15 16:18:42 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll [2012.11.15 16:18:40 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll [2012.11.15 16:18:40 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll [2012.11.15 16:18:39 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll [2012.11.15 16:18:39 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll [2012.11.15 16:18:39 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll [2012.11.15 16:18:39 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll [2012.11.15 16:18:37 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll [2012.11.15 16:18:37 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll [2012.11.15 16:18:36 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll [2012.11.15 16:18:36 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll [2012.11.15 16:18:36 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll [2012.11.15 16:18:36 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll [2012.11.15 16:18:36 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll [2012.11.15 16:18:36 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll [2012.11.15 16:18:35 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll [2012.11.15 16:18:35 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll [2012.11.15 16:18:34 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll [2012.11.15 16:18:34 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll [2012.11.15 16:18:34 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll [2012.11.15 16:18:34 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll [2012.11.15 16:18:32 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll [2012.11.15 16:18:32 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll [2012.11.15 16:18:32 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll [2012.11.15 16:18:32 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll [2012.11.15 16:18:32 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll [2012.11.15 16:18:32 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll [2012.11.15 16:18:31 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll [2012.11.15 16:18:31 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll [2012.11.15 16:18:31 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll [2012.11.15 16:18:31 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll [2012.11.15 16:18:30 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll [2012.11.15 16:18:30 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll [2012.11.15 16:18:30 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll [2012.11.15 16:18:30 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll [2012.11.15 16:18:29 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll [2012.11.15 16:18:29 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll [2012.11.15 16:18:28 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll [2012.11.15 16:18:28 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2012.11.15 16:18:28 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll [2012.11.15 16:18:28 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2012.11.15 16:18:26 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll [2012.11.15 16:18:26 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2012.11.15 16:18:25 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll [2012.11.15 16:18:25 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll [2012.11.15 16:18:25 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll [2012.11.15 16:18:25 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll [2012.11.15 16:18:24 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll [2012.11.15 16:18:24 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll [2012.11.15 16:18:24 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll [2012.11.15 16:18:24 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll [2012.11.15 16:18:21 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll [2012.11.15 16:18:21 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll [2012.11.15 16:18:21 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll [2012.11.15 16:18:21 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll [2012.11.15 16:18:20 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll [2012.11.15 16:18:20 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll [2012.11.15 16:18:19 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll [2012.11.15 16:18:19 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll [2012.11.15 16:18:19 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll [2012.11.15 16:18:19 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll [2012.11.15 16:18:16 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll [2012.11.15 16:18:16 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll [2012.11.15 16:18:15 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll [2012.11.15 16:18:15 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll [2012.11.15 16:18:14 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll [2012.11.15 16:18:14 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll [2012.11.15 16:18:14 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll [2012.11.15 16:18:14 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll [2012.11.15 16:18:11 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll [2012.11.15 16:18:11 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll [2012.11.15 16:18:11 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll [2012.11.15 16:18:11 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll [2012.11.15 16:18:10 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll [2012.11.15 16:18:10 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll [2012.11.15 16:18:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll [2012.11.15 16:18:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll [2012.11.15 16:18:07 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll [2012.11.15 16:18:07 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll [2012.11.15 16:18:07 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll [2012.11.15 16:18:07 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll [2012.11.15 16:18:07 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll [2012.11.15 16:18:07 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll [2012.11.15 16:18:05 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll [2012.11.15 16:18:05 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll [2012.11.15 16:18:05 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll [2012.11.15 16:18:05 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll [2012.11.15 16:18:04 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll [2012.11.15 16:18:04 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll [2012.11.15 16:18:03 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll [2012.11.15 16:18:03 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll [2012.11.15 16:18:02 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll [2012.11.15 16:18:02 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll [2012.11.15 16:18:02 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll [2012.11.15 16:18:02 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll [2012.11.15 16:18:01 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll [2012.11.15 16:18:01 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll [2012.11.15 16:18:00 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll [2012.11.15 16:18:00 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll [2012.11.15 16:17:59 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll [2012.11.15 16:17:59 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll [2012.11.15 16:17:59 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll [2012.11.15 16:17:59 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll [2012.11.15 16:17:58 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll [2012.11.15 16:17:58 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll [2012.11.15 16:17:58 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll [2012.11.15 16:17:58 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll [2012.11.15 16:17:58 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll [2012.11.15 16:17:58 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll [2012.11.15 16:17:57 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll [2012.11.15 16:17:57 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll [2012.11.15 16:17:56 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll [2012.11.15 16:17:56 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll [2012.11.15 16:17:56 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll [2012.11.15 16:17:56 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll [2012.11.15 16:17:56 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll [2012.11.15 16:17:56 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll [2012.11.15 16:17:55 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll [2012.11.15 16:17:55 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll [2012.11.15 16:17:55 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll [2012.11.15 16:17:55 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll [2012.11.15 16:17:50 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll [2012.11.15 16:17:50 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll [2012.11.15 16:17:49 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll [2012.11.15 16:17:49 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll [2012.11.15 16:17:49 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll [2012.11.15 16:17:49 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll [2012.11.15 16:17:48 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll [2012.11.15 16:17:48 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll [2012.11.15 16:17:46 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll [2012.11.15 16:17:46 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll [2012.11.15 16:17:45 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll [2012.11.15 16:17:45 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll [2012.11.15 16:17:44 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll [2012.11.15 16:17:44 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll [2012.11.15 16:17:43 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll [2012.11.15 16:17:43 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll [2012.11.15 16:17:42 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll [2012.11.15 16:17:42 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Roaming\ATI [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\ATI [2012.11.15 16:04:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.11.15 16:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD [2012.11.15 16:00:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT [2012.11.15 16:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2012.11.15 16:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2012.11.15 16:00:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2012.11.15 15:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2012.11.15 15:58:53 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.11.15 15:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.11.15 15:57:33 | 000,000,000 | ---D | C] -- C:\AMD [2012.11.15 15:22:57 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys [2012.11.15 15:22:57 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll [2012.11.15 15:18:04 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.11.15 15:18:04 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.11.15 15:18:03 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.11.15 15:18:03 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.11.15 15:18:03 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.11.15 15:18:03 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.11.15 15:18:03 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.11.15 15:18:03 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.11.15 15:18:02 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.11.15 15:18:02 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.11.15 15:18:02 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.11.15 15:18:02 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.11.15 15:18:01 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.11.15 15:18:01 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.11.15 15:18:01 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.11.15 15:15:22 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll [2012.11.15 15:15:22 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe [2012.11.15 15:15:22 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll [2012.11.15 15:15:22 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll [2012.11.15 14:43:00 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll [2012.11.15 14:43:00 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll [2012.11.15 14:43:00 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll [2012.11.15 14:43:00 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll [2012.11.15 14:43:00 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll [2012.11.15 14:43:00 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll [2012.11.15 14:42:51 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll [2012.11.15 14:42:51 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll [2012.11.15 14:42:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll [2012.11.15 14:42:16 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll [2012.11.15 14:42:16 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll [2012.11.15 14:41:32 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\4a games [2012.11.12 12:33:34 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Diagnostics [2012.11.08 16:40:07 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\Electronic Arts [2012.11.08 16:39:58 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electronic Arts [2012.11.08 16:39:47 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll [2012.11.08 16:39:47 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll [2012.11.08 16:39:47 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll [2012.11.08 16:39:47 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll [2012.11.08 16:39:44 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll [2012.11.08 16:39:44 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll [2012.11.08 16:39:43 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll [2012.11.08 16:39:20 | 000,000,000 | ---D | C] -- C:\Users\Thomas\Documents\Electrontic Arts [2012.11.06 19:50:18 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2012.11.01 10:51:50 | 000,000,000 | ---D | C] -- C:\Users\Thomas\AppData\Local\NFS Underground 2 [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.22 14:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.22 14:48:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.22 14:48:33 | 3220,074,496 | -HS- | M] () -- C:\hiberfil.sys [2012.11.22 14:17:34 | 000,543,531 | ---- | M] () -- C:\Users\Thomas\Desktop\adwcleaner.exe [2012.11.22 13:25:08 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Thomas\Desktop\tdsskiller.exe [2012.11.22 13:18:16 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.22 13:18:16 | 000,013,472 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.22 12:35:58 | 000,000,739 | ---- | M] () -- C:\Users\Public\Desktop\TrueCrypt.lnk [2012.11.22 12:35:54 | 000,231,376 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2012.11.22 12:25:47 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Thomas\Desktop\aswMBR.exe [2012.11.21 12:13:33 | 000,444,833 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2012.11.20 21:04:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Thomas\Desktop\OTL.exe [2012.11.20 12:27:42 | 000,000,741 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.18 18:09:15 | 440,077,062 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.11.18 17:45:46 | 000,000,672 | ---- | M] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk [2012.11.18 17:45:45 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo [2012.11.18 16:59:32 | 000,001,387 | ---- | M] () -- C:\Users\Thomas\Desktop\Core Temp.lnk [2012.11.15 16:11:50 | 000,001,017 | ---- | M] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk [2012.11.15 16:07:53 | 000,000,208 | ---- | M] () -- C:\Users\Thomas\Desktop\Metro 2033.url [2012.11.15 16:02:18 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2012.11.15 15:30:08 | 002,274,000 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.15 15:24:39 | 001,663,204 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.11.15 15:24:39 | 000,707,300 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.11.15 15:24:39 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.11.15 15:24:39 | 000,152,892 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.11.15 15:24:39 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.11.08 00:32:40 | 000,000,218 | ---- | M] () -- C:\Users\Thomas\.recently-used.xbel [2012.11.01 10:50:09 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.22 14:17:25 | 000,543,531 | ---- | C] () -- C:\Users\Thomas\Desktop\adwcleaner.exe [2012.11.22 12:35:58 | 000,000,739 | ---- | C] () -- C:\Users\Public\Desktop\TrueCrypt.lnk [2012.11.18 17:45:46 | 000,000,672 | ---- | C] () -- C:\Users\Thomas\Desktop\SpeedFan.lnk [2012.11.18 17:45:45 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo [2012.11.18 16:59:32 | 000,001,387 | ---- | C] () -- C:\Users\Thomas\Desktop\Core Temp.lnk [2012.11.15 16:11:50 | 000,001,017 | ---- | C] () -- C:\Users\Thomas\Desktop\GPU-Z.lnk [2012.11.15 16:07:53 | 000,000,208 | ---- | C] () -- C:\Users\Thomas\Desktop\Metro 2033.url [2012.11.15 16:02:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.11.15 15:22:59 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.15 15:15:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.08 00:32:40 | 000,000,218 | ---- | C] () -- C:\Users\Thomas\.recently-used.xbel [2012.11.06 19:50:12 | 440,077,062 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.11.01 10:50:09 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Need for Speed Underground 2.lnk [2012.10.21 00:16:44 | 000,001,148 | ---- | C] () -- C:\Users\Thomas\AppData\Roaming\EasyToolz.ini [2012.09.28 02:29:54 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.09.28 02:29:54 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.09.10 08:32:05 | 001,618,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2011.09.28 16:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > OTL-Extras-Log: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 22.11.2012 14:52:32 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Thomas\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
4.00 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 63.26% Memory free
8.00 Gb Paging File | 6.28 Gb Available in Paging File | 78.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 99.90 Gb Total Space | 60.25 Gb Free Space | 60.31% Space Free | Partition Type: NTFS
Drive D: | 272.61 Gb Total Space | 26.56 Gb Free Space | 9.74% Space Free | Partition Type: NTFS
Drive E: | 661.53 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 891.51 Gb Total Space | 432.46 Gb Free Space | 48.51% Space Free | Partition Type: NTFS
Computer Name: BEHEMOTH | User Name: Thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07EC683D-E99D-4D57-9DF1-FC211E10E2F8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{36B80E5C-E188-4FD0-BA15-EBBEBCB52539}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{41A3DD54-2B30-45CB-BF6E-D789CE33FFB8}" = lport=10243 | protocol=6 | dir=in | app=system |
"{43DFE6FD-A49F-4CEA-BE8F-D01617364F44}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{478565E3-5697-4F05-AE82-969EA716FBA9}" = rport=445 | protocol=6 | dir=out | app=system |
"{51B4D801-9810-4CD9-88D6-2C560D846A82}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{52C79A64-D927-487B-A2E5-1883FB9805C3}" = lport=56681 | protocol=6 | dir=in | name=pando media booster |
"{709B9683-8A96-4A5E-AB91-6774940A1414}" = lport=137 | protocol=17 | dir=in | app=system |
"{740862C4-321B-4AB5-B32E-BA4D0C4EFC92}" = lport=6004 | protocol=17 | dir=in | app=d:\programme\microsoft office\office12\outlook.exe |
"{7BD6C38B-A953-4924-B2A2-657687791F36}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7F1C73AB-8A53-433D-823F-65E965007A15}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8CE1451F-3D57-4731-BCD0-C0E9A5E8CAAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8D3C7EE8-1422-48ED-9B46-2333961B97F2}" = lport=445 | protocol=6 | dir=in | app=system |
"{8E804689-A7C1-45A7-91F6-C1685920FD74}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8EB8452C-AB07-474A-9857-B20D01FE8490}" = rport=138 | protocol=17 | dir=out | app=system |
"{934A4DE4-A8E1-4D94-B6AC-704EB7DAD932}" = lport=56681 | protocol=17 | dir=in | name=pando media booster |
"{9DA040D6-9FCA-4457-A942-59EB750A9338}" = rport=137 | protocol=17 | dir=out | app=system |
"{A6606C15-7A1F-486F-B161-EE6FB8416477}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D6082C2F-B122-479B-B791-DF02EE3A8648}" = lport=139 | protocol=6 | dir=in | app=system |
"{D7452FCA-FC78-40D5-A4E4-DB367C9004B5}" = rport=139 | protocol=6 | dir=out | app=system |
"{D8B8EC0C-6580-4D6C-A188-3F9FB2B3374A}" = lport=56681 | protocol=17 | dir=in | name=pando media booster |
"{DA529022-7A08-44D7-B3CF-16F846EBB6C6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DE95DDFA-A893-48D6-9F4B-48BAF6B305C5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E5B5A599-4478-4C02-B853-DD44F72A869A}" = lport=138 | protocol=17 | dir=in | app=system |
"{EF49318F-B5F3-4A36-BBA5-87DFFAC4BE00}" = lport=56681 | protocol=6 | dir=in | name=pando media booster |
"{FC0BA8F4-81C2-4068-8596-5EB317A51E6D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011F8F6C-13E2-40D6-9CE1-D01E2CDF6761}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\dead space.exe |
"{01A341BE-E845-45FD-A0D3-6F25B18E34BE}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\reliccoh.exe |
"{02E7A2A2-A520-4603-8280-6F127A145AAB}" = protocol=17 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"{032CC7F2-567C-478C-A736-28350105217B}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{0336141F-8113-4256-B1CF-AC65582AA5CF}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe |
"{03D071BD-EB30-4DAE-9E2E-E76EA04FC1F9}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\unreal tournament\system\unrealtournament.exe |
"{043DA7C4-AF78-4908-A22B-AD3F5FA01F96}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\setup.exe |
"{0677905C-5B9F-4B24-B369-3D204134E5BE}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{09DBDB3C-DFEB-44A2-90C2-1D029F35CF48}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight ii\torchlight2.exe |
"{0DE1A7DA-6CA2-4903-B7EC-D7E6860B7335}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{0EAFB3A8-7E8E-4AD7-8AD7-2F2991C1D37F}" = dir=in | app=d:\programme\skype\phone\skype.exe |
"{10F3560C-88CA-4414-9A16-B62BAC48A17A}" = protocol=6 | dir=in | app=d:\spiele\two worlds\twoworlds.exe |
"{11AAC1A7-80B0-464F-AC5E-89DAA7EE9DE9}" = protocol=17 | dir=in | app=d:\programme\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{159EA599-7214-4042-A4F4-BEC1CFC043E3}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2benchmarktool.exe |
"{175E9C5B-29E3-4FF5-9EEE-953517A81B86}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2editor.exe |
"{17E66AB5-4400-470D-92F7-6435678463D4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\warhammer 40,000 space marine\spacemarine.exe |
"{1B41CF59-3A52-43DF-BA5E-71B498660173}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2serverlauncher.exe |
"{1CAC1E1D-BA31-4EAC-B3D0-A5D3A63A37FA}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{2060886E-2204-4146-B835-C557217C972A}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\deus ex\system\deusex.exe |
"{21ABA4CE-9B5F-4C51-8600-5BE45888466F}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\darksiders 2\darksiders2.exe |
"{220C8F05-2186-4B83-93E6-6DDC67F48D5A}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic_ds.exe |
"{22734FAF-0125-4B20-9061-94F3478052DB}" = protocol=17 | dir=in | app=d:\spiele\hellgate london\launcher.exe |
"{232B94F4-5A07-4C69-B9C0-F94FE1CF40FC}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\deus ex\system\deusex.exe |
"{245D9E7C-E9BD-4E41-9723-201F98434DD0}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{262365AF-683E-43B3-8873-B001FAE567AC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{2664C695-4E63-41A3-9B12-E1CBB6A71E68}" = protocol=17 | dir=in | app=d:\spiele\steam\steam.exe |
"{2EB11F0E-FD9B-4A7D-A198-CDCF4A7EFF27}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight\torchlight.exe |
"{37B4C35E-0B9D-4116-87B5-4F3FC73B24C3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{41F39C58-C080-4D1D-BE38-579F6BFFB4DF}" = protocol=6 | dir=out | app=system |
"{445352DC-F8D0-4CCE-A72B-BF8DD7ED0E8E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\runlauncher.bat |
"{4885D15D-CA81-4829-B500-8E46773BE6D1}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4A0B8D30-AA77-44AB-8F43-7BAA34A03ABD}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\runlauncher.bat |
"{4AAD182A-0DE5-4AD0-8E16-64185BEF7C6B}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\game.exe |
"{4F78D620-218A-4279-8366-AFACF2BECA7B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{50142EE3-5A5C-4733-AE3C-FE0EE62F79B2}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\game.exe |
"{527945E3-6C5C-47EF-BA30-404769720190}" = protocol=6 | dir=in | app=d:\programme\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{5445A562-5198-49C9-A912-7FBB164D389D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{56107278-4962-4574-95A8-BD9EFA1A75A5}" = protocol=6 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"{587EB998-C501-43F5-B9B6-3589F1BC40AD}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic.exe |
"{5AC90AE4-707A-42B5-8475-ED08D953CE67}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5B4BBE06-AE21-4952-B728-C5AD564155C6}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5C1556AE-F638-4874-8CE7-651766B96745}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\doom 3\doom3.exe |
"{5C237E64-DF8E-48A9-B1D4-E06A29323073}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5CA3F426-306F-4D0D-921E-EC922F3F8F36}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm |
"{5CD044FA-5789-4C28-9EC6-31421B34BC7E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\quake 3 arena\quake3.exe |
"{5D1D2BF7-1D46-4E1A-84F7-D92E3C5DEC05}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight ii\torchlight2.exe |
"{5E114B25-CFBB-43B5-9C64-C6E0B1AA1A2D}" = protocol=17 | dir=in | app=d:\spiele\two worlds\twoworlds_radeon.exe |
"{5F3CBF0F-9D12-492A-A269-ABEE37755D74}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2serverlauncher.exe |
"{61353E43-4074-4B10-A6B8-6AF670ED391C}" = dir=out | app=d:\spiele\steam\steamapps\common\dungeons\dungeonsstarter.exe |
"{61A6859E-0FE5-4CF3-88F1-63FCD67F8F07}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic_ds.exe |
"{62FC417A-C430-4B65-B058-217A42F39FDA}" = protocol=6 | dir=in | app=d:\spiele\grid\grid.exe |
"{6580BEFA-3494-4196-B979-90104A9834B9}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\farcry2.exe |
"{665D2583-3B66-43CB-95E1-DA2E64D78D67}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\soldiers heroes of world war 2\soldiers.exe |
"{69C2FDF7-68E7-4C5B-8BFD-126B83E73588}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war ii - retribution\dow2.exe |
"{6CB7F127-C8A0-494F-9626-A2F86D6CDC47}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6D389F27-FC1A-4E78-B735-2224A226211D}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033.exe |
"{6DDD992C-4A39-4033-BEEF-F99D856D98FB}" = protocol=6 | dir=in | app=d:\spiele\hellgate london\launcher.exe |
"{6EB14E16-F352-4F29-96E5-5782037236D5}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dead island\deadislandgame.exe |
"{6F2D0EAB-03E3-4B26-820D-A302C447BA7D}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\farcry2.exe |
"{70419B49-56F2-482D-AA98-AC9AB508B2B0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{70579402-7A9A-4203-9996-D28332355B43}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\unreal tournament\system\unrealtournament.exe |
"{72063097-3475-4D0B-9D3A-C5870BC9D553}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{73278E89-001F-4A08-B343-E86D79AAAF26}" = protocol=6 | dir=in | app=d:\spiele\hellgate global\hgllauncher.exe |
"{7658317F-854C-4202-82F2-BF3BEF31D98B}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7751F293-10A5-481E-97D5-1E448DA2C55B}" = dir=in | app=d:\programme\itunes\itunes.exe |
"{79258FCB-4D58-4786-A39C-A7C9C46367BE}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\blood bowl legendary edition\bb_le.exe |
"{79586D60-A682-4280-B93C-B08921780AAB}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7AD8ABA7-A5A0-472B-A1DC-CF610889984E}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic_online.exe |
"{7B41FA90-502E-48BE-8E3A-C3CA1FDA34D1}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7CDA608E-639A-4AC1-A89C-833456AAA2BC}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{7EC3B1FD-C386-4F09-B340-7A49E9A2CFD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{809B4953-8D40-4081-9AB0-96CFDF47DAFC}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{81039886-0564-4D1E-A4D7-C3E74BBEC04F}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war 2\dow2.exe |
"{81F47B59-07FC-48AA-8C1D-C12E880B1786}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{82BFAFEB-9D20-4CD3-A5FC-52232C6BE4C6}" = protocol=17 | dir=in | app=d:\spiele\hellgate global\hgllauncher.exe |
"{85043CA3-8F49-45B2-B242-73CC3E0AA97C}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\reliccoh.exe |
"{8880F35D-E5F0-4B6F-B1B0-55D3C5753940}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead island\deadislandgame.exe |
"{8994A5B2-68C3-478C-B35F-BAB4F12E47AB}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\max payne\maxpayne.exe |
"{8B706717-D2FA-4A54-B8D2-5F9669BA8F10}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{8D0E0690-1324-4951-85B3-8F34B6698CB3}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\railroad tycoon 2 platinum\rt2_plat.exe |
"{8D17713C-AD04-48C7-9EF2-3577328FF38A}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2benchmarktool.exe |
"{8DDA8AA4-5196-4169-AA99-80CF06A8BCC6}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\warhammer 40,000 space marine\spacemarine.exe |
"{8F093585-CA87-4419-9868-C1238741F2B3}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{96FF9A6D-E3AA-4A58-8CE2-5F4D4EB0F460}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war 2\dow2.exe |
"{9CA55186-0048-4C6C-9923-48DC5B55321A}" = protocol=6 | dir=in | app=d:\spiele\two worlds\twoworlds_radeon.exe |
"{9D25E98C-AC76-4AFE-A6C2-20CE0D124F03}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\blood bowl legendary edition\bb_le.exe |
"{9D536F14-3D4D-4C0B-94A7-DF7E7E523E11}" = protocol=17 | dir=in | app=d:\spiele\two worlds\twoworlds.exe |
"{A29B1BA9-4D77-4050-96E2-B61C16BA06EC}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{A54E7B52-607F-4200-A729-94E2882412F3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AD5323AB-F9D7-496B-A4AC-560356BD3BC4}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{B35B9870-92EC-4C3E-AC38-34C75E532DEE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B368E4AB-BF74-4567-8FD8-112C10212771}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\binaries\win32\batmanac.exe |
"{B5988DD5-BBA1-45F9-B34F-EEC47FDC027E}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\far cry 2\bin\fc2editor.exe |
"{B5C914B1-664F-4575-B4C5-A479B0A77497}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe |
"{B5CB8E19-8809-4B03-83D3-37B89396054F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B862F30C-327C-4705-80EF-AFBB29F49569}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B8EF78C1-188E-4467-8077-23BC70997714}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\tomb raider legend\trl.exe |
"{BA90E971-04B1-4301-84B0-55C3DF03255B}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dawn of war ii - retribution\dow2.exe |
"{BE8DA6E6-0FF6-4705-B43A-A12D15DB3A83}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\tomb raider legend\trl.exe |
"{BEA883AF-5A2E-4565-A8BB-A48558F6D4B5}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\soldiers heroes of world war 2\soldiers.exe |
"{C153E3A2-600E-4930-ADF6-C446F5D26CAF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C65463C2-6C16-4151-940D-7AD5A460734B}" = protocol=17 | dir=in | app=d:\spiele\world in conflict\wic.exe |
"{C76E85D9-416A-4D59-A96A-95A0B63BE3D3}" = protocol=6 | dir=in | app=d:\spiele\world in conflict\wic_online.exe |
"{C8B653D6-939A-4D20-9F17-75068363006B}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\support\ea help\electronic_arts_technical_support.htm |
"{C8E1B9D7-BDC8-4013-851E-A8C59C56EA34}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{CB1C4E43-1FD1-4BAB-90B0-33203DF40CB0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{CF39232F-9E36-42C0-B6D0-8E17EE67A7FC}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{CF8E504B-E86C-4D47-AA01-EC77F1A5CAF5}" = protocol=17 | dir=in | app=d:\spiele\grid\grid.exe |
"{D2C8F4AC-2818-4AA7-92D2-B6DEACABB57A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D35572CA-75CA-47CC-BC2E-10CDA7CF94E8}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\mafia\setup.exe |
"{D442D84B-5235-48D9-867E-971FD3B96626}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{D46EE8DE-F9D1-4EF6-9A5E-97A9611B329D}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\darksiders 2\darksiders2.exe |
"{D503B77F-72FA-4868-AEC6-81D7FF2C54EF}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\portal 2\portal2.exe |
"{D51CE6EE-12AD-4EB6-8334-4D24E3210A3F}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{DBE13617-398C-4C68-A9E9-07FC9DB5E0F1}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\railroad tycoon 2 platinum\rt2_plat.exe |
"{DC46B56C-355A-4B8B-A360-CAF0E747640D}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DE1A36EB-C4B3-4E19-B7C0-EE17252E90B8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DFE589EA-51E1-429E-8548-45C58258F65E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E2824A49-8AFF-45FB-810C-381397BE7ADB}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{E57E3618-6504-4700-9BAB-19133AE86F07}" = protocol=6 | dir=in | app=d:\spiele\steam\steam.exe |
"{E7F462F6-6AB6-4051-93D3-3D8A4655ECA5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ECD0BA67-C1E0-43B7-8E45-F2A39896769E}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman2\binaries\win32\batmanac.exe |
"{ECEA6759-0817-4ACD-8CF8-2C825C1493F7}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033.exe |
"{EFDF0205-374C-4493-AC8A-DB8029BD0E59}" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\torchlight\torchlight.exe |
"{F033055C-0185-48C7-9A58-F8CAA9D2B3AC}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\portal 2\portal2.exe |
"{F0C18CA6-CD07-4CBD-88EE-83679BD7EDE1}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\doom 3\doom3.exe |
"{F1F6E2D5-90E9-49E1-8F4F-7748DA9677A4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\dead space\dead space.exe |
"{F1FFA869-F1AA-4A80-B21D-A9145561F407}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FE73B50F-C34A-400D-BB8E-1D29394BC540}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\quake 3 arena\quake3.exe |
"{FED7FA85-DB7F-4D37-B0E1-77504F42D6C4}" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\max payne\maxpayne.exe |
"TCP Query User{08EDFD40-0A66-4B7A-8A65-D4F5CFB0DDCE}D:\programme\java\64bit\bin\javaw.exe" = protocol=6 | dir=in | app=d:\programme\java\64bit\bin\javaw.exe |
"TCP Query User{223341D4-7AF3-49B7-813A-E82CC87AAD8A}D:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe |
"TCP Query User{2768D805-4503-47AA-A07D-E89E352EA859}D:\programme\opera\opera.exe" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"TCP Query User{3F3FEE1B-B9EE-49C2-AA67-085A692551BC}D:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"TCP Query User{4091BA76-C2F1-4673-BE83-4421DB6AB3DB}D:\wot testserver\worldoftanks.exe" = protocol=6 | dir=in | app=d:\wot testserver\worldoftanks.exe |
"TCP Query User{54D491BA-F435-440D-84B9-E90ADEDDB339}D:\spiele\world of tanks\worldoftanks.exe" = protocol=6 | dir=in | app=d:\spiele\world of tanks\worldoftanks.exe |
"TCP Query User{6D6ECECC-6FE8-41B4-BD68-499E9086658B}C:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{74069D8E-A6F9-4269-9B43-9E24D0AC7376}D:\programme\pidgin\pidgin.exe" = protocol=6 | dir=in | app=d:\programme\pidgin\pidgin.exe |
"TCP Query User{90FD85C8-4579-4421-BA60-67C5F9C56025}D:\spiele\call of duty modern warfare 2\iw4sp.exe" = protocol=6 | dir=in | app=d:\spiele\call of duty modern warfare 2\iw4sp.exe |
"TCP Query User{AD09432D-C061-4543-8676-1355E204EC32}D:\spiele\world of tanks\wotlauncher.exe" = protocol=6 | dir=in | app=d:\spiele\world of tanks\wotlauncher.exe |
"TCP Query User{C420AE6F-46B1-49E0-97C2-DDA219FC8104}D:\wot testserver\wotlauncher.exe" = protocol=6 | dir=in | app=d:\wot testserver\wotlauncher.exe |
"TCP Query User{D7BE9B92-B9C4-4A40-9EC9-30ED6149D225}D:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"UDP Query User{1231C1C9-6461-48CD-AAC0-F011C5E7D74E}D:\spiele\call of duty modern warfare 2\iw4sp.exe" = protocol=17 | dir=in | app=d:\spiele\call of duty modern warfare 2\iw4sp.exe |
"UDP Query User{25E6B7C9-80A5-432E-87BD-577D50DA1AF3}D:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\metro 2033\metro2033benchmark.exe |
"UDP Query User{3D4AAFE0-1457-4634-9C1F-06D7C04BDAF9}D:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"UDP Query User{3E75366E-1459-47FA-9BAE-8E6C0409616C}D:\programme\opera\opera.exe" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"UDP Query User{65CFDE6C-7192-4BDF-98C0-3D371FEB8D97}D:\programme\pidgin\pidgin.exe" = protocol=17 | dir=in | app=d:\programme\pidgin\pidgin.exe |
"UDP Query User{662EEBE0-0976-4A27-993F-9CA075D3E9C4}D:\spiele\world of tanks\wotlauncher.exe" = protocol=17 | dir=in | app=d:\spiele\world of tanks\wotlauncher.exe |
"UDP Query User{77127263-BBE2-46BD-B394-1D033568DED6}C:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\thomas\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{A8813CA3-E732-4C0F-B455-9A8159643CF1}D:\wot testserver\worldoftanks.exe" = protocol=17 | dir=in | app=d:\wot testserver\worldoftanks.exe |
"UDP Query User{B01DFDD4-AB73-4442-89F3-CBC845C948B8}D:\wot testserver\wotlauncher.exe" = protocol=17 | dir=in | app=d:\wot testserver\wotlauncher.exe |
"UDP Query User{BE461C6D-AD26-4E03-BB8E-A64B743E80B7}D:\spiele\world of tanks\worldoftanks.exe" = protocol=17 | dir=in | app=d:\spiele\world of tanks\worldoftanks.exe |
"UDP Query User{F3D6690A-E993-4BB6-B774-CD0A5488A0A4}D:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=d:\spiele\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"UDP Query User{FEE44D81-0CF7-4D5F-B2A2-FCF1084E0C52}D:\programme\java\64bit\bin\javaw.exe" = protocol=17 | dir=in | app=d:\programme\java\64bit\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0407893F-352C-B182-E04A-A8C3333DA29B}" = AMD Drag and Drop Transcoding
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC4
"{0DCAB5DD-CC69-271A-CF03-F2BD6B60BD8A}" = AMD Media Foundation Decoders
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86417004FF}" = Java(TM) 7 Update 4 (64-bit)
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = MPC-HC 1.6.2.4902 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}" = AMD Catalyst Install Manager
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{504184A2-1B0E-5D93-603A-517E93E7EDB3}" = AMD Accelerated Video Transcoding
"{57580625-C673-7FEA-8791-E84B7AAF5069}" = ccc-utility64
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{8219EDCB-CE5A-4348-B056-AAC0FE4E99D0}" = Microsoft IntelliType Pro 8.2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A2B4455D-1046-4732-BFBC-0821BEFC07BC}" = Hellgate: London
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{E0FE1E14-3A7A-4DB0-9FFA-0DD945AE84DB}" = HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.62
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft IntelliType Pro 8.2" = Microsoft IntelliType Pro 8.2
"NVIDIA Drivers" = NVIDIA Drivers
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0F7A6FD0-87F5-FB5D-973C-CF604DE1BC6B}" = CCC Help Polish
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A9BE3D6-4D53-2C9D-B77D-562D85936B91}" = CCC Help Norwegian
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C8CT1}_is1" = World of Tanks - Common Test
"{210DFA65-F805-1A2B-4F83-8E27279AE385}" = Catalyst Control Center Graphics Previews Common
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{29822CAD-C76A-0BEE-55F5-AAA524DA814F}" = CCC Help Greek
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{38A1E3ED-D913-41D2-9953-A93D5ACE3ADF}" = TL-WN721N/TL-WN722N Driver
"{3A1293DF-7D09-BB0F-9576-EC47EE4A9362}" = CCC Help Italian
"{47416F0B-6589-591E-C6F8-4235D2230B14}" = Catalyst Control Center InstallProxy
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{625FC7D1-656D-1BEC-F86F-3EACAFDAA8FE}" = CCC Help English
"{65DF3688-6EF3-4C86-83DE-54AB46029F07}" = Hellgate
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7351EEF8-9D6C-5F46-5A19-F2C7456CE132}" = CCC Help German
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F172E34-4107-8964-6AEA-5051FFD265FF}" = CCC Help Portuguese
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86095E92-1959-8364-920E-82E81F64F8FB}" = Catalyst Control Center
"{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}" = HP Officejet Pro 8500 A910 Hilfe
"{89D05F35-933A-89C0-B935-C92BEE4229BD}" = CCC Help French
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{959E4378-CCA1-E4E4-2425-793DA92E8D95}" = CCC Help Czech
"{96BB3C67-4EB4-9757-E0C2-C0D2FE9053B1}" = CCC Help Turkish
"{974F4B73-2017-E174-9070-3F58F01B341F}" = CCC Help Danish
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98E20A18-3C29-86FA-50B4-918C2B34A082}" = CCC Help Hungarian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9E2E5EB3-DC6E-9277-E9DB-13175E7DDA39}" = CCC Help Dutch
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{AAACC0A5-4382-04D0-C75E-0669C7B949B6}" = CCC Help Japanese
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACEF4078-9B86-2455-E18D-34D52D37D9D5}" = CCC Help Chinese Standard
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B1B669F9-B9FE-486D-924F-D6678FDB0FD5}" = Adobe Setup
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B55FB422-B803-11F5-5582-B3666EA1B9AC}" = Catalyst Control Center Localization All
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B75932F6-EC0A-4E3A-AA7A-11AAC267B8A3}" = Adobe Creative Suite 3 Design Premium
"{B8010864-15F8-613B-20EF-AC35B14B3E0D}" = CCC Help Russian
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C1342411-5A98-DE8A-5629-D0C518E1C280}" = CCC Help Finnish
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
"{D08B4177-5160-6B66-8934-2F9012134D61}" = CCC Help Thai
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D34A6029-FB1A-9EA8-A938-5393F82A3A00}" = CCC Help Korean
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE4CF159-4AD2-4754-BDA0-5FB088C8B58B}" = Razer Diamondback
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3A09D13-4D40-3CF8-7D32-8BD55F8D1533}" = CCC Help Spanish
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = World in Conflict: Soviet Assault
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2C35491-9323-3AE7-6023-6B4128045153}" = CCC Help Swedish
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8A2AB6C-CB98-419C-BC96-95809B455AA7}" = WOT Statistics
"{FC66A32F-1A57-AC5C-4F12-DAC2F4CB77A0}" = CCC Help Chinese Traditional
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_dba14d7ef3aa07282d2b5a7a98d902a" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Fallout 2_is1" = Fallout 2
"Fraps" = Fraps
"G3QP231012008_is1" = Questpaket 4 Update 2 Deinstallation
"GameSpy Arcade" = GameSpy Arcade
"ImgBurn" = ImgBurn
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenAL" = OpenAL
"Opera 12.10.1652" = Opera 12.10
"Picasa 3" = Picasa 3
"Pidgin" = Pidgin
"SpeedFan" = SpeedFan (remove only)
----------------!!!!--------------
EDIT
Aufzählung der Steam-Apps aus der Liste entfernt
----------------!!!!--------------
"TrueCrypt" = TrueCrypt
"Two Worlds" = Two Worlds
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2615511845-3995912360-3144667431-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 21.11.2012 10:39:04 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15585
Error - 21.11.2012 10:39:04 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15585
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3076917
Error - 21.11.2012 14:38:01 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3076917
Error - 21.11.2012 18:23:44 | Computer Name = Behemoth | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "d:\programme\Spybot\DelZip179.dll".
Fehler in Manifest- oder Richtliniendatei "d:\programme\Spybot\DelZip179.dll" in
Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 21.11.2012 19:57:24 | Computer Name = Behemoth | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: hellgate_sp_dx9_x64.exe, Version:
1.18074.70.4256, Zeitstempel: 0x4804f713 Name des fehlerhaften Moduls: hellgate_sp_dx9_x64.exe,
Version: 1.18074.70.4256, Zeitstempel: 0x4804f713 Ausnahmecode: 0xc0000005 Fehleroffset:
0x0000000000406dcd ID des fehlerhaften Prozesses: 0x1194 Startzeit der fehlerhaften
Anwendung: 0x01cdc83838c10cc0 Pfad der fehlerhaften Anwendung: D:\Spiele\Hellgate
London\SP_x64\hellgate_sp_dx9_x64.exe Pfad des fehlerhaften Moduls: D:\Spiele\Hellgate
London\SP_x64\hellgate_sp_dx9_x64.exe Berichtskennung: 31836af0-3437-11e2-9296-00044b038885
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15600
Error - 22.11.2012 08:38:33 | Computer Name = Behemoth | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15600
[ System Events ]
Error - 20.11.2012 07:37:35 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 20.11.2012 07:37:43 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 20.11.2012 09:39:08 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 20.11.2012 09:39:22 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 21.11.2012 03:49:49 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 21.11.2012 03:49:59 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 22.11.2012 04:27:22 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 22.11.2012 04:27:28 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 22.11.2012 09:49:06 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 22.11.2012 09:49:19 | Computer Name = Behemoth | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
< End of report >
Beim Extras-Log habe ich die Aufzählung der installierten Steam-Apps wegen der kürzlich bekanntgewordenen Sicherheitslücke bei Steam entfernt. Sollten sie relevant sein, kann ich sie aber nachliefern. |
|
22.11.2012, 15:18
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.11.2012, 19:16
| #13 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr So, nach einem laaaangen Scan von ESET hier die beiden Log-Files. Sämtliche externen HDDs und USB-Sticks angeschlossen. Malwarebytes Anti-Malware : Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.22.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Thomas :: BEHEMOTH [Administrator] 22.11.2012 15:20:35 mbam-log-2012-11-22 (15-20-35).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 201552 Laufzeit: 2 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) ESET Scan-Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9c8013b20d1c7b4e86c135bbed0539cb
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-22 06:11:34
# local_time=2012-11-22 07:11:34 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 6208 105224528 0 0
# compatibility_mode=8192 67108863 100 0 3791 3791 0 0
# scanned=418825
# found=0
# cleaned=0
# scan_time=13216
|
|
22.11.2012, 20:29
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Sieht soweit ok aus Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.11.2012, 22:32
| #15 |
| | AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr Nein, keine Funde, keine Probleme. Vielen, vielen Dank für die Hilfe (und für das Vertrauen). |
|
| Themen zu AntiVir Echtzeit Scanner meldete Trojaner, findet jetzt aber nichts mehr |
| .dll, adobe, antivir, autorun, avg, bho, bonjour, desktop, explorer, fehlalarm, firefox, flash player, logfile, mozilla, ntdll.dll, plug-in, programm, realtek, registry, rojaner gefunden, safer networking, scan, services.exe, software, svchost.exe, temp, trojaner, warnung, wuauclt.exe |
Linear-Darstellung
