Bka-Trojaner entfernen

Amstaff3 · 14.02.2013, 10:05

Hallo,
könnt ihr mir helfen?
Hab mir den BKA-Trojaner 2.11 eingefangen, hab es schon mit Kaspersky rescue disc probiert aber funktioniert nicht. kann auch nicht in den abgesicherten Modus.
was kann ich machen damit ich ihn wieder losbekomme?

aharonov · 14.02.2013, 10:15

Was hast du für ein Betriebssystem?
Windows XP / Vista / 7 ?
Ist es 32-bit oder 64-bit?

Amstaff3 · 14.02.2013, 15:56

Hab Vista 32-bit

aharonov · 14.02.2013, 16:04

Hallo Amstaff3 und

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich.
Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.
Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.

Hinweise zum Ablauf

Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
- Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
- Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles gesammelt in einer Antwort.
- Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
- Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.

Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert. Deshalb: Bitte
- .. lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
- .. installiere oder deinstalliere während der Bereinigung keine Software.
- .. frag nicht parallel in anderen Foren nach Hilfe (Crossposting).

Ich kann dir keine Garantien geben, dass die Bereinigung schlussendlich erfolgreich sein wird und wir alles finden werden.
- Ein Formatieren und Neuinstallieren ist meist der schnellere und immer der sicherere Weg.
- Sollte ich eine schwerwiegende Infektion bei dir finden, werde ich dich nochmals darauf hinweisen. Es bleibt aber deine Entscheidung.

Los geht's: Alle Tools immer auf den Desktop speichern und von dort starten.

Ok, dann versuchen wir es so:

Schritt 1

Downloade dir bitte Farbar Recovery Scan Tool 32-Bit und speichere diese auf einen USB Stick (nicht in einen Unterordner!).
Schliesse den USB Stick an den infizierten Rechner an.

Du musst das System nun in die System Reparatur Option booten:

Variante 1 - Über den Boot Manager
Starte den Rechner neu auf.

Während des Hochfahrens drücke mehrmals die F8 Taste.

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

oder

Variante 2 - Mit Windows CD/DVD
Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu auf und boote von der CD.

Wähle die Spracheinstellungen und klicke Weiter.

Klicke auf Computerreparaturoptionen.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

Wenn du jetzt in den Reparaturoptionen bist, wähle Eingabeaufforderung.

Gib nun bitte notepad ein und drücke Enter.
- Es öffnet sich ein Textdokument. Klicke auf Datei -> Speichern unter und wähle Computer.
- Lese hier nun den Laufwerksbuchstaben deines USB Sticks (z.B. e:\) ab.
- Schliesse Notepad wieder.
Gib nun bitte folgenden Befehl ein und drücke Enter:
e:\frst.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
Akzeptiere den Disclaimer mit Yes und klicke Scan.

Das Tool erstellt eine Datei FRST.txt auf deinem USB Stick. Poste dessen Inhalt bitte hier.

Bitte poste in deiner nächsten Antwort:

Log von FRST

Amstaff3 · 14.02.2013, 17:07

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2013
Ran by SYSTEM at 14-02-2013 16:59:23
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1006264 2008-01-03] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [] [x]
HKLM\...\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [232184 2007-01-11] (Sonic Solutions)
HKLM\...\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe [102400 2007-06-12] ()
HKLM\...\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe [366400 2007-02-21] (Google Inc.)
HKLM\...\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [28672 2007-02-20] ( )
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [385024 2008-01-10] (Apple Inc.)
HKLM\...\Run: [NPSStartup] [x]
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947176 2012-09-12] (Microsoft Corporation)
HKU\Holzer\...\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [1120568 2007-07-19] (Packard Bell BV)
HKU\Holzer\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125440 2006-11-02] (Microsoft Corporation)
HKU\Holzer\...\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s [191488 2006-11-02] (Microsoft Corporation)
HKU\Holzer\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [687560 2008-12-29] (DT Soft Ltd)
HKU\Holzer\...\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [3338240 2009-04-29] (Electronic Arts)
HKU\Holzer\...\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [218032 2006-09-11] (Macrovision Corporation)
HKU\Holzer\...\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKU\Holzer\...\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe [2161600 2008-08-01] (SlySoft, Inc.)
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [313856 2008-06-25] (Microsoft Corporation)
Tcpip\..\Interfaces\{C3375EE2-EF51-44E5-96BF-14CB68EE4477}: [NameServer]192.168.2.1
Tcpip\..\Interfaces\{E1A06106-9DF7-4923-93D3-915FC6A8AAB8}: [NameServer]192.168.2.1
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
ShortcutTarget: Logitech Desktop Messenger.lnk -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)

==================== Services (Whitelisted) ===================

3 MozillaMaintenance; "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" [115608 2013-01-16] (Mozilla Foundation)
3 PACSPTISVR; "C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe" [57344 2006-12-14] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()
2 RichVideo; "C:\Program Files\CyberLink\Shared Files\RichVideo.exe" [266343 2007-03-06] ()
3 SPTISRV; "C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe" [69632 2006-12-14] (Sony Corporation)
2 Winmgmt; C:\Users\Holzer\579855.exe [192000 2013-02-01] ()
2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]

==================== Drivers (Whitelisted) ====================

3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [99648 2008-08-01] (SlySoft, Inc.)
2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()
1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [24392 2008-07-21] (Elaborate Bytes AG)
2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()
3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)
3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation )
0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)
3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
4 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [x]
3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x]
3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x]
3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-02-14 16:59 - 2013-02-14 16:59 - 00000000 ____D C:\FRST
2013-02-01 16:20 - 2013-02-13 12:14 - 95023320 ___AT C:\Users\All Users\558975.pad
2013-02-01 16:20 - 2013-02-01 16:20 - 00192000 ____A C:\Users\Holzer\579855.exe
2013-01-30 18:58 - 2009-08-24 13:47 - 00378368 ____A (Microsoft Corporation) C:\Windows\System32\winhttp.dll
2013-01-29 17:49 - 2013-01-29 17:49 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Startmenü
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Netzwerkumgebung
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Druckumgebung
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Documents\Eigene Musik
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-01-29 17:49 - 2012-10-02 20:29 - 02557288 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-01-29 17:49 - 2012-10-02 20:29 - 00645992 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-01-29 17:49 - 2012-10-02 20:29 - 00062312 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-01-29 17:48 - 2012-10-10 21:14 - 00052584 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2013-01-29 17:47 - 2013-01-29 17:50 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-01-29 17:47 - 2013-01-29 17:47 - 00000000 ____D C:\Users\All Users\NVIDIA Corporation
2013-01-29 17:44 - 2013-01-29 17:44 - 00000000 ____D C:\Program Files\Microsoft CAPICOM 2.1.0.2
2013-01-29 17:42 - 2010-02-12 11:49 - 00293376 ____A (Microsoft Corporation) C:\Windows\System32\browserchoice.exe
2013-01-29 17:38 - 2013-01-29 17:38 - 00000000 ___RD C:\Program Files\Skype
2013-01-29 17:38 - 2013-01-29 17:38 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-01-29 17:37 - 2010-02-21 00:54 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\nshhttp.dll
2013-01-29 17:37 - 2010-02-21 00:51 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\httpapi.dll
2013-01-29 17:37 - 2010-02-20 22:30 - 00396800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2013-01-29 17:33 - 2013-01-29 17:33 - 00282618 ____A C:\Windows\msxml4-KB973688-enu.LOG
2013-01-29 16:30 - 2013-01-29 16:30 - 00001994 ____A C:\Windows\IE9_main.log
2013-01-29 16:19 - 2013-01-29 16:19 - 00000883 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-01-29 16:19 - 2013-01-29 16:19 - 00000000 ____D C:\Users\All Users\Mozilla
2013-01-29 16:19 - 2013-01-29 16:19 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-01-29 15:52 - 2008-06-26 04:22 - 09845248 ____A (Microsoft Corporation) C:\Windows\System32\NlsData000a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04874240 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0009.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04495360 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0019.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04493312 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0816.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04493312 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0416.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04493312 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0414.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04493312 ____A (Microsoft Corporation) C:\Windows\System32\NlsData001d.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 04493312 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0010.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03464704 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0013.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData004e.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData004c.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData004b.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData004a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0049.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0047.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0046.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0045.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0039.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 03102720 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0020.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 02655232 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0011.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 02641408 ____A (Microsoft Corporation) C:\Windows\System32\NlsData000c.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 02597888 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0001.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 02340864 ____A (Microsoft Corporation) C:\Windows\System32\NlsData000d.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0007.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01965056 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0027.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0c1a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData081a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0026.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0024.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData001b.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData001a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0018.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData000f.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0003.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01963520 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0002.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01799168 ____A (Microsoft Corporation) C:\Windows\System32\NlsData003e.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01799168 ____A (Microsoft Corporation) C:\Windows\System32\NlsData002a.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01799168 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0022.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01799168 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0021.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 01523200 ____A (Microsoft Corporation) C:\Windows\System32\NlsData0000.dll
2013-01-29 15:52 - 2008-06-26 04:22 - 00797696 ____A (Microsoft Corporation) C:\Windows\System32\NaturalLanguage6.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 07964672 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0024.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 07042560 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons081a.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 06917120 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0c1a.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 06781440 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0019.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 06585856 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons001b.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 06346240 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons001d.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 05791232 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0026.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 05499904 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0022.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 04164096 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0002.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 04093440 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons004c.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 03419136 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons004a.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 03331072 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0018.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 01972736 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons004e.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 01793536 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0045.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 01702912 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons004b.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 01558016 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0049.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0020.dll
2013-01-29 15:52 - 2008-06-26 01:34 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons002a.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 12240896 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0007.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 11722752 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0001.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 09892864 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons000a.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 06237696 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons000c.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 06224896 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0027.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 06014976 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons001a.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 05654528 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons000f.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 05090816 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0416.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 05071872 ____A (Microsoft Corporation) C:\Windows\System32\NlsModels0011.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 05031936 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0816.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 04981248 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0013.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 04616192 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0414.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 04175872 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0010.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 04045824 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons003e.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 02644480 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0009.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 02466816 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0011.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 02136064 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0021.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 01808896 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0046.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 01782272 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0039.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 01722368 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons000d.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 01452544 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0003.dll
2013-01-29 15:52 - 2008-06-26 01:33 - 01411072 ____A (Microsoft Corporation) C:\Windows\System32\NlsLexicons0047.dll
2013-01-29 15:26 - 2013-01-29 15:28 - 95023320 ___AT C:\Users\All Users\0tbpw.pad
2013-01-29 15:06 - 2009-12-18 13:52 - 01168384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-01-29 15:06 - 2009-12-18 13:52 - 00832512 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-01-29 15:06 - 2009-12-18 13:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-01-29 15:06 - 2009-12-18 13:51 - 00044544 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-01-29 15:06 - 2009-12-18 13:50 - 03599360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-01-29 15:06 - 2009-12-18 13:50 - 00671232 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-01-29 15:06 - 2009-12-18 13:50 - 00477696 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-01-29 15:06 - 2009-12-18 13:50 - 00459264 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-01-29 15:06 - 2009-12-18 13:49 - 01830912 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-01-29 15:06 - 2009-12-18 13:49 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 06067200 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00385024 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00380928 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00268288 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00180736 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00161792 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00078336 ____A (Microsoft Corporation) C:\Windows\System32\ieencode.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00063488 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00056320 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-01-29 15:06 - 2009-12-18 13:48 - 00044544 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-01-29 15:06 - 2009-12-18 13:47 - 00347136 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-01-29 15:06 - 2009-12-18 13:47 - 00214528 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-01-29 15:06 - 2009-12-18 13:46 - 00124928 ____A (Microsoft Corporation) C:\Windows\System32\advpack.dll
2013-01-29 15:06 - 2009-12-18 13:46 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2013-01-29 15:06 - 2009-12-18 11:46 - 00389120 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-01-29 15:06 - 2009-12-18 11:18 - 00070656 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-01-29 15:06 - 2009-12-18 11:18 - 00026624 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-01-29 15:06 - 2009-12-18 09:45 - 00048128 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-01-29 15:06 - 2009-12-18 09:38 - 01383424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-01-29 15:06 - 2009-12-11 13:15 - 00306688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv.sys
2013-01-29 15:06 - 2009-12-11 13:15 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srvnet.sys
2013-01-29 15:06 - 2009-10-19 15:42 - 00156672 ____A (Microsoft Corporation) C:\Windows\System32\t2embed.dll
2013-01-29 15:06 - 2009-10-19 15:39 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\lpk.dll
2013-01-29 15:06 - 2009-10-19 15:37 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\fontsub.dll
2013-01-29 15:06 - 2009-10-19 15:37 - 00010240 ____A (Microsoft Corporation) C:\Windows\System32\dciman32.dll
2013-01-29 15:06 - 2009-10-19 15:36 - 00034304 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-01-29 15:06 - 2009-10-19 12:45 - 00289792 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-01-29 15:06 - 2009-08-14 17:40 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\netiohlp.dll
2013-01-29 15:06 - 2009-08-14 17:40 - 00015360 ____A (Microsoft Corporation) C:\Windows\System32\netevent.dll
2013-01-29 15:06 - 2009-08-14 15:25 - 00027136 ____A (Microsoft Corporation) C:\Windows\System32\NETSTAT.EXE
2013-01-29 15:06 - 2009-08-14 15:25 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\ARP.EXE
2013-01-29 15:06 - 2009-08-14 15:25 - 00017920 ____A (Microsoft Corporation) C:\Windows\System32\ROUTE.EXE
2013-01-29 15:06 - 2009-08-14 15:25 - 00011264 ____A (Microsoft Corporation) C:\Windows\System32\MRINFO.EXE
2013-01-29 15:06 - 2009-08-14 15:25 - 00010240 ____A (Microsoft Corporation) C:\Windows\System32\finger.exe
2013-01-29 15:06 - 2009-08-14 15:25 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE
2013-01-29 15:06 - 2009-08-14 15:25 - 00008704 ____A (Microsoft Corporation) C:\Windows\System32\HOSTNAME.EXE
2013-01-29 15:05 - 2010-03-04 20:24 - 00434176 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-01-29 15:05 - 2010-02-23 14:14 - 00211968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2013-01-29 15:05 - 2010-02-23 14:14 - 00102400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2013-01-29 15:05 - 2010-02-23 14:14 - 00058368 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2013-01-29 15:05 - 2010-02-18 15:54 - 03502480 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-01-29 15:05 - 2010-02-18 15:54 - 03468168 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-01-29 15:05 - 2009-10-23 18:54 - 00713728 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2013-01-29 15:05 - 2009-09-10 18:38 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2013-01-29 15:05 - 2009-08-10 14:05 - 01406464 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2013-01-29 15:05 - 2009-08-10 14:05 - 01260032 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2013-01-29 15:05 - 2009-08-10 14:05 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml6r.dll
2013-01-29 15:05 - 2009-08-10 14:05 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2013-01-29 15:05 - 2009-07-11 20:32 - 00502272 ____A (Microsoft Corporation) C:\Windows\System32\wlansvc.dll
2013-01-29 15:05 - 2009-07-11 20:32 - 00297984 ____A (Microsoft Corporation) C:\Windows\System32\wlansec.dll
2013-01-29 15:05 - 2009-07-11 20:32 - 00290816 ____A (Microsoft Corporation) C:\Windows\System32\wlanmsm.dll
2013-01-29 15:05 - 2009-07-11 20:32 - 00067584 ____A (Microsoft Corporation) C:\Windows\System32\wlanhlp.dll
2013-01-29 15:05 - 2009-07-11 20:32 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\wlanapi.dll
2013-01-29 15:05 - 2009-07-11 20:26 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\L2SecHC.dll
2013-01-29 15:05 - 2009-07-11 18:25 - 01657350 ____A C:\Windows\System32\wlan.tmf
2013-01-29 15:05 - 2009-06-10 13:16 - 02433536 ____A (Microsoft Corporation) C:\Windows\System32\WMVCORE.DLL
2013-01-29 15:05 - 2009-06-10 13:07 - 02855424 ____A (Microsoft Corporation) C:\Windows\System32\mf.dll
2013-01-29 15:05 - 2009-06-10 13:07 - 00098816 ____A (Microsoft Corporation) C:\Windows\System32\mfps.dll
2013-01-29 15:05 - 2009-06-10 11:15 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\mfpmp.exe
2013-01-29 15:05 - 2009-06-10 11:14 - 00052736 ____A (Microsoft Corporation) C:\Windows\System32\rrinstaller.exe
2013-01-29 15:05 - 2009-06-10 09:50 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\mferror.dll
2013-01-29 15:04 - 2010-01-23 09:05 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-01-29 15:04 - 2010-01-21 17:02 - 00220672 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codecp.acm
2013-01-29 15:04 - 2010-01-21 17:02 - 00062464 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2013-01-29 15:04 - 2009-08-31 16:18 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\mpg2splt.ax
2013-01-29 15:04 - 2009-08-31 16:17 - 01244672 ____A (Microsoft Corporation) C:\Windows\System32\mcmde.dll
2013-01-29 15:04 - 2009-08-31 15:21 - 00292352 ____A (Microsoft Corporation) C:\Windows\System32\psisdecd.dll
2013-01-29 15:04 - 2009-08-31 15:21 - 00217088 ____A (Microsoft Corporation) C:\Windows\System32\psisrndr.ax
2013-01-29 15:04 - 2009-08-31 15:19 - 00080896 ____A (Microsoft Corporation) C:\Windows\System32\MSNP.ax
2013-01-29 15:04 - 2009-08-31 15:19 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\Mpeg2Data.ax
2013-01-29 15:04 - 2009-08-31 15:19 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\MSDvbNP.ax
2013-01-29 15:04 - 2009-08-31 15:17 - 00428032 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
2013-01-29 15:03 - 2010-02-18 15:22 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\tcpipcfg.dll
2013-01-29 15:03 - 2010-02-18 15:19 - 00179712 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll
2013-01-29 15:03 - 2010-02-18 13:05 - 00815104 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-01-29 15:03 - 2010-02-18 13:04 - 00025088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tunnel.sys
2013-01-29 15:03 - 2010-02-18 13:04 - 00022016 ____A (Microsoft Corporation) C:\Windows\System32\netiougc.exe
2013-01-29 15:03 - 2010-02-18 13:04 - 00015360 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TUNMP.SYS
2013-01-29 15:03 - 2010-01-25 13:58 - 00473088 ____A (Microsoft Corporation) C:\Windows\System32\secproc_isv.dll
2013-01-29 15:03 - 2010-01-25 13:58 - 00472576 ____A (Microsoft Corporation) C:\Windows\System32\secproc.dll
2013-01-29 15:03 - 2010-01-25 13:58 - 00154624 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp_isv.dll
2013-01-29 15:03 - 2010-01-25 13:58 - 00154112 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp.dll
2013-01-29 15:03 - 2010-01-25 13:56 - 00312320 ____A (Microsoft Corporation) C:\Windows\System32\msdrm.dll
2013-01-29 15:03 - 2010-01-25 09:36 - 00515584 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate.exe
2013-01-29 15:03 - 2010-01-25 09:36 - 00435712 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp.exe
2013-01-29 15:03 - 2010-01-25 09:36 - 00431104 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp_isv.exe
2013-01-29 15:03 - 2010-01-25 09:35 - 00523776 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_isv.exe
2013-01-29 15:03 - 2009-12-28 13:36 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\tsbyuv.dll
2013-01-29 15:03 - 2009-12-28 13:35 - 01327616 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2013-01-29 15:03 - 2009-12-28 13:34 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\msvfw32.dll
2013-01-29 15:03 - 2009-12-28 13:34 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\msvidc32.dll
2013-01-29 15:03 - 2009-12-28 13:34 - 00022528 ____A (Microsoft Corporation) C:\Windows\System32\msyuv.dll
2013-01-29 15:03 - 2009-12-28 13:34 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msrle32.dll
2013-01-29 15:03 - 2009-12-28 13:33 - 00082944 ____A (Microsoft Corporation) C:\Windows\System32\mciavi32.dll
2013-01-29 15:03 - 2009-12-28 13:32 - 00050176 ____A (Microsoft Corporation) C:\Windows\System32\iyuv_32.dll
2013-01-29 15:03 - 2009-12-28 13:30 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\avifil32.dll
2013-01-29 15:03 - 2009-12-28 13:30 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\avicap32.dll
2013-01-29 15:03 - 2009-10-07 13:47 - 00274432 ____A (Microsoft Corporation) C:\Windows\System32\raschap.dll
2013-01-29 15:03 - 2009-10-07 13:47 - 00232960 ____A (Microsoft Corporation) C:\Windows\System32\rastls.dll
2013-01-29 15:03 - 2009-09-14 10:50 - 00130048 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv2.sys
2013-01-29 15:03 - 2009-09-04 13:38 - 00060928 ____A (Microsoft Corporation) C:\Windows\System32\msasn1.dll
2013-01-29 15:03 - 2009-08-29 04:41 - 01686528 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll
2013-01-29 15:03 - 2009-08-29 04:40 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\Apphlpdm.dll
2013-01-29 15:03 - 2009-08-29 00:31 - 04247552 ____A (Microsoft) C:\Windows\System32\GameUXLegacyGDFs.dll
2013-01-29 15:03 - 2009-08-14 18:16 - 00213592 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2013-01-29 15:03 - 2009-08-14 15:01 - 02031104 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-01-29 15:03 - 2009-08-10 14:08 - 00321536 ____A (Microsoft Corporation) C:\Windows\System32\WSDApi.dll
2013-01-29 15:03 - 2009-06-04 13:40 - 00512000 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-01-29 15:03 - 2009-04-02 12:50 - 00604672 ____A (Microsoft Corporation) C:\Windows\System32\WMSPDMOD.DLL
2013-01-29 15:02 - 2009-09-10 18:40 - 10622464 ____A (Microsoft Corporation) C:\Windows\System32\wmp.dll
2013-01-29 15:02 - 2009-09-10 18:40 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\msdxm.ocx
2013-01-29 15:02 - 2009-09-10 18:40 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\dxmasf.dll
2013-01-29 15:02 - 2009-09-10 18:39 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\spwmp.dll
2013-01-29 15:02 - 2009-09-10 16:29 - 08147968 ____A (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2013-01-29 15:02 - 2009-09-10 16:29 - 00311296 ____A (Microsoft Corporation) C:\Windows\System32\unregmp2.exe
2013-01-29 14:56 - 2009-06-15 19:12 - 00408136 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-01-29 14:56 - 2009-06-15 16:29 - 00175104 ____A (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2013-01-29 14:56 - 2009-06-15 16:28 - 00272384 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-01-29 14:56 - 2009-06-15 16:28 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-01-29 14:56 - 2009-06-15 16:23 - 01233920 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-01-29 14:56 - 2009-06-15 16:23 - 00494592 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2013-01-29 14:56 - 2009-06-15 14:10 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-01-29 14:54 - 2009-12-23 13:45 - 00171520 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-01-29 14:53 - 2010-01-13 19:23 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\cabview.dll
2013-01-29 14:35 - 2013-01-29 14:35 - 00001912 ____A C:\Windows\epplauncher.mif
2013-01-29 14:35 - 2013-01-29 14:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-01-29 14:34 - 2013-01-30 11:53 - 00232336 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-01-29 11:37 - 2013-02-01 18:40 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-01-29 11:37 - 2013-01-29 11:37 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-01-29 11:37 - 2013-01-29 11:37 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-01-29 10:21 - 2012-07-06 02:28 - 00007524 ____A C:\Windows\System32\net8192cu.cat
2013-01-29 10:21 - 2012-05-14 17:41 - 00764520 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\rtl8192cu.sys
2013-01-29 10:20 - 2012-05-14 10:41 - 00764520 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\RTL8192cu.sys
2013-01-29 10:19 - 2013-01-29 10:19 - 00000000 ____D C:\Users\All Users\TP-LINK

==================== One Month Modified Files and Folders ========

2013-02-14 16:50 - 2008-03-22 16:18 - 01862437 ____A C:\Windows\WindowsUpdate.log
2013-02-14 16:50 - 2006-11-02 14:01 - 00032620 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-02-14 16:50 - 2006-11-02 14:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-02-14 16:49 - 2008-01-03 04:16 - 00000000 ____D C:\Users\All Users\NVIDIA
2013-02-14 16:49 - 2006-11-02 13:47 - 00003072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-02-14 16:49 - 2006-11-02 13:47 - 00003072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-02-13 12:14 - 2013-02-01 16:20 - 95023320 ___AT C:\Users\All Users\558975.pad
2013-02-13 12:00 - 2009-11-30 13:30 - 00000040 ___SH C:\Users\All Users\.zreglib
2013-02-13 10:08 - 2008-03-22 16:46 - 00041472 ____A C:\Users\Holzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-13 10:03 - 2006-11-02 11:33 - 01488910 ____A C:\Windows\System32\PerfStringBackup.INI
2013-02-05 19:00 - 2008-03-22 16:41 - 00000342 ____A C:\Windows\Tasks\Erweiterte Garantie.job
2013-02-01 18:40 - 2013-01-29 11:37 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-02-01 17:56 - 2008-01-03 04:29 - 00000000 ____D C:\Users\All Users\Sonic
2013-02-01 17:38 - 2008-03-22 16:30 - 00000000 ____D C:\users\Holzer
2013-02-01 17:38 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\spool
2013-02-01 17:38 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-02-01 17:38 - 2006-11-02 11:22 - 31457280 ____A C:\Windows\System32\config\software_previous
2013-02-01 17:38 - 2006-11-02 11:22 - 16515072 ____A C:\Windows\System32\config\system_previous
2013-02-01 17:36 - 2006-11-02 11:22 - 34078720 ____A C:\Windows\System32\config\components_previous
2013-02-01 17:36 - 2006-11-02 11:22 - 00262144 ____A C:\Windows\System32\config\sam_previous
2013-02-01 17:28 - 2006-11-02 11:22 - 00262144 ____A C:\Windows\System32\config\security_previous
2013-02-01 17:28 - 2006-11-02 11:22 - 00262144 ____A C:\Windows\System32\config\default_previous
2013-02-01 16:20 - 2013-02-01 16:20 - 00192000 ____A C:\Users\Holzer\579855.exe
2013-01-31 15:12 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-01-31 14:43 - 2008-01-03 12:35 - 00000000 ____D C:\Windows\System32\Drivers\de-DE
2013-01-31 14:43 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-01-30 18:47 - 2008-01-03 04:37 - 00056338 ____A C:\Windows\PFRO.log
2013-01-30 11:53 - 2013-01-29 14:34 - 00232336 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-01-30 00:44 - 2008-03-22 16:39 - 00082392 ____A C:\Users\Holzer\AppData\Local\GDIPFONTCACHEV1.DAT
2013-01-30 00:43 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-01-30 00:39 - 2006-11-02 13:47 - 00320512 ____A C:\Windows\System32\FNTCACHE.DAT
2013-01-30 00:37 - 2006-11-02 13:37 - 00000000 ____D C:\Program Files\Movie Maker
2013-01-29 17:50 - 2013-01-29 17:47 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-01-29 17:49 - 2013-01-29 17:49 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Startmenü
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Netzwerkumgebung
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Druckumgebung
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Documents\Eigene Musik
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-01-29 17:49 - 2013-01-29 17:49 - 00000000 __SHD C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-01-29 17:47 - 2013-01-29 17:47 - 00000000 ____D C:\Users\All Users\NVIDIA Corporation
2013-01-29 17:44 - 2013-01-29 17:44 - 00000000 ____D C:\Program Files\Microsoft CAPICOM 2.1.0.2
2013-01-29 17:41 - 2008-01-03 04:35 - 00000000 ____D C:\Program Files\Microsoft Works
2013-01-29 17:38 - 2013-01-29 17:38 - 00000000 ___RD C:\Program Files\Skype
2013-01-29 17:38 - 2013-01-29 17:38 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-01-29 17:38 - 2008-01-03 04:35 - 00000000 ____D C:\Users\All Users\Skype
2013-01-29 17:36 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-01-29 17:33 - 2013-01-29 17:33 - 00282618 ____A C:\Windows\msxml4-KB973688-enu.LOG
2013-01-29 16:30 - 2013-01-29 16:30 - 00001994 ____A C:\Windows\IE9_main.log
2013-01-29 16:20 - 2008-03-22 18:06 - 00000000 ____D C:\Users\Holzer\AppData\Roaming\Mozilla
2013-01-29 16:19 - 2013-01-29 16:19 - 00000883 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-01-29 16:19 - 2013-01-29 16:19 - 00000000 ____D C:\Users\All Users\Mozilla
2013-01-29 16:19 - 2013-01-29 16:19 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-01-29 16:19 - 2008-01-03 04:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-01-29 15:28 - 2013-01-29 15:26 - 95023320 ___AT C:\Users\All Users\0tbpw.pad
2013-01-29 14:35 - 2013-01-29 14:35 - 00001912 ____A C:\Windows\epplauncher.mif
2013-01-29 14:35 - 2013-01-29 14:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-01-29 11:37 - 2013-01-29 11:37 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-01-29 11:37 - 2013-01-29 11:37 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-01-29 10:21 - 2008-01-03 04:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-01-29 10:19 - 2013-01-29 10:19 - 00000000 ____D C:\Users\All Users\TP-LINK
2013-01-28 21:48 - 2008-03-22 18:11 - 00000000 ____D C:\Filme
2013-01-28 21:45 - 2008-04-05 13:46 - 00000000 ___AD C:\HipHop Clips

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-01-29 14:34:00
Restore point made on: 2013-01-29 14:38:42
Restore point made on: 2013-01-29 17:31:35
Restore point made on: 2013-01-30 18:52:18
Restore point made on: 2013-01-30 18:59:09
Restore point made on: 2013-01-31 14:42:30
Restore point made on: 2013-02-01 16:22:29

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 3069.88 MB
Available physical RAM: 2654.71 MB
Total Pagefile: 2842.17 MB
Available Pagefile: 2694.81 MB
Total Virtual: 2047.88 MB
Available Virtual: 1975.71 MB

==================== Partitions =============================

1 Drive c: (HDD) (Fixed) (Total:457.76 GB) (Free:73.9 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
3 Drive e: (_OEMBP) (Fixed) (Total:8.01 GB) (Free:5.86 GB) NTFS ==>[System with boot components (obtained from reading drive)]
4 Drive f: (HITMANPRO) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32
9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Datentr ### Status Gr”áe Frei Dyn GPT
-------- ---------- ------- ------- --- ---
0 Online 466 GB 0 B
1 Online 7640 MB 0 B
2 Kein Mediu 0 B 0 B
3 Kein Mediu 0 B 0 B
4 Kein Mediu 0 B 0 B
5 Kein Mediu 0 B 0 B

Last Boot: 2013-02-13 11:40

==================== End Of Log ============================

aharonov · 14.02.2013, 17:50

Hey,

im ersten Schritt entfernen wir den Sperrbildschirm, danach solltest du wieder normal starten können.

Schritt 1

Drücke auf einem Zweitrechner bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument:

Code:

ATTFilter

2013-01-29 15:28 - 2013-01-29 15:26 - 95023320 ___AT C:\Users\All Users\0tbpw.pad
2013-02-01 16:20 - 2013-02-01 16:20 - 00192000 ____A C:\Users\Holzer\579855.exe
2013-02-13 12:14 - 2013-02-01 16:20 - 95023320 ___AT C:\Users\All Users\558975.pad

Speichere dieses dann bitte unter dem Dateinamen Fixlist.txt auf deinen USB Stick neben FRST.

Schliesse den USB Stick wieder an den infizierten Rechner an.
Starte deinen Rechner erneut in die Reparaturoptionen.
Starte nun wiederum FRST, aber klicke dieses Mal auf den Fix Button.

Das Tool erstellt eine Datei Fixlog.txt auf deinem USB Stick. Poste deren Inhalt bitte hier.

Diese Schritte noch ausführen, wenn du wieder normal aufstarten konntest.

Schritt 2

Downloade dir bitte defogger (von jpshortstuff) auf deinen Desktop.

Starte das Tool mit Doppelklick.
Klicke nun auf den Disable Button.
Bestätige diese Sicherheitsabfrage mit Ja.
Wenn der Scan beendet wurde (Finished), klicke auf OK.
Falls Defogger zu einem Neustart auffordert, bestätige dies mit OK.
Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.txt.
Nur falls Probleme aufgetreten sind, poste deren Inhalt mit deiner nächsten Antwort.

Klicke den Re-enable Button nicht ohne Anweisung!

Schritt 3

Lade dir Gmer herunter (auf den Button Download EXE drücken) und speichere das Programm auf den Desktop.

Deaktiviere alle Antivirenprogramme und Malware/Spyware Scanner.
Trenne alle bestehenden Verbindungen zu einem Netzwerk/Internet (WLAN nicht vergessen).
Schliesse bitte alle anderen Programme.
Starte gmer.exe (die Datei hat einen zufälligen Dateinamen).
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Sollte sich ein Fenster mit folgender Warnung öffnen
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?
dann klicke unbedingt auf No.
Entferne rechts den Haken bei:
- IAT/EAT
- Show all
Setze rechts den Haken bei deiner Systempartition (normalerweise C:\).
Starte den Scan mit einem Klick auf Scan.
Mache gar nichts am Computer, während der Scan läuft!
Wenn der Scan fertig ist, klicke auf Save und speichere das Logfile unter Gmer.txt auf deinen Desktop.
Schliesse dann GMER und führe unmittelbar einen Neustart des Computers durch.
Füge bitte den Inhalt des Logfiles hier in deine Thread ein.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor du ins Netz gehst.

Schritt 4

Lade dir bitte OTL (von Oldtimer) herunter und speichere es auf deinen Desktop.

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

regsvr32 wmisvc.dll /c

Schliesse bitte nun alle anderen Programme.
Klicke nun auf den Quick Scan Button.
Kopiere danach den Inhalt von OTL.txt und Extras.txt hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Fixlog von FRST
Log von Gmer
Logs von OTL

Amstaff3 · 14.02.2013, 18:15

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-02-2013
Ran by SYSTEM at 2013-02-14 18:12:32 Run:1
Running from F:\

==============================================

C:\Users\All Users\0tbpw.pad moved successfully.
C:\Users\Holzer\579855.exe moved successfully.
C:\Users\All Users\558975.pad moved successfully.

==== End of Fixlog ====

Hab ein Problem mit Gmer. Es zeigt mir an dass es aufgrund eines Problems nicht richtig ausgefuhrt werden konnte

Hab ein Problem mit gmer. es konnte nicht richtig ausgeführt werden..

Hab ein Problem mit gmer. Programm konnte nicht richtig ausgeführt werden.. worankann das liegen?

aharonov · 14.02.2013, 20:34

Kann ich so noch nicht sagen, mach mal weiter mit Schritt 4.

Amstaff3 · 15.02.2013, 07:13

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 15.02.2013 07:01:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Holzer\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,22% Memory free
6,17 Gb Paging File | 5,28 Gb Available in Paging File | 85,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 457,76 Gb Total Space | 72,60 Gb Free Space | 15,86% Space Free | Partition Type: NTFS
 
Computer Name: HOLZER-PC | User Name: Holzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.15 06:56:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Holzer\Desktop\OTL.exe
PRC - [2012.10.10 21:15:04 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.09.12 17:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2009.12.18 11:18:29 | 000,301,568 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\ieuser.exe
PRC - [2009.08.15 01:28:50 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.08.13 17:30:50 | 000,067,128 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2009.04.29 18:55:24 | 003,338,240 | ---- | M] (Electronic Arts) -- C:\Programme\Electronic Arts\EADM\Core.exe
PRC - [2009.04.02 17:05:22 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2009.03.31 08:39:36 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2008.06.25 23:05:47 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.03 12:44:02 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.11.15 09:12:04 | 000,784,912 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe
PRC - [2007.11.15 09:08:26 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2007.07.19 14:32:34 | 001,120,568 | ---- | M] (Packard Bell BV) -- C:\Programme\Packard Bell\SetUpMyPC\SmpSys.exe
PRC - [2007.06.12 23:36:04 | 000,102,400 | ---- | M] () -- C:\Programme\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
PRC - [2007.03.01 15:38:48 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.02.21 02:18:32 | 000,366,400 | ---- | M] (Google Inc.) -- C:\Programme\Picasa2\PicasaMediaDetector.exe
PRC - [2007.01.11 11:40:22 | 000,232,184 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2007.01.11 11:40:18 | 000,017,656 | ---- | M] (Sonic Solutions) -- C:\Programme\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006.11.02 13:35:38 | 000,191,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\p2phost.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.08.13 17:30:48 | 000,061,496 | ---- | M] () -- C:\Programme\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\clntutil.dll
MOD - [2007.06.12 23:36:12 | 000,180,224 | ---- | M] () -- C:\Programme\CyberLink\MagicSports\Kernel\MagicSports\MediaObj.dll
MOD - [2007.06.12 23:36:06 | 000,208,896 | ---- | M] () -- C:\Programme\CyberLink\MagicSports\Kernel\MagicSports\OptCVw7.dll
MOD - [2007.06.12 23:36:04 | 000,102,400 | ---- | M] () -- C:\Programme\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
MOD - [2007.03.06 10:47:28 | 000,028,672 | ---- | M] () -- C:\Programme\CyberLink\Shared Files\richvideops.dll
MOD - [2007.01.11 11:02:14 | 004,587,520 | R--- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Users\Holzer\579855.exe -- (Winmgmt)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)
SRV - [2013.02.15 06:41:12 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.16 21:09:27 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.10 21:15:04 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.07.13 13:39:50 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2009.03.31 08:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008.04.07 08:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.01.03 12:44:02 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.11.15 09:09:42 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2006.12.14 01:21:20 | 000,045,056 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2006.12.14 01:02:08 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2006.12.14 00:46:16 | 000,057,344 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2006.11.02 13:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKsleccc8ee7.sys -- (MpKsleccc8ee7)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKslc4c0faa5.sys -- (MpKslc4c0faa5)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKslb1e16cd3.sys -- (MpKslb1e16cd3)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKsl9c2f3cfe.sys -- (MpKsl9c2f3cfe)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKsl446d2faa.sys -- (MpKsl446d2faa)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4AAEE0E8-D730-4284-B410-7904A7B126AB}\MpKsl0ac7de5f.sys -- (MpKsl0ac7de5f)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.10.10 21:14:28 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.05.14 10:41:29 | 000,764,520 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8192cu.sys -- (RTL8192cu)
DRV - [2011.01.08 12:16:20 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.01.08 12:16:20 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.04.05 07:25:19 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009.03.31 08:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009.03.20 09:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009.03.20 09:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus)
DRV - [2009.03.20 09:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV - [2008.08.01 14:27:35 | 000,099,648 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2008.06.25 23:06:05 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2007.09.21 02:11:02 | 000,028,432 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2007.09.21 02:10:46 | 000,036,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007.09.21 02:10:40 | 000,035,088 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.09.21 02:10:20 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007.09.17 14:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007.05.02 10:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007.05.02 10:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007.05.02 10:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus)
DRV - [2006.11.02 08:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! Deutschland
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Nachrichten - Service - Shopping bei t-online.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7PBEA
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-divx
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "DAEMON Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.29 16:19:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.01.29 16:19:11 | 000,000,000 | ---D | M]
 
[2013.01.29 16:20:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Holzer\AppData\Roaming\mozilla\Extensions
[2008.03.22 18:06:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Holzer\AppData\Roaming\mozilla\Firefox\Profiles\h4oqspno.default\extensions
[2009.04.05 07:29:51 | 000,002,921 | ---- | M] () -- C:\Users\Holzer\AppData\Roaming\mozilla\firefox\profiles\h4oqspno.default\searchplugins\daemon-search.xml
[2013.01.29 16:19:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2008.01.03 04:25:41 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013.01.16 21:10:14 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2007.06.11 16:15:58 | 002,115,816 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll
[2013.01.17 01:11:04 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.17 01:11:04 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.01.17 01:11:04 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.17 01:11:04 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.17 01:11:04 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.17 01:11:04 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Google\Google_BAE\BAE.dll (Packard Bell)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MSPService] C:\Programme\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe ()
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\Packard Bell\GOOGLE_EULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [CollaborationHost] C:\Windows\System32\p2phost.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [SmpcSys] C:\Programme\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3375EE2-EF51-44E5-96BF-14CB68EE4477}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1A06106-9DF7-4923-93D3-915FC6A8AAB8}: NameServer = 192.168.2.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Holzer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Holzer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{b6c0da46-21aa-11de-89d2-001c25821631}\Shell - "" = AutoRun
O33 - MountPoints2\{b6c0da46-21aa-11de-89d2-001c25821631}\Shell\AutoRun\command - "" = I:\setup.exe
O33 - MountPoints2\{b6c0da75-21aa-11de-89d2-001c25821631}\Shell - "" = AutoRun
O33 - MountPoints2\{b6c0da75-21aa-11de-89d2-001c25821631}\Shell\AutoRun\command - "" = I:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.15 06:56:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Holzer\Desktop\OTL.exe
[2013.02.14 16:59:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013.02.13 08:57:57 | 000,000,000 | ---D | C] -- C:\Temp
[2013.01.29 17:48:33 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2013.01.29 17:47:36 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2013.01.29 17:47:22 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2013.01.29 17:44:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2013.01.29 17:41:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
[2013.01.29 17:38:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.01.29 17:38:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013.01.29 17:38:24 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2013.01.29 16:19:33 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.01.29 16:19:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.01.29 14:35:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2013.01.29 10:23:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK
[2013.01.29 10:19:30 | 000,000,000 | ---D | C] -- C:\ProgramData\TP-LINK
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.15 07:00:04 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie.job
[2013.02.15 06:56:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Holzer\Desktop\OTL.exe
[2013.02.15 06:41:13 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.15 06:29:14 | 000,000,040 | -HS- | M] () -- C:\ProgramData\.zreglib
[2013.02.15 06:29:05 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.15 06:29:05 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.15 06:28:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.14 20:40:37 | 252,397,780 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.02.14 18:45:44 | 000,374,784 | ---- | M] () -- C:\Users\Holzer\Desktop\fezrfd39.exe
[2013.02.14 18:39:11 | 000,000,176 | ---- | M] () -- C:\Users\Holzer\defogger_reenable
[2013.02.14 18:37:54 | 000,050,477 | ---- | M] () -- C:\Users\Holzer\Desktop\Defogger.exe
[2013.02.13 10:08:05 | 000,041,472 | ---- | M] () -- C:\Users\Holzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.02.13 10:03:11 | 000,650,364 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.13 10:03:11 | 000,617,860 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.13 10:03:11 | 000,120,530 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.13 10:03:11 | 000,107,004 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.30 00:39:54 | 000,320,512 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.29 16:19:34 | 000,000,883 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.29 14:35:53 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.14 19:10:58 | 252,397,780 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.02.14 18:45:42 | 000,374,784 | ---- | C] () -- C:\Users\Holzer\Desktop\fezrfd39.exe
[2013.02.14 18:38:58 | 000,000,176 | ---- | C] () -- C:\Users\Holzer\defogger_reenable
[2013.02.14 18:37:52 | 000,050,477 | ---- | C] () -- C:\Users\Holzer\Desktop\Defogger.exe
[2013.01.29 16:19:34 | 000,000,895 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.01.29 16:19:34 | 000,000,883 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.29 15:05:40 | 001,657,350 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2013.01.29 14:35:53 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.01.29 14:35:48 | 000,001,863 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013.01.29 11:37:08 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.29 10:21:11 | 000,014,780 | ---- | C] () -- C:\Windows\System32\net8192cu.inf
[2013.01.29 10:21:11 | 000,007,524 | ---- | C] () -- C:\Windows\System32\net8192cu.cat
[2009.11.30 13:30:37 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.04.05 15:22:48 | 000,000,680 | ---- | C] () -- C:\Users\Holzer\AppData\Local\d3d9caps.dat
[2008.12.05 11:42:45 | 000,139,152 | ---- | C] () -- C:\Users\Holzer\AppData\Roaming\PnkBstrK.sys
[2008.08.16 10:02:45 | 000,000,116 | ---- | C] () -- C:\Users\Holzer\AppData\Roaming\wklnhst.dat
[2008.03.28 01:33:33 | 000,018,311 | ---- | C] () -- C:\Users\Holzer\AppData\Roaming\UserTile.png
[2008.03.22 23:38:41 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008.03.22 16:46:12 | 000,041,472 | ---- | C] () -- C:\Users\Holzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.03.22 16:39:58 | 000,000,094 | ---- | C] () -- C:\Users\Holzer\AppData\Local\fusioncache.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2009.08.15 01:30:19 | 011,315,712 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.08.15 01:26:59 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2006.11.02 10:46:13 | 000,348,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2010.05.06 08:51:05 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\CoSoSys
[2009.04.04 21:38:57 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\DAEMON Tools
[2009.04.04 21:43:06 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\DAEMON Tools Lite
[2009.04.05 15:58:53 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\DAEMON Tools Pro
[2008.12.21 16:06:22 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\Digital Red
[2011.12.17 18:29:13 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\iShell
[2008.03.24 12:25:27 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\Packard Bell
[2009.06.09 16:22:46 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\PC Suite
[2008.03.28 01:33:33 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\PeerNetworking
[2009.06.11 15:45:16 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\Samsung
[2008.08.16 10:03:44 | 000,000,000 | ---D | M] -- C:\Users\Holzer\AppData\Roaming\Template
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< regsvr32 wmisvc.dll /c >
 
<           >
[2006.11.02 14:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006.11.02 14:01:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2008.03.22 16:41:01 | 000,000,342 | ---- | C] () -- C:\Windows\Tasks\Erweiterte Garantie.job
[2013.01.29 11:37:08 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\World in Conflict:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\The KMPlayer:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\Samsung PC Studio:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\Samsung PC Studio 3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\My Games:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\Meine Projekte:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\HipHop Clips:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\GameShadow:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\Eigene Google Gadgets:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\DIE SIEDLER - Aufstieg eines Königreichs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\Codemasters:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Documents\ArmA:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Holzer\Desktop\BF 2 patches:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\HipHop Clips:Roxio EMC Stream
@Alternate Data Stream - 36 bytes -> C:\Users\Holzer\Desktop\PAL ONE_The Whole World VIDEO.mpg:KAVICHS

< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 15.02.2013 07:01:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Holzer\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,22% Memory free
6,17 Gb Paging File | 5,28 Gb Available in Paging File | 85,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 457,76 Gb Total Space | 72,60 Gb Free Space | 15,86% Space Free | Partition Type: NTFS
 
Computer Name: HOLZER-PC | User Name: Holzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06B4A9C1-A390-4E71-B8F3-58A2F623E7B2}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{0EDA8D64-B330-4E49-9EB9-91B8C92DD4F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1142383B-6FBE-4A3F-846A-798E5B652CCA}" = rport=5358 | protocol=6 | dir=out | app=system | 
"{20A653BE-C7EB-4451-A8EA-003E8E8726C7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2FF73FE1-E170-4F8E-96B3-D767CE9A179D}" = rport=138 | protocol=17 | dir=out | app=system | 
"{301B4A64-8842-4B9F-8502-A87DB2E66EE3}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{3057D3D7-F8B7-413B-9BF3-25428D84B316}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{3A9C6BB6-954F-4F21-A8B2-E678296D6EFE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3D83CBDE-871A-4A69-BBED-58E19D24A12C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{4403BB7C-CD1A-4A6B-BCDA-868FE50F45E8}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{56BA5EBA-0E98-4B1A-91D3-EE48BBAED25F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{5B00D58A-BE64-4B77-9F1D-A23CE07EE551}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{5E8299DA-649B-4924-BA49-4708FD6C136B}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{630C39D4-7BAF-4AA6-9C97-C59A451C55B0}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{63654153-E8FE-4EAB-8DCA-ED5ACC897AE7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{699B5DD9-19DF-414D-8EB0-DCE68B18D395}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{6EE033E4-58C3-44CF-8F68-9C989474BBBB}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{7C57E783-DED1-4539-9C30-02681447F0C5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7C8607FC-31AB-4A9F-B762-2A88F6CE6C5B}" = lport=445 | protocol=6 | dir=in | app=system | 
"{82652868-C9F8-4547-80D4-1E2E8A57EF78}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{84766A90-ADF3-4306-A60C-567026CCDD45}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{87EB16E6-D363-4A97-85BB-9956A53C39A2}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{8D6F5CD6-6368-49F0-A586-120052BD6E86}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{986E7003-4C30-46ED-B6B4-0671E13EE209}" = lport=139 | protocol=6 | dir=in | app=system | 
"{99925B6C-4B61-494B-BA6C-7E87517F6D74}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{9EEB47F0-1E76-4DD9-B982-19B35A10DCAA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A1742874-D98E-444F-8525-673D170747F4}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{A39B2525-9EBD-475E-BF55-648C52AD594C}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{A3EAD7E0-3336-46A2-9780-5E6099241F89}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{AB8FF170-7A96-4E54-A1BD-747596D879B0}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{BE256E25-5469-4DDB-83CA-66ADBE00C49D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{C1DA485B-FE90-4C62-8C6F-65CB9CBB7A36}" = rport=5357 | protocol=6 | dir=out | app=system | 
"{C22BE4BC-43CB-443C-A9F3-BE9E125A21DF}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{C7AF681F-66AD-455E-B1B6-1CEEEED44D67}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{CC849320-2D20-4CB8-8119-C458A05E9CDE}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{D5975869-C818-4D23-B9E4-9B59C867431B}" = lport=5357 | protocol=6 | dir=in | app=system | 
"{E2AF660E-0052-4ECD-9C51-C16910ABED0C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{E73D60ED-3145-4AB3-BBD8-2BE227CA22FF}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{EA7C16E6-C6E1-4133-8EF0-410D9633EF15}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{EC43B7BF-7110-46F7-9B08-8FDE589369CB}" = rport=445 | protocol=6 | dir=out | app=system | 
"{ED1EF4DF-CF94-40BD-9AE8-EABD507CB297}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FB79DD39-5A75-4A9D-BAE5-1BE50577EB62}" = lport=5358 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03423A93-5267-4584-A43F-17A9746DBEC3}" = protocol=6 | dir=in | app=c:\program files\sony\media manager for walkman\mediamanager.exe | 
"{09F8EF37-48E9-492F-A7C2-9404FC8F66A1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{0B1905A8-2752-4FE8-81E8-A5E428AB7BC5}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{0ED07E5F-75DB-4C1C-9BF8-846FA9667622}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{13CD3855-E665-4474-BA0F-86F636CA2EC0}" = protocol=6 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\extra1\bin\settlers6.exe | 
"{141DAFA7-9468-4F1C-8E85-AFD849531BD7}" = protocol=17 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{19CD5D9A-33D1-4110-83FF-E7BBA7A42EA3}" = protocol=6 | dir=in | app=c:\program files\codemasters\overlord ii\overlord2.exe | 
"{21915841-0804-449F-91CB-F8771D09A582}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{21B58C2A-A272-4357-B74C-457E512D715C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{22890B4B-5188-4DAB-976E-67344A14C029}" = protocol=6 | dir=in | app=c:\program files\activision\prototype\prototypef.exe | 
"{231C336D-D673-4A19-A072-17C425F8F247}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe | 
"{274CFF5C-3015-4D55-9C17-A812492C4768}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{299A1B2D-B535-478D-9384-8CC02DD5B2EA}" = protocol=6 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mplite.exe | 
"{2AFC86B3-0F9F-47BA-97F7-F75CFE638310}" = protocol=6 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{2D8F811D-418E-4BA5-804E-36DD7CF981E0}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{2E028527-2EF1-4DC4-AF25-DFC689AC235F}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{2FE4F36C-CFEE-4360-8228-572CB412E53F}" = protocol=17 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe | 
"{303CB57C-B259-4810-B0BF-57C2F1B8427D}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic.exe | 
"{331D2F7C-6035-4D0E-90F4-2EE4A11FE468}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{334037FA-CE81-4B4F-B364-FE2475D7F2AA}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{396472BD-6CBF-4022-83E5-675F5E2147BC}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{39C7D627-D891-42E9-AE1A-16A794743A66}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3D3D2EA3-4D87-41DE-9D3B-3AED0747B965}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{4264C830-C672-4C62-B863-7A090FD60645}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\binaries\endwar.exe | 
"{44AF49EE-7B03-4EB7-9248-7B408B797624}" = protocol=6 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe | 
"{453520B4-F909-420F-B627-074C9FB90B8F}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{4657DA5B-1D36-48DB-AC1F-387C147A43A4}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\f.e.a.r. mission perseus\fearxp2.exe | 
"{46CEBF59-DF6F-4688-A4F3-C278B05EA697}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{4AF9AD46-295D-47E2-98A4-26BC3391E3BF}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{4C9B5A15-E53E-41B3-B15B-AE60F8CF8FFF}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\tom clancy's endwar launcher.exe | 
"{4D7D04F6-6546-43F8-A33F-F87C5E76946C}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{4F58406C-48C5-4D95-ACBA-8F02FFC02C5C}" = protocol=17 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mplite.exe | 
"{515D6C27-191C-47F9-A615-3BE823716FAB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{548E6AA0-62DF-45CF-9027-FC95FD331E96}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{58B72CCF-2F27-4F9E-84C2-7052A7A0AF33}" = dir=in | app=c:\program files\cyberlink\magicsports\magicsports.exe | 
"{5A733BC6-5926-4925-AD1A-3C956BBEFBAD}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{5AA99FF1-BD26-479A-A6BF-6D7C7BB551D6}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_ds.exe | 
"{5CB23BFC-6980-4618-B462-61B2A36A3ED7}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{60D5428F-2C27-440F-970B-2DAE01888177}" = protocol=6 | dir=in | app=c:\program files\codemasters\of dragon rising\ofdr.exe | 
"{65720F9E-6648-4478-8A36-13D75A7E4F3F}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{67038229-80F9-44D9-A40C-36F5DC5C04B2}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 
"{69B7B76A-B5A0-4AAE-9CE2-226BCF68F210}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe | 
"{6B7A9F8C-6B67-4C52-8C0A-8830C3CAC2D4}" = protocol=6 | dir=in | app=c:\program files\thq\frontlines-fuel of war\binaries\ffow.exe | 
"{6C41DB79-41CC-4C59-B0CC-D8E79D08C07B}" = protocol=17 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe | 
"{6C703B3E-9291-4825-B05B-7037BD54B8B7}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{6DC96E73-F3A7-4630-B421-FAC96A6DBBE8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6E5F16E3-2D57-4950-A7AE-A74DD32572DF}" = protocol=17 | dir=in | app=c:\program files\activision\prototype\prototypef.exe | 
"{7028B332-4F22-4894-9F99-1436D736140E}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{7254B0ED-2690-4C13-8075-6236C31F08FA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{72FD8A21-2B85-459E-AF27-DE551515EBB5}" = protocol=17 | dir=in | app=c:\program files\sony\media manager for walkman\mediamanager.exe | 
"{746D41E4-BAD3-428C-840D-2543807DAAB5}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{75366667-E87B-4F3C-BD4A-8879CF3BC854}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_online.exe | 
"{758B08B5-A11D-476B-B04B-EB75EB2E6F81}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 
"{7611832F-BE0F-42E1-8143-2DAD4374313C}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\f.e.a.r. mission perseus\fearxp2.exe | 
"{7FD96175-C48D-4E03-8CD8-2367E20A9CEE}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{84D31384-78DE-48ED-8C79-EC36AC84524F}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{86832F7F-4FF4-46FD-81BC-B91BAC70D61C}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{87F1E37E-F7C4-48EC-8242-3981DFC9618F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{8A4E30E5-03C5-41AC-A40A-CB4FB34C7628}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 
"{8E1BA165-EFCD-405A-8F09-139AA0D2F4F5}" = protocol=17 | dir=in | app=c:\program files\thq\frontlines-fuel of war\binaries\ffow.exe | 
"{9347A837-FF0A-4B98-A6E9-867324E7DEF1}" = protocol=6 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe | 
"{96B7671E-F886-4281-8D99-D33A90E1511B}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{96E347ED-8494-43C0-B2C3-DC16AAD5A034}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{9DA5152E-1957-479A-95E3-D038BCEA1D6F}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{9F04B5DA-C357-44CD-97F7-08F30F031ED9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{9F4C300B-C1DC-4AE0-80C8-497B220BCFB8}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{9FE59D6A-1986-4E30-8E37-33B536E20088}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{A2C9D4C5-720C-4C31-8BD7-4E2824DE5D83}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{ACC9D29D-A435-439D-9EF1-B53192E48DD1}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe | 
"{AE494473-DA58-4222-B443-A4705D988EAE}" = protocol=17 | dir=in | app=c:\program files\codemasters\overlord ii\overlord2.exe | 
"{AEC2D037-7BDC-4C59-8E45-817C9945A1E8}" = protocol=17 | dir=in | app=c:\program files\codemasters\of dragon rising\ofdr.exe | 
"{AF08872E-7671-4F03-98AF-6448591418A6}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 
"{B0C6E591-89F9-4BB6-91F3-1F4ED6415424}" = protocol=6 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mp.exe | 
"{B165ADC7-289C-4927-8B24-1397987ECABA}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{B2D13E1D-00BF-4FAE-9D65-F5543B83A2CE}" = protocol=17 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mp.exe | 
"{B5D70C87-01B9-431D-9DDD-96CB169D5CA3}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\tom clancy's endwar launcher.exe | 
"{BD23712D-B24D-435A-BEE9-49C1E0C27F88}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C05C9D3B-55BA-4822-A813-73ED2BAE8CAE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C0B7DCDC-B977-4B58-B2E8-670B87F802C5}" = protocol=6 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{C51DA4FF-756A-4318-B93E-F4DB391648F6}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{C5CA968F-60FA-4D8F-B290-3AF897A3174F}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{C921294D-5F88-41B8-9AB0-60EAEA4C1999}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{CB1598D9-D60C-4519-ABE0-7BE7F56A0186}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{CB797CFE-85D7-4193-99B2-FDB9398EFF73}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{CC25E8BB-B5EE-4713-87CE-D072EAC7ADE9}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{D03DF017-952A-405E-AC13-07B1195290EC}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_ds.exe | 
"{D28B641D-BA4D-41C5-86CC-623F4306FDBF}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{D5DCD4ED-6640-4A55-AF0C-BE2F975DEF77}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{D6BA226A-C8DD-4637-BFA5-D43EDC81F79D}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{D705718C-9261-41D1-A0C2-953E1EE3A1C8}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{E1108E00-2548-4EF5-8273-8037165EB7C6}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic.exe | 
"{E276BD90-025C-43DE-8225-8449DCF96A84}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{E9428AC2-2F24-4396-8772-64D639ABCE52}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{ED7D1768-596A-46FD-AC75-66DA8819203C}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_online.exe | 
"{EE99BA12-94F5-44EB-B5E3-99E8AEB3D1E5}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{EEA90AE1-A614-4439-92F2-C14BF1CF9F34}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{F23AECC7-FE5C-4FCE-8BAB-2722ED604FA5}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{F427FB41-64A8-4450-A305-07901F5AFAB9}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\binaries\endwar.exe | 
"{F98EF9AC-7E8C-45A4-A24E-0C6F16A79590}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{FD45BAAA-3DA7-49FD-B29D-0426A8CFA09C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\extra1\bin\settlers6.exe | 
"{FFB72C5D-EC8F-4119-9C72-87E979C893D3}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe | 
"TCP Query User{15F77E75-6E16-4FE2-8416-E1283B1A5E9D}C:\program files\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"TCP Query User{8F170BB8-2014-4FD0-8AF8-8BFE45B72882}C:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe | 
"TCP Query User{A50679F1-16B5-49DE-9EA8-81B9FAAA3968}C:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe | 
"TCP Query User{C849A27B-6AE9-49CC-885B-E332724ACE45}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{0ACF8B2E-764C-4CBB-B566-32538F3C7C15}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{D09175E1-B352-46B6-AD2F-2F62D79BAFB6}C:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe | 
"UDP Query User{DC751CAD-6E0C-4B6E-8DEC-B3350A48FD0B}C:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe | 
"UDP Query User{E0DE2DA4-FF67-4DCD-8830-3CC3EA960670}C:\program files\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{04B848BE-8B67-4B44-929D-BC14D9B4FFF4}" = Adobe Flash Player 9 Plugin
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs
"{26B52E5B-1620-4676-9B46-B6C56B8105CE}" = TP-LINK TL-WN821N Driver
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{373C3DAE-62C8-4F63-887C-769A8986ED50}" = GameShadow
"{3BB33584-3860-4772-AEE9-D8E61F552896}" = Tom Clancy's Rainbow Six: Lockdown
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{49F2D7DE-0EEE-4411-8283-16BAAECF2079}" = Media Manager for WALKMAN 1.1
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{5927AF0D-335C-41D6-937B-54587EBD6D2C}" = MagicSports 3.5
"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360
"{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}" = QuickTime
"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74224F8D-4A17-4816-9EDB-7BB854DE532C}" = NVIDIA PhysX v8.04.25
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C3D8108-8D99-427F-A1C2-D8E0D25A469C}" = Tom Clancy's EndWar
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{99889189-C739-4A46-BA02-3B271A118957}" = F.E.A.R. Mission Perseus
"{A7894110-9C15-43EF-89E9-060363290188}" = Samsung PC Studio
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Creator 9 LE
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio
"{C711E88C-9DC2-4254-A989-D6E017844DDF}" = Frontlines: Fuel of War
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D0E526A1-73B3-4378-B66A-E926E96EA820}_is1" = Scorpion-Disfigured 1.0.0
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs (Alle Produkte)
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{E426CEC1-35C5-42BF-913E-6EF8F1211D01}" = Overlord II
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"AdobeReader" = Adobe Reader 8
"ALICEDE" = Alice
"AnyDVD" = AnyDVD
"ArmA" = ArmA Uninstall
"ArmA2" = ArmA2 Uninstall
"ASSP_is1" = All Star Strip Poker
"AUDIO_REALTEK" = Realtek HD Audio V6.0.1.5377
"Brothers in Arms - Hell's Highway" = Brothers in Arms: Hell's Highway
"Covert Operations" = Covert Operations
"CREATOR9" = Creator 9
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"EADM" = EA Download Manager
"FirefoxDE" = Firefox
"Flashplayer" = Flash Player 9 Internet Explorer
"GameSpy Arcade" = GameSpy Arcade
"GOOGLE_EARTH" = Google Earth
"GoogleBAE" = Google BAE
"GoogleToolbar" = Google Toolbar
"Hanf Baron" = Hanf Baron 1.00 
"ImageWriter" = Packard Bell ImageWriter
"Infocentre" = Infocentre Rev. 2.0
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"InstallShield_{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"LCDTest" = Packard Bell LCD Test
"Left 4 Dead" = Left 4 Dead
"MagicSports" = Magic Sports
"METABOLI" = Metaboli
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"ModJive" = ModJive
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360_2007_DE" = Norton 360
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Peter Games Officers" = Peter Games Officers
"Picasa_2" = Picasa2
"Picasa2" = Picasa 2
"PoE:2" = PoE:2 2.1.0.0
"PunkBusterSvc" = PunkBuster Services
"S.T.A.L.K.E.R. - Clear Sky_is1" = S.T.A.L.K.E.R. - Clear Sky
"S.T.A.L.K.E.R. - Shadow of Chernobyl_is1" = S.T.A.L.K.E.R. - Shadow of Chernobyl
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SAS Secure Tomorrow_is1" = SAS Secure Tomorrow (1.0)
"SETUPMYPC_DE" = SetUp My PC
"Shockwave" = Shockwave player 10
"SKYPE" = Skype 3.5.2.239
"sniper_de_is1" = Sniper - Art of Victory
"Spreng- und Abriss-Simulator" = Spreng- und Abriss-Simulator
"The KMPlayer" = The KMPlayer (remove only)
"Updator" = Packard Bell Updator
"VIDEO_NVIDIA" = Video NVIDIA v162.22
"VLC media player" = VLC media player 1.0.1
"Vodafone WCDMA Composite Device Drive" = Vodafone WCDMA Composite Device Drive Software
"Works8.5DE" = Works 8.5 DE
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.05.2011 06:50:42 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 24.05.2011 16:38:43 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 25.05.2011 06:51:00 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 26.05.2011 06:36:27 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 06:42:19 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 15:06:31 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 16:43:08 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 28.05.2011 08:11:48 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 28.05.2011 16:57:51 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 29.05.2011 08:50:44 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
[ System Events ]
Error - 14.02.2013 15:51:12 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 15:51:12 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%801     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 16:04:51 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%859     Aktualisierungsphase: %%852     Quellpfad: Microsoft Deutschland | Geräte und Dienste     Signaturtyp: 
%%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x8024402c     Fehlerbeschreibung: Unerwartetes
 Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates
 oder zur Problembehandlung finden Sie unter "Hilfe und Support". 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%801     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 15.02.2013 01:30:26 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 15.02.2013 01:30:56 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 15.02.2013 01:56:16 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion:      Aktualisierungsquelle: %%815     Aktualisierungsphase:
 %%854     Quellpfad:      Signaturtyp: %%886     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle
 Modulversion:      Vorherige Modulversion:      Fehlercode: 0x80070002     Fehlerbeschreibung:
 Das System kann die angegebene Datei nicht finden. 
 
Error - 15.02.2013 01:56:16 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2003
Description = Beim Aktualisieren des Moduls wurde von %%860 ein Fehler festgestellt.

	Neue
 Modulversion:      Vorherige Modulversion:      Modultyp: %%886     Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Fehlercode:
 0x80070002     Fehlerbeschreibung: Das System kann die angegebene Datei nicht finden.
 
 
 
< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 15.02.2013 07:01:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Holzer\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,22% Memory free
6,17 Gb Paging File | 5,28 Gb Available in Paging File | 85,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 457,76 Gb Total Space | 72,60 Gb Free Space | 15,86% Space Free | Partition Type: NTFS
 
Computer Name: HOLZER-PC | User Name: Holzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06B4A9C1-A390-4E71-B8F3-58A2F623E7B2}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{0EDA8D64-B330-4E49-9EB9-91B8C92DD4F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1142383B-6FBE-4A3F-846A-798E5B652CCA}" = rport=5358 | protocol=6 | dir=out | app=system | 
"{20A653BE-C7EB-4451-A8EA-003E8E8726C7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2FF73FE1-E170-4F8E-96B3-D767CE9A179D}" = rport=138 | protocol=17 | dir=out | app=system | 
"{301B4A64-8842-4B9F-8502-A87DB2E66EE3}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{3057D3D7-F8B7-413B-9BF3-25428D84B316}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{3A9C6BB6-954F-4F21-A8B2-E678296D6EFE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3D83CBDE-871A-4A69-BBED-58E19D24A12C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{4403BB7C-CD1A-4A6B-BCDA-868FE50F45E8}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{56BA5EBA-0E98-4B1A-91D3-EE48BBAED25F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{5B00D58A-BE64-4B77-9F1D-A23CE07EE551}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{5E8299DA-649B-4924-BA49-4708FD6C136B}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{630C39D4-7BAF-4AA6-9C97-C59A451C55B0}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{63654153-E8FE-4EAB-8DCA-ED5ACC897AE7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{699B5DD9-19DF-414D-8EB0-DCE68B18D395}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{6EE033E4-58C3-44CF-8F68-9C989474BBBB}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{7C57E783-DED1-4539-9C30-02681447F0C5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7C8607FC-31AB-4A9F-B762-2A88F6CE6C5B}" = lport=445 | protocol=6 | dir=in | app=system | 
"{82652868-C9F8-4547-80D4-1E2E8A57EF78}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{84766A90-ADF3-4306-A60C-567026CCDD45}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{87EB16E6-D363-4A97-85BB-9956A53C39A2}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{8D6F5CD6-6368-49F0-A586-120052BD6E86}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe | 
"{986E7003-4C30-46ED-B6B4-0671E13EE209}" = lport=139 | protocol=6 | dir=in | app=system | 
"{99925B6C-4B61-494B-BA6C-7E87517F6D74}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe | 
"{9EEB47F0-1E76-4DD9-B982-19B35A10DCAA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A1742874-D98E-444F-8525-673D170747F4}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{A39B2525-9EBD-475E-BF55-648C52AD594C}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{A3EAD7E0-3336-46A2-9780-5E6099241F89}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{AB8FF170-7A96-4E54-A1BD-747596D879B0}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{BE256E25-5469-4DDB-83CA-66ADBE00C49D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{C1DA485B-FE90-4C62-8C6F-65CB9CBB7A36}" = rport=5357 | protocol=6 | dir=out | app=system | 
"{C22BE4BC-43CB-443C-A9F3-BE9E125A21DF}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{C7AF681F-66AD-455E-B1B6-1CEEEED44D67}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe | 
"{CC849320-2D20-4CB8-8119-C458A05E9CDE}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{D5975869-C818-4D23-B9E4-9B59C867431B}" = lport=5357 | protocol=6 | dir=in | app=system | 
"{E2AF660E-0052-4ECD-9C51-C16910ABED0C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{E73D60ED-3145-4AB3-BBD8-2BE227CA22FF}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{EA7C16E6-C6E1-4133-8EF0-410D9633EF15}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{EC43B7BF-7110-46F7-9B08-8FDE589369CB}" = rport=445 | protocol=6 | dir=out | app=system | 
"{ED1EF4DF-CF94-40BD-9AE8-EABD507CB297}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FB79DD39-5A75-4A9D-BAE5-1BE50577EB62}" = lport=5358 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03423A93-5267-4584-A43F-17A9746DBEC3}" = protocol=6 | dir=in | app=c:\program files\sony\media manager for walkman\mediamanager.exe | 
"{09F8EF37-48E9-492F-A7C2-9404FC8F66A1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{0B1905A8-2752-4FE8-81E8-A5E428AB7BC5}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{0ED07E5F-75DB-4C1C-9BF8-846FA9667622}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{13CD3855-E665-4474-BA0F-86F636CA2EC0}" = protocol=6 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\extra1\bin\settlers6.exe | 
"{141DAFA7-9468-4F1C-8E85-AFD849531BD7}" = protocol=17 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{19CD5D9A-33D1-4110-83FF-E7BBA7A42EA3}" = protocol=6 | dir=in | app=c:\program files\codemasters\overlord ii\overlord2.exe | 
"{21915841-0804-449F-91CB-F8771D09A582}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{21B58C2A-A272-4357-B74C-457E512D715C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{22890B4B-5188-4DAB-976E-67344A14C029}" = protocol=6 | dir=in | app=c:\program files\activision\prototype\prototypef.exe | 
"{231C336D-D673-4A19-A072-17C425F8F247}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe | 
"{274CFF5C-3015-4D55-9C17-A812492C4768}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{299A1B2D-B535-478D-9384-8CC02DD5B2EA}" = protocol=6 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mplite.exe | 
"{2AFC86B3-0F9F-47BA-97F7-F75CFE638310}" = protocol=6 | dir=out | app=%systemroot%\system32\netproj.exe | 
"{2D8F811D-418E-4BA5-804E-36DD7CF981E0}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{2E028527-2EF1-4DC4-AF25-DFC689AC235F}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{2FE4F36C-CFEE-4360-8228-572CB412E53F}" = protocol=17 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe | 
"{303CB57C-B259-4810-B0BF-57C2F1B8427D}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic.exe | 
"{331D2F7C-6035-4D0E-90F4-2EE4A11FE468}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{334037FA-CE81-4B4F-B364-FE2475D7F2AA}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{396472BD-6CBF-4022-83E5-675F5E2147BC}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{39C7D627-D891-42E9-AE1A-16A794743A66}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3D3D2EA3-4D87-41DE-9D3B-3AED0747B965}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{4264C830-C672-4C62-B863-7A090FD60645}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\binaries\endwar.exe | 
"{44AF49EE-7B03-4EB7-9248-7B408B797624}" = protocol=6 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe | 
"{453520B4-F909-420F-B627-074C9FB90B8F}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{4657DA5B-1D36-48DB-AC1F-387C147A43A4}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\f.e.a.r. mission perseus\fearxp2.exe | 
"{46CEBF59-DF6F-4688-A4F3-C278B05EA697}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{4AF9AD46-295D-47E2-98A4-26BC3391E3BF}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{4C9B5A15-E53E-41B3-B15B-AE60F8CF8FFF}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\tom clancy's endwar launcher.exe | 
"{4D7D04F6-6546-43F8-A33F-F87C5E76946C}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{4F58406C-48C5-4D95-ACBA-8F02FFC02C5C}" = protocol=17 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mplite.exe | 
"{515D6C27-191C-47F9-A615-3BE823716FAB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{548E6AA0-62DF-45CF-9027-FC95FD331E96}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{58B72CCF-2F27-4F9E-84C2-7052A7A0AF33}" = dir=in | app=c:\program files\cyberlink\magicsports\magicsports.exe | 
"{5A733BC6-5926-4925-AD1A-3C956BBEFBAD}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{5AA99FF1-BD26-479A-A6BF-6D7C7BB551D6}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_ds.exe | 
"{5CB23BFC-6980-4618-B462-61B2A36A3ED7}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe | 
"{60D5428F-2C27-440F-970B-2DAE01888177}" = protocol=6 | dir=in | app=c:\program files\codemasters\of dragon rising\ofdr.exe | 
"{65720F9E-6648-4478-8A36-13D75A7E4F3F}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{67038229-80F9-44D9-A40C-36F5DC5C04B2}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 
"{69B7B76A-B5A0-4AAE-9CE2-226BCF68F210}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3x.exe | 
"{6B7A9F8C-6B67-4C52-8C0A-8830C3CAC2D4}" = protocol=6 | dir=in | app=c:\program files\thq\frontlines-fuel of war\binaries\ffow.exe | 
"{6C41DB79-41CC-4C59-B0CC-D8E79D08C07B}" = protocol=17 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe | 
"{6C703B3E-9291-4825-B05B-7037BD54B8B7}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{6DC96E73-F3A7-4630-B421-FAC96A6DBBE8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6E5F16E3-2D57-4950-A7AE-A74DD32572DF}" = protocol=17 | dir=in | app=c:\program files\activision\prototype\prototypef.exe | 
"{7028B332-4F22-4894-9F99-1436D736140E}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{7254B0ED-2690-4C13-8075-6236C31F08FA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{72FD8A21-2B85-459E-AF27-DE551515EBB5}" = protocol=17 | dir=in | app=c:\program files\sony\media manager for walkman\mediamanager.exe | 
"{746D41E4-BAD3-428C-840D-2543807DAAB5}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{75366667-E87B-4F3C-BD4A-8879CF3BC854}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_online.exe | 
"{758B08B5-A11D-476B-B04B-EB75EB2E6F81}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 
"{7611832F-BE0F-42E1-8143-2DAD4374313C}" = protocol=6 | dir=in | app=c:\program files\sierra entertainment\f.e.a.r. mission perseus\fearxp2.exe | 
"{7FD96175-C48D-4E03-8CD8-2367E20A9CEE}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{84D31384-78DE-48ED-8C79-EC36AC84524F}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{86832F7F-4FF4-46FD-81BC-B91BAC70D61C}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{87F1E37E-F7C4-48EC-8242-3981DFC9618F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{8A4E30E5-03C5-41AC-A40A-CB4FB34C7628}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 
"{8E1BA165-EFCD-405A-8F09-139AA0D2F4F5}" = protocol=17 | dir=in | app=c:\program files\thq\frontlines-fuel of war\binaries\ffow.exe | 
"{9347A837-FF0A-4B98-A6E9-867324E7DEF1}" = protocol=6 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe | 
"{96B7671E-F886-4281-8D99-D33A90E1511B}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{96E347ED-8494-43C0-B2C3-DC16AAD5A034}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{9DA5152E-1957-479A-95E3-D038BCEA1D6F}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe | 
"{9F04B5DA-C357-44CD-97F7-08F30F031ED9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{9F4C300B-C1DC-4AE0-80C8-497B220BCFB8}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{9FE59D6A-1986-4E30-8E37-33B536E20088}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{A2C9D4C5-720C-4C31-8BD7-4E2824DE5D83}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{ACC9D29D-A435-439D-9EF1-B53192E48DD1}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe | 
"{AE494473-DA58-4222-B443-A4705D988EAE}" = protocol=17 | dir=in | app=c:\program files\codemasters\overlord ii\overlord2.exe | 
"{AEC2D037-7BDC-4C59-8E45-817C9945A1E8}" = protocol=17 | dir=in | app=c:\program files\codemasters\of dragon rising\ofdr.exe | 
"{AF08872E-7671-4F03-98AF-6448591418A6}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 
"{B0C6E591-89F9-4BB6-91F3-1F4ED6415424}" = protocol=6 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mp.exe | 
"{B165ADC7-289C-4927-8B24-1397987ECABA}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{B2D13E1D-00BF-4FAE-9D65-F5543B83A2CE}" = protocol=17 | dir=in | app=c:\program files\activision\wolfenstein\mp\wolf2mp.exe | 
"{B5D70C87-01B9-431D-9DDD-96CB169D5CA3}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\tom clancy's endwar launcher.exe | 
"{BD23712D-B24D-435A-BEE9-49C1E0C27F88}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C05C9D3B-55BA-4822-A813-73ED2BAE8CAE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C0B7DCDC-B977-4B58-B2E8-670B87F802C5}" = protocol=6 | dir=in | app=%systemroot%\system32\netproj.exe | 
"{C51DA4FF-756A-4318-B93E-F4DB391648F6}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{C5CA968F-60FA-4D8F-B290-3AF897A3174F}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{C921294D-5F88-41B8-9AB0-60EAEA4C1999}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{CB1598D9-D60C-4519-ABE0-7BE7F56A0186}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{CB797CFE-85D7-4193-99B2-FDB9398EFF73}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{CC25E8BB-B5EE-4713-87CE-D072EAC7ADE9}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{D03DF017-952A-405E-AC13-07B1195290EC}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_ds.exe | 
"{D28B641D-BA4D-41C5-86CC-623F4306FDBF}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{D5DCD4ED-6640-4A55-AF0C-BE2F975DEF77}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{D6BA226A-C8DD-4637-BFA5-D43EDC81F79D}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe | 
"{D705718C-9261-41D1-A0C2-953E1EE3A1C8}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{E1108E00-2548-4EF5-8273-8037165EB7C6}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic.exe | 
"{E276BD90-025C-43DE-8225-8449DCF96A84}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{E9428AC2-2F24-4396-8772-64D639ABCE52}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{ED7D1768-596A-46FD-AC75-66DA8819203C}" = protocol=17 | dir=in | app=c:\program files\sierra entertainment\world in conflict\wic_online.exe | 
"{EE99BA12-94F5-44EB-B5E3-99E8AEB3D1E5}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{EEA90AE1-A614-4439-92F2-C14BF1CF9F34}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe | 
"{F23AECC7-FE5C-4FCE-8BAB-2722ED604FA5}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{F427FB41-64A8-4450-A305-07901F5AFAB9}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's endwar\binaries\endwar.exe | 
"{F98EF9AC-7E8C-45A4-A24E-0C6F16A79590}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{FD45BAAA-3DA7-49FD-B29D-0426A8CFA09C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\extra1\bin\settlers6.exe | 
"{FFB72C5D-EC8F-4119-9C72-87E979C893D3}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe | 
"TCP Query User{15F77E75-6E16-4FE2-8416-E1283B1A5E9D}C:\program files\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"TCP Query User{8F170BB8-2014-4FD0-8AF8-8BFE45B72882}C:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe | 
"TCP Query User{A50679F1-16B5-49DE-9EA8-81B9FAAA3968}C:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe | 
"TCP Query User{C849A27B-6AE9-49CC-885B-E332724ACE45}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{0ACF8B2E-764C-4CBB-B566-32538F3C7C15}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{D09175E1-B352-46B6-AD2F-2F62D79BAFB6}C:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2 (2).exe | 
"UDP Query User{DC751CAD-6E0C-4B6E-8DEC-B3350A48FD0B}C:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\gearbox software\brothers in arms - hell's highway\binaries\biahh.exe | 
"UDP Query User{E0DE2DA4-FF67-4DCD-8830-3CC3EA960670}C:\program files\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{04B848BE-8B67-4B44-929D-BC14D9B4FFF4}" = Adobe Flash Player 9 Plugin
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs
"{26B52E5B-1620-4676-9B46-B6C56B8105CE}" = TP-LINK TL-WN821N Driver
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{373C3DAE-62C8-4F63-887C-769A8986ED50}" = GameShadow
"{3BB33584-3860-4772-AEE9-D8E61F552896}" = Tom Clancy's Rainbow Six: Lockdown
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{49F2D7DE-0EEE-4411-8283-16BAAECF2079}" = Media Manager for WALKMAN 1.1
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{5927AF0D-335C-41D6-937B-54587EBD6D2C}" = MagicSports 3.5
"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360
"{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}" = QuickTime
"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74224F8D-4A17-4816-9EDB-7BB854DE532C}" = NVIDIA PhysX v8.04.25
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C3D8108-8D99-427F-A1C2-D8E0D25A469C}" = Tom Clancy's EndWar
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{99889189-C739-4A46-BA02-3B271A118957}" = F.E.A.R. Mission Perseus
"{A7894110-9C15-43EF-89E9-060363290188}" = Samsung PC Studio
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Creator 9 LE
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio
"{C711E88C-9DC2-4254-A989-D6E017844DDF}" = Frontlines: Fuel of War
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D0E526A1-73B3-4378-B66A-E926E96EA820}_is1" = Scorpion-Disfigured 1.0.0
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs (Alle Produkte)
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{E426CEC1-35C5-42BF-913E-6EF8F1211D01}" = Overlord II
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"AdobeReader" = Adobe Reader 8
"ALICEDE" = Alice
"AnyDVD" = AnyDVD
"ArmA" = ArmA Uninstall
"ArmA2" = ArmA2 Uninstall
"ASSP_is1" = All Star Strip Poker
"AUDIO_REALTEK" = Realtek HD Audio V6.0.1.5377
"Brothers in Arms - Hell's Highway" = Brothers in Arms: Hell's Highway
"Covert Operations" = Covert Operations
"CREATOR9" = Creator 9
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"EADM" = EA Download Manager
"FirefoxDE" = Firefox
"Flashplayer" = Flash Player 9 Internet Explorer
"GameSpy Arcade" = GameSpy Arcade
"GOOGLE_EARTH" = Google Earth
"GoogleBAE" = Google BAE
"GoogleToolbar" = Google Toolbar
"Hanf Baron" = Hanf Baron 1.00 
"ImageWriter" = Packard Bell ImageWriter
"Infocentre" = Infocentre Rev. 2.0
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"InstallShield_{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"LCDTest" = Packard Bell LCD Test
"Left 4 Dead" = Left 4 Dead
"MagicSports" = Magic Sports
"METABOLI" = Metaboli
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"ModJive" = ModJive
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360_2007_DE" = Norton 360
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Peter Games Officers" = Peter Games Officers
"Picasa_2" = Picasa2
"Picasa2" = Picasa 2
"PoE:2" = PoE:2 2.1.0.0
"PunkBusterSvc" = PunkBuster Services
"S.T.A.L.K.E.R. - Clear Sky_is1" = S.T.A.L.K.E.R. - Clear Sky
"S.T.A.L.K.E.R. - Shadow of Chernobyl_is1" = S.T.A.L.K.E.R. - Shadow of Chernobyl
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SAS Secure Tomorrow_is1" = SAS Secure Tomorrow (1.0)
"SETUPMYPC_DE" = SetUp My PC
"Shockwave" = Shockwave player 10
"SKYPE" = Skype 3.5.2.239
"sniper_de_is1" = Sniper - Art of Victory
"Spreng- und Abriss-Simulator" = Spreng- und Abriss-Simulator
"The KMPlayer" = The KMPlayer (remove only)
"Updator" = Packard Bell Updator
"VIDEO_NVIDIA" = Video NVIDIA v162.22
"VLC media player" = VLC media player 1.0.1
"Vodafone WCDMA Composite Device Drive" = Vodafone WCDMA Composite Device Drive Software
"Works8.5DE" = Works 8.5 DE
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.05.2011 06:50:42 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 24.05.2011 16:38:43 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 25.05.2011 06:51:00 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 26.05.2011 06:36:27 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 06:42:19 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 15:06:31 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 27.05.2011 16:43:08 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 28.05.2011 08:11:48 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 28.05.2011 16:57:51 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 29.05.2011 08:50:44 | Computer Name = Holzer-PC | Source = WerSvc | ID = 5007
Description = 
 
[ System Events ]
Error - 14.02.2013 15:51:12 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 15:51:12 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%801     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 16:04:51 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%859     Aktualisierungsphase: %%852     Quellpfad: Microsoft Deutschland | Geräte und Dienste     Signaturtyp: 
%%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x8024402c     Fehlerbeschreibung: Unerwartetes
 Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates
 oder zur Problembehandlung finden Sie unter "Hilfe und Support". 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 14.02.2013 16:10:59 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.143.1166.0     Aktualisierungsquelle: 
%%851     Aktualisierungsphase: %%852     Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.9103.0&avdelta=1.143.1166.0&asdelta=1.143.1166.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

	Signaturtyp:
 %%801     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.9103.0     Fehlercode: 0x80072ee7     Fehlerbeschreibung: Der
 Servername oder die Serveradresse konnte nicht verarbeitet werden. 
 
Error - 15.02.2013 01:30:26 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 15.02.2013 01:30:56 | Computer Name = Holzer-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 15.02.2013 01:56:16 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion:      Aktualisierungsquelle: %%815     Aktualisierungsphase:
 %%854     Quellpfad:      Signaturtyp: %%886     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle
 Modulversion:      Vorherige Modulversion:      Fehlercode: 0x80070002     Fehlerbeschreibung:
 Das System kann die angegebene Datei nicht finden. 
 
Error - 15.02.2013 01:56:16 | Computer Name = Holzer-PC | Source = Microsoft Antimalware | ID = 2003
Description = Beim Aktualisieren des Moduls wurde von %%860 ein Fehler festgestellt.

	Neue
 Modulversion:      Vorherige Modulversion:      Modultyp: %%886     Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Fehlercode:
 0x80070002     Fehlerbeschreibung: Das System kann die angegebene Datei nicht finden.
 
 
 
< End of report >

--- --- ---

aharonov · 15.02.2013, 09:35

Gut, dann schauen wir noch weiter:

Schritt 1

Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts löschen, sondern nur einen Scan-Report sehen.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop.

Starte die TDSSKiller.exe.
Drücke Start Scan.
Warnung: Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile.
TDSSKiller wird ein Logfile auf deinem Systemlaufwerk speichern (C:\TDSSKiller.<version_date_time>log.txt).
Poste bitte den Inhalt dieses Logfiles hier in den Thread.

Bitte poste in deiner nächsten Antwort:

Log von TDSSKiller

Amstaff3 · 15.02.2013, 12:54

12:36:50.0198 3904 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:36:50.0447 3904 ============================================================
12:36:50.0447 3904 Current date / time: 2013/02/15 12:36:50.0447
12:36:50.0447 3904 SystemInfo:
12:36:50.0447 3904
12:36:50.0447 3904 OS Version: 6.0.6000 ServicePack: 0.0
12:36:50.0447 3904 Product type: Workstation
12:36:50.0447 3904 ComputerName: HOLZER-PC
12:36:50.0447 3904 UserName: Holzer
12:36:50.0447 3904 Windows directory: C:\Windows
12:36:50.0447 3904 System windows directory: C:\Windows
12:36:50.0447 3904 Processor architecture: Intel x86
12:36:50.0447 3904 Number of processors: 4
12:36:50.0447 3904 Page size: 0x1000
12:36:50.0447 3904 Boot type: Normal boot
12:36:50.0447 3904 ============================================================
12:36:51.0524 3904 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
12:36:51.0539 3904 ============================================================
12:36:51.0539 3904 \Device\Harddisk0\DR0:
12:36:51.0539 3904 MBR partitions:
12:36:51.0539 3904 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x10029D5, BlocksNum 0x39382E5B
12:36:51.0539 3904 ============================================================
12:36:51.0571 3904 C: <-> \Device\Harddisk0\DR0\Partition1
12:36:51.0571 3904 ============================================================
12:36:51.0571 3904 Initialize success
12:36:51.0571 3904 ============================================================
12:37:00.0853 3756 ============================================================
12:37:00.0853 3756 Scan started
12:37:00.0853 3756 Mode: Manual;
12:37:00.0853 3756 ============================================================
12:37:01.0352 3756 ================ Scan system memory ========================
12:37:01.0352 3756 System memory - ok
12:37:01.0352 3756 ================ Scan services =============================
12:37:01.0477 3756 [ 84FC6DF81212D16BE5C4F441682FECCC ] ACPI C:\Windows\system32\drivers\acpi.sys
12:37:01.0477 3756 ACPI - ok
12:37:01.0570 3756 [ EC807244904FA170C299AB06D87FBDBE ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:37:01.0570 3756 AdobeFlashPlayerUpdateSvc - ok
12:37:01.0601 3756 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
12:37:01.0601 3756 adp94xx - ok
12:37:01.0648 3756 [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci C:\Windows\system32\drivers\adpahci.sys
12:37:01.0648 3756 adpahci - ok
12:37:01.0664 3756 [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
12:37:01.0679 3756 adpu160m - ok
12:37:01.0679 3756 [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320 C:\Windows\system32\drivers\adpu320.sys
12:37:01.0679 3756 adpu320 - ok
12:37:01.0757 3756 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
12:37:01.0757 3756 AeLookupSvc - ok
12:37:01.0804 3756 [ 5D24CAF8EFD924A875698FF28384DB8B ] AFD C:\Windows\system32\drivers\afd.sys
12:37:01.0820 3756 AFD - ok
12:37:01.0882 3756 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
12:37:01.0882 3756 aic78xx - ok
12:37:01.0898 3756 [ E69FB0E3112C40FDC0EF7D21A52DC951 ] ALG C:\Windows\System32\alg.exe
12:37:01.0898 3756 ALG - ok
12:37:01.0945 3756 [ 90395B64600EBB4552E26E178C94B2E4 ] aliide C:\Windows\system32\drivers\aliide.sys
12:37:01.0945 3756 aliide - ok
12:37:01.0991 3756 [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
12:37:01.0991 3756 amdagp - ok
12:37:02.0007 3756 [ 0577DF1D323FE75A739C787893D300EA ] amdide C:\Windows\system32\drivers\amdide.sys
12:37:02.0007 3756 amdide - ok
12:37:02.0038 3756 [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
12:37:02.0038 3756 AmdK7 - ok
12:37:02.0054 3756 [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
12:37:02.0054 3756 AmdK8 - ok
12:37:02.0132 3756 [ 56D390508DEC076CDF57CD0E41238B8C ] AnyDVD C:\Windows\system32\Drivers\AnyDVD.sys
12:37:02.0132 3756 AnyDVD - ok
12:37:02.0194 3756 [ CFA455816879F06F1C4E5BBF9E8AEF7D ] Appinfo C:\Windows\System32\appinfo.dll
12:37:02.0194 3756 Appinfo - ok
12:37:02.0241 3756 [ 5F673180268BB1FDB69C99B6619FE379 ] arc C:\Windows\system32\drivers\arc.sys
12:37:02.0241 3756 arc - ok
12:37:02.0288 3756 [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas C:\Windows\system32\drivers\arcsas.sys
12:37:02.0288 3756 arcsas - ok
12:37:02.0335 3756 [ E86CF7CE67D5DE898F27EF884DC357D8 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
12:37:02.0335 3756 AsyncMac - ok
12:37:02.0366 3756 [ B35CFCEF838382AB6490B321C87EDF17 ] atapi C:\Windows\system32\drivers\atapi.sys
12:37:02.0366 3756 atapi - ok
12:37:02.0444 3756 [ F9C24D25D9FF29F894995A64812B4D85 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
12:37:02.0444 3756 atksgt - ok
12:37:02.0491 3756 [ E760FC1BD68F7F6F1B17EB4E8D9480B0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:37:02.0506 3756 AudioEndpointBuilder - ok
12:37:02.0522 3756 [ E760FC1BD68F7F6F1B17EB4E8D9480B0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
12:37:02.0522 3756 Audiosrv - ok
12:37:02.0584 3756 [ AC3DD1708B22761EBD7CBE14DCC3B5D7 ] Beep C:\Windows\system32\drivers\Beep.sys
12:37:02.0584 3756 Beep - ok
12:37:02.0631 3756 [ 98EBDFFB824A7C265337D68DD480E45C ] BFE C:\Windows\System32\bfe.dll
12:37:02.0631 3756 BFE - ok
12:37:02.0709 3756 [ DA551697E34D2B9943C8B1C8EAFFE89A ] BITS C:\Windows\System32\qmgr.dll
12:37:02.0725 3756 BITS - ok
12:37:02.0725 3756 blbdrive - ok
12:37:02.0740 3756 [ 913CD06FBE9105CE6077E90FD4418561 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
12:37:02.0740 3756 bowser - ok
12:37:02.0771 3756 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
12:37:02.0771 3756 BrFiltLo - ok
12:37:02.0787 3756 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
12:37:02.0787 3756 BrFiltUp - ok
12:37:02.0803 3756 [ BEB6470532B7461D7BB426E3FACB424F ] Browser C:\Windows\System32\browser.dll
12:37:02.0818 3756 Browser - ok
12:37:02.0849 3756 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
12:37:02.0849 3756 Brserid - ok
12:37:02.0881 3756 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
12:37:02.0881 3756 BrSerWdm - ok
12:37:02.0881 3756 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
12:37:02.0896 3756 BrUsbMdm - ok
12:37:02.0896 3756 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
12:37:02.0896 3756 BrUsbSer - ok
12:37:02.0943 3756 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
12:37:02.0943 3756 BTHMODEM - ok
12:37:02.0974 3756 [ 6C3A437FC873C6F6A4FC620B6888CB86 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
12:37:02.0974 3756 cdfs - ok
12:37:03.0021 3756 [ 8D1866E61AF096AE8B582454F5E4D303 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
12:37:03.0021 3756 cdrom - ok
12:37:03.0068 3756 [ 0600E04315FE543802A379D5D23C8BE0 ] CertPropSvc C:\Windows\System32\certprop.dll
12:37:03.0068 3756 CertPropSvc - ok
12:37:03.0099 3756 [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass C:\Windows\system32\drivers\circlass.sys
12:37:03.0099 3756 circlass - ok
12:37:03.0130 3756 [ 1B84FD0937D3B99AF9BA38DDFF3DAF54 ] CLFS C:\Windows\system32\CLFS.sys
12:37:03.0130 3756 CLFS - ok
12:37:03.0177 3756 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:37:03.0177 3756 clr_optimization_v2.0.50727_32 - ok
12:37:03.0271 3756 CLTNetCnService - ok
12:37:03.0286 3756 [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide C:\Windows\system32\drivers\cmdide.sys
12:37:03.0286 3756 cmdide - ok
12:37:03.0302 3756 [ 722936AFB75A7F509662B69B5632F48A ] Compbatt C:\Windows\system32\drivers\compbatt.sys
12:37:03.0302 3756 Compbatt - ok
12:37:03.0317 3756 COMSysApp - ok
12:37:03.0333 3756 [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
12:37:03.0333 3756 crcdisk - ok
12:37:03.0349 3756 [ 22A7F883508176489F559EE745B5BF5D ] Crusoe C:\Windows\system32\drivers\crusoe.sys
12:37:03.0349 3756 Crusoe - ok
12:37:03.0395 3756 [ 1C26FB097170A2A91066D1E3A24366E3 ] CryptSvc C:\Windows\system32\cryptsvc.dll
12:37:03.0411 3756 CryptSvc - ok
12:37:03.0473 3756 [ 7B981222A257D076885BFFB66F19B7CE ] DcomLaunch C:\Windows\system32\rpcss.dll
12:37:03.0473 3756 DcomLaunch - ok
12:37:03.0505 3756 [ A7179DE59AE269AB70345527894CCD7C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
12:37:03.0505 3756 DfsC - ok
12:37:03.0614 3756 [ E0D584AA76C7D845BA9F3A788260528F ] DFSR C:\Windows\system32\DFSR.exe
12:37:03.0676 3756 DFSR - ok
12:37:03.0739 3756 [ DC45739BC22D528D2B3E50D3F6761750 ] Dhcp C:\Windows\System32\dhcpcsvc.dll
12:37:03.0739 3756 Dhcp - ok
12:37:03.0801 3756 [ 841AF4C4D41D3E3B2F244E976B0F7963 ] disk C:\Windows\system32\drivers\disk.sys
12:37:03.0801 3756 disk - ok
12:37:03.0832 3756 [ EECBA1DD142BF8693C476BE8F32FE253 ] Dnscache C:\Windows\System32\dnsrslvr.dll
12:37:03.0832 3756 Dnscache - ok
12:37:03.0848 3756 [ 1F795D214820E496BF1124434A6DB546 ] dot3svc C:\Windows\System32\dot3svc.dll
12:37:03.0848 3756 dot3svc - ok
12:37:03.0863 3756 [ 032C90AD677BF7B7A8013D6087C7A921 ] DPS C:\Windows\system32\dps.dll
12:37:03.0879 3756 DPS - ok
12:37:03.0926 3756 [ EE472CD2C01F6F8E8AA1FA06FFEF61B6 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
12:37:03.0926 3756 drmkaud - ok
12:37:03.0973 3756 [ B95202EFD0464D226E7542C1E319C028 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
12:37:03.0973 3756 DXGKrnl - ok
12:37:04.0035 3756 [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
12:37:04.0051 3756 E1G60 - ok
12:37:04.0097 3756 [ 90A0A875642E18618010645311B4E89E ] EapHost C:\Windows\System32\eapsvc.dll
12:37:04.0097 3756 EapHost - ok
12:37:04.0144 3756 [ 0EFC7531B936EE57FDB4E837664C509F ] Ecache C:\Windows\system32\drivers\ecache.sys
12:37:04.0144 3756 Ecache - ok
12:37:04.0207 3756 [ B4580122B0A7B263B6EE9ACBA69C8013 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
12:37:04.0253 3756 ehRecvr - ok
12:37:04.0269 3756 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
12:37:04.0285 3756 ehSched - ok
12:37:04.0331 3756 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
12:37:04.0331 3756 ehstart - ok
12:37:04.0409 3756 [ 28CB0B64134AD62C2ACF77DB8501A619 ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys
12:37:04.0409 3756 ElbyCDIO - ok
12:37:04.0456 3756 [ E8F3F21A71720C84BCF423B80028359F ] elxstor C:\Windows\system32\drivers\elxstor.sys
12:37:04.0472 3756 elxstor - ok
12:37:04.0503 3756 [ 3226FDA08988526E819E364E8CCE4CEE ] EMDMgmt C:\Windows\system32\emdmgmt.dll
12:37:04.0503 3756 EMDMgmt - ok
12:37:04.0550 3756 [ 7B4971C3D43525175A4EA0D143E0412E ] EventSystem C:\Windows\system32\es.dll
12:37:04.0550 3756 EventSystem - ok
12:37:04.0581 3756 [ 84A317CB0B3954D3768CDCD018DBF670 ] fastfat C:\Windows\system32\drivers\fastfat.sys
12:37:04.0581 3756 fastfat - ok
12:37:04.0612 3756 [ 63BDADA84951B9C03E641800E176898A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
12:37:04.0612 3756 fdc - ok
12:37:04.0628 3756 [ E43BCE1A77D6FD4ED5F8E0482B9E7DF1 ] fdPHost C:\Windows\system32\fdPHost.dll
12:37:04.0628 3756 fdPHost - ok
12:37:04.0628 3756 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
12:37:04.0628 3756 FDResPub - ok
12:37:04.0675 3756 [ 65773D6115C037FFD7EF8280AE85EB9D ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
12:37:04.0675 3756 FileInfo - ok
12:37:04.0690 3756 [ C226DD0DE060745F3E042F58DCF78402 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
12:37:04.0690 3756 Filetrace - ok
12:37:04.0706 3756 [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
12:37:04.0706 3756 flpydisk - ok
12:37:04.0706 3756 [ A6A8DA7AE4D53394AB22AC3AB6D3F5D3 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
12:37:04.0706 3756 FltMgr - ok
12:37:04.0768 3756 [ C9BE08664611DDAF98E2331E9288B00B ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
12:37:04.0768 3756 FontCache3.0.0.0 - ok
12:37:04.0815 3756 [ 790A4CA68F44BE35967B3DF61F3E4675 ] FsUsbExDisk C:\Windows\system32\FsUsbExDisk.SYS
12:37:04.0831 3756 FsUsbExDisk - ok
12:37:04.0909 3756 [ D3F9205CC4CB07553F2F9472C767EA87 ] FsUsbExService C:\Windows\system32\FsUsbExService.Exe
12:37:04.0909 3756 FsUsbExService - ok
12:37:04.0940 3756 [ 66A078591208BAA210C7634B11EB392C ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
12:37:04.0940 3756 Fs_Rec - ok
12:37:04.0955 3756 [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
12:37:04.0971 3756 gagp30kx - ok
12:37:05.0002 3756 [ 4AC51459805264AFFD5F6FDFB9D9235F ] GEARAspiWDM C:\Windows\system32\Drivers\GEARAspiWDM.sys
12:37:05.0002 3756 GEARAspiWDM - ok
12:37:05.0033 3756 [ BCF6589C42D8F6A20F33EF133FFE0524 ] gpsvc C:\Windows\System32\gpsvc.dll
12:37:05.0033 3756 gpsvc - ok
12:37:05.0080 3756 [ 751C1D2CA2ABF4A9F5A6B8D7D45B907C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:37:05.0080 3756 gusvc - ok
12:37:05.0111 3756 [ 0DB613A7E427B5663563677796FD5258 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
12:37:05.0111 3756 HDAudBus - ok
12:37:05.0143 3756 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
12:37:05.0143 3756 HidBth - ok
12:37:05.0158 3756 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
12:37:05.0158 3756 HidIr - ok
12:37:05.0189 3756 [ 8FA640195279ACE21BEA91396A0054FC ] hidserv C:\Windows\system32\hidserv.dll
12:37:05.0205 3756 hidserv - ok
12:37:05.0236 3756 [ 01E7971E9F4BD6AC6A08DB52D0EA0418 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
12:37:05.0236 3756 HidUsb - ok
12:37:05.0252 3756 [ D40AA05E29BF6ED29B139F044B461E9B ] hkmsvc C:\Windows\system32\kmsvc.dll
12:37:05.0267 3756 hkmsvc - ok
12:37:05.0299 3756 [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
12:37:05.0299 3756 HpCISSs - ok
12:37:05.0330 3756 [ EA24FE637D974A8A31BC650F478E3533 ] HTTP C:\Windows\system32\drivers\HTTP.sys
12:37:05.0330 3756 HTTP - ok
12:37:05.0361 3756 [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp C:\Windows\system32\drivers\i2omp.sys
12:37:05.0361 3756 i2omp - ok
12:37:05.0423 3756 [ 1C9EE072BAA3ABB460B91D7EE9152660 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
12:37:05.0423 3756 i8042prt - ok
12:37:05.0439 3756 [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
12:37:05.0439 3756 iaStorV - ok
12:37:05.0564 3756 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
12:37:05.0579 3756 IDriverT - ok
12:37:05.0720 3756 [ 7B630ACAED64FEF0C3E1CF255CB56686 ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:37:05.0798 3756 idsvc - ok
12:37:05.0813 3756 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
12:37:05.0813 3756 iirsp - ok
12:37:05.0845 3756 [ 35662FE4D8622F667AA5A5568F7F1B40 ] IKEEXT C:\Windows\System32\ikeext.dll
12:37:05.0860 3756 IKEEXT - ok
12:37:05.0954 3756 [ 4A705BF2A6F7972F2F2AD8A0D8079F95 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
12:37:06.0016 3756 IntcAzAudAddService - ok
12:37:06.0079 3756 [ 97469037714070E45194ED318D636401 ] intelide C:\Windows\system32\drivers\intelide.sys
12:37:06.0079 3756 intelide - ok
12:37:06.0125 3756 [ CE44CC04262F28216DD4341E9E36A16F ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
12:37:06.0125 3756 intelppm - ok
12:37:06.0157 3756 [ 88CF5281ED9880D74DC9011CF8B5262D ] IPBusEnum C:\Windows\system32\ipbusenum.dll
12:37:06.0157 3756 IPBusEnum - ok
12:37:06.0203 3756 [ 880C6F86CC3F551B8FEA2C11141268C0 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:37:06.0219 3756 IpFilterDriver - ok
12:37:06.0266 3756 [ ECC9AD72CFC4AB41CF6A9BCC11F9FEF6 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
12:37:06.0266 3756 iphlpsvc - ok
12:37:06.0266 3756 IpInIp - ok
12:37:06.0313 3756 [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
12:37:06.0313 3756 IPMIDRV - ok
12:37:06.0328 3756 [ 10077C35845101548037DF04FD1A420B ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
12:37:06.0328 3756 IPNAT - ok
12:37:06.0359 3756 [ A82F328F4792304184642D6D397BB1E3 ] IRENUM C:\Windows\system32\drivers\irenum.sys
12:37:06.0359 3756 IRENUM - ok
12:37:06.0406 3756 [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp C:\Windows\system32\drivers\isapnp.sys
12:37:06.0406 3756 isapnp - ok
12:37:06.0437 3756 [ 4DCA456D4D5723F8FA9C6760D240B0DF ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
12:37:06.0437 3756 iScsiPrt - ok
12:37:06.0469 3756 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
12:37:06.0484 3756 iteatapi - ok
12:37:06.0515 3756 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
12:37:06.0515 3756 iteraid - ok
12:37:06.0547 3756 [ B076B2AB806B3F696DAB21375389101C ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
12:37:06.0547 3756 kbdclass - ok
12:37:06.0547 3756 [ D2600CB17B7408B4A83F231DC9A11AC3 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
12:37:06.0547 3756 kbdhid - ok
12:37:06.0578 3756 [ C731B1FE449D4E9CEA358C9D55B69BE9 ] KeyIso C:\Windows\system32\lsass.exe
12:37:06.0578 3756 KeyIso - ok
12:37:06.0656 3756 [ 0A829977B078DEA11641FC2AF87CEADE ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
12:37:06.0656 3756 KSecDD - ok
12:37:06.0718 3756 [ 45C537FE5DDE9A0146AEFF76E615737D ] KtmRm C:\Windows\system32\msdtckrm.dll
12:37:06.0718 3756 KtmRm - ok
12:37:06.0781 3756 [ AC728768DE636093B4D5AE6361CFADAE ] L8042Kbd C:\Windows\system32\DRIVERS\L8042Kbd.sys
12:37:06.0781 3756 L8042Kbd - ok
12:37:06.0812 3756 [ 53D1482FC1AA36AC015A85E6CF2146BD ] LanmanServer C:\Windows\system32\srvsvc.dll
12:37:06.0812 3756 LanmanServer - ok
12:37:06.0874 3756 [ 435F0F6DC87A4B5DA78F1FA309884189 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:37:06.0874 3756 LanmanWorkstation - ok
12:37:07.0015 3756 [ 80CAF1FDEBE4E2CDEA021BC55CC4C1DE ] LBTServ C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
12:37:07.0046 3756 LBTServ - ok
12:37:07.0077 3756 [ 75415A95C589A07D6C97BAA2D4143916 ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
12:37:07.0077 3756 LHidFilt - ok
12:37:07.0155 3756 [ 8CCF9ED46D52AF1375875F74A91FFACF ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
12:37:07.0155 3756 lirsgt - ok
12:37:07.0186 3756 [ FD015B4F95DAA2B712F0E372A116FBAD ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
12:37:07.0186 3756 lltdio - ok
12:37:07.0249 3756 [ 7450DBCF754391DD6363FFFD5EF0E789 ] lltdsvc C:\Windows\System32\lltdsvc.dll
12:37:07.0280 3756 lltdsvc - ok
12:37:07.0295 3756 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
12:37:07.0311 3756 lmhosts - ok
12:37:07.0311 3756 [ FCB3F81AC07B8608F921134237823B88 ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
12:37:07.0311 3756 LMouFilt - ok
12:37:07.0342 3756 [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
12:37:07.0342 3756 LSI_FC - ok
12:37:07.0373 3756 [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
12:37:07.0373 3756 LSI_SAS - ok
12:37:07.0420 3756 [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
12:37:07.0420 3756 LSI_SCSI - ok
12:37:07.0436 3756 [ 42885BB44B6E065B8575A8DD6C430C52 ] luafv C:\Windows\system32\drivers\luafv.sys
12:37:07.0436 3756 luafv - ok
12:37:07.0483 3756 [ FF1C2F90D40A2E52649937854E175987 ] LUsbFilt C:\Windows\system32\Drivers\LUsbFilt.Sys
12:37:07.0498 3756 LUsbFilt - ok
12:37:07.0514 3756 [ E93C1AD58E88A0846EAEE10671C2A8F3 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
12:37:07.0529 3756 Mcx2Svc - ok
12:37:07.0561 3756 [ D153B14FC6598EAE8422A2037553ADCE ] megasas C:\Windows\system32\drivers\megasas.sys
12:37:07.0561 3756 megasas - ok
12:37:07.0592 3756 [ 9DFA3A459AF0954AA85B4F7622AD87BB ] MMCSS C:\Windows\system32\mmcss.dll
12:37:07.0592 3756 MMCSS - ok
12:37:07.0607 3756 [ 21755967298A46FB6ADFEC9DB6012211 ] Modem C:\Windows\system32\drivers\modem.sys
12:37:07.0607 3756 Modem - ok
12:37:07.0654 3756 [ 7446E104A5FE5987CA9E4983FBAC4F97 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
12:37:07.0717 3756 monitor - ok
12:37:07.0748 3756 [ 5FBA13C1A1841B0885D316ED3589489D ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
12:37:07.0748 3756 mouclass - ok
12:37:07.0763 3756 [ B569B5C5D3BDE545DF3A6AF512CCCDBA ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
12:37:07.0763 3756 mouhid - ok
12:37:07.0779 3756 [ 01F1E5A3E4877C931CBB31613FEC16A6 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
12:37:07.0779 3756 MountMgr - ok
12:37:07.0857 3756 [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:37:07.0888 3756 MozillaMaintenance - ok
12:37:07.0951 3756 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
12:37:07.0966 3756 MpFilter - ok
12:37:08.0029 3756 [ 583A41F26278D9E0EA548163D6139397 ] mpio C:\Windows\system32\drivers\mpio.sys
12:37:08.0029 3756 mpio - ok
12:37:08.0216 3756 [ A69630D039C38018689190234F866D77 ] MpKsl9eb49869 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B799712B-8001-4707-9CC7-EEAB541321CA}\MpKsl9eb49869.sys
12:37:08.0231 3756 Suspicious file (Forged): c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B799712B-8001-4707-9CC7-EEAB541321CA}\MpKsl9eb49869.sys. Real md5: A69630D039C38018689190234F866D77, Fake md5: 4137EE420481D10734DA3018D0325582
12:37:08.0231 3756 MpKsl9eb49869 ( ForgedFile.Multi.Generic ) - warning
12:37:08.0231 3756 MpKsl9eb49869 - detected ForgedFile.Multi.Generic (1)
12:37:08.0278 3756 [ A69630D039C38018689190234F866D77 ] MpKslb45a62dc c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B799712B-8001-4707-9CC7-EEAB541321CA}\MpKslb45a62dc.sys
12:37:08.0278 3756 MpKslb45a62dc - ok
12:37:08.0294 3756 [ 6E7A7F0C1193EE5648443FE2D4B789EC ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
12:37:08.0294 3756 mpsdrv - ok
12:37:08.0325 3756 [ 563ED845885C6A7C09A7715D8BD0585C ] MpsSvc C:\Windows\system32\mpssvc.dll
12:37:08.0341 3756 MpsSvc - ok
12:37:08.0372 3756 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
12:37:08.0372 3756 Mraid35x - ok
12:37:08.0387 3756 [ 1D8828B98EE309D65E006F0829E280E5 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
12:37:08.0387 3756 MRxDAV - ok
12:37:08.0450 3756 [ 8AF705CE1BB907932157FAB821170F27 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
12:37:08.0450 3756 mrxsmb - ok
12:37:08.0465 3756 [ 47E13AB23371BE3279EEF22BBFA2C1BE ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:37:08.0481 3756 mrxsmb10 - ok
12:37:08.0497 3756 [ 90B3FC7BD6B3D7EE7635DEBBA2187F66 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:37:08.0497 3756 mrxsmb20 - ok
12:37:08.0512 3756 [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci C:\Windows\system32\drivers\msahci.sys
12:37:08.0512 3756 msahci - ok
12:37:08.0606 3756 [ 8E46A7BAC823DD82D4FB2A34C3DF4C1D ] MSCSPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
12:37:08.0637 3756 MSCSPTISRV - ok
12:37:08.0653 3756 [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm C:\Windows\system32\drivers\msdsm.sys
12:37:08.0653 3756 msdsm - ok
12:37:08.0684 3756 [ BC64A92D821EFEA8BAB8E8CAF1B668BC ] MSDTC C:\Windows\System32\msdtc.exe
12:37:08.0684 3756 MSDTC - ok
12:37:08.0699 3756 [ 729EAFEFD4E7417165F353A18DBE947D ] Msfs C:\Windows\system32\drivers\Msfs.sys
12:37:08.0699 3756 Msfs - ok
12:37:08.0746 3756 [ 5F454A16A5146CD91A176D70F0CFA3EC ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
12:37:08.0746 3756 msisadrv - ok
12:37:08.0777 3756 [ 8ACF956D9154E893E789881430C12632 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
12:37:08.0777 3756 MSiSCSI - ok
12:37:08.0777 3756 msiserver - ok
12:37:08.0809 3756 [ 892CEDEFA7E0FFE7BE8DA651B651D047 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
12:37:08.0809 3756 MSKSSRV - ok
12:37:08.0887 3756 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
12:37:08.0902 3756 MsMpSvc - ok
12:37:08.0933 3756 [ AE2CB1DA69B2676B4CEE2A501AF5871C ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
12:37:08.0933 3756 MSPCLOCK - ok
12:37:08.0965 3756 [ F910DA84FA90C44A3ADDB7CD874463FD ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
12:37:08.0965 3756 MSPQM - ok
12:37:08.0965 3756 [ 84571C0AE07647BA38D493F5F0015DF7 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
12:37:08.0965 3756 MsRPC - ok
12:37:08.0996 3756 [ 4385C80EDE885E25492D408CAD91BD6F ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
12:37:08.0996 3756 mssmbios - ok
12:37:09.0011 3756 [ C826DD1373F38AFD9CA46EC3C436A14E ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
12:37:09.0011 3756 MSTEE - ok
12:37:09.0027 3756 [ FA7AA70050CF5E2D15DE00941E5665E5 ] Mup C:\Windows\system32\Drivers\mup.sys
12:37:09.0027 3756 Mup - ok
12:37:09.0058 3756 [ 1CDBB5D002FE2BC5300AA20550D8A52E ] napagent C:\Windows\system32\qagentRT.dll
12:37:09.0074 3756 napagent - ok
12:37:09.0136 3756 [ 6DA4A0FC7C0E83DF0CB3CFD0A514C3BC ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
12:37:09.0136 3756 NativeWifiP - ok
12:37:09.0183 3756 [ 227C11E1E7CF6EF8AFB2A238D209760C ] NDIS C:\Windows\system32\drivers\ndis.sys
12:37:09.0199 3756 NDIS - ok
12:37:09.0245 3756 [ 81659CDCBD0F9A9E07E6878AD8C78D3F ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
12:37:09.0245 3756 NdisTapi - ok
12:37:09.0277 3756 [ 5DE5EE546BF40838EBE0E01CB629DF64 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
12:37:09.0277 3756 Ndisuio - ok
12:37:09.0292 3756 [ 397402ADCBB8946223A1950101F6CD94 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
12:37:09.0292 3756 NdisWan - ok
12:37:09.0292 3756 [ 1B24FA907AF283199A81B3BB37E5E526 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
12:37:09.0292 3756 NDProxy - ok
12:37:09.0308 3756 [ 356DBB9F98E8DC1028DD3092FCEEB877 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
12:37:09.0308 3756 NetBIOS - ok
12:37:09.0323 3756 [ E3A168912E7EEFC3BD3B814720D68B41 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
12:37:09.0323 3756 netbt - ok
12:37:09.0355 3756 [ C731B1FE449D4E9CEA358C9D55B69BE9 ] Netlogon C:\Windows\system32\lsass.exe
12:37:09.0355 3756 Netlogon - ok
12:37:09.0386 3756 [ 90A4DAE28B94497F83BEA0F2A3B77092 ] Netman C:\Windows\System32\netman.dll
12:37:09.0401 3756 Netman - ok
12:37:09.0417 3756 [ 7C5C3D9CEEE838856B828AB6F98A2857 ] netprofm C:\Windows\System32\netprofm.dll
12:37:09.0417 3756 netprofm - ok
12:37:09.0448 3756 [ 0AD5876EF4E9EB77C8F93EB5B2FFF386 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:37:09.0448 3756 NetTcpPortSharing - ok
12:37:09.0479 3756 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
12:37:09.0479 3756 nfrd960 - ok
12:37:09.0495 3756 [ C424117A562F2DE37A42266894C79AEB ] NlaSvc C:\Windows\System32\nlasvc.dll
12:37:09.0511 3756 NlaSvc - ok
12:37:09.0542 3756 [ 4F9832BEB9FAFD8CEB0E541F1323B26E ] Npfs C:\Windows\system32\drivers\Npfs.sys
12:37:09.0542 3756 Npfs - ok
12:37:09.0557 3756 [ 23B8201A363DE0E649FC75EE9874DEE2 ] nsi C:\Windows\system32\nsisvc.dll
12:37:09.0557 3756 nsi - ok
12:37:09.0573 3756 [ B488DFEC274DE1FC9D653870EF2587BE ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
12:37:09.0573 3756 nsiproxy - ok
12:37:09.0635 3756 [ 37430AA7A66D7A63407ADC2C0D05E9F6 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
12:37:09.0651 3756 Ntfs - ok
12:37:09.0682 3756 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
12:37:09.0682 3756 ntrigdigi - ok
12:37:09.0698 3756 [ EC5EFB3C60F1B624648344A328BCE596 ] Null C:\Windows\system32\drivers\Null.sys
12:37:09.0698 3756 Null - ok
12:37:10.0306 3756 [ 0A1B502CBC8230DA74BEFBAADDB58916 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:37:10.0400 3756 nvlddmkm - ok
12:37:10.0462 3756 [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid C:\Windows\system32\drivers\nvraid.sys
12:37:10.0478 3756 nvraid - ok
12:37:10.0540 3756 [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor C:\Windows\system32\drivers\nvstor.sys
12:37:10.0540 3756 nvstor - ok
12:37:10.0603 3756 [ EB5A13F9139F20AD71ADF4BF79C3AA29 ] nvsvc C:\Windows\system32\nvvsvc.exe
12:37:10.0634 3756 nvsvc - ok
12:37:10.0712 3756 [ 0629259E3AF6BB0534FCECA208973404 ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
12:37:10.0759 3756 nvUpdatusService - ok
12:37:10.0790 3756 [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
12:37:10.0790 3756 nv_agp - ok
12:37:10.0790 3756 NwlnkFlt - ok
12:37:10.0790 3756 NwlnkFwd - ok
12:37:10.0852 3756 [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
12:37:10.0852 3756 ohci1394 - ok
12:37:10.0899 3756 [ 016D01D3B8FB976A193C7434BED8DCCF ] p2pimsvc C:\Windows\system32\p2psvc.dll
12:37:10.0915 3756 p2pimsvc - ok
12:37:10.0915 3756 [ 016D01D3B8FB976A193C7434BED8DCCF ] p2psvc C:\Windows\system32\p2psvc.dll
12:37:10.0930 3756 p2psvc - ok
12:37:10.0977 3756 [ 753A8F339F231D2B857E2CCD51A6E6CA ] PACSPTISVR C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
12:37:11.0039 3756 PACSPTISVR - ok
12:37:11.0086 3756 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
12:37:11.0086 3756 Parport - ok
12:37:11.0102 3756 [ 555A5B2C8022983BC7467BC925B222EE ] partmgr C:\Windows\system32\drivers\partmgr.sys
12:37:11.0102 3756 partmgr - ok
12:37:11.0133 3756 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
12:37:11.0133 3756 Parvdm - ok
12:37:11.0164 3756 [ D8C5C215C932233A4F1D7F368F4E4E65 ] PcaSvc C:\Windows\System32\pcasvc.dll
12:37:11.0164 3756 PcaSvc - ok
12:37:11.0211 3756 [ 175CC28DCF819F78CAA3FBD44AD9E52A ] pccsmcfd C:\Windows\system32\DRIVERS\pccsmcfd.sys
12:37:11.0211 3756 pccsmcfd - ok
12:37:11.0227 3756 [ 1085D75657807E0E8B32F9E19A1647C3 ] pci C:\Windows\system32\drivers\pci.sys
12:37:11.0242 3756 pci - ok
12:37:11.0242 3756 [ 3B1901E401473E03EB8C874271E50C26 ] pciide C:\Windows\system32\drivers\pciide.sys
12:37:11.0242 3756 pciide - ok
12:37:11.0273 3756 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
12:37:11.0273 3756 pcmcia - ok
12:37:11.0351 3756 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
12:37:11.0383 3756 PEAUTH - ok
12:37:11.0445 3756 [ CD05A38D166BEADE18030BAFC0C0A939 ] pla C:\Windows\system32\pla.dll
12:37:11.0492 3756 pla - ok
12:37:11.0539 3756 [ 747BB4C31F3B6E8D1B5ED0AD61518CB5 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
12:37:11.0539 3756 PlugPlay - ok
12:37:11.0601 3756 [ A1DD33D16F277CE34124EE52AB2C0F14 ] PnkBstrA C:\Windows\system32\PnkBstrA.exe
12:37:11.0601 3756 PnkBstrA - ok
12:37:11.0617 3756 [ 016D01D3B8FB976A193C7434BED8DCCF ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
12:37:11.0632 3756 PNRPAutoReg - ok
12:37:11.0648 3756 [ 016D01D3B8FB976A193C7434BED8DCCF ] PNRPsvc C:\Windows\system32\p2psvc.dll
12:37:11.0648 3756 PNRPsvc - ok
12:37:11.0695 3756 [ 5EBDEC613BD377CE9A85382BE5C6B83B ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
12:37:11.0710 3756 PolicyAgent - ok
12:37:11.0741 3756 [ C04DEC5ACE67C5247B150C4223970BB7 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
12:37:11.0741 3756 PptpMiniport - ok
12:37:11.0773 3756 [ 0E3CEF5D28B40CF273281D620C50700A ] Processor C:\Windows\system32\drivers\processr.sys
12:37:11.0773 3756 Processor - ok
12:37:11.0804 3756 [ 213112E152E68F0E4705E36F052A2880 ] ProfSvc C:\Windows\system32\profsvc.dll
12:37:11.0804 3756 ProfSvc - ok
12:37:11.0835 3756 [ C731B1FE449D4E9CEA358C9D55B69BE9 ] ProtectedStorage C:\Windows\system32\lsass.exe
12:37:11.0835 3756 ProtectedStorage - ok
12:37:11.0866 3756 [ 2C8BAE55247C4E09352E870292E4D1AB ] PSched C:\Windows\system32\DRIVERS\pacer.sys
12:37:11.0866 3756 PSched - ok
12:37:11.0897 3756 [ F7BB4E7A7C02AB4A2672937E124E306E ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys
12:37:11.0913 3756 PxHelp20 - ok
12:37:12.0116 3756 [ CCDAC889326317792480C0A67156A1EC ] ql2300 C:\Windows\system32\drivers\ql2300.sys
12:37:12.0178 3756 ql2300 - ok
12:37:12.0209 3756 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
12:37:12.0209 3756 ql40xx - ok
12:37:12.0256 3756 [ CA61BDFD3713A7CE75F2812AFC431594 ] QWAVE C:\Windows\system32\qwave.dll
12:37:12.0256 3756 QWAVE - ok
12:37:12.0272 3756 [ D2B3E2B7426DC23E185FBC73C8936C12 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
12:37:12.0272 3756 QWAVEdrv - ok
12:37:12.0287 3756 [ BD7B30F55B3649506DD8B3D38F571D2A ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
12:37:12.0287 3756 RasAcd - ok
12:37:12.0303 3756 [ F14F4AAB9F54D099FE99192BDB100AC9 ] RasAuto C:\Windows\System32\rasauto.dll
12:37:12.0303 3756 RasAuto - ok
12:37:12.0334 3756 [ 68B0019FEE429EC49D29017AF937E482 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
12:37:12.0334 3756 Rasl2tp - ok
12:37:12.0365 3756 [ 11D65E29BC9D1E4114D18FE68194394C ] RasMan C:\Windows\System32\rasmans.dll
12:37:12.0381 3756 RasMan - ok
12:37:12.0443 3756 [ CCF4E9C6CBBAC81437F88CB2AE0B6C96 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
12:37:12.0443 3756 RasPppoe - ok
12:37:12.0459 3756 [ 54129C5D9581BBEC8BD1EBD3BA813F47 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
12:37:12.0475 3756 rdbss - ok
12:37:12.0506 3756 [ 794585276B5D7FCA9F3FC15543F9F0B9 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
12:37:12.0506 3756 RDPCDD - ok
12:37:12.0521 3756 [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
12:37:12.0521 3756 rdpdr - ok
12:37:12.0537 3756 [ 980B56E2E273E19D3A9D72D5C420F008 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
12:37:12.0537 3756 RDPENCDD - ok
12:37:12.0553 3756 [ 8830E790A74A96605FABA74F9665BB3C ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
12:37:12.0568 3756 RDPWD - ok
12:37:12.0615 3756 [ 6C1A43C589EE8011A1EBFD51C01B77CE ] RemoteAccess C:\Windows\System32\mprdim.dll
12:37:12.0615 3756 RemoteAccess - ok
12:37:12.0646 3756 [ 9A043808667C8C1893DA7275AF373F0E ] RemoteRegistry C:\Windows\system32\regsvc.dll
12:37:12.0646 3756 RemoteRegistry - ok
12:37:12.0693 3756 [ C3162AC1B592CEB43ABE2F972A7222D3 ] RichVideo C:\Program Files\CyberLink\Shared Files\RichVideo.exe
12:37:12.0693 3756 RichVideo - ok
12:37:12.0724 3756 [ 8804BCB4383859F66FFD51F049A1D744 ] RMCAST C:\Windows\system32\DRIVERS\RMCAST.sys
12:37:12.0724 3756 RMCAST - ok
12:37:12.0802 3756 [ 9638E5820858593A12005C753B03CEAE ] RoxMediaDB9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
12:37:12.0833 3756 RoxMediaDB9 - ok
12:37:12.0849 3756 [ 910FBA95EE4F56449AA81315884C8EFD ] RoxWatch9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
12:37:12.0849 3756 RoxWatch9 - ok
12:37:12.0880 3756 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
12:37:12.0880 3756 RpcLocator - ok
12:37:12.0927 3756 [ 7B981222A257D076885BFFB66F19B7CE ] RpcSs C:\Windows\system32\rpcss.dll
12:37:12.0927 3756 RpcSs - ok
12:37:12.0943 3756 [ 97E939D2128FEC5D5A3E6E79B290A2F4 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
12:37:12.0958 3756 rspndr - ok
12:37:13.0005 3756 [ 959EF612D2CCFDB6D9E443F8E3655013 ] RTL8023xp C:\Windows\system32\DRIVERS\Rtnicxp.sys
12:37:13.0005 3756 RTL8023xp - ok
12:37:13.0099 3756 [ 77672C9065F8DA2B6492496BEE547284 ] RTL8192cu C:\Windows\system32\DRIVERS\RTL8192cu.sys
12:37:13.0114 3756 RTL8192cu - ok
12:37:13.0130 3756 [ C731B1FE449D4E9CEA358C9D55B69BE9 ] SamSs C:\Windows\system32\lsass.exe
12:37:13.0130 3756 SamSs - ok
12:37:13.0145 3756 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
12:37:13.0145 3756 sbp2port - ok
12:37:13.0177 3756 [ 565B4B9E5AD2F2F18A4F8AAFA6C06BBB ] SCardSvr C:\Windows\System32\SCardSvr.dll
12:37:13.0177 3756 SCardSvr - ok
12:37:13.0239 3756 [ 886CEC884B5BE29AB9828B8AB46B11F7 ] Schedule C:\Windows\system32\schedsvc.dll
12:37:13.0239 3756 Schedule - ok
12:37:13.0255 3756 [ 0600E04315FE543802A379D5D23C8BE0 ] SCPolicySvc C:\Windows\System32\certprop.dll
12:37:13.0255 3756 SCPolicySvc - ok
12:37:13.0270 3756 [ F7B6BF02240D0A764ADF8C8966735552 ] SDRSVC C:\Windows\System32\SDRSVC.dll
12:37:13.0270 3756 SDRSVC - ok
12:37:13.0286 3756 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
12:37:13.0286 3756 secdrv - ok
12:37:13.0317 3756 [ 8388C4133DDBE62AD7BC3EC9F14271ED ] seclogon C:\Windows\system32\seclogon.dll
12:37:13.0317 3756 seclogon - ok
12:37:13.0333 3756 [ 34350AE2C1D33D21C7305F861BD8DAD8 ] SENS C:\Windows\System32\sens.dll
12:37:13.0333 3756 SENS - ok
12:37:13.0364 3756 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
12:37:13.0364 3756 Serenum - ok
12:37:13.0379 3756 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
12:37:13.0379 3756 Serial - ok
12:37:13.0411 3756 [ 450ACCD77EC5CEA720C1CDB9E26B953B ] sermouse C:\Windows\system32\drivers\sermouse.sys
12:37:13.0411 3756 sermouse - ok
12:37:13.0504 3756 [ 9D38320BB32230349379DF5DDBBF7FCE ] ServiceLayer C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
12:37:13.0567 3756 ServiceLayer - ok
12:37:13.0613 3756 [ 78878235DA4DF0D116E86837A0A21DF8 ] SessionEnv C:\Windows\system32\sessenv.dll
12:37:13.0613 3756 SessionEnv - ok
12:37:13.0645 3756 [ 51CF56AA8BCC241F134B420B8F850406 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
12:37:13.0645 3756 sffdisk - ok
12:37:13.0676 3756 [ 96DED8B20C734AC41641CE275250E55D ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
12:37:13.0676 3756 sffp_mmc - ok
12:37:13.0691 3756 [ 8B08CAB1267B2C377883FC9E56981F90 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
12:37:13.0691 3756 sffp_sd - ok
12:37:13.0707 3756 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
12:37:13.0707 3756 sfloppy - ok
12:37:13.0738 3756 [ 9A82BF4C90B00A63150A606A1E2FD82B ] SharedAccess C:\Windows\System32\ipnathlp.dll
12:37:13.0738 3756 SharedAccess - ok
12:37:13.0769 3756 [ B264DFA21677728613267FE63802B332 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:37:13.0785 3756 ShellHWDetection - ok
12:37:13.0816 3756 [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
12:37:13.0816 3756 SiSRaid2 - ok
12:37:13.0847 3756 [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
12:37:13.0847 3756 SiSRaid4 - ok
12:37:13.0894 3756 [ A61BEC28D555B65D1CE2604AF85AD9BE ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
12:37:13.0894 3756 SkypeUpdate - ok
12:37:13.0988 3756 [ A1DCD30534835CB67733AD00175125A6 ] slsvc C:\Windows\system32\SLsvc.exe
12:37:14.0066 3756 slsvc - ok
12:37:14.0113 3756 [ 56DA296E7B376A727E7BDC5AC7FBEE02 ] SLUINotify C:\Windows\system32\SLUINotify.dll
12:37:14.0113 3756 SLUINotify - ok
12:37:14.0128 3756 [ AC0D90738ADB51A6FD12FF00874A2162 ] Smb C:\Windows\system32\DRIVERS\smb.sys
12:37:14.0128 3756 Smb - ok
12:37:14.0159 3756 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
12:37:14.0159 3756 SNMPTRAP - ok
12:37:14.0191 3756 [ 426F9B029AA9162CECCF65369457D046 ] spldr C:\Windows\system32\drivers\spldr.sys
12:37:14.0191 3756 spldr - ok
12:37:14.0206 3756 [ DA612EF2556776DF2630B68BF2D48935 ] Spooler C:\Windows\System32\spoolsv.exe
12:37:14.0206 3756 Spooler - ok
12:37:14.0284 3756 [ 71E276F6D189413266EA22171806597B ] sptd C:\Windows\System32\Drivers\sptd.sys
12:37:14.0300 3756 sptd - ok
12:37:14.0331 3756 [ E3E6C96B0EF4492C3C8FD0DEEF4E35A1 ] SPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
12:37:14.0362 3756 SPTISRV - ok
12:37:14.0409 3756 [ 038579C35F7CAD4A4BBF735DBF83277D ] srv C:\Windows\system32\DRIVERS\srv.sys
12:37:14.0409 3756 srv - ok
12:37:14.0440 3756 [ 6971A757AF8CB5E2CBCBB76CC530DB6C ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
12:37:14.0440 3756 srv2 - ok
12:37:14.0471 3756 [ 9E1A4603B874EEBCE0298113951ABEFB ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
12:37:14.0471 3756 srvnet - ok
12:37:14.0503 3756 [ 8D3E4BAFF8B3997138C38EB1B600519A ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
12:37:14.0503 3756 SSDPSRV - ok
12:37:14.0565 3756 [ EAA66218CD39F5BB1B4853A78C67C787 ] ss_bbus C:\Windows\system32\DRIVERS\ss_bbus.sys
12:37:14.0565 3756 ss_bbus - ok
12:37:14.0612 3756 [ 91765F99914ED8693D8BC76524F21581 ] ss_bmdfl C:\Windows\system32\DRIVERS\ss_bmdfl.sys
12:37:14.0612 3756 ss_bmdfl - ok
12:37:14.0643 3756 [ 840E7B738B03C10EE91D9B7D3D6EFF15 ] ss_bmdm C:\Windows\system32\DRIVERS\ss_bmdm.sys
12:37:14.0659 3756 ss_bmdm - ok
12:37:14.0690 3756 [ 5A1D0CA8A5F1E7B4EC50B9D76C001F0E ] ss_bus C:\Windows\system32\DRIVERS\ss_bus.sys
12:37:14.0690 3756 ss_bus - ok
12:37:14.0737 3756 [ F0A85580E36A3A85059037D39A9CF079 ] ss_mdfl C:\Windows\system32\DRIVERS\ss_mdfl.sys
12:37:14.0737 3756 ss_mdfl - ok
12:37:14.0752 3756 [ 84C3DBFD1BFA4ADC0A950B3D5506CB00 ] ss_mdm C:\Windows\system32\DRIVERS\ss_mdm.sys
12:37:14.0752 3756 ss_mdm - ok
12:37:14.0830 3756 [ F0359F7CE712D69ACEF0886BDB4792ED ] Stereo Service C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
12:37:14.0830 3756 Stereo Service - ok
12:37:14.0893 3756 [ A941E099EF46E3CC12F898CBE1C39910 ] stisvc C:\Windows\System32\wiaservc.dll
12:37:14.0908 3756 stisvc - ok
12:37:14.0955 3756 [ 51778FD315C9882F1CBD932743E62A72 ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
12:37:14.0986 3756 stllssvr - ok
12:37:15.0033 3756 [ 1379BDB336F8158C176A465E30759F57 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
12:37:15.0033 3756 swenum - ok
12:37:15.0064 3756 [ 749ADA8D6C18A08ADFEDE69CBF5DB2E0 ] swprv C:\Windows\System32\swprv.dll
12:37:15.0064 3756 swprv - ok
12:37:15.0095 3756 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
12:37:15.0095 3756 Symc8xx - ok
12:37:15.0127 3756 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
12:37:15.0127 3756 Sym_hi - ok
12:37:15.0142 3756 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
12:37:15.0142 3756 Sym_u3 - ok
12:37:15.0173 3756 [ 8F2B5FEDE18BD3C4C926CBF88E6F1264 ] SysMain C:\Windows\system32\sysmain.dll
12:37:15.0205 3756 SysMain - ok
12:37:15.0220 3756 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:37:15.0236 3756 TabletInputService - ok
12:37:15.0267 3756 [ EF3DD33C740FC2F82E7E4622F1C49289 ] TapiSrv C:\Windows\System32\tapisrv.dll
12:37:15.0267 3756 TapiSrv - ok
12:37:15.0298 3756 [ 68FA52794AE9ACC61BDE16FE0956B414 ] TBS C:\Windows\System32\tbssvc.dll
12:37:15.0298 3756 TBS - ok
12:37:15.0329 3756 [ 4A82FA8F0DF67AA354580C3FAAF8BDE3 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
12:37:15.0345 3756 Tcpip - ok
12:37:15.0376 3756 [ 4A82FA8F0DF67AA354580C3FAAF8BDE3 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
12:37:15.0376 3756 Tcpip6 - ok
12:37:15.0407 3756 [ 5CE0C4A7B12D0067DAD527D72B68C726 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
12:37:15.0407 3756 tcpipreg - ok
12:37:15.0423 3756 [ 964248AEF49C31FA6A93201A73FFAF50 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
12:37:15.0423 3756 TDPIPE - ok
12:37:15.0439 3756 [ 7D2C1AE1648A60FCE4AA0F7982E419D3 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
12:37:15.0439 3756 TDTCP - ok
12:37:15.0439 3756 [ AB4FDE8AF4A0270A46A001C08CBCE1C2 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
12:37:15.0439 3756 tdx - ok
12:37:15.0454 3756 [ 2C549BD9DD091FBFAA0A2A48E82EC2FB ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
12:37:15.0454 3756 TermDD - ok
12:37:15.0485 3756 [ FAD71C1E8E4047B154E899AE31EB8CAA ] TermService C:\Windows\System32\termsrv.dll
12:37:15.0485 3756 TermService - ok
12:37:15.0501 3756 [ B264DFA21677728613267FE63802B332 ] Themes C:\Windows\system32\shsvcs.dll
12:37:15.0501 3756 Themes - ok
12:37:15.0517 3756 [ 9DFA3A459AF0954AA85B4F7622AD87BB ] THREADORDER C:\Windows\system32\mmcss.dll
12:37:15.0517 3756 THREADORDER - ok
12:37:15.0532 3756 [ 6BBA0582C0025D43729A1112D3B57897 ] TrkWks C:\Windows\System32\trkwks.dll
12:37:15.0532 3756 TrkWks - ok
12:37:15.0579 3756 [ 34E388A395FEDBA1D0511ED39BBF4074 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:37:15.0579 3756 TrustedInstaller - ok
12:37:15.0595 3756 [ 29F0ECA726F0D51F7E048BDB0B372F29 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
12:37:15.0595 3756 tssecsrv - ok
12:37:15.0626 3756 [ 65E953BC0084D44498B51F59784D2A82 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
12:37:15.0626 3756 tunmp - ok
12:37:15.0673 3756 [ 4A39BDA5E0FD30BDF4884F9D33AE6105 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
12:37:15.0673 3756 tunnel - ok
12:37:15.0688 3756 [ C3ADE15414120033A36C0F293D4A4121 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
12:37:15.0688 3756 uagp35 - ok
12:37:15.0704 3756 [ 6348DA98707CEDA8A0DFB05820E17732 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
12:37:15.0719 3756 udfs - ok
12:37:15.0751 3756 [ 24A333F4F14DCFB6FF6D5A1B9E5D79DD ] UI0Detect C:\Windows\system32\UI0Detect.exe
12:37:15.0751 3756 UI0Detect - ok
12:37:15.0766 3756 [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
12:37:15.0766 3756 uliagpkx - ok
12:37:15.0813 3756 [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci C:\Windows\system32\drivers\uliahci.sys
12:37:15.0813 3756 uliahci - ok
12:37:15.0844 3756 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
12:37:15.0844 3756 UlSata - ok
12:37:15.0891 3756 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
12:37:15.0907 3756 ulsata2 - ok
12:37:15.0938 3756 [ 3FB78F1D1DD86D87BECECD9DFFA24DD9 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
12:37:15.0938 3756 umbus - ok
12:37:15.0985 3756 [ 8EB871A3DEB6B3D5A85EB6DDFC390B59 ] upnphost C:\Windows\System32\upnphost.dll
12:37:16.0000 3756 upnphost - ok
12:37:16.0078 3756 [ 03B01E8DBD2DA2B49157B7E51912AAF2 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
12:37:16.0094 3756 usbccgp - ok
12:37:16.0109 3756 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
12:37:16.0109 3756 usbcir - ok
12:37:16.0125 3756 [ 2F83363F98484F8EDAF49F9B41520D14 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
12:37:16.0125 3756 usbehci - ok
12:37:16.0141 3756 [ 14D2A4DCD92C0B3368667AED6893463D ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
12:37:16.0156 3756 usbhub - ok
12:37:16.0172 3756 [ 38DBC7DD6CC5A72011F187425384388B ] usbohci C:\Windows\system32\drivers\usbohci.sys
12:37:16.0172 3756 usbohci - ok
12:37:16.0203 3756 [ B51E52ACF758BE00EF3A58EA452FE360 ] usbprint C:\Windows\system32\drivers\usbprint.sys
12:37:16.0203 3756 usbprint - ok
12:37:16.0234 3756 [ 7887CE56934E7F104E98C975F47353C5 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:37:16.0234 3756 USBSTOR - ok
12:37:16.0234 3756 [ 7747B902F6B7D0096F9C2BF55D3247F1 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
12:37:16.0234 3756 usbuhci - ok
12:37:16.0265 3756 [ F79D0D7C9004474CB42746D9B2C30A2B ] UxSms C:\Windows\System32\uxsms.dll
12:37:16.0265 3756 UxSms - ok
12:37:16.0281 3756 [ C9D0BAFEE0D0A2681F048CA61BC0DA96 ] vds C:\Windows\System32\vds.exe
12:37:16.0297 3756 vds - ok
12:37:16.0343 3756 [ 7D92BE0028ECDEDEC74617009084B5EF ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
12:37:16.0343 3756 vga - ok
12:37:16.0359 3756 [ 17A8F877314E4067F8C8172CC6D9101C ] VgaSave C:\Windows\System32\drivers\vga.sys
12:37:16.0359 3756 VgaSave - ok
12:37:16.0390 3756 [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp C:\Windows\system32\drivers\viaagp.sys
12:37:16.0390 3756 viaagp - ok
12:37:16.0421 3756 [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
12:37:16.0421 3756 ViaC7 - ok
12:37:16.0468 3756 [ 48C9B50CDDD51A205F7AA1639B3D4822 ] viaide C:\Windows\system32\drivers\viaide.sys
12:37:16.0468 3756 viaide - ok
12:37:16.0484 3756 [ 103E84C95832D0ED93507997CC7B54E8 ] volmgr C:\Windows\system32\drivers\volmgr.sys
12:37:16.0484 3756 volmgr - ok
12:37:16.0499 3756 [ 294DA8D3F965F6A8DB934A83C7B461FF ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
12:37:16.0515 3756 volmgrx - ok
12:37:16.0562 3756 [ 80DC0C9BCB579ED9815001A4D37CBFD5 ] volsnap C:\Windows\system32\drivers\volsnap.sys
12:37:16.0562 3756 volsnap - ok
12:37:16.0577 3756 [ D984439746D42B30FC65A4C3546C6829 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
12:37:16.0577 3756 vsmraid - ok
12:37:16.0640 3756 [ E0E29D9EF2524ABD11749C7C2FD7F607 ] VSS C:\Windows\system32\vssvc.exe
12:37:16.0671 3756 VSS - ok
12:37:16.0687 3756 [ 62B0D0F6F5580D9D0DFA5E0B466FF2ED ] W32Time C:\Windows\system32\w32time.dll
12:37:16.0702 3756 W32Time - ok
12:37:16.0718 3756 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
12:37:16.0718 3756 WacomPen - ok
12:37:16.0749 3756 [ 6798C1209A53B5A0DED8D437C45145FF ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
12:37:16.0749 3756 Wanarp - ok
12:37:16.0749 3756 [ 6798C1209A53B5A0DED8D437C45145FF ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
12:37:16.0765 3756 Wanarpv6 - ok
12:37:16.0780 3756 [ C1B19162E0509CEAB4CDF664E139D956 ] wcncsvc C:\Windows\System32\wcncsvc.dll
12:37:16.0780 3756 wcncsvc - ok
12:37:16.0811 3756 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:37:16.0811 3756 WcsPlugInService - ok
12:37:16.0827 3756 [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd C:\Windows\system32\drivers\wd.sys
12:37:16.0843 3756 Wd - ok
12:37:16.0874 3756 [ 7B5F66E4A2219C7D9DAF9E738480E534 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
12:37:16.0874 3756 Wdf01000 - ok
12:37:16.0905 3756 [ 2A424B89B14EF17A3D06BCB5A8F79601 ] WdiServiceHost C:\Windows\system32\wdi.dll
12:37:16.0905 3756 WdiServiceHost - ok
12:37:16.0905 3756 [ 2A424B89B14EF17A3D06BCB5A8F79601 ] WdiSystemHost C:\Windows\system32\wdi.dll
12:37:16.0905 3756 WdiSystemHost - ok
12:37:16.0936 3756 [ 01E41C264EEDCB827820A1909162579F ] WebClient C:\Windows\System32\webclnt.dll
12:37:16.0936 3756 WebClient - ok
12:37:16.0952 3756 [ 9CF67FF7F8D34CBF115D0C278B9F74AA ] Wecsvc C:\Windows\system32\wecsvc.dll
12:37:16.0952 3756 Wecsvc - ok
12:37:16.0952 3756 [ B68CAB45DB1DAB59D92ACADFAD6364A8 ] wercplsupport C:\Windows\System32\wercplsupport.dll
12:37:16.0967 3756 wercplsupport - ok
12:37:16.0983 3756 [ 36BA0707680EF4236FD752BEE982CC25 ] WerSvc C:\Windows\System32\WerSvc.dll
12:37:16.0983 3756 WerSvc - ok
12:37:17.0030 3756 [ 0D5AD0E71FF5DDAC5DD2F443B499ABD0 ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
12:37:17.0030 3756 WinDefend - ok
12:37:17.0030 3756 WinHttpAutoProxySvc - ok
12:37:17.0092 3756 [ 38A7B89DE4E3417C122317949667FDD8 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
12:37:17.0092 3756 Winmgmt - ok
12:37:17.0123 3756 [ 3F6823040030C3E4DA1CF11CD40B7534 ] WinRM C:\Windows\system32\WsmSvc.dll
12:37:17.0139 3756 WinRM - ok
12:37:17.0186 3756 [ 7640ACEA41348BFEF34B76E245501261 ] Wlansvc C:\Windows\System32\wlansvc.dll
12:37:17.0186 3756 Wlansvc - ok
12:37:17.0217 3756 [ 17EAC0D023A65FA9B02114CC2BAACAD5 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
12:37:17.0217 3756 WmiAcpi - ok
12:37:17.0248 3756 [ A279323BEE5FFFAFDA222910BCE92132 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
12:37:17.0311 3756 wmiApSrv - ok
12:37:17.0373 3756 [ ACB2E63D50157E3EA7140F29D9E76A48 ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
12:37:17.0420 3756 WMPNetworkSvc - ok
12:37:17.0467 3756 [ 3D3B3B80C12ABE506F56930C46422C28 ] WPCSvc C:\Windows\System32\wpcsvc.dll
12:37:17.0467 3756 WPCSvc - ok
12:37:17.0498 3756 [ C24844A1D0D9528B19D5BC266B8CD572 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
12:37:17.0498 3756 WPDBusEnum - ok
12:37:17.0560 3756 [ 2D27171B16A577EF14C1273668753485 ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
12:37:17.0560 3756 WpdUsb - ok
12:37:17.0591 3756 [ 84620AECDCFD2A7A14E6263927D8C0ED ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
12:37:17.0591 3756 ws2ifsl - ok
12:37:17.0623 3756 [ F97CBB919AF6D0A6643D1A59C15014D1 ] wscsvc C:\Windows\System32\wscsvc.dll
12:37:17.0623 3756 wscsvc - ok
12:37:17.0623 3756 WSearch - ok
12:37:17.0716 3756 [ 84A03BFE004B06E93408618976DC9C14 ] wuauserv C:\Windows\system32\wuaueng.dll
12:37:17.0763 3756 wuauserv - ok
12:37:17.0810 3756 [ A2AAFCC8A204736296D937C7C545B53F ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
12:37:17.0810 3756 WUDFRd - ok
12:37:17.0857 3756 [ DB5BF5AAB72B1B99B5331231D09EBB26 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
12:37:17.0857 3756 wudfsvc - ok
12:37:17.0872 3756 ================ Scan global ===============================
12:37:17.0903 3756 [ 8CD98A8EC9CADAF4E051CDCAC15C96C4 ] C:\Windows\system32\basesrv.dll
12:37:17.0935 3756 [ E3F137ADC0A9D7F3A2E4F557272FE6B3 ] C:\Windows\system32\winsrv.dll
12:37:17.0950 3756 [ E3F137ADC0A9D7F3A2E4F557272FE6B3 ] C:\Windows\system32\winsrv.dll
12:37:17.0981 3756 [ 329CF3C97CE4C19375C8ABCABAE258B0 ] C:\Windows\system32\services.exe
12:37:17.0997 3756 [Global] - ok
12:37:17.0997 3756 ================ Scan MBR ==================================
12:37:18.0028 3756 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
12:37:18.0169 3756 \Device\Harddisk0\DR0 - ok
12:37:18.0169 3756 ================ Scan VBR ==================================
12:37:18.0169 3756 [ 6A615C53B48426058D1B320BDDC5EBD9 ] \Device\Harddisk0\DR0\Partition1
12:37:18.0184 3756 \Device\Harddisk0\DR0\Partition1 - ok
12:37:18.0184 3756 ============================================================
12:37:18.0184 3756 Scan finished
12:37:18.0184 3756 ============================================================
12:37:18.0184 3680 Detected object count: 1
12:37:18.0184 3680 Actual detected object count: 1
12:41:19.0625 3680 MpKsl9eb49869 ( ForgedFile.Multi.Generic ) - skipped by user
12:41:19.0625 3680 MpKsl9eb49869 ( ForgedFile.Multi.Generic ) - User select action: Skip

aharonov · 15.02.2013, 13:14

Wie läuft der Rechner jetzt? Hast du noch Probleme?

Schritt 1

Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.

Schliesse alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Schritt 2

Warnung für Mitleser:
Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link.

WICHTIG: Speichere Combofix auf deinen Desktop.
Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
Während Combofix läuft, bitte gar nichts am Computer arbeiten, auch nicht die Maus bewegen!
Wenn Combofix fertig ist, wird es ein Logfile erstellen (C:\Combofix.txt).
Bitte poste den Inhalt dieses Logfiles in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3

Starte bitte die OTL.exe.

Drücke auf den Quick Scan Button.
Poste den Inhalt von OTL.txt hier in den Thread.

Bitte poste in deiner nächsten Antwort:

Log von AdwCleaner
Log von Combofix
Log von OTL

Amstaff3 · 15.02.2013, 13:32

Der rechner läuft jetzt wieder wie zuvor und kann keine Probleme feststellen

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.112 - Datei am 15/02/2013 um 13:35:04 erstellt
# Aktualisiert am 10/02/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium  (32 bits)
# Benutzer : Holzer - HOLZER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Holzer\Desktop\adwcleaner0.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Holzer\AppData\Roaming\Mozilla\Firefox\Profiles\h4oqspno.default\searchplugins\daemon-search.xml
Ordner Gelöscht : C:\Program Files\DAEMON Tools Toolbar

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6000.16982

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v18.0.1 (de)

Datei : C:\Users\Holzer\AppData\Roaming\Mozilla\Firefox\Profiles\h4oqspno.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [2061 octets] - [15/02/2013 13:35:04]

########## EOF - C:\AdwCleaner[S1].txt - [2121 octets] ##########

--- --- ---

aharonov · 15.02.2013, 13:50

Ok, noch die Logs von Combofix und OTL und dann kann's weitergehen.

Amstaff3 · 15.02.2013, 14:39

Ich hab ein Problem mit ComboFix.bei Combofix läuft der scan nicht richtig durch, irgwann bei stufe 50 kommt dann für einen kurzen Augenblick ein großer Blauer Bildschirm mit a problem has been detected..... dann macht der Rechner nen Neustart und kann dann wählen zwischen abgesicherten Modus usw und es steht da dass zum Schutz von Daten abgebrochen wurde. Was nun? Soll ich
mit Schritt 3 vorfahren?

14.02.2013, 10:15	#2
aharonov /// TB-Ausbilder	Bka-Trojaner entfernen Was hast du für ein Betriebssystem? Windows XP / Vista / 7 ? Ist es 32-bit oder 64-bit? __________________ __________________

14.02.2013, 20:34	#8
aharonov /// TB-Ausbilder	Bka-Trojaner entfernen Kann ich so noch nicht sagen, mach mal weiter mit Schritt 4. __________________ cheers, Leo

15.02.2013, 13:50	#14
aharonov /// TB-Ausbilder	Bka-Trojaner entfernen Ok, noch die Logs von Combofix und OTL und dann kann's weitergehen. __________________ cheers, Leo

Bka-Trojaner entfernen

Plagegeister aller Art und deren Bekämpfung: Bka-Trojaner entfernen