| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere MalwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.03.2013, 00:21
| #1 |
 |  Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo, ich habe ein Problem und wende mich an euch um Hilfe. Mein Laptop mit Betriebssystem Windows 7 Home Premium zeigte vergangene Woche Symptome einer Infektion durch Malware: die Lautsprecher gaben komische knackende Geräusche von sich, mehrere Programme + Anwendungen installierten sich ohne mein Zutun, die Google-Startseite sah plötzlich anders aus als sonst... Ich ließ dann mehrere Antivirenprogramme (Malwarebytes, Avira und ESET-Onlinescanner) im Laufe der Woche mehrfach drüberlaufen, die dann auch fündig wurden und habe die Ergenisse größtenteils gesammelt. Die ersten Funde habe ich löschen lassen, als ich noch nicht die Info dieses Boards gelesen hatte, dass sie (vorerst) in Quarantäne zu belassen sind. Seit gestern kann ich Malwarebytes auch nicht mehr updaten. Als ich es vom Administrator-Profil aus versuchte, informierte mich eine Fehlermeldung, dass ein anderer (bösartiger?) Prozess den auszuführenden Prozess verwenden würde. Der Update-Reiter blieb hellgrau. ESET-Onlinescanner fand beim ersten Scan Anfang der Woche ca. 13 Infektionen, die ich zuerst entfernen ließ. Bei einem weiteren Scan heute (9. März) wurde Folgendes gefunden: C:\Program Files (x68)\Avira\AntiVir\Desktop\ApnCI.dll - 'a variant of Windows32/Bundled/Toolbar.Ask application' C:\Program Files (x68)\Avira\AntiVir\Desktop\ApnToolbarInstaller.exe - 'a variant of Windows32/Bundled/Toolbar.Ask application' Die anderen beiden Programme kamen in den vergangenen drei Tagen zu folgenden Ergebnissen: Malwarebytes (PRO): Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.06.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sternchen :: Sternchen [administrator] Protection: Enabled 06.03.2013 15:28:47 MBAM-log-2013-03-06 (18-59-36).txt Scan type: Full scan (C:\|D:\|E:\|Q:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 641067 Time elapsed: 3 hour(s), 27 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\Aquaria.Sternchen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\319a00a7-1fee00e3 (Trojan.Agent.ED) -> No action taken. (end) Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.07.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sternchen :: Sternchen [administrator] Protection: Enabled 07.03.2013 11:00:03 mbam-log-2013-03-07 (11-00-03).txt Scan type: Full scan (C:\|D:\|E:\|Q:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 641062 Time elapsed: 4 hour(s), 13 minute(s), 29 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Code:
ATTFilter Avira Antivirus Premium
Erstellungsdatum der Reportdatei: Mittwoch, 6. März 2013 19:21
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Sternchen
Seriennummer : 2223588839-PEPWE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Sternchen
Computername : Sternchen
Versionsinformationen:
BUILD.DAT : 13.0.0.3185 50006 Bytes 30.01.2013 10:09:00
AVSCAN.EXE : 13.6.0.584 640224 Bytes 06.02.2013 10:22:26
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 13:05:40
LUKE.DLL : 13.6.0.602 67808 Bytes 06.02.2013 10:22:37
AVSCPLR.DLL : 13.6.0.628 94432 Bytes 05.02.2013 10:29:01
AVREG.DLL : 13.6.0.600 250592 Bytes 05.02.2013 10:29:00
avlode.dll : 13.6.2.624 434912 Bytes 05.02.2013 12:28:52
avlode.rdf : 13.0.0.38 15231 Bytes 13.02.2013 10:10:06
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 19:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 10:07:39
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 17:18:26
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 17:18:34
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:15:26
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 10:11:29
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 10:14:04
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 12:10:47
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 14:57:03
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 14:57:03
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 14:57:03
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 14:57:03
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 14:57:20
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 10:32:15
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 14:17:07
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 17:29:01
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 01:43:01
VBASE017.VDF : 7.11.61.65 151040 Bytes 15.02.2013 13:08:26
VBASE018.VDF : 7.11.61.135 159232 Bytes 18.02.2013 09:30:38
VBASE019.VDF : 7.11.61.163 152064 Bytes 18.02.2013 21:36:05
VBASE020.VDF : 7.11.61.207 164352 Bytes 19.02.2013 16:23:31
VBASE021.VDF : 7.11.62.43 206336 Bytes 21.02.2013 23:32:46
VBASE022.VDF : 7.11.62.111 136192 Bytes 23.02.2013 13:09:32
VBASE023.VDF : 7.11.62.157 143360 Bytes 25.02.2013 13:28:51
VBASE024.VDF : 7.11.62.237 199168 Bytes 27.02.2013 14:48:14
VBASE025.VDF : 7.11.63.71 209408 Bytes 01.03.2013 20:42:06
VBASE026.VDF : 7.11.63.121 257536 Bytes 04.03.2013 12:46:08
VBASE027.VDF : 7.11.63.211 212480 Bytes 06.03.2013 12:13:21
VBASE028.VDF : 7.11.63.212 2048 Bytes 06.03.2013 12:13:21
VBASE029.VDF : 7.11.63.213 2048 Bytes 06.03.2013 12:13:21
VBASE030.VDF : 7.11.63.214 2048 Bytes 06.03.2013 12:13:21
VBASE031.VDF : 7.11.63.220 10240 Bytes 06.03.2013 14:13:16
Engineversion : 8.2.12.10
AEVDF.DLL : 8.1.2.10 102772 Bytes 11.07.2012 12:57:57
AESCRIPT.DLL : 8.1.4.94 467324 Bytes 22.02.2013 19:28:22
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 19:49:45
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 18:36:27
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 16:00:56
AEPACK.DLL : 8.3.1.12 815480 Bytes 28.02.2013 15:36:19
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 15.11.2012 19:03:21
AEHEUR.DLL : 8.1.4.222 5767545 Bytes 28.02.2013 15:36:19
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 11:42:43
AEGEN.DLL : 8.1.6.16 434549 Bytes 24.01.2013 13:49:41
AEEXP.DLL : 8.4.0.6 192885 Bytes 28.02.2013 15:36:19
AEEMU.DLL : 8.1.3.2 393587 Bytes 11.07.2012 12:57:56
AECORE.DLL : 8.1.31.2 201080 Bytes 19.02.2013 12:23:32
AEBB.DLL : 8.1.1.4 53619 Bytes 15.11.2012 19:03:17
AVWINLL.DLL : 13.6.0.480 26480 Bytes 06.02.2013 10:22:22
AVPREF.DLL : 13.6.0.480 51056 Bytes 06.02.2013 10:22:25
AVREP.DLL : 13.6.0.480 178544 Bytes 05.02.2013 10:29:01
AVARKT.DLL : 13.6.0.624 260832 Bytes 06.02.2013 10:22:23
AVEVTLOG.DLL : 13.6.0.600 167648 Bytes 06.02.2013 10:22:24
SQLITE3.DLL : 3.7.0.1 397088 Bytes 09.10.2012 13:29:18
AVSMTP.DLL : 13.6.0.480 63344 Bytes 06.02.2013 10:22:26
NETNT.DLL : 13.6.0.480 16240 Bytes 06.02.2013 10:22:37
RCIMAGE.DLL : 13.4.0.360 4826400 Bytes 11.12.2012 13:05:35
RCTEXT.DLL : 13.6.0.480 68976 Bytes 06.02.2013 10:22:22
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660, +Windows Imaging File (WIM),
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+SPR,
Beginn des Suchlaufs: Mittwoch, 6. März 2013 19:21
Der Suchlauf nach versteckten Objekten wird begonnen.
Eine Instanz der ARK Library läuft bereits.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '164' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnSrv.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ath_CoexAgent.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'adminservice.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSMonitorServicePDVD12.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSServerPDVD12.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFilterSvc.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'd3dxof64.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SIONExportService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'TurboBoost.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '245' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'AmIcoSinglun64.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'BtvStack.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'AthBtTray.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'flux.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'SonicMasterTray.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'winampa.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhilipsDeviceListener.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'PowerDVD12Agent.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'DeviceDetector.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLHNServiceForPowerDVD12.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'FABS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnWMI.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'PowerDVD12DMREngine.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvXDSync.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '125' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '125' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '146' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '6301' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:' <OS>
[0] Archivtyp: RSRC
--> C:\Program Files (x86)\Philips\Philips Songbird Resources\Drivers\Actions_driver\WinUsbCoInstaller2.dll
[1] Archivtyp: RSRC
--> C:\Program Files (x86)\Philips\Philips Songbird Resources\Drivers\Actions_driver\WUDFUpdate_01009.dll
[2] Archivtyp: RSRC
--> C:\Program Files (x86)\Philips\Philips Songbird Resources\Drivers\PI7000\amd64\WUDFUpdate_01007.dll
[3] Archivtyp: RSRC
--> C:\Users\Sternchen\Downloads\jxpiinstall.exe
[4] Archivtyp: Runtime Packed
--> C:\Users\Sternchen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\26066d0b-52a03cec
[5] Archivtyp: ZIP
--> CXkpO/dsjDBzBWd.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2012-1723.GE
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> CXkpO/iOeOOv.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2012-1723.GE
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Aquaria.Sternchen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\26066d0b-52a03cec
[FUND] Enthält Erkennungsmuster des Exploits EXP/2012-1723.GE
Beginne mit der Desinfektion:
C:\Users\Aquaria.Sternchen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\26066d0b-52a03cec
[FUND] Enthält Erkennungsmuster des Exploits EXP/2012-1723.GE
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5e8d79f6.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 7. März 2013 00:48
Benötigte Zeit: 5:24:04 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
46497 Verzeichnisse wurden überprüft
1293562 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1293559 Dateien ohne Befall
10091 Archive wurden durchsucht
2 Warnungen
1 Hinweise
Code:
ATTFilter
Avira Antivirus Premium
Erstellungsdatum der Reportdatei: Donnerstag, 7. März 2013 11:04
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Sternchen
Seriennummer : 2223588839-PEPWE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : Sternchen
Versionsinformationen:
BUILD.DAT : 13.0.0.3185 50006 Bytes 30.01.2013 10:09:00
AVSCAN.EXE : 13.6.0.584 640224 Bytes 06.02.2013 10:22:26
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 13:05:40
LUKE.DLL : 13.6.0.602 67808 Bytes 06.02.2013 10:22:37
AVSCPLR.DLL : 13.6.0.628 94432 Bytes 05.02.2013 10:29:01
AVREG.DLL : 13.6.0.600 250592 Bytes 05.02.2013 10:29:00
avlode.dll : 13.6.2.624 434912 Bytes 05.02.2013 12:28:52
avlode.rdf : 13.0.0.38 15231 Bytes 13.02.2013 10:10:06
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 19:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 10:07:39
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 17:18:26
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 17:18:34
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:15:26
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 10:11:29
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 10:14:04
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 12:10:47
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 14:57:03
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 14:57:03
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 14:57:03
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 14:57:03
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 14:57:20
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 10:32:15
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 14:17:07
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 17:29:01
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 01:43:01
VBASE017.VDF : 7.11.61.65 151040 Bytes 15.02.2013 13:08:26
VBASE018.VDF : 7.11.61.135 159232 Bytes 18.02.2013 09:30:38
VBASE019.VDF : 7.11.61.163 152064 Bytes 18.02.2013 21:36:05
VBASE020.VDF : 7.11.61.207 164352 Bytes 19.02.2013 16:23:31
VBASE021.VDF : 7.11.62.43 206336 Bytes 21.02.2013 23:32:46
VBASE022.VDF : 7.11.62.111 136192 Bytes 23.02.2013 13:09:32
VBASE023.VDF : 7.11.62.157 143360 Bytes 25.02.2013 13:28:51
VBASE024.VDF : 7.11.62.237 199168 Bytes 27.02.2013 14:48:14
VBASE025.VDF : 7.11.63.71 209408 Bytes 01.03.2013 20:42:06
VBASE026.VDF : 7.11.63.121 257536 Bytes 04.03.2013 12:46:08
VBASE027.VDF : 7.11.63.211 212480 Bytes 06.03.2013 12:13:21
VBASE028.VDF : 7.11.63.212 2048 Bytes 06.03.2013 12:13:21
VBASE029.VDF : 7.11.63.213 2048 Bytes 06.03.2013 12:13:21
VBASE030.VDF : 7.11.63.214 2048 Bytes 06.03.2013 12:13:21
VBASE031.VDF : 7.11.63.244 101376 Bytes 07.03.2013 09:56:23
Engineversion : 8.2.12.10
AEVDF.DLL : 8.1.2.10 102772 Bytes 11.07.2012 12:57:57
AESCRIPT.DLL : 8.1.4.94 467324 Bytes 22.02.2013 19:28:22
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 19:49:45
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 18:36:27
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 16:00:56
AEPACK.DLL : 8.3.1.12 815480 Bytes 28.02.2013 15:36:19
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 15.11.2012 19:03:21
AEHEUR.DLL : 8.1.4.222 5767545 Bytes 28.02.2013 15:36:19
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 11:42:43
AEGEN.DLL : 8.1.6.16 434549 Bytes 24.01.2013 13:49:41
AEEXP.DLL : 8.4.0.6 192885 Bytes 28.02.2013 15:36:19
AEEMU.DLL : 8.1.3.2 393587 Bytes 11.07.2012 12:57:56
AECORE.DLL : 8.1.31.2 201080 Bytes 19.02.2013 12:23:32
AEBB.DLL : 8.1.1.4 53619 Bytes 15.11.2012 19:03:17
AVWINLL.DLL : 13.6.0.480 26480 Bytes 06.02.2013 10:22:22
AVPREF.DLL : 13.6.0.480 51056 Bytes 06.02.2013 10:22:25
AVREP.DLL : 13.6.0.480 178544 Bytes 05.02.2013 10:29:01
AVARKT.DLL : 13.6.0.624 260832 Bytes 06.02.2013 10:22:23
AVEVTLOG.DLL : 13.6.0.600 167648 Bytes 06.02.2013 10:22:24
SQLITE3.DLL : 3.7.0.1 397088 Bytes 09.10.2012 13:29:18
AVSMTP.DLL : 13.6.0.480 63344 Bytes 06.02.2013 10:22:26
NETNT.DLL : 13.6.0.480 16240 Bytes 06.02.2013 10:22:37
RCIMAGE.DLL : 13.4.0.360 4826400 Bytes 11.12.2012 13:05:35
RCTEXT.DLL : 13.6.0.480 68976 Bytes 06.02.2013 10:22:22
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files
(x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: quarantäne
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, Q:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,
+SPR,
Beginn des Suchlaufs: Donnerstag, 7. März 2013 11:04
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '121' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '151' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '25' Modul(e) wurden
durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden
durchsucht
Durchsuche Prozess 'spoolsv.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvXDSync.exe' - '49' Modul(e) wurden
durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '70' Modul(e)
wurden durchsucht
Durchsuche Prozess 'InsOnSrv.exe' - '40' Modul(e) wurden
durchsucht
Durchsuche Prozess 'Ath_CoexAgent.exe' - '41' Modul(e) wurden
durchsucht
Durchsuche Prozess 'adminservice.exe' - '33' Modul(e) wurden
durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '37' Modul(e) wurden
durchsucht
Durchsuche Prozess 'CLMSMonitorServicePDVD12.exe' - '24' Modul(e)
wurden durchsucht
Durchsuche Prozess 'CLMSServerPDVD12.exe' - '89' Modul(e) wurden
durchsucht
Durchsuche Prozess 'GFilterSvc.exe' - '59' Modul(e) wurden
durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '38' Modul(e) wurden
durchsucht
Durchsuche Prozess 'mbamservice.exe' - '54' Modul(e) wurden
durchsucht
Durchsuche Prozess 'd3dxof64.exe' - '61' Modul(e) wurden
durchsucht
Durchsuche Prozess 'sftvsa.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SIONExportService.exe' - '34' Modul(e) wurden
durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '35' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'TurboBoost.exe' - '25' Modul(e) wurden
durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '18' Modul(e) wurden
durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '53' Modul(e) wurden
durchsucht
Durchsuche Prozess 'mbamgui.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnWMI.exe' - '43' Modul(e) wurden
durchsucht
Durchsuche Prozess 'Dwm.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '215' Modul(e) wurden
durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '40' Modul(e) wurden
durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'AmIcoSinglun64.exe' - '33' Modul(e) wurden
durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '61' Modul(e) wurden
durchsucht
Durchsuche Prozess 'BtvStack.exe' - '89' Modul(e) wurden
durchsucht
Durchsuche Prozess 'AthBtTray.exe' - '47' Modul(e) wurden
durchsucht
Durchsuche Prozess 'igfxtray.exe' - '30' Modul(e) wurden
durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '53' Modul(e) wurden
durchsucht
Durchsuche Prozess 'flux.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '50' Modul(e) wurden
durchsucht
Durchsuche Prozess 'taskeng.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SonicMasterTray.exe' - '46' Modul(e) wurden
durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '31' Modul(e) wurden
durchsucht
Durchsuche Prozess 'wcourier.exe' - '46' Modul(e) wurden
durchsucht
Durchsuche Prozess 'winampa.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '101' Modul(e) wurden
durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '78' Modul(e) wurden
durchsucht
Durchsuche Prozess 'avgnt.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhilipsDeviceListener.exe' - '38' Modul(e)
wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'PowerDVD12DMREngine.exe' - '66' Modul(e)
wurden durchsucht
Durchsuche Prozess 'PowerDVD12Agent.exe' - '102' Modul(e) wurden
durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden
durchsucht
Durchsuche Prozess 'avmailc.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '66' Modul(e) wurden
durchsucht
Durchsuche Prozess 'iPodService.exe' - '34' Modul(e) wurden
durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '55' Modul(e) wurden
durchsucht
Durchsuche Prozess 'RichVideo.exe' - '29' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '114' Modul(e) wurden
durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '26' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'DeviceDetector.exe' - '49' Modul(e) wurden
durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLHNServiceForPowerDVD12.exe' - '30' Modul(e)
wurden durchsucht
Durchsuche Prozess 'FABS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '134' Modul(e) wurden
durchsucht
Durchsuche Prozess 'avscan.exe' - '125' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '37' Modul(e) wurden
durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden
durchsucht
Durchsuche Prozess 'lsass.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird
begonnen:
Die Registry wurde durchsucht ( '6290' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <OS>
C:\Users\Aquaria.Sternchen\AppData\LocalLow\Sun\Java
\Deployment\cache\6.0\39\319a00a7-1fee00e3
[FUND] Ist das Trojanische Pferd TR/PSW.Fareit.1142
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem
Namen '5fda7eb4.qua' verschoben!
Beginne mit der Suche in 'D:\' <DATA>
Beginne mit der Suche in 'Q:\'
Der zu durchsuchende Pfad Q:\ konnte nicht geöffnet werden!
Systemfehler [5]: Zugriff verweigert
Ende des Suchlaufs: Donnerstag, 7. März 2013 14:08
Benötigte Zeit: 3:03:03 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
89571 Verzeichnisse wurden überprüft
1078578 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1078577 Dateien ohne Befall
7543 Archive wurden durchsucht
0 Warnungen
1 Hinweise
942970 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Code:
ATTFilter
Avira Antivirus Premium
Erstellungsdatum der Reportdatei: Freitag, 8. März 2013 17:21
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Sternchen
Seriennummer : 2223588839-PEPWE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Sternchen
Computername : Sternchen
Versionsinformationen:
BUILD.DAT : 13.0.0.3185 50006 Bytes 30.01.2013 10:09:00
AVSCAN.EXE : 13.6.0.584 640224 Bytes 06.02.2013 10:22:26
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 13:05:40
LUKE.DLL : 13.6.0.602 67808 Bytes 06.02.2013 10:22:37
AVSCPLR.DLL : 13.6.0.628 94432 Bytes 05.02.2013 10:29:01
AVREG.DLL : 13.6.0.600 250592 Bytes 05.02.2013 10:29:00
avlode.dll : 13.6.2.624 434912 Bytes 05.02.2013 12:28:52
avlode.rdf : 13.0.0.38 15231 Bytes 13.02.2013 10:10:06
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 19:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 10:07:39
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 17:18:26
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 17:18:34
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:15:26
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 10:11:29
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 10:14:04
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 12:10:47
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 14:57:03
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 14:57:03
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 14:57:03
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 14:57:03
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 14:57:20
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 10:32:15
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 14:17:07
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 17:29:01
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 01:43:01
VBASE017.VDF : 7.11.61.65 151040 Bytes 15.02.2013 13:08:26
VBASE018.VDF : 7.11.61.135 159232 Bytes 18.02.2013 09:30:38
VBASE019.VDF : 7.11.61.163 152064 Bytes 18.02.2013 21:36:05
VBASE020.VDF : 7.11.61.207 164352 Bytes 19.02.2013 16:23:31
VBASE021.VDF : 7.11.62.43 206336 Bytes 21.02.2013 23:32:46
VBASE022.VDF : 7.11.62.111 136192 Bytes 23.02.2013 13:09:32
VBASE023.VDF : 7.11.62.157 143360 Bytes 25.02.2013 13:28:51
VBASE024.VDF : 7.11.62.237 199168 Bytes 27.02.2013 14:48:14
VBASE025.VDF : 7.11.63.71 209408 Bytes 01.03.2013 20:42:06
VBASE026.VDF : 7.11.63.121 257536 Bytes 04.03.2013 12:46:08
VBASE027.VDF : 7.11.63.211 212480 Bytes 06.03.2013 12:13:21
VBASE028.VDF : 7.11.64.21 198656 Bytes 08.03.2013 14:14:53
VBASE029.VDF : 7.11.64.22 2048 Bytes 08.03.2013 14:14:54
VBASE030.VDF : 7.11.64.23 2048 Bytes 08.03.2013 14:14:54
VBASE031.VDF : 7.11.64.34 75776 Bytes 08.03.2013 16:12:23
Engineversion : 8.2.12.14
AEVDF.DLL : 8.1.2.10 102772 Bytes 11.07.2012 12:57:57
AESCRIPT.DLL : 8.1.4.96 471420 Bytes 08.03.2013 14:14:58
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 19:49:45
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 18:36:27
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 16:00:56
AEPACK.DLL : 8.3.2.0 827767 Bytes 08.03.2013 14:14:57
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 14:14:57
AEHEUR.DLL : 8.1.4.236 5833081 Bytes 08.03.2013 14:14:57
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 11:42:43
AEGEN.DLL : 8.1.6.16 434549 Bytes 24.01.2013 13:49:41
AEEXP.DLL : 8.4.0.10 192886 Bytes 08.03.2013 14:14:58
AEEMU.DLL : 8.1.3.2 393587 Bytes 11.07.2012 12:57:56
AECORE.DLL : 8.1.31.2 201080 Bytes 19.02.2013 12:23:32
AEBB.DLL : 8.1.1.4 53619 Bytes 15.11.2012 19:03:17
AVWINLL.DLL : 13.6.0.480 26480 Bytes 06.02.2013 10:22:22
AVPREF.DLL : 13.6.0.480 51056 Bytes 06.02.2013 10:22:25
AVREP.DLL : 13.6.0.480 178544 Bytes 05.02.2013 10:29:01
AVARKT.DLL : 13.6.0.624 260832 Bytes 06.02.2013 10:22:23
AVEVTLOG.DLL : 13.6.0.600 167648 Bytes 06.02.2013 10:22:24
SQLITE3.DLL : 3.7.0.1 397088 Bytes 09.10.2012 13:29:18
AVSMTP.DLL : 13.6.0.480 63344 Bytes 06.02.2013 10:22:26
NETNT.DLL : 13.6.0.480 16240 Bytes 06.02.2013 10:22:37
RCIMAGE.DLL : 13.4.0.360 4826400 Bytes 11.12.2012 13:05:35
RCTEXT.DLL : 13.6.0.480 68976 Bytes 06.02.2013 10:22:22
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660, +Windows Imaging File (WIM),
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+SPR,
Beginn des Suchlaufs: Freitag, 8. März 2013 17:21
Der Suchlauf nach versteckten Objekten wird begonnen.
Eine Instanz der ARK Library läuft bereits.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '169' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnSrv.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ath_CoexAgent.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'adminservice.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSMonitorServicePDVD12.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFilterSvc.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'd3dxof64.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SIONExportService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'TurboBoost.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '247' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'AmIcoSinglun64.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'BtvStack.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'AthBtTray.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'flux.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SonicMasterTray.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'winampa.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhilipsDeviceListener.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'PowerDVD12Agent.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'DeviceDetector.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLHNServiceForPowerDVD12.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'FABS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '152' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '141' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnWMI.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'PowerDVD12DMREngine.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvXDSync.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSServerPDVD12.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'NOTEPAD.EXE' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '6279' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:' <OS>
Ende des Suchlaufs: Freitag, 8. März 2013 20:07
Benötigte Zeit: 2:46:13 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
46497 Verzeichnisse wurden überprüft
1293974 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1293974 Dateien ohne Befall
10057 Archive wurden durchsucht
0 Warnungen
0 Hinweise
 Wie kann ich nun weiter verfahren? Soll ich den Rechner neu starten und den Update von Mbam dann noch mal versuchen? Lieben Dank schon mal! Esmeralda |
|
10.03.2013, 21:15
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Esmeralda und
__________________ Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Note: Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread. Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards. Erstmal eine Kontrolle mit OTL bitte:
__________________ |
|
11.03.2013, 14:36
| #3 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus,
__________________danke, dass du dich meines Problems annimmst. Habe gestern, bevor deine Antwort kam, den Laptop doch noch mal neu gestartet und konnte Malwarebytes dann unter Ausführung als Admin updaten. Auch heute (ohne Neustart) hat das Update funktioniert. Gestern führte ich mit Mbam einen Quick Scan, einen Flash Scan und einen Full Scan aus - ohne Fund. Hier schonmal die Logs: a) Quick Scan Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.10.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sternchen :: STERNCHEN [administrator] Protection: Enabled 10.03.2013 18:57:29 mbam-log-2013-03-10 (18-57-29).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 296858 Time elapsed: 7 minute(s), 29 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) b) Flash Scan Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.10.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sternchen :: STERNCHEN [administrator] Protection: Enabled 10.03.2013 19:05:22 mbam-log-2013-03-10 (19-05-22).txt Scan type: Flash scan Scan options enabled: Memory | Startup | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Registry | File System Objects scanned: 266922 Time elapsed: 29 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) c) Full Scan Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.10.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sternchen :: STERNCHEN [administrator] Protection: Enabled 10.03.2013 19:06:15 mbam-log-2013-03-10 (19-06-15).txt Scan type: Full scan (C:\|D:\|E:\|Q:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 633696 Time elapsed: 4 hour(s), 10 minute(s), 4 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Habe auch OTL nach deiner Anleitung sowie nach der allgem. Anleitung hier ausgeführt. Bevor ich die Logs davon poste, möchte ich noch folgende Frage klären: Mein Name ist in den untersuchten Dateien sehr oft aufgeführt. Muss ich die Aufführung des Namens in jeder Datei einzeln durch Sternchen (*** oder "Sternchen" ? ) ersetzen oder gibt es eine Möglichkeit, alle Aufführungen in einem Streich zu anonymisieren? Da wäre dann noch eine weitere Frage: Mein Avira Antiviren-Scanner hat vergangene Woche zwei infizierte Dateien in die Quarantäne verschoben, wo sie auch noch sind. Soll ich die Dateien löschen, reparieren oder erstmal ignorieren? Ist nach einer Aktion gegen diese Dateien ein Neustart erforderlich? Sorry für all die Fragen - bin halt ziemlich ahnungslos... Zum Schluss möchte ich noch meinen Verdacht erwähnen, durch was die Infektion meines Rechners zustande gekommen sein könnte: durch eine Sicherheitslücke in einer älteren Java-Version und/oder durch ein kürzlich installiertes (aber dann wegen Verdacht wieder deinstalliertes) Freeware-Programm namens "CoP2go". Vielleicht helfen dir diese Infos bei der Analyse. Viele Grüße, Esmeralda |
|
11.03.2013, 14:46
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Welcher Name? Dein echter oder sowas: C:\Users\Aquaria.Sternchen Pseudoname und nur Vornamen müssen nicht unkenntlich gemacht werden und auch dein echter Vor- und Nachname nicht wenn es dich nicht stört
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.03.2013, 15:46
| #5 | |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus, hab meinen echten Namen gemeint. Zitat:
Hier sind die beiden OTL-Logs: Code:
ATTFilter OTL logfile created on: 3/11/2013 1:26:44 AM - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aquaria.MariasRechner\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7.91 Gb Total Physical Memory | 5.15 Gb Available Physical Memory | 65.08% Memory free 15.81 Gb Paging File | 13.05 Gb Available in Paging File | 82.52% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 305.67 Gb Total Space | 176.72 Gb Free Space | 57.81% Space Free | Partition Type: NTFS Drive D: | 367.97 Gb Total Space | 355.62 Gb Free Space | 96.64% Space Free | Partition Type: NTFS Computer Name: MARIASRECHNER | User Name: Maria Wohlfarth | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Aquaria.MariasRechner\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe (CyberLink) PRC - C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () PRC - C:\Windows\AsScrPro.exe (ASUS) PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe (ASUS) PRC - C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe (ASUS) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\ASUS.SYS\SIONExportService.exe (Splashtop Inc.) PRC - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe (Virage Logic Corporation / Sonic Focus) PRC - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) PRC - C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_ssl.pyd () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\koan\_ctypes.pyd () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_socket.pyd () MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll () MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () MOD - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll () MOD - C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe () ========== Services (SafeList) ========== SRV:64bit: - (GFilterSvc) -- C:\Windows\SysNative\GFilterSvc.exe () SRV:64bit: - (secinitd) -- C:\Windows\SysNative\d3dxof64.exe () SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (CyberLink PowerDVD 12 Media Server Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink) SRV - (CyberLink PowerDVD 12 Media Server Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) SRV - (CLHNServiceForPowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (ASUS InstantOn) -- C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe (ASUS) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Splashtop MDES) -- C:\ASUS.SYS\SIONExportService.exe (Splashtop Inc.) SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros) SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations) SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV:64bit: - (mbamchameleon) -- C:\Windows\SysNative\drivers\mbamchameleon.sys () DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation) DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc) DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros) DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros) DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros) DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros) DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros) DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros) DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (AiCharger) -- C:\Windows\SysNative\drivers\AiCharger.sys (ASUSTek Computer Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys () DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( ) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV - ({73526619-C24F-470B-9BED-53D455FBB5C6}) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl (CyberLink Corp.) DRV - (ntk_PowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys (Cyberlink Corp.) DRV - (GEARAspiWDM) -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=ie9hp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://asus.msn.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://asus.msn.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?affID=119828&babsrc=HP_ss&mntrId=a06c3664000000000000742f68fa9c99 IE - HKCU\..\SearchScopes,DefaultScope = {783132D5-473D-4F21-B77C-F2BE8F6B9F22} IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.delta-search.com/?q={searchTerms}&affID=119828&babsrc=SP_ss&mntrId=a06c3664000000000000742f68fa9c99 IE - HKCU\..\SearchScopes\{783132D5-473D-4F21-B77C-F2BE8F6B9F22}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE9SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledAddons: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119 FF - prefs.js..extensions.enabledAddons: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120910 FF - prefs.js..extensions.enabledAddons: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.2.6 FF - prefs.js..extensions.enabledAddons: firejump@firejump.net:1.0.2.5 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012/01/20 00:59:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/29 18:55:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/23 14:11:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net [2013/02/26 00:16:42 | 000,000,000 | ---D | M] [2011/12/02 23:26:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Extensions [2013/03/05 00:02:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions [2013/03/05 00:02:11 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2012/11/22 01:12:14 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012/08/11 18:32:02 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2013/02/26 00:16:42 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net [2011/12/02 23:39:53 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\extensions\personas@christopher.beard.xpi [2013/02/26 02:09:21 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013/02/26 00:17:07 | 000,001,294 | ---- | M] () -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\searchplugins\delta.xml [2012/02/03 21:43:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/08/11 18:31:58 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/10/26 19:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2013/03/03 22:06:32 | 000,001,400 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2013/02/26 00:16:56 | 000,006,484 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2013/03/03 22:06:32 | 000,001,679 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013/03/03 22:06:32 | 000,000,947 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2013/03/03 22:06:32 | 000,006,818 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2013/02/26 00:16:42 | 000,001,279 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2013/03/03 22:06:32 | 000,000,903 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml Hosts file not found O2:64bit: - BHO: (no name) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - No CLSID value found. O2:64bit: - BHO: (no name) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - No CLSID value found. O2 - BHO: (no name) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - No CLSID value found. O2 - BHO: (no name) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (no name) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.) O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [Philips Device Listener] C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () O4 - HKLM..\Run: [PowerDVD12Agent] C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.) O4 - HKLM..\Run: [PowerDVD12DMREngine] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink) O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe (Virage Logic Corporation / Sonic Focus) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () O4 - HKCU..\Run: [F.lux] C:\Users\Maria Wohlfarth\Local Settings\Apps\F.lux\flux.exe () O4 - Startup: C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.9.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{472526DB-FACF-4C72-8CC4-6BF1B4BA372E}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BAB72536-28FF-4C93-886C-41FD60ED208B}: DhcpNameServer = 13.5.0.10 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\tmbp - No CLSID value found O18:64bit: - Protocol\Handler\tmpx - No CLSID value found O18:64bit: - Protocol\Handler\tmtbim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\tmbp - No CLSID value found O18 - Protocol\Handler\tmpx - No CLSID value found O18 - Protocol\Handler\tmtbim - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (sdnclean64.exe) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/03/09 22:11:12 | 000,000,000 | R--D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices [2013/03/05 22:57:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2013/03/05 22:57:30 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2013/03/05 13:50:59 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Local\Programs [2013/03/05 04:43:37 | 002,770,944 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\athrx.sys [2013/03/05 00:11:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2013/03/03 22:06:31 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\IO [2013/02/27 03:00:54 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll [2013/02/27 03:00:54 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll [2013/02/27 03:00:54 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll [2013/02/27 03:00:54 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll [2013/02/27 03:00:50 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll [2013/02/27 03:00:50 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll [2013/02/27 03:00:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013/02/27 03:00:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013/02/27 03:00:44 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll [2013/02/27 03:00:44 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013/02/27 03:00:44 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013/02/27 03:00:44 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013/02/27 03:00:44 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013/02/27 03:00:44 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013/02/27 03:00:44 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013/02/27 03:00:43 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll [2013/02/27 03:00:43 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll [2013/02/27 03:00:43 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll [2013/02/27 03:00:43 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll [2013/02/27 03:00:43 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll [2013/02/27 03:00:43 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll [2013/02/27 03:00:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll [2013/02/27 03:00:42 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll [2013/02/27 03:00:42 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll [2013/02/27 03:00:42 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2013/02/27 03:00:42 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll [2013/02/27 03:00:42 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll [2013/02/27 03:00:41 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll [2013/02/27 03:00:41 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2013/02/27 03:00:41 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll [2013/02/27 03:00:41 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll [2013/02/27 03:00:40 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll [2013/02/27 03:00:40 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll [2013/02/26 22:15:50 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink MediaEspresso 6.7 [2013/02/26 22:15:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX [2013/02/26 22:05:53 | 000,000,000 | ---D | C] -- C:\MediaServer [2013/02/26 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CyberLink [2013/02/26 22:05:49 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Local\MediaServer [2013/02/26 22:05:47 | 000,000,000 | ---D | C] -- C:\ProgramData\PDVD [2013/02/26 22:05:33 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 12 [2013/02/26 21:59:31 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap [2013/02/26 02:10:22 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Wise Disk Cleaner [2013/02/26 02:09:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Disk Cleaner [2013/02/26 02:09:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise [2013/02/26 00:16:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2013/02/26 00:16:43 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Babylon [2013/02/26 00:16:42 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll [2013/02/26 00:16:42 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Opera [2013/02/26 00:16:38 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\DesktopIconForAmazon [2013/02/26 00:16:36 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\OCS [2013/02/14 03:01:02 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013/02/14 03:01:02 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013/02/14 03:01:01 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013/02/14 03:01:01 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013/02/14 03:01:00 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013/02/14 03:01:00 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013/02/14 03:00:59 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013/02/14 03:00:59 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013/02/14 03:00:59 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013/02/14 03:00:58 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013/02/14 03:00:58 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013/02/14 03:00:58 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013/02/14 03:00:55 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013/02/14 03:00:55 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013/02/14 03:00:55 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013/02/13 11:27:04 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013/02/13 11:26:58 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013/02/13 11:26:57 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013/02/13 11:26:46 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2013/02/13 11:26:45 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2013/02/13 11:26:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2013/02/13 11:26:45 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2013/02/13 11:26:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2013/02/13 11:26:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2013/02/13 11:26:40 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/03/11 01:10:23 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx [2013/03/11 01:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013/03/10 19:00:56 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/03/10 19:00:56 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/03/10 18:52:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/03/10 18:52:09 | 2072,027,135 | -HS- | M] () -- C:\hiberfil.sys [2013/03/09 22:11:19 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe [2013/03/09 19:12:20 | 000,706,520 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat [2013/03/09 19:12:20 | 000,705,544 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat [2013/03/09 19:12:20 | 000,703,282 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat [2013/03/09 19:12:20 | 000,701,198 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat [2013/03/09 19:12:20 | 000,691,432 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat [2013/03/09 19:12:20 | 000,688,048 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat [2013/03/09 19:12:20 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013/03/09 19:12:20 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013/03/09 19:12:20 | 000,563,860 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat [2013/03/09 19:12:20 | 000,397,410 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat [2013/03/09 19:12:20 | 000,365,612 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat [2013/03/09 19:12:20 | 000,141,234 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat [2013/03/09 19:12:20 | 000,137,924 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat [2013/03/09 19:12:20 | 000,137,112 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat [2013/03/09 19:12:20 | 000,136,688 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat [2013/03/09 19:12:20 | 000,134,312 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat [2013/03/09 19:12:20 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013/03/09 19:12:20 | 000,131,316 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat [2013/03/09 19:12:20 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat [2013/03/09 19:12:20 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013/03/09 19:12:20 | 000,093,608 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat [2013/03/09 19:12:20 | 000,073,266 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat [2013/03/09 19:12:19 | 008,133,930 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013/03/08 17:07:58 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013/03/05 23:02:28 | 000,014,979 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\hijackthis_01 [2013/03/05 22:57:30 | 000,003,019 | ---- | M] () -- C:\Users\Maria Wohlfarth\Desktop\HiJackThis.lnk [2013/03/05 20:10:09 | 000,071,374 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\cc_20130305_200958.reg [2013/03/05 17:26:31 | 000,002,114 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini [2013/03/05 14:33:22 | 000,036,680 | ---- | M] () -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2013/03/05 13:54:41 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013/02/27 23:07:20 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013/02/27 23:07:20 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013/02/26 22:15:50 | 000,002,125 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink MediaEspresso 6.7.lnk [2013/02/26 22:05:32 | 000,002,190 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk [2013/02/26 22:01:34 | 000,063,851 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\Lizenzvertrag PowerDVD.xps [2013/02/26 20:51:43 | 000,002,490 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini [2013/02/26 00:16:42 | 000,119,808 | ---- | M] () -- C:\Windows\SysNative\GFilterSvc.exe [2013/02/26 00:16:41 | 000,118,272 | ---- | M] () -- C:\Windows\SysNative\d3dxof64.exe [2013/02/26 00:16:39 | 000,001,496 | ---- | M] () -- C:\Users\Maria Wohlfarth\Desktop\Amazon.lnk [2013/02/14 11:55:47 | 000,385,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/03/05 23:02:28 | 000,014,979 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\hijackthis_01 [2013/03/05 22:57:30 | 000,003,019 | ---- | C] () -- C:\Users\Maria Wohlfarth\Desktop\HiJackThis.lnk [2013/03/05 20:10:04 | 000,071,374 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\cc_20130305_200958.reg [2013/03/05 14:33:22 | 000,036,680 | ---- | C] () -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2013/03/05 13:54:41 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013/02/26 22:15:50 | 000,002,125 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink MediaEspresso 6.7.lnk [2013/02/26 22:05:32 | 000,002,190 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk [2013/02/26 22:01:32 | 000,063,851 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\Lizenzvertrag PowerDVD.xps [2013/02/26 00:16:42 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll [2013/02/26 00:16:42 | 000,119,808 | ---- | C] () -- C:\Windows\SysNative\GFilterSvc.exe [2013/02/26 00:16:41 | 000,118,272 | ---- | C] () -- C:\Windows\SysNative\d3dxof64.exe [2013/02/26 00:16:39 | 000,001,496 | ---- | C] () -- C:\Users\Maria Wohlfarth\Desktop\Amazon.lnk [2012/02/11 21:35:25 | 000,874,396 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\census.cache [2012/02/11 21:35:05 | 000,130,524 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\ars.cache [2012/02/11 21:22:15 | 000,000,036 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\housecall.guid.cache [2012/01/25 19:12:27 | 000,000,043 | ---- | C] () -- C:\Users\Maria Wohlfarth\gsview64.ini [2011/12/03 04:44:11 | 008,232,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011/10/29 02:51:27 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll [2011/08/31 19:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011/08/31 19:46:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2011/08/31 19:26:20 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2011/08/19 03:33:36 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll [2011/08/19 03:32:39 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011/08/19 03:32:34 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2011/05/10 23:55:50 | 000,368,400 | ---- | C] () -- C:\Windows\SysWow64\sqlite3.dll [2011/04/13 03:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 248 bytes -> C:\ProgramData\Temp:FD786DCA @Alternate Data Stream - 248 bytes -> C:\ProgramData\Temp:B65E763D @Alternate Data Stream - 243 bytes -> C:\ProgramData\Temp:12D21A9A @Alternate Data Stream - 239 bytes -> C:\ProgramData\Temp:869C6B4A @Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:164561C8 @Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:DC7EDF41 @Alternate Data Stream - 234 bytes -> C:\ProgramData\Temp:63C29481 @Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:99AC3203 @Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:11590865 @Alternate Data Stream - 226 bytes -> C:\ProgramData\Temp:A5584049 @Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:2AE74FF9 @Alternate Data Stream - 222 bytes -> C:\ProgramData\Temp:8944C195 @Alternate Data Stream - 220 bytes -> C:\ProgramData\Temp:FED25C29 @Alternate Data Stream - 216 bytes -> C:\ProgramData\Temp:9B285B76 @Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:0EC7A545 @Alternate Data Stream - 210 bytes -> C:\ProgramData\Temp:6EE8565A @Alternate Data Stream - 209 bytes -> C:\ProgramData\Temp:1B9E79B3 @Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:774A0E14 @Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:C2F24DB5 @Alternate Data Stream - 204 bytes -> C:\ProgramData\Temp:96AFAB10 @Alternate Data Stream - 203 bytes -> C:\ProgramData\Temp:D2A66480 @Alternate Data Stream - 198 bytes -> C:\ProgramData\Temp:5BC73C48 @Alternate Data Stream - 191 bytes -> C:\ProgramData\Temp:5A437AC3 @Alternate Data Stream - 188 bytes -> C:\ProgramData\Temp:27D1368B @Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:58C9BCAC < End of report > Code:
ATTFilter OTL Extras logfile created on: 3/11/2013 1:26:44 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aquaria.MariasRechner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7.91 Gb Total Physical Memory | 5.15 Gb Available Physical Memory | 65.08% Memory free
15.81 Gb Paging File | 13.05 Gb Available in Paging File | 82.52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 305.67 Gb Total Space | 176.72 Gb Free Space | 57.81% Space Free | Partition Type: NTFS
Drive D: | 367.97 Gb Total Space | 355.62 Gb Free Space | 96.64% Space Free | Partition Type: NTFS
Computer Name: MARIASRECHNER | User Name: Maria Wohlfarth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03374369-29B8-498E-8EEA-9A491A218B5F}" = lport=137 | protocol=17 | dir=in | app=system |
"{0E39FEF6-1FCD-45E4-AD61-C3CC303DC0B4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13FD5E8E-CC0A-4CAE-A8EC-ABAD54609A84}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1CEC1512-BEE9-40E2-9C74-F46C7366E94A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2B6B8543-2F6E-43B2-96BF-A74079DFB358}" = rport=139 | protocol=6 | dir=out | app=system |
"{4CC190BB-2D4C-4E58-B2D7-6494589A2A7F}" = lport=139 | protocol=6 | dir=in | app=system |
"{4EA5703C-7329-4F56-A671-C88ECD41DDB0}" = lport=138 | protocol=17 | dir=in | app=system |
"{506984D9-DE61-4E40-9679-2D3BDE5A3CB8}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary |
"{6120440A-6801-4740-9A03-7FE7AA72AC17}" = rport=138 | protocol=17 | dir=out | app=system |
"{6D86BBA6-660B-4EA4-9C85-ADBCBF533D55}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{7EDA2D0F-9565-4E31-8CD1-97A5231B9189}" = lport=445 | protocol=6 | dir=in | app=system |
"{85D4A1DB-156E-45C8-8968-15C7EA44A151}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{89113D06-E3D5-49A7-9856-9E2775632F95}" = rport=445 | protocol=6 | dir=out | app=system |
"{8D688385-9104-4FF3-BE3D-28B7D2D59362}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8EFCA642-564A-4023-998E-B59AEFB67090}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9357CE08-0AA1-4819-A0F7-263FC257043A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9735A264-B861-4C85-9022-E60099F68C8B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A72233AF-337A-40D3-BCE9-4CBCFF8C6B0B}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary |
"{ACA48445-98A7-4395-AF16-B4668DE88C3B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{AE366A47-2CC4-4C8E-9C68-A3EE46A50F79}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AFFBD841-0971-4826-9D75-447EF13A9EDE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B827E1C7-5A7A-484C-9653-2FE388A8B888}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B92833AB-1682-40F4-9B55-D80B3476C46F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BE28CBB8-D4D4-4582-948E-AF0F7AD42F9A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D662F18D-0DE0-4197-88AC-A6D9B588AAFE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E7294DB9-E707-434E-A807-DD0BF7F74F64}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{F3E173A1-B600-417E-92A5-9DFAEECF97C8}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0583604E-9C23-4FAC-A86B-4D821F0355CB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0BE4E83C-CE6C-4C45-A80C-0034D3E43FD8}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{0C32B695-2393-4C43-9CE5-25BB31020208}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{107C4BF2-7492-4492-ABFA-D80819990EB6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe |
"{1549554E-270D-4FCD-84B5-51EF5C88A9F3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe |
"{16AC0CDA-309F-47EC-BADA-708B2635A390}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd cinema\powerdvdcinema12.exe |
"{170D01B4-8E6E-49FB-BF3D-3A9DD9CB304A}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe |
"{3162169B-81B6-4AED-AEB3-7A6711AEB3D7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3B0D3C74-3124-42D9-8B60-B215385FE169}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{41778980-3D38-49C1-8518-AA77CCC54FD9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4831BE12-7EA9-4CEF-93F5-6E373189DF54}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{50D76052-134E-46DB-AF8E-63827F883C0F}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{513E8BF9-7A3F-4ACB-AC6C-68AC8DFD3D68}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{561376D4-CDAE-4217-9CCA-E625F16996EF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6D79AC48-775E-47E8-8E8D-BC15612A1055}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{77E2118B-E954-4B7C-A3EE-D1F9A25AC586}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr8.exe |
"{7A692C6F-175C-4590-A7FF-62988D1A5AE6}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7CB3309E-ACB0-446D-BED6-64FE4DEBAFF1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{801886BB-5AFB-4669-AFBA-D53DF5E5BC09}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{815523A5-A2F6-485B-9063-765C5DFDA0C6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{870CDFE1-DAD7-47DC-8A63-75C6CEA7BF3E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8CAB0023-E43A-4ACA-B871-3A39CF4C33E6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8D9AF99E-48D8-4131-B2E7-977DB77A846E}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{8E30A05E-C912-40A2-90CF-9EE024DDC6C6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8EF01BA1-D1F6-4D73-AADB-AB5E81F83EF1}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{9203B834-0E81-4C4A-A00D-203B32276868}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{94F0BC9D-1EBC-4719-B008-EF0352791717}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe |
"{9EA5D877-E091-461B-9514-F65A484DFA15}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A4C3D668-82B4-42D2-99B9-7D1F51B857FE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AB04A308-4E99-4DAF-9239-64F6808BFD5C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AE3A674C-E0E4-43A7-A948-C3C1DC391A18}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe |
"{C0891C94-94AD-4C93-81F4-097206DA3920}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C8FB76A2-B5F1-4F2C-90EF-9DF1667B6FBB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D0F7D040-06DD-4CCF-BAEE-2EBBE4DCB4B1}" = protocol=6 | dir=out | app=system |
"{E9F71ECB-FE66-4DC2-8B09-CA8B49662E65}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{08CC73E9-CE90-4215-BF4E-1F5524ED5D8C}C:\program files (x86)\philips\philips songbird\philips-songbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\philips\philips songbird\philips-songbird.exe |
"TCP Query User{42E271BA-A919-4DD0-96BF-4D6538BAD34E}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{DE5DDBAB-A960-476D-8D76-F7BCB871064C}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{2200AA82-EBDA-4E43-845B-0167CE4ABDB2}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{2A34FE88-97E0-4AAE-889B-5A14CE1F6055}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{51AC1EBA-DFE8-4340-AB78-77109FBE13A7}C:\program files (x86)\philips\philips songbird\philips-songbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\philips\philips songbird\philips-songbird.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{02A5BD31-16AC-45DF-BE9F-A3167BC4AFB2}" = Windows Live Family Safety
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{27B3E5AA-5B75-414A-AC37-F5ADDFA68BDB}" = Windows Live Family Safety
"{287134AD-092F-4BD0-A6F4-911B0B351E87}" = Windows Live Family Safety
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel(R) Turbo Boost Technology Monitor
"{464F7B5E-80BB-4F34-A602-384F0702674A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5ECA80C9-7D7A-49AC-B487-52F1CF47ECEE}" = Windows Live Family Safety
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{698EAE05-09DE-47D0-9586-29E41A0934DD}" = Windows Live Family Safety
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{74AC7ECE-87E1-41F7-ABA2-5ED9B13CECFA}" = Windows Live Family Safety
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8832CAA2-4934-4916-A8BF-A9A51C6B58B3}" = Windows Live Family Safety
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{944E73EF-857E-4F71-9DC4-CD059D7ADDEF}" = Windows Live Family Safety
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 268.74
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{BFBE6E95-5724-47EC-85A0-74D436AD938F}" = Windows Live Family Safety
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C61D639C-3A1B-4654-901F-08927C804321}" = Windows Live Family Safety
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"AsMakeLink" = AsMakeLink
"CCleaner" = CCleaner
"DesktopIconAmazon" = Desktop Icon für Amazon
"GIMP-2_is1" = GIMP 2.6.12
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}" = SonicMaster
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0E1FE502-7536-4155-BBC6-7BE8E465DE08}" = Firebird SQL Server - MAGIX Edition
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{341697D8-9923-445E-B42A-529E5A99CB7A}" = syncables desktop SE
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4555BB9E-E715-4260-A178-E8EFD2B653E3}" = Alcor Micro USB Card Reader
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{749F674B-2674-47E8-879C-5626A06B2A91}" = InstantOn for NB
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C6A4E35-5EEE-426A-A7BF-EA95CDC54DEA}" = Music Now!
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96A9A1C8-FBAD-4703-ABF1-E93AA8FE85A0}_is1" = Artweaver Free 3.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}" = פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AECA3622-E634-4A55-A696-70A511CBE06E}" = ASUS USB Charger Plus
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}" = Элемент управления Windows Live Mesh ActiveX для удаленных подключений
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}" = ASUS FancyStart
"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DD47370C-E0F1-407F-9DB0-3FF98907F1BC}" = ASUS Music Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E18B30AA-6E2D-480C-B918-AF61009F4010}" = عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.7
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E71E60C1-533E-45A5-8D80-E475E88D2B17}_is1" = Game Park Console
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17
"AmUStor" = Alcor Micro USB Card Reader
"Asus Vibe2.0" = AsusVibe2.0
"ASUS WebStorage" = ASUS WebStorage
"AsusScr_N5_En" = AsusScr_N5_En
"AudibleManager" = AudibleManager
"Avira AntiVir Desktop" = Avira Antivirus Premium
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"BFG-A Gypsy's Tale - Der Turm des Schicksals" = A Gypsy's Tale: Der Turm des Schicksals
"BFG-Abra Academy" = Abra Academy
"BFG-Allora und das zerbrochene Portal" = Allora und das zerbrochene Portal
"BFG-Awakening - Das Koenigreich der Kobolde Sammleredition" = Awakening: Das Königreich der Kobolde Sammleredition
"BFG-Awakening 2 - Der Mondenwald" = Awakening 2: Der Mondenwald
"BFGC" = Big Fish Games: Game Manager
"BFG-Das gelobte Land" = Das gelobte Land
"BFG-Das Vermaechtnis - Der Baum des Lebens" = Das Vermächtnis: Der Baum des Lebens
"BFG-Die Chroniken von Emerland Solitaer" = Die Chroniken von Emerland Solitär
"BFG-Echoes of the Past - Die Rache der Hexe Sammleredition" = Echoes of the Past: Die Rache der Hexe Sammleredition
"BFG-Echoes of the Past - Royal House of Stone" = Echoes of the Past: Royal House of Stone
"BFG-Gehirntraining" = Gehirntraining
"BFG-Grim Tales - Das Vermaechtnis Sammleredition" = Grim Tales: Das Vermächtnis Sammleredition
"BFG-Hidden Magic" = Hidden Magic
"BFG-Liong - The Lost Amulets" = Liong: The Lost Amulets
"BFG-Magic Farm" = Magic Farm
"BFG-Monarch - The Butterfly King" = Monarch - The Butterfly King
"BFG-Mushroom Age" = Mushroom Age
"BFG-Mystery Age - Die Dunklen Priester" = Mystery Age: Die Dunklen Priester
"BFG-Otherworld - Fruehling der Schatten Sammleredition" = Otherworld: Frühling der Schatten Sammleredition
"BFG-Prinzessin Isabella - Die Rueckkehr des Fluches" = Prinzessin Isabella: Die Rückkehr des Fluches
"BFG-Roads of Rome" = Roads of Rome
"BFG-Spirits of Mystery - Der Gesang des Phoenix" = Spirits of Mystery: Der Gesang des Phönix
"BFG-Spirits of Mystery - Dunkler Fluch Sammleredition" = Spirits of Mystery: Dunkler Fluch Sammleredition
"Bookworm Deluxe" = Bookworm Deluxe
"Cheatbook 07.2009" = Cheatbook 07.2009
"Cooking Dash" = Cooking Dash
"Edraw Mind Map Freeware_is1" = Edraw Mind Map 6.5
"ESET Online Scanner" = ESET Online Scanner v3
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"IcoFX_is1" = IcoFX 1.6.4
"Inkscape" = Inkscape 0.48.2
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{7C6A4E35-5EEE-426A-A7BF-EA95CDC54DEA}" = Music Now!
"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.7
"Luxor 3" = Luxor 3
"MAGIX_MSI_mm17_silver_asus" = ASUS Music Maker
"Mahjongg dimensions" = Mahjongg dimensions
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"PDFConverter Desktop_is1" = PDFConverter Desktop
"Philips Songbird" = Philips Songbird
"Plants vs Zombies" = Plants vs Zombies
"Streamripper" = Streamripper (Remove only)
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"Wise Disk Cleaner_is1" = Wise Disk Cleaner 7.76
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 7.64
"World of Goo" = World of Goo
"XnView_is1" = XnView 1.99.6
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{206a7328-437f-4bd9-b53e-12bfee24d588}" = G-Filter
"Amazon Kindle" = Amazon Kindle
"Flux" = F.lux
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 2/13/2013 9:05:40 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1030
Error - 2/13/2013 9:05:40 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1030
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2044
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2044
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3042
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3042
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4056
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4056
[ System Events ]
Error - 3/10/2013 7:02:02 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:03:14 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:03:14 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:53:59 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:54:00 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:54:05 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:54:05 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 7:54:06 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 8:25:21 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/10/2013 8:25:21 PM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
< End of report >
Esmeralda |
|
11.03.2013, 15:56
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere MalwareCode:
ATTFilter Scan Mode: Current user
__________________ --> Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware |
|
11.03.2013, 16:28
| #7 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Oh, das hatte ich wohl tatsächlich vergesen - sorry! Hier noch mal die aktuellen Logs - hab diesmal bewusst auf das Häkchen bei "alle Benutzer" geachtet: Code:
ATTFilter OTL logfile created on: 3/11/2013 4:01:20 PM - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aquaria.MariasRechner\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7.91 Gb Total Physical Memory | 5.30 Gb Available Physical Memory | 66.98% Memory free 15.81 Gb Paging File | 12.80 Gb Available in Paging File | 80.97% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 305.67 Gb Total Space | 179.26 Gb Free Space | 58.65% Space Free | Partition Type: NTFS Drive D: | 367.97 Gb Total Space | 355.62 Gb Free Space | 96.64% Space Free | Partition Type: NTFS Computer Name: MARIASRECHNER | User Name: Maria Wohlfarth | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Aquaria.MariasRechner\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) PRC - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe (CyberLink) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () PRC - C:\Windows\AsScrPro.exe (ASUS) PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe (ASUS) PRC - C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe (ASUS) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\ASUS.SYS\SIONExportService.exe (Splashtop Inc.) PRC - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe (Virage Logic Corporation / Sonic Focus) PRC - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) PRC - C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_ssl.pyd () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\koan\_ctypes.pyd () MOD - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_socket.pyd () MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () MOD - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll () MOD - C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe () ========== Services (SafeList) ========== SRV:64bit: - (GFilterSvc) -- C:\Windows\SysNative\GFilterSvc.exe () SRV:64bit: - (secinitd) -- C:\Windows\SysNative\d3dxof64.exe () SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (CyberLink PowerDVD 12 Media Server Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink) SRV - (CyberLink PowerDVD 12 Media Server Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) SRV - (CLHNServiceForPowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (ASUS InstantOn) -- C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe (ASUS) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Splashtop MDES) -- C:\ASUS.SYS\SIONExportService.exe (Splashtop Inc.) SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros) SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations) SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV:64bit: - (mbamchameleon) -- C:\Windows\SysNative\drivers\mbamchameleon.sys () DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation) DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc) DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros) DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros) DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros) DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros) DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros) DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros) DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (AiCharger) -- C:\Windows\SysNative\drivers\AiCharger.sys (ASUSTek Computer Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys () DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( ) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV - ({73526619-C24F-470B-9BED-53D455FBB5C6}) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl (CyberLink Corp.) DRV - (ntk_PowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys (Cyberlink Corp.) DRV - (GEARAspiWDM) -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=ie9hp IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://asus.msn.com [binary data] IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://asus.msn.com [binary data] IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?affID=119828&babsrc=HP_ss&mntrId=a06c3664000000000000742f68fa9c99 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\..\SearchScopes,DefaultScope = {783132D5-473D-4F21-B77C-F2BE8F6B9F22} IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.delta-search.com/?q={searchTerms}&affID=119828&babsrc=SP_ss&mntrId=a06c3664000000000000742f68fa9c99 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\..\SearchScopes\{783132D5-473D-4F21-B77C-F2BE8F6B9F22}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE9SRC IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=ie9hp IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://asus.msn.com [binary data] IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://asus.msn.com [binary data] IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=ie9hp IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\..\SearchScopes,DefaultScope = {2EE28B92-C46E-4AB5-BB66-8A7527220737} IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\..\SearchScopes\{2EE28B92-C46E-4AB5-BB66-8A7527220737}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE9SRC IE - HKU\S-1-5-21-542383332-4153358020-2719540128-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledAddons: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119 FF - prefs.js..extensions.enabledAddons: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120910 FF - prefs.js..extensions.enabledAddons: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.2.6 FF - prefs.js..extensions.enabledAddons: firejump@firejump.net:1.0.2.5 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012/01/20 00:59:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/29 18:55:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/23 14:11:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net [2013/02/26 00:16:42 | 000,000,000 | ---D | M] [2011/12/02 23:26:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Extensions [2013/03/05 00:02:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions [2013/03/05 00:02:11 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2012/11/22 01:12:14 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012/08/11 18:32:02 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2013/02/26 00:16:42 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net [2011/12/02 23:39:53 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\extensions\personas@christopher.beard.xpi [2013/02/26 02:09:21 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013/02/26 00:17:07 | 000,001,294 | ---- | M] () -- C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\searchplugins\delta.xml [2012/02/03 21:43:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/08/11 18:31:58 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/10/26 19:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2013/03/03 22:06:32 | 000,001,400 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2013/02/26 00:16:56 | 000,006,484 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2013/03/03 22:06:32 | 000,001,679 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013/03/03 22:06:32 | 000,000,947 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2013/03/03 22:06:32 | 000,006,818 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2013/02/26 00:16:42 | 000,001,279 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2013/03/03 22:06:32 | 000,000,903 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml Hosts file not found O2:64bit: - BHO: (no name) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - No CLSID value found. O2:64bit: - BHO: (no name) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - No CLSID value found. O2 - BHO: (no name) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - No CLSID value found. O2 - BHO: (no name) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (no name) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.) O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [Philips Device Listener] C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe () O4 - HKLM..\Run: [PowerDVD12Agent] C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.) O4 - HKLM..\Run: [PowerDVD12DMREngine] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink) O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe (Virage Logic Corporation / Sonic Focus) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1000..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler File not found O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1001..\Run: [F.lux] C:\Users\Maria Wohlfarth\Local Settings\Apps\F.lux\flux.exe () O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1005..\Run: [F.lux] C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe () O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1005..\Run: [sbitunesagent] C:\Program Files (x86)\Philips\Philips Songbird\songbirditunesagent.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-542383332-4153358020-2719540128-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Aquaria.MariasRechner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-542383332-4153358020-2719540128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKU\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.9.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{472526DB-FACF-4C72-8CC4-6BF1B4BA372E}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BAB72536-28FF-4C93-886C-41FD60ED208B}: DhcpNameServer = 13.5.0.10 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\tmbp - No CLSID value found O18:64bit: - Protocol\Handler\tmpx - No CLSID value found O18:64bit: - Protocol\Handler\tmtbim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\tmbp - No CLSID value found O18 - Protocol\Handler\tmpx - No CLSID value found O18 - Protocol\Handler\tmtbim - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (sdnclean64.exe) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/03/09 22:11:12 | 000,000,000 | R--D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices [2013/03/05 22:57:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2013/03/05 22:57:30 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2013/03/05 13:50:59 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Local\Programs [2013/03/05 04:43:37 | 002,770,944 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\athrx.sys [2013/03/05 00:11:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2013/03/03 22:06:31 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\IO [2013/02/27 03:00:54 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll [2013/02/27 03:00:54 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll [2013/02/27 03:00:54 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll [2013/02/27 03:00:54 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll [2013/02/27 03:00:50 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll [2013/02/27 03:00:50 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll [2013/02/27 03:00:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013/02/27 03:00:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013/02/27 03:00:44 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll [2013/02/27 03:00:44 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013/02/27 03:00:44 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013/02/27 03:00:44 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013/02/27 03:00:44 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013/02/27 03:00:44 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013/02/27 03:00:44 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013/02/27 03:00:43 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll [2013/02/27 03:00:43 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll [2013/02/27 03:00:43 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll [2013/02/27 03:00:43 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll [2013/02/27 03:00:43 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll [2013/02/27 03:00:43 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll [2013/02/27 03:00:43 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll [2013/02/27 03:00:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll [2013/02/27 03:00:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll [2013/02/27 03:00:42 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll [2013/02/27 03:00:42 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll [2013/02/27 03:00:42 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2013/02/27 03:00:42 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll [2013/02/27 03:00:42 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll [2013/02/27 03:00:41 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll [2013/02/27 03:00:41 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2013/02/27 03:00:41 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll [2013/02/27 03:00:41 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll [2013/02/27 03:00:40 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll [2013/02/27 03:00:40 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll [2013/02/26 22:15:50 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink MediaEspresso 6.7 [2013/02/26 22:15:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX [2013/02/26 22:05:53 | 000,000,000 | ---D | C] -- C:\MediaServer [2013/02/26 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CyberLink [2013/02/26 22:05:49 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Local\MediaServer [2013/02/26 22:05:47 | 000,000,000 | ---D | C] -- C:\ProgramData\PDVD [2013/02/26 22:05:33 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 12 [2013/02/26 21:59:31 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap [2013/02/26 02:10:22 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Wise Disk Cleaner [2013/02/26 02:09:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Disk Cleaner [2013/02/26 02:09:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise [2013/02/26 00:16:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2013/02/26 00:16:43 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Babylon [2013/02/26 00:16:42 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll [2013/02/26 00:16:42 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Opera [2013/02/26 00:16:38 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\DesktopIconForAmazon [2013/02/26 00:16:36 | 000,000,000 | ---D | C] -- C:\Users\Maria Wohlfarth\AppData\Roaming\OCS [2013/02/14 03:01:02 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013/02/14 03:01:02 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013/02/14 03:01:01 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013/02/14 03:01:01 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013/02/14 03:01:00 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013/02/14 03:01:00 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013/02/14 03:00:59 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013/02/14 03:00:59 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013/02/14 03:00:59 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013/02/14 03:00:58 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013/02/14 03:00:58 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013/02/14 03:00:58 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013/02/14 03:00:55 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013/02/14 03:00:55 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013/02/14 03:00:55 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013/02/13 11:27:04 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013/02/13 11:26:58 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013/02/13 11:26:57 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013/02/13 11:26:46 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2013/02/13 11:26:45 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2013/02/13 11:26:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2013/02/13 11:26:45 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2013/02/13 11:26:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2013/02/13 11:26:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2013/02/13 11:26:40 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/03/11 15:59:59 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx [2013/03/11 15:07:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013/03/11 13:22:55 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/03/11 13:22:55 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/03/11 13:16:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/03/10 18:52:09 | 2072,027,135 | -HS- | M] () -- C:\hiberfil.sys [2013/03/09 22:11:19 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe [2013/03/09 19:12:20 | 000,706,520 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat [2013/03/09 19:12:20 | 000,705,544 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat [2013/03/09 19:12:20 | 000,703,282 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat [2013/03/09 19:12:20 | 000,701,198 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat [2013/03/09 19:12:20 | 000,691,432 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat [2013/03/09 19:12:20 | 000,688,048 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat [2013/03/09 19:12:20 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013/03/09 19:12:20 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013/03/09 19:12:20 | 000,563,860 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat [2013/03/09 19:12:20 | 000,397,410 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat [2013/03/09 19:12:20 | 000,365,612 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat [2013/03/09 19:12:20 | 000,141,234 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat [2013/03/09 19:12:20 | 000,137,924 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat [2013/03/09 19:12:20 | 000,137,112 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat [2013/03/09 19:12:20 | 000,136,688 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat [2013/03/09 19:12:20 | 000,134,312 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat [2013/03/09 19:12:20 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013/03/09 19:12:20 | 000,131,316 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat [2013/03/09 19:12:20 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat [2013/03/09 19:12:20 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013/03/09 19:12:20 | 000,093,608 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat [2013/03/09 19:12:20 | 000,073,266 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat [2013/03/09 19:12:19 | 008,133,930 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013/03/08 17:07:58 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013/03/05 23:02:28 | 000,014,979 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\hijackthis_01 [2013/03/05 22:57:30 | 000,003,019 | ---- | M] () -- C:\Users\Maria Wohlfarth\Desktop\HiJackThis.lnk [2013/03/05 20:10:09 | 000,071,374 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\cc_20130305_200958.reg [2013/03/05 17:26:31 | 000,002,114 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini [2013/03/05 14:33:22 | 000,036,680 | ---- | M] () -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2013/03/05 13:54:41 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013/02/27 23:07:20 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013/02/27 23:07:20 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013/02/26 22:15:50 | 000,002,125 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink MediaEspresso 6.7.lnk [2013/02/26 22:05:32 | 000,002,190 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk [2013/02/26 22:01:34 | 000,063,851 | ---- | M] () -- C:\Users\Maria Wohlfarth\Documents\Lizenzvertrag PowerDVD.xps [2013/02/26 20:51:43 | 000,002,490 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini [2013/02/26 00:16:42 | 000,119,808 | ---- | M] () -- C:\Windows\SysNative\GFilterSvc.exe [2013/02/26 00:16:41 | 000,118,272 | ---- | M] () -- C:\Windows\SysNative\d3dxof64.exe [2013/02/26 00:16:39 | 000,001,496 | ---- | M] () -- C:\Users\Maria Wohlfarth\Desktop\Amazon.lnk [2013/02/14 11:55:47 | 000,385,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/03/05 23:02:28 | 000,014,979 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\hijackthis_01 [2013/03/05 22:57:30 | 000,003,019 | ---- | C] () -- C:\Users\Maria Wohlfarth\Desktop\HiJackThis.lnk [2013/03/05 20:10:04 | 000,071,374 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\cc_20130305_200958.reg [2013/03/05 14:33:22 | 000,036,680 | ---- | C] () -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2013/03/05 13:54:41 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013/02/26 22:15:50 | 000,002,125 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink MediaEspresso 6.7.lnk [2013/02/26 22:05:32 | 000,002,190 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk [2013/02/26 22:01:32 | 000,063,851 | ---- | C] () -- C:\Users\Maria Wohlfarth\Documents\Lizenzvertrag PowerDVD.xps [2013/02/26 00:16:42 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll [2013/02/26 00:16:42 | 000,119,808 | ---- | C] () -- C:\Windows\SysNative\GFilterSvc.exe [2013/02/26 00:16:41 | 000,118,272 | ---- | C] () -- C:\Windows\SysNative\d3dxof64.exe [2013/02/26 00:16:39 | 000,001,496 | ---- | C] () -- C:\Users\Maria Wohlfarth\Desktop\Amazon.lnk [2012/02/11 21:35:25 | 000,874,396 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\census.cache [2012/02/11 21:35:05 | 000,130,524 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\ars.cache [2012/02/11 21:22:15 | 000,000,036 | ---- | C] () -- C:\Users\Maria Wohlfarth\AppData\Local\housecall.guid.cache [2012/01/25 19:12:27 | 000,000,043 | ---- | C] () -- C:\Users\Maria Wohlfarth\gsview64.ini [2011/12/03 04:44:11 | 008,232,426 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011/10/29 02:51:27 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll [2011/08/31 19:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011/08/31 19:46:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2011/08/31 19:26:20 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2011/08/19 03:33:36 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll [2011/08/19 03:32:39 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011/08/19 03:32:34 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2011/05/10 23:55:50 | 000,368,400 | ---- | C] () -- C:\Windows\SysWow64\sqlite3.dll [2011/04/13 03:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011/12/04 20:56:12 | 000,000,000 | ---D | M] -- C:\Users\Aquaria\AppData\Roaming\ASUS WebStorage [2012/03/21 00:50:54 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\A Gypsy's Tale - Der Turm des Schicksals [2012/03/22 03:27:06 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Abra Academy [2012/01/13 20:24:05 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Amazon [2012/01/13 00:41:13 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Artweaver Free [2011/12/10 14:01:18 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\ASUS WebStorage [2012/03/20 16:07:04 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Az-Art [2012/12/03 14:11:11 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Boolat Games [2013/01/18 12:59:27 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Boomzap [2012/01/14 04:14:55 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\DAZ 3D [2012/12/08 19:18:42 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Edraw Mind Map [2012/03/12 21:05:02 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Elephant Games [2012/08/03 14:50:29 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\ERS Game Studios [2012/03/20 11:42:12 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Gogii [2012/04/12 01:35:47 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\gtk-2.0 [2013/03/09 12:14:25 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\inkscape [2012/03/21 00:51:49 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\MA2 [2012/03/26 20:01:41 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Meridian93 [2011/12/21 19:34:09 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\OpenOffice.org [2013/01/04 22:33:09 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Orneon [2012/09/29 17:22:28 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Philips [2012/12/11 15:03:16 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Philips-Songbird [2012/02/12 12:03:17 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Radialpoint [2012/12/29 09:29:23 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Rainbow [2013/02/26 02:29:39 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\SoftGrid Client [2011/12/14 16:39:48 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\streamripper [2012/01/20 01:00:55 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Swiss Academic Software [2012/09/20 16:40:35 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\Windows Live Writer [2012/12/27 19:11:03 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\XnView [2012/02/12 12:03:08 | 000,000,000 | ---D | M] -- C:\Users\Aquaria.MariasRechner\AppData\Roaming\{{userdatapath.company}} [2013/01/02 00:27:42 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\A Gypsy's Tale - Der Turm des Schicksals [2012/03/22 03:24:19 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Abra Academy [2011/12/04 04:08:44 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Amazon [2011/12/03 00:28:11 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\ASUS WebStorage [2012/03/19 22:07:29 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Az-Art [2013/02/26 00:16:43 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Babylon [2013/01/17 19:54:28 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Boomzap [2012/02/02 00:15:33 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\DAZ 3D [2012/03/25 21:53:58 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Dekovir [2013/02/26 00:16:39 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\DesktopIconForAmazon [2011/12/03 01:56:55 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Downloaded Installations [2012/12/08 18:37:14 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Edraw Mind Map [2012/03/13 18:00:59 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Elephant Games [2012/02/09 02:25:45 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\ERS Game Studios [2012/03/19 22:31:56 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Gogii [2012/02/02 01:09:54 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\IcoFX [2013/03/08 17:08:22 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\inkscape [2012/03/25 22:37:58 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Meridian93 [2011/12/03 01:55:06 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Nitro PDF [2011/12/03 00:34:07 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Nuance [2013/02/26 00:16:36 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\OCS [2011/12/03 01:53:56 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\OpenCandy [2011/12/03 04:40:21 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\OpenOffice.org [2013/02/26 00:16:42 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Opera [2013/01/02 00:41:19 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Orneon [2013/03/05 00:06:32 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\QuickScan [2012/02/11 21:31:30 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Radialpoint [2012/12/28 16:52:44 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Rainbow [2011/12/10 00:56:23 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\SoftGrid Client [2011/12/08 04:03:37 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\streamripper [2011/12/03 04:44:50 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\TP [2013/02/26 02:29:38 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Wise Disk Cleaner [2013/03/03 22:23:09 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Wise Registry Cleaner [2011/12/03 00:34:04 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\Zeon [2012/02/11 21:58:52 | 000,000,000 | ---D | M] -- C:\Users\Maria Wohlfarth\AppData\Roaming\{{userdatapath.company}} ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 248 bytes -> C:\ProgramData\Temp:FD786DCA @Alternate Data Stream - 248 bytes -> C:\ProgramData\Temp:B65E763D @Alternate Data Stream - 243 bytes -> C:\ProgramData\Temp:12D21A9A @Alternate Data Stream - 239 bytes -> C:\ProgramData\Temp:869C6B4A @Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:164561C8 @Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:DC7EDF41 @Alternate Data Stream - 234 bytes -> C:\ProgramData\Temp:63C29481 @Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:99AC3203 @Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:11590865 @Alternate Data Stream - 226 bytes -> C:\ProgramData\Temp:A5584049 @Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:2AE74FF9 @Alternate Data Stream - 222 bytes -> C:\ProgramData\Temp:8944C195 @Alternate Data Stream - 220 bytes -> C:\ProgramData\Temp:FED25C29 @Alternate Data Stream - 216 bytes -> C:\ProgramData\Temp:9B285B76 @Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:0EC7A545 @Alternate Data Stream - 210 bytes -> C:\ProgramData\Temp:6EE8565A @Alternate Data Stream - 209 bytes -> C:\ProgramData\Temp:1B9E79B3 @Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:774A0E14 @Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:C2F24DB5 @Alternate Data Stream - 204 bytes -> C:\ProgramData\Temp:96AFAB10 @Alternate Data Stream - 203 bytes -> C:\ProgramData\Temp:D2A66480 @Alternate Data Stream - 198 bytes -> C:\ProgramData\Temp:5BC73C48 @Alternate Data Stream - 191 bytes -> C:\ProgramData\Temp:5A437AC3 @Alternate Data Stream - 188 bytes -> C:\ProgramData\Temp:27D1368B @Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:58C9BCAC < End of report > Code:
ATTFilter OTL Extras logfile created on: 3/11/2013 4:01:20 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aquaria.MariasRechner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7.91 Gb Total Physical Memory | 5.30 Gb Available Physical Memory | 66.98% Memory free
15.81 Gb Paging File | 12.80 Gb Available in Paging File | 80.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 305.67 Gb Total Space | 179.26 Gb Free Space | 58.65% Space Free | Partition Type: NTFS
Drive D: | 367.97 Gb Total Space | 355.62 Gb Free Space | 96.64% Space Free | Partition Type: NTFS
Computer Name: MARIASRECHNER | User Name: Maria Wohlfarth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03374369-29B8-498E-8EEA-9A491A218B5F}" = lport=137 | protocol=17 | dir=in | app=system |
"{0E39FEF6-1FCD-45E4-AD61-C3CC303DC0B4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13FD5E8E-CC0A-4CAE-A8EC-ABAD54609A84}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1CEC1512-BEE9-40E2-9C74-F46C7366E94A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2B6B8543-2F6E-43B2-96BF-A74079DFB358}" = rport=139 | protocol=6 | dir=out | app=system |
"{4CC190BB-2D4C-4E58-B2D7-6494589A2A7F}" = lport=139 | protocol=6 | dir=in | app=system |
"{4EA5703C-7329-4F56-A671-C88ECD41DDB0}" = lport=138 | protocol=17 | dir=in | app=system |
"{506984D9-DE61-4E40-9679-2D3BDE5A3CB8}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary |
"{6120440A-6801-4740-9A03-7FE7AA72AC17}" = rport=138 | protocol=17 | dir=out | app=system |
"{6D86BBA6-660B-4EA4-9C85-ADBCBF533D55}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{7EDA2D0F-9565-4E31-8CD1-97A5231B9189}" = lport=445 | protocol=6 | dir=in | app=system |
"{85D4A1DB-156E-45C8-8968-15C7EA44A151}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{89113D06-E3D5-49A7-9856-9E2775632F95}" = rport=445 | protocol=6 | dir=out | app=system |
"{8D688385-9104-4FF3-BE3D-28B7D2D59362}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8EFCA642-564A-4023-998E-B59AEFB67090}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9357CE08-0AA1-4819-A0F7-263FC257043A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9735A264-B861-4C85-9022-E60099F68C8B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A72233AF-337A-40D3-BCE9-4CBCFF8C6B0B}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary |
"{ACA48445-98A7-4395-AF16-B4668DE88C3B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{AE366A47-2CC4-4C8E-9C68-A3EE46A50F79}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AFFBD841-0971-4826-9D75-447EF13A9EDE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B827E1C7-5A7A-484C-9653-2FE388A8B888}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B92833AB-1682-40F4-9B55-D80B3476C46F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BE28CBB8-D4D4-4582-948E-AF0F7AD42F9A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D662F18D-0DE0-4197-88AC-A6D9B588AAFE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E7294DB9-E707-434E-A807-DD0BF7F74F64}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{F3E173A1-B600-417E-92A5-9DFAEECF97C8}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0583604E-9C23-4FAC-A86B-4D821F0355CB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0BE4E83C-CE6C-4C45-A80C-0034D3E43FD8}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{0C32B695-2393-4C43-9CE5-25BB31020208}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{107C4BF2-7492-4492-ABFA-D80819990EB6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe |
"{1549554E-270D-4FCD-84B5-51EF5C88A9F3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe |
"{16AC0CDA-309F-47EC-BADA-708B2635A390}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd cinema\powerdvdcinema12.exe |
"{170D01B4-8E6E-49FB-BF3D-3A9DD9CB304A}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe |
"{3162169B-81B6-4AED-AEB3-7A6711AEB3D7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3B0D3C74-3124-42D9-8B60-B215385FE169}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{41778980-3D38-49C1-8518-AA77CCC54FD9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4831BE12-7EA9-4CEF-93F5-6E373189DF54}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{50D76052-134E-46DB-AF8E-63827F883C0F}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{513E8BF9-7A3F-4ACB-AC6C-68AC8DFD3D68}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{561376D4-CDAE-4217-9CCA-E625F16996EF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6D79AC48-775E-47E8-8E8D-BC15612A1055}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{77E2118B-E954-4B7C-A3EE-D1F9A25AC586}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr8.exe |
"{7A692C6F-175C-4590-A7FF-62988D1A5AE6}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7CB3309E-ACB0-446D-BED6-64FE4DEBAFF1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{801886BB-5AFB-4669-AFBA-D53DF5E5BC09}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{815523A5-A2F6-485B-9063-765C5DFDA0C6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{870CDFE1-DAD7-47DC-8A63-75C6CEA7BF3E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8CAB0023-E43A-4ACA-B871-3A39CF4C33E6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8D9AF99E-48D8-4131-B2E7-977DB77A846E}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{8E30A05E-C912-40A2-90CF-9EE024DDC6C6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8EF01BA1-D1F6-4D73-AADB-AB5E81F83EF1}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{9203B834-0E81-4C4A-A00D-203B32276868}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{94F0BC9D-1EBC-4719-B008-EF0352791717}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe |
"{9EA5D877-E091-461B-9514-F65A484DFA15}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A4C3D668-82B4-42D2-99B9-7D1F51B857FE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AB04A308-4E99-4DAF-9239-64F6808BFD5C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AE3A674C-E0E4-43A7-A948-C3C1DC391A18}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe |
"{C0891C94-94AD-4C93-81F4-097206DA3920}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C8FB76A2-B5F1-4F2C-90EF-9DF1667B6FBB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D0F7D040-06DD-4CCF-BAEE-2EBBE4DCB4B1}" = protocol=6 | dir=out | app=system |
"{E9F71ECB-FE66-4DC2-8B09-CA8B49662E65}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{08CC73E9-CE90-4215-BF4E-1F5524ED5D8C}C:\program files (x86)\philips\philips songbird\philips-songbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\philips\philips songbird\philips-songbird.exe |
"TCP Query User{42E271BA-A919-4DD0-96BF-4D6538BAD34E}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{DE5DDBAB-A960-476D-8D76-F7BCB871064C}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{2200AA82-EBDA-4E43-845B-0167CE4ABDB2}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{2A34FE88-97E0-4AAE-889B-5A14CE1F6055}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{51AC1EBA-DFE8-4340-AB78-77109FBE13A7}C:\program files (x86)\philips\philips songbird\philips-songbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\philips\philips songbird\philips-songbird.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{02A5BD31-16AC-45DF-BE9F-A3167BC4AFB2}" = Windows Live Family Safety
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{27B3E5AA-5B75-414A-AC37-F5ADDFA68BDB}" = Windows Live Family Safety
"{287134AD-092F-4BD0-A6F4-911B0B351E87}" = Windows Live Family Safety
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel(R) Turbo Boost Technology Monitor
"{464F7B5E-80BB-4F34-A602-384F0702674A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5ECA80C9-7D7A-49AC-B487-52F1CF47ECEE}" = Windows Live Family Safety
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{698EAE05-09DE-47D0-9586-29E41A0934DD}" = Windows Live Family Safety
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{74AC7ECE-87E1-41F7-ABA2-5ED9B13CECFA}" = Windows Live Family Safety
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8832CAA2-4934-4916-A8BF-A9A51C6B58B3}" = Windows Live Family Safety
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{944E73EF-857E-4F71-9DC4-CD059D7ADDEF}" = Windows Live Family Safety
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 268.74
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{BFBE6E95-5724-47EC-85A0-74D436AD938F}" = Windows Live Family Safety
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C61D639C-3A1B-4654-901F-08927C804321}" = Windows Live Family Safety
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"AsMakeLink" = AsMakeLink
"CCleaner" = CCleaner
"DesktopIconAmazon" = Desktop Icon für Amazon
"GIMP-2_is1" = GIMP 2.6.12
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}" = SonicMaster
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0E1FE502-7536-4155-BBC6-7BE8E465DE08}" = Firebird SQL Server - MAGIX Edition
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{341697D8-9923-445E-B42A-529E5A99CB7A}" = syncables desktop SE
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4555BB9E-E715-4260-A178-E8EFD2B653E3}" = Alcor Micro USB Card Reader
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{749F674B-2674-47E8-879C-5626A06B2A91}" = InstantOn for NB
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C6A4E35-5EEE-426A-A7BF-EA95CDC54DEA}" = Music Now!
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96A9A1C8-FBAD-4703-ABF1-E93AA8FE85A0}_is1" = Artweaver Free 3.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}" = פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AECA3622-E634-4A55-A696-70A511CBE06E}" = ASUS USB Charger Plus
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}" = Элемент управления Windows Live Mesh ActiveX для удаленных подключений
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}" = ASUS FancyStart
"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DD47370C-E0F1-407F-9DB0-3FF98907F1BC}" = ASUS Music Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E18B30AA-6E2D-480C-B918-AF61009F4010}" = عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.7
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E71E60C1-533E-45A5-8D80-E475E88D2B17}_is1" = Game Park Console
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17
"AmUStor" = Alcor Micro USB Card Reader
"Asus Vibe2.0" = AsusVibe2.0
"ASUS WebStorage" = ASUS WebStorage
"AsusScr_N5_En" = AsusScr_N5_En
"AudibleManager" = AudibleManager
"Avira AntiVir Desktop" = Avira Antivirus Premium
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"BFG-A Gypsy's Tale - Der Turm des Schicksals" = A Gypsy's Tale: Der Turm des Schicksals
"BFG-Abra Academy" = Abra Academy
"BFG-Allora und das zerbrochene Portal" = Allora und das zerbrochene Portal
"BFG-Awakening - Das Koenigreich der Kobolde Sammleredition" = Awakening: Das Königreich der Kobolde Sammleredition
"BFG-Awakening 2 - Der Mondenwald" = Awakening 2: Der Mondenwald
"BFGC" = Big Fish Games: Game Manager
"BFG-Das gelobte Land" = Das gelobte Land
"BFG-Das Vermaechtnis - Der Baum des Lebens" = Das Vermächtnis: Der Baum des Lebens
"BFG-Die Chroniken von Emerland Solitaer" = Die Chroniken von Emerland Solitär
"BFG-Echoes of the Past - Die Rache der Hexe Sammleredition" = Echoes of the Past: Die Rache der Hexe Sammleredition
"BFG-Echoes of the Past - Royal House of Stone" = Echoes of the Past: Royal House of Stone
"BFG-Gehirntraining" = Gehirntraining
"BFG-Grim Tales - Das Vermaechtnis Sammleredition" = Grim Tales: Das Vermächtnis Sammleredition
"BFG-Hidden Magic" = Hidden Magic
"BFG-Liong - The Lost Amulets" = Liong: The Lost Amulets
"BFG-Magic Farm" = Magic Farm
"BFG-Monarch - The Butterfly King" = Monarch - The Butterfly King
"BFG-Mushroom Age" = Mushroom Age
"BFG-Mystery Age - Die Dunklen Priester" = Mystery Age: Die Dunklen Priester
"BFG-Otherworld - Fruehling der Schatten Sammleredition" = Otherworld: Frühling der Schatten Sammleredition
"BFG-Prinzessin Isabella - Die Rueckkehr des Fluches" = Prinzessin Isabella: Die Rückkehr des Fluches
"BFG-Roads of Rome" = Roads of Rome
"BFG-Spirits of Mystery - Der Gesang des Phoenix" = Spirits of Mystery: Der Gesang des Phönix
"BFG-Spirits of Mystery - Dunkler Fluch Sammleredition" = Spirits of Mystery: Dunkler Fluch Sammleredition
"Bookworm Deluxe" = Bookworm Deluxe
"Cheatbook 07.2009" = Cheatbook 07.2009
"Cooking Dash" = Cooking Dash
"Edraw Mind Map Freeware_is1" = Edraw Mind Map 6.5
"ESET Online Scanner" = ESET Online Scanner v3
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"IcoFX_is1" = IcoFX 1.6.4
"Inkscape" = Inkscape 0.48.2
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{7C6A4E35-5EEE-426A-A7BF-EA95CDC54DEA}" = Music Now!
"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.7
"Luxor 3" = Luxor 3
"MAGIX_MSI_mm17_silver_asus" = ASUS Music Maker
"Mahjongg dimensions" = Mahjongg dimensions
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"PDFConverter Desktop_is1" = PDFConverter Desktop
"Philips Songbird" = Philips Songbird
"Plants vs Zombies" = Plants vs Zombies
"Streamripper" = Streamripper (Remove only)
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"Wise Disk Cleaner_is1" = Wise Disk Cleaner 7.76
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 7.64
"World of Goo" = World of Goo
"XnView_is1" = XnView 1.99.6
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-542383332-4153358020-2719540128-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{206a7328-437f-4bd9-b53e-12bfee24d588}" = G-Filter
"Amazon Kindle" = Amazon Kindle
"Flux" = F.lux
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-542383332-4153358020-2719540128-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Flux" = F.lux
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 2/13/2013 9:05:40 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1030
Error - 2/13/2013 9:05:40 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1030
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2044
Error - 2/13/2013 9:05:41 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2044
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3042
Error - 2/13/2013 9:05:42 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3042
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4056
Error - 2/13/2013 9:05:43 AM | Computer Name = MariasRechner | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4056
[ System Events ]
Error - 3/11/2013 10:57:26 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:27 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:30 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:32 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:32 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:33 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:34 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 10:57:35 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 11:00:51 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 3/11/2013 11:00:51 AM | Computer Name = MariasRechner | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
< End of report >
|
|
11.03.2013, 16:51
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Rootkitscan mit GMER Bitte lade dir  GMER herunter: (Dateiname zufällig)
 Tauchen Probleme auf?
Anschließend bitte MBAR ausführen: Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.03.2013, 22:04
| #9 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus, ich habe die Scans mit beiden Programmen ausgeführt. Dabei kam Folgendes heraus: Gmer-Log: Code:
ATTFilter GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-11 20:06:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST975042 rev.0001 698,64GB
Running: y1nlre3y.exe; Driver: C:\Users\MARIAW~1\AppData\Local\Temp\uwdyykoc.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000163c00 7 bytes [00, 96, F3, FF, 01, A2, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163c08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdd83460 7 bytes JMP 000007fffdd700d8
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdd89940 6 bytes JMP 000007fffdd70148
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdd89fb0 5 bytes JMP 000007fffdd70180
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdd8a150 5 bytes JMP 000007fffdd70110
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff7189e0 8 bytes JMP 000007fffdd701f0
.text C:\Windows\system32\Dwm.exe[3804] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff71be40 8 bytes JMP 000007fffdd701b8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4092] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3952] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007774efe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3952] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000777799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3952] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000777894d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3952] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077789640 5 bytes JMP 000000016fff0110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3952] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000777aa500 7 bytes JMP 000000016fff01b8
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4056] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007774efe0 5 bytes JMP 000000016fff0148
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4056] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000777799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4056] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000777894d0 5 bytes JMP 000000016fff0180
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4056] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077789640 5 bytes JMP 000000016fff0110
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4056] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000777aa500 7 bytes JMP 000000016fff01b8
.text C:\Windows\System32\igfxpers.exe[2472] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007774efe0 5 bytes JMP 000000016fff0148
.text C:\Windows\System32\igfxpers.exe[2472] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000777799b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\System32\igfxpers.exe[2472] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000777894d0 5 bytes JMP 000000016fff0180
.text C:\Windows\System32\igfxpers.exe[2472] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077789640 5 bytes JMP 000000016fff0110
.text C:\Windows\System32\igfxpers.exe[2472] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000777aa500 7 bytes JMP 000000016fff01b8
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Users\Aquaria.MariasRechner\Local Settings\Apps\F.lux\flux.exe[4516] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076d3e9a2 5 bytes JMP 0000000172051a00
.text C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[4772] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076d3ebdc 5 bytes JMP 0000000172051a90
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[3628] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4320] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4312] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe[4912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5008] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076ed87b1 5 bytes JMP 0000000172e61000
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[1468] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076ed87b1 5 bytes JMP 0000000172e61000
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3904] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[3004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000755d5ea5 5 bytes JMP 0000000172051ce0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075609d0b 5 bytes JMP 0000000172051c70
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076d3e9a2 5 bytes JMP 0000000172051a00
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076d3ebdc 5 bytes JMP 0000000172051a90
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[6384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076ee1429 7 bytes JMP 0000000172051e90
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000076efb223 5 bytes JMP 0000000172051da0
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076f788f4 7 bytes JMP 0000000172051d90
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076f78979 5 bytes JMP 0000000172051e80
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000076f78ccf 5 bytes JMP 0000000172051e10
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000770d1d1b 5 bytes JMP 0000000172052490
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000770d1dc9 5 bytes JMP 00000001720524f0
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000770d2aa4 5 bytes JMP 0000000172052560
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000770d2d0a 5 bytes JMP 00000001720526b0
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076d3e9a2 5 bytes JMP 0000000172051a00
.text C:\Users\Aquaria.MariasRechner\Desktop\y1nlre3y.exe[34808] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076d3ebdc 5 bytes JMP 0000000172051a90
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [6424:32348] 000007fef9299874
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f68fa9c99
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f68fa9c99 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org
Database version: v2013.03.11.11
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Maria Wohlfarth :: MARIASRECHNER [administrator]
11.03.2013 21:41:01
mbar-log-2013-03-11 (21-41-01).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 31587
Time elapsed: 16 minute(s), 48 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Viele Grüße, Esmeralda |
|
12.03.2013, 16:07
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware aswMBR Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). TDSS-Killer Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.03.2013, 20:46
| #11 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus, habe die Scans durchgeführt. Hier das Log zu MBR (nur als Qick Scan durchgeführt): Code:
ATTFilter aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-03-12 19:11:47
-----------------------------
19:11:47.501 OS Version: Windows x64 6.1.7601 Service Pack 1
19:11:47.501 Number of processors: 8 586 0x2A07
19:11:47.516 ComputerName: MARIASRECHNER UserName:
19:11:48.764 Initialize success
19:12:04.286 AVAST engine defs: 13031200
19:12:26.111 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:12:26.126 Disk 0 Vendor: ST975042 0001 Size: 715404MB BusType: 3
19:12:26.204 Disk 0 MBR read successfully
19:12:26.220 Disk 0 MBR scan
19:12:26.220 Disk 0 Windows 7 default MBR code
19:12:26.251 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 25600 MB offset 2048
19:12:26.267 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 313006 MB offset 52430848
19:12:26.314 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 376797 MB offset 693467136
19:12:26.360 Disk 0 scanning C:\Windows\system32\drivers
19:12:46.516 Service scanning
19:13:22.723 Modules scanning
19:13:22.723 Disk 0 trace - called modules:
19:13:22.786 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
19:13:22.786 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80080de790]
19:13:22.801 3 CLASSPNP.SYS[fffff88001c7843f] -> nt!IofCallDriver -> [0xfffffa8007b13b20]
19:13:22.801 5 ACPI.sys[fffff88000fac7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007b19050]
19:13:37.855 AVAST engine scan C:\Windows
19:13:43.378 AVAST engine scan C:\Windows\system32
19:17:41.154 AVAST engine scan C:\Windows\system32\drivers
19:17:59.765 AVAST engine scan C:\Users\Maria Wohlfarth
19:19:12.056 AVAST engine scan C:\ProgramData
19:20:46.561 Scan finished successfully
20:20:40.479 Disk 0 MBR has been saved successfully to "C:\Users\Aquaria.MariasRechner\Desktop\MBR.dat"
20:20:40.495 The log file has been saved successfully to "C:\Users\Aquaria.MariasRechner\Desktop\aswMBR.txt"
Code:
ATTFilter 20:28:48.0557 13852 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:28:48.0588 13852 ============================================================
20:28:48.0588 13852 Current date / time: 2013/03/12 20:28:48.0588
20:28:48.0588 13852 SystemInfo:
20:28:48.0588 13852
20:28:48.0588 13852 OS Version: 6.1.7601 ServicePack: 1.0
20:28:48.0588 13852 Product type: Workstation
20:28:48.0588 13852 ComputerName: MARIASRECHNER
20:28:48.0588 13852 UserName: Maria Wohlfarth
20:28:48.0588 13852 Windows directory: C:\Windows
20:28:48.0588 13852 System windows directory: C:\Windows
20:28:48.0588 13852 Running under WOW64
20:28:48.0588 13852 Processor architecture: Intel x64
20:28:48.0588 13852 Number of processors: 8
20:28:48.0588 13852 Page size: 0x1000
20:28:48.0588 13852 Boot type: Normal boot
20:28:48.0588 13852 ============================================================
20:28:49.0602 13852 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:28:49.0696 13852 ============================================================
20:28:49.0696 13852 \Device\Harddisk0\DR0:
20:28:49.0712 13852 MBR partitions:
20:28:49.0712 13852 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3200800, BlocksNum 0x26357000
20:28:49.0712 13852 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x29557800, BlocksNum 0x2DFEE800
20:28:49.0712 13852 ============================================================
20:28:49.0743 13852 C: <-> \Device\Harddisk0\DR0\Partition1
20:28:49.0774 13852 D: <-> \Device\Harddisk0\DR0\Partition2
20:28:49.0774 13852 ============================================================
20:28:49.0774 13852 Initialize success
20:28:49.0774 13852 ============================================================
20:29:50.0536 18176 ============================================================
20:29:50.0536 18176 Scan started
20:29:50.0536 18176 Mode: Manual; SigCheck; TDLFS;
20:29:50.0536 18176 ============================================================
20:29:51.0004 18176 ================ Scan system memory ========================
20:29:51.0004 18176 System memory - ok
20:29:51.0004 18176 ================ Scan services =============================
20:29:51.0254 18176 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
20:29:51.0425 18176 1394ohci - ok
20:29:51.0441 18176 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:29:51.0488 18176 ACPI - ok
20:29:51.0503 18176 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:29:51.0613 18176 AcpiPmi - ok
20:29:51.0753 18176 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
20:29:51.0784 18176 AdobeARMservice - ok
20:29:51.0925 18176 [ 9942DC4CC265CDA00486504444EF521D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:29:51.0956 18176 AdobeFlashPlayerUpdateSvc - ok
20:29:52.0003 18176 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
20:29:52.0065 18176 adp94xx - ok
20:29:52.0096 18176 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
20:29:52.0127 18176 adpahci - ok
20:29:52.0159 18176 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
20:29:52.0190 18176 adpu320 - ok
20:29:52.0221 18176 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:29:52.0346 18176 AeLookupSvc - ok
20:29:52.0393 18176 [ 6E79A119B0CE418FE44E0C824BF3F039 ] AFBAgent C:\Windows\system32\FBAgent.exe
20:29:52.0439 18176 AFBAgent - ok
20:29:52.0502 18176 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
20:29:52.0595 18176 AFD - ok
20:29:52.0627 18176 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
20:29:52.0658 18176 agp440 - ok
20:29:52.0720 18176 [ 14370049D8C9912EAC7603809A77C378 ] AiCharger C:\Windows\system32\DRIVERS\AiCharger.sys
20:29:52.0736 18176 AiCharger - ok
20:29:52.0767 18176 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
20:29:52.0814 18176 ALG - ok
20:29:52.0861 18176 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
20:29:52.0876 18176 aliide - ok
20:29:52.0907 18176 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
20:29:52.0939 18176 amdide - ok
20:29:52.0970 18176 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
20:29:53.0048 18176 AmdK8 - ok
20:29:53.0063 18176 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
20:29:53.0126 18176 AmdPPM - ok
20:29:53.0173 18176 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:29:53.0188 18176 amdsata - ok
20:29:53.0219 18176 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
20:29:53.0251 18176 amdsbs - ok
20:29:53.0266 18176 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:29:53.0297 18176 amdxata - ok
20:29:53.0407 18176 [ B73EB5109193A4BACE8520B79DD77B25 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
20:29:53.0438 18176 AntiVirMailService - ok
20:29:53.0469 18176 [ 44E76CC89F7E38B3C31F000A4E566856 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
20:29:53.0485 18176 AntiVirSchedulerService - ok
20:29:53.0547 18176 [ 3FE1CDD4DCF5D42DDBD6F1A3F83B5D3A ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
20:29:53.0563 18176 AntiVirService - ok
20:29:53.0609 18176 [ 4B46FED191BEB6EAFED88DE90E97A7DB ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
20:29:53.0656 18176 AntiVirWebService - ok
20:29:53.0672 18176 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
20:29:53.0797 18176 AppID - ok
20:29:53.0828 18176 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:29:53.0937 18176 AppIDSvc - ok
20:29:53.0968 18176 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
20:29:54.0093 18176 Appinfo - ok
20:29:54.0155 18176 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:29:54.0187 18176 Apple Mobile Device - ok
20:29:54.0202 18176 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
20:29:54.0233 18176 arc - ok
20:29:54.0265 18176 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
20:29:54.0296 18176 arcsas - ok
20:29:54.0358 18176 [ 18E5C2F937F9DEB8C282DF66A3761925 ] ASLDRService C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
20:29:54.0389 18176 ASLDRService - ok
20:29:54.0436 18176 [ 4C016FD76ED5C05E84CA8CAB77993961 ] ASMMAP64 C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
20:29:54.0452 18176 ASMMAP64 - ok
20:29:54.0514 18176 [ 0AA7A996792FB0287B33A57A8093AE44 ] asmthub3 C:\Windows\system32\DRIVERS\asmthub3.sys
20:29:54.0608 18176 asmthub3 - ok
20:29:54.0623 18176 [ 125DC3ABF5BFCCFE82AD17D078E0B9EC ] asmtxhci C:\Windows\system32\DRIVERS\asmtxhci.sys
20:29:54.0717 18176 asmtxhci - ok
20:29:54.0764 18176 [ DB662D792190D95EFA2F49DE092FD3D9 ] ASUS InstantOn C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe
20:29:54.0795 18176 ASUS InstantOn - ok
20:29:54.0826 18176 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:29:54.0935 18176 AsyncMac - ok
20:29:54.0982 18176 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
20:29:55.0013 18176 atapi - ok
20:29:55.0060 18176 [ CBE61B4494165F458BD87E37181EE934 ] AthBTPort C:\Windows\system32\DRIVERS\btath_flt.sys
20:29:55.0076 18176 AthBTPort - ok
20:29:55.0123 18176 [ 4C4A576818EA028257C624AE36FF7A03 ] Atheros Bt&Wlan Coex Agent C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
20:29:55.0138 18176 Atheros Bt&Wlan Coex Agent - ok
20:29:55.0154 18176 [ 21753130331188C4B474E1D3B396E629 ] AtherosSvc C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
20:29:55.0169 18176 AtherosSvc - ok
20:29:55.0263 18176 [ B4174564AD5834A1680610572477878C ] athr C:\Windows\system32\DRIVERS\athrx.sys
20:29:55.0450 18176 athr - ok
20:29:55.0497 18176 [ 7910158929571214A959D5A6D16DD9C0 ] ATKGFNEXSrv C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
20:29:55.0513 18176 ATKGFNEXSrv - ok
20:29:55.0559 18176 [ AC31727F9946E9009480708E4D1B9986 ] ATKWMIACPIIO C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys
20:29:55.0591 18176 ATKWMIACPIIO - ok
20:29:55.0637 18176 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:29:55.0778 18176 AudioEndpointBuilder - ok
20:29:55.0809 18176 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
20:29:55.0903 18176 AudioSrv - ok
20:29:55.0981 18176 [ BFE9598EBC3934CF8D876A303849C896 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
20:29:56.0012 18176 avgntflt - ok
20:29:56.0059 18176 [ F74D86A9FB35FA5F24627B8DBBF3A9A4 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
20:29:56.0090 18176 avipbb - ok
20:29:56.0121 18176 [ CD0E732347BF09717E0BDDC0C66699AB ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
20:29:56.0152 18176 avkmgr - ok
20:29:56.0199 18176 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:29:56.0308 18176 AxInstSV - ok
20:29:56.0355 18176 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
20:29:56.0449 18176 b06bdrv - ok
20:29:56.0480 18176 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
20:29:56.0527 18176 b57nd60a - ok
20:29:56.0589 18176 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
20:29:56.0651 18176 BDESVC - ok
20:29:56.0667 18176 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
20:29:56.0776 18176 Beep - ok
20:29:56.0839 18176 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
20:29:56.0963 18176 BFE - ok
20:29:57.0026 18176 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
20:29:57.0166 18176 BITS - ok
20:29:57.0197 18176 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:29:57.0244 18176 blbdrive - ok
20:29:57.0338 18176 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:29:57.0369 18176 Bonjour Service - ok
20:29:57.0416 18176 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:29:57.0494 18176 bowser - ok
20:29:57.0525 18176 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
20:29:57.0603 18176 BrFiltLo - ok
20:29:57.0619 18176 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
20:29:57.0665 18176 BrFiltUp - ok
20:29:57.0728 18176 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
20:29:57.0790 18176 Browser - ok
20:29:57.0821 18176 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:29:57.0899 18176 Brserid - ok
20:29:57.0915 18176 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:29:57.0977 18176 BrSerWdm - ok
20:29:57.0993 18176 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:29:58.0040 18176 BrUsbMdm - ok
20:29:58.0087 18176 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:29:58.0133 18176 BrUsbSer - ok
20:29:58.0196 18176 [ FE70889A85C57A9268101B2DB0474509 ] BTATH_A2DP C:\Windows\system32\drivers\btath_a2dp.sys
20:29:58.0227 18176 BTATH_A2DP - ok
20:29:58.0258 18176 [ A83A91D07D1FE6BBE7A9DB46CA00434B ] BTATH_BUS C:\Windows\system32\DRIVERS\btath_bus.sys
20:29:58.0274 18176 BTATH_BUS - ok
20:29:58.0305 18176 [ C864FF85EE16D61C2BDD5EF76824625F ] BTATH_HCRP C:\Windows\system32\DRIVERS\btath_hcrp.sys
20:29:58.0336 18176 BTATH_HCRP - ok
20:29:58.0352 18176 [ 0DEA505EFB5D771826D177EF8B8A208F ] BTATH_LWFLT C:\Windows\system32\DRIVERS\btath_lwflt.sys
20:29:58.0367 18176 BTATH_LWFLT - ok
20:29:58.0383 18176 [ 724C8088C96EFE7A3E63FEC21D4681C0 ] BTATH_RCP C:\Windows\system32\DRIVERS\btath_rcp.sys
20:29:58.0399 18176 BTATH_RCP - ok
20:29:58.0445 18176 [ AA0F5AFCF077C5246589B32ECEEAE566 ] BtFilter C:\Windows\system32\DRIVERS\btfilter.sys
20:29:58.0477 18176 BtFilter - ok
20:29:58.0523 18176 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
20:29:58.0757 18176 BthEnum - ok
20:29:58.0789 18176 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
20:29:58.0851 18176 BTHMODEM - ok
20:29:58.0882 18176 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
20:29:58.0945 18176 BthPan - ok
20:29:58.0991 18176 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
20:29:59.0069 18176 BTHPORT - ok
20:29:59.0116 18176 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
20:29:59.0241 18176 bthserv - ok
20:29:59.0257 18176 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
20:29:59.0303 18176 BTHUSB - ok
20:29:59.0350 18176 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:29:59.0475 18176 cdfs - ok
20:29:59.0506 18176 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:29:59.0553 18176 cdrom - ok
20:29:59.0600 18176 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
20:29:59.0693 18176 CertPropSvc - ok
20:29:59.0740 18176 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys
20:29:59.0803 18176 circlass - ok
20:29:59.0834 18176 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
20:29:59.0881 18176 CLFS - ok
20:30:00.0021 18176 [ B30A02EBC936B0F270E77D72F7C839CC ] CLHNServiceForPowerDVD12 C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
20:30:00.0052 18176 CLHNServiceForPowerDVD12 - ok
20:30:00.0130 18176 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:30:00.0146 18176 clr_optimization_v2.0.50727_32 - ok
20:30:00.0208 18176 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:30:00.0224 18176 clr_optimization_v2.0.50727_64 - ok
20:30:00.0333 18176 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:30:00.0349 18176 clr_optimization_v4.0.30319_32 - ok
20:30:00.0380 18176 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:30:00.0411 18176 clr_optimization_v4.0.30319_64 - ok
20:30:00.0458 18176 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:30:00.0505 18176 CmBatt - ok
20:30:00.0536 18176 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:30:00.0567 18176 cmdide - ok
20:30:00.0629 18176 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
20:30:00.0692 18176 CNG - ok
20:30:00.0723 18176 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
20:30:00.0754 18176 Compbatt - ok
20:30:00.0785 18176 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
20:30:00.0832 18176 CompositeBus - ok
20:30:00.0848 18176 COMSysApp - ok
20:30:00.0863 18176 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
20:30:00.0895 18176 crcdisk - ok
20:30:00.0926 18176 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:30:01.0004 18176 CryptSvc - ok
20:30:01.0082 18176 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
20:30:01.0144 18176 cvhsvc - ok
20:30:01.0222 18176 [ 1353959C5DC99FD81945D9424BFFD47E ] CyberLink PowerDVD 12 Media Server Monitor Service C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
20:30:01.0253 18176 CyberLink PowerDVD 12 Media Server Monitor Service - ok
20:30:01.0285 18176 [ 1F506193CC8F96600285277B455882BA ] CyberLink PowerDVD 12 Media Server Service C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
20:30:01.0316 18176 CyberLink PowerDVD 12 Media Server Service - ok
20:30:01.0378 18176 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:30:01.0519 18176 DcomLaunch - ok
20:30:01.0565 18176 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
20:30:01.0690 18176 defragsvc - ok
20:30:01.0721 18176 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:30:01.0815 18176 DfsC - ok
20:30:01.0862 18176 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
20:30:01.0924 18176 Dhcp - ok
20:30:01.0955 18176 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
20:30:02.0080 18176 discache - ok
20:30:02.0127 18176 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
20:30:02.0158 18176 Disk - ok
20:30:02.0205 18176 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:30:02.0267 18176 Dnscache - ok
20:30:02.0314 18176 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
20:30:02.0439 18176 dot3svc - ok
20:30:02.0455 18176 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
20:30:02.0564 18176 DPS - ok
20:30:02.0611 18176 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:30:02.0657 18176 drmkaud - ok
20:30:02.0704 18176 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:30:02.0798 18176 DXGKrnl - ok
20:30:02.0829 18176 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
20:30:02.0938 18176 EapHost - ok
20:30:03.0047 18176 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
20:30:03.0219 18176 ebdrv - ok
20:30:03.0266 18176 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
20:30:03.0328 18176 EFS - ok
20:30:03.0406 18176 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:30:03.0484 18176 ehRecvr - ok
20:30:03.0500 18176 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
20:30:03.0562 18176 ehSched - ok
20:30:03.0625 18176 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
20:30:03.0671 18176 elxstor - ok
20:30:03.0687 18176 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:30:03.0749 18176 ErrDev - ok
20:30:03.0796 18176 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
20:30:03.0921 18176 EventSystem - ok
20:30:03.0952 18176 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
20:30:04.0046 18176 exfat - ok
20:30:04.0108 18176 Fabs - ok
20:30:04.0139 18176 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:30:04.0249 18176 fastfat - ok
20:30:04.0280 18176 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
20:30:04.0373 18176 Fax - ok
20:30:04.0389 18176 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
20:30:04.0436 18176 fdc - ok
20:30:04.0483 18176 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
20:30:04.0592 18176 fdPHost - ok
20:30:04.0607 18176 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
20:30:04.0717 18176 FDResPub - ok
20:30:04.0763 18176 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:30:04.0795 18176 FileInfo - ok
20:30:04.0810 18176 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:30:04.0919 18176 Filetrace - ok
20:30:05.0029 18176 [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
20:30:05.0185 18176 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
20:30:05.0185 18176 FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
20:30:05.0216 18176 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
20:30:05.0263 18176 flpydisk - ok
20:30:05.0294 18176 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:30:05.0325 18176 FltMgr - ok
20:30:05.0403 18176 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll
20:30:05.0512 18176 FontCache - ok
20:30:05.0575 18176 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:30:05.0606 18176 FontCache3.0.0.0 - ok
20:30:05.0621 18176 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:30:05.0653 18176 FsDepends - ok
20:30:05.0699 18176 [ 07DA62C960DDCCC2D35836AEAB4FC578 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys
20:30:05.0731 18176 fssfltr - ok
20:30:05.0809 18176 [ 28DDEEEC44E988657B732CF404D504CB ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
20:30:05.0887 18176 fsssvc - ok
20:30:05.0933 18176 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:30:05.0965 18176 Fs_Rec - ok
20:30:06.0011 18176 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:30:06.0043 18176 fvevol - ok
20:30:06.0058 18176 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
20:30:06.0089 18176 gagp30kx - ok
20:30:06.0152 18176 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\Drivers\GEARAspiWDM.sys
20:30:06.0167 18176 GEARAspiWDM - ok
20:30:06.0214 18176 [ 82BDA5A345206271D582E42951290AAF ] GFilterSvc C:\Windows\System32\GFilterSvc.exe
20:30:06.0261 18176 GFilterSvc ( UnsignedFile.Multi.Generic ) - warning
20:30:06.0261 18176 GFilterSvc - detected UnsignedFile.Multi.Generic (1)
20:30:06.0323 18176 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
20:30:06.0433 18176 gpsvc - ok
20:30:06.0479 18176 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:30:06.0542 18176 hcw85cir - ok
20:30:06.0589 18176 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:30:06.0651 18176 HdAudAddService - ok
20:30:06.0698 18176 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
20:30:06.0760 18176 HDAudBus - ok
20:30:06.0776 18176 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
20:30:06.0823 18176 HidBatt - ok
20:30:06.0854 18176 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
20:30:06.0901 18176 HidBth - ok
20:30:06.0947 18176 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys
20:30:06.0979 18176 HidIr - ok
20:30:07.0010 18176 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
20:30:07.0103 18176 hidserv - ok
20:30:07.0135 18176 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:30:07.0181 18176 HidUsb - ok
20:30:07.0213 18176 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:30:07.0337 18176 hkmsvc - ok
20:30:07.0353 18176 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:30:07.0431 18176 HomeGroupListener - ok
20:30:07.0462 18176 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:30:07.0525 18176 HomeGroupProvider - ok
20:30:07.0556 18176 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:30:07.0571 18176 HpSAMD - ok
20:30:07.0618 18176 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:30:07.0743 18176 HTTP - ok
20:30:07.0774 18176 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:30:07.0790 18176 hwpolicy - ok
20:30:07.0821 18176 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
20:30:07.0852 18176 i8042prt - ok
20:30:07.0915 18176 [ 26CF4275034214ECEDD8EC17B0A18A99 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
20:30:07.0961 18176 iaStor - ok
20:30:08.0008 18176 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:30:08.0039 18176 iaStorV - ok
20:30:08.0117 18176 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:30:08.0164 18176 idsvc - ok
20:30:08.0507 18176 [ 0D1B8C64BDF0E5CDC523A1409FFB5EF0 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
20:30:09.0069 18176 igfx - ok
20:30:09.0116 18176 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
20:30:09.0131 18176 iirsp - ok
20:30:09.0178 18176 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
20:30:09.0319 18176 IKEEXT - ok
20:30:09.0443 18176 [ 8E05ADB4B809B478B2EC65A1A1633DEB ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:30:09.0615 18176 IntcAzAudAddService - ok
20:30:09.0646 18176 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
20:30:09.0662 18176 intelide - ok
20:30:09.0693 18176 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:30:09.0740 18176 intelppm - ok
20:30:09.0787 18176 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:30:09.0880 18176 IPBusEnum - ok
20:30:09.0927 18176 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:30:10.0036 18176 IpFilterDriver - ok
20:30:10.0099 18176 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:30:10.0145 18176 iphlpsvc - ok
20:30:10.0177 18176 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:30:10.0223 18176 IPMIDRV - ok
20:30:10.0255 18176 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:30:10.0379 18176 IPNAT - ok
20:30:10.0457 18176 [ 6E50CFA46527B39015B750AAD161C5CC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
20:30:10.0504 18176 iPod Service - ok
20:30:10.0551 18176 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:30:10.0660 18176 IRENUM - ok
20:30:10.0676 18176 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:30:10.0707 18176 isapnp - ok
20:30:10.0738 18176 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:30:10.0769 18176 iScsiPrt - ok
20:30:10.0801 18176 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:30:10.0832 18176 kbdclass - ok
20:30:10.0847 18176 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:30:10.0894 18176 kbdhid - ok
20:30:10.0957 18176 [ E63EF8C3271D014F14E2469CE75FECB4 ] kbfiltr C:\Windows\system32\DRIVERS\kbfiltr.sys
20:30:10.0988 18176 kbfiltr - ok
20:30:11.0003 18176 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
20:30:11.0035 18176 KeyIso - ok
20:30:11.0081 18176 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:30:11.0097 18176 KSecDD - ok
20:30:11.0159 18176 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:30:11.0191 18176 KSecPkg - ok
20:30:11.0222 18176 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
20:30:11.0331 18176 ksthunk - ok
20:30:11.0362 18176 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
20:30:11.0503 18176 KtmRm - ok
20:30:11.0549 18176 [ A4A9CA24E54E81C6C3E469EAEB4B3F42 ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
20:30:11.0581 18176 L1C - ok
20:30:11.0627 18176 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
20:30:11.0721 18176 LanmanServer - ok
20:30:11.0737 18176 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:30:11.0846 18176 LanmanWorkstation - ok
20:30:11.0908 18176 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:30:12.0017 18176 lltdio - ok
20:30:12.0049 18176 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:30:12.0189 18176 lltdsvc - ok
20:30:12.0220 18176 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:30:12.0314 18176 lmhosts - ok
20:30:12.0407 18176 [ 0803906D607A9B83184447B75B60ECC2 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:30:12.0454 18176 LMS - ok
20:30:12.0517 18176 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
20:30:12.0548 18176 LSI_FC - ok
20:30:12.0563 18176 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
20:30:12.0579 18176 LSI_SAS - ok
20:30:12.0595 18176 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
20:30:12.0626 18176 LSI_SAS2 - ok
20:30:12.0641 18176 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
20:30:12.0673 18176 LSI_SCSI - ok
20:30:12.0704 18176 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
20:30:12.0813 18176 luafv - ok
20:30:12.0860 18176 [ 92EB844D90615CB266F84C3202B8786E ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
20:30:12.0891 18176 MBAMProtector - ok
20:30:12.0969 18176 [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
20:30:13.0000 18176 MBAMScheduler - ok
20:30:13.0031 18176 [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
20:30:13.0078 18176 MBAMService - ok
20:30:13.0094 18176 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:30:13.0156 18176 Mcx2Svc - ok
20:30:13.0187 18176 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
20:30:13.0203 18176 megasas - ok
20:30:13.0250 18176 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
20:30:13.0297 18176 MegaSR - ok
20:30:13.0328 18176 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
20:30:13.0359 18176 MEIx64 - ok
20:30:13.0390 18176 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
20:30:13.0515 18176 MMCSS - ok
20:30:13.0531 18176 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
20:30:13.0655 18176 Modem - ok
20:30:13.0687 18176 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:30:13.0733 18176 monitor - ok
20:30:13.0765 18176 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:30:13.0796 18176 mouclass - ok
20:30:13.0827 18176 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:30:13.0874 18176 mouhid - ok
20:30:13.0889 18176 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:30:13.0921 18176 mountmgr - ok
20:30:13.0952 18176 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
20:30:13.0983 18176 mpio - ok
20:30:13.0999 18176 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:30:14.0108 18176 mpsdrv - ok
20:30:14.0170 18176 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:30:14.0295 18176 MpsSvc - ok
20:30:14.0326 18176 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:30:14.0389 18176 MRxDAV - ok
20:30:14.0435 18176 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:30:14.0498 18176 mrxsmb - ok
20:30:14.0513 18176 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:30:14.0560 18176 mrxsmb10 - ok
20:30:14.0591 18176 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:30:14.0654 18176 mrxsmb20 - ok
20:30:14.0685 18176 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
20:30:14.0716 18176 msahci - ok
20:30:14.0732 18176 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:30:14.0763 18176 msdsm - ok
20:30:14.0779 18176 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
20:30:14.0841 18176 MSDTC - ok
20:30:14.0857 18176 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:30:14.0950 18176 Msfs - ok
20:30:14.0966 18176 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:30:15.0075 18176 mshidkmdf - ok
20:30:15.0091 18176 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:30:15.0122 18176 msisadrv - ok
20:30:15.0153 18176 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:30:15.0262 18176 MSiSCSI - ok
20:30:15.0278 18176 msiserver - ok
20:30:15.0293 18176 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:30:15.0403 18176 MSKSSRV - ok
20:30:15.0418 18176 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:30:15.0527 18176 MSPCLOCK - ok
20:30:15.0574 18176 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:30:15.0668 18176 MSPQM - ok
20:30:15.0715 18176 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:30:15.0746 18176 MsRPC - ok
20:30:15.0761 18176 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
20:30:15.0793 18176 mssmbios - ok
20:30:15.0808 18176 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:30:15.0917 18176 MSTEE - ok
20:30:15.0933 18176 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
20:30:15.0980 18176 MTConfig - ok
20:30:16.0011 18176 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
20:30:16.0027 18176 Mup - ok
20:30:16.0073 18176 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
20:30:16.0198 18176 napagent - ok
20:30:16.0229 18176 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:30:16.0307 18176 NativeWifiP - ok
20:30:16.0354 18176 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
20:30:16.0432 18176 NDIS - ok
20:30:16.0463 18176 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:30:16.0588 18176 NdisCap - ok
20:30:16.0619 18176 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:30:16.0713 18176 NdisTapi - ok
20:30:16.0744 18176 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:30:16.0838 18176 Ndisuio - ok
20:30:16.0869 18176 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:30:16.0978 18176 NdisWan - ok
20:30:17.0009 18176 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:30:17.0119 18176 NDProxy - ok
20:30:17.0150 18176 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:30:17.0259 18176 NetBIOS - ok
20:30:17.0275 18176 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:30:17.0384 18176 NetBT - ok
20:30:17.0399 18176 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
20:30:17.0431 18176 Netlogon - ok
20:30:17.0477 18176 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
20:30:17.0618 18176 Netman - ok
20:30:17.0633 18176 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
20:30:17.0743 18176 netprofm - ok
20:30:17.0789 18176 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:30:17.0805 18176 NetTcpPortSharing - ok
20:30:17.0852 18176 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
20:30:17.0883 18176 nfrd960 - ok
20:30:17.0945 18176 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:30:17.0992 18176 NlaSvc - ok
20:30:18.0055 18176 [ 907B5E1E4A592E5EDC5E4CCBDE4863C2 ] nmwcd C:\Windows\system32\drivers\ccdcmbx64.sys
20:30:18.0148 18176 nmwcd - ok
20:30:18.0164 18176 [ 41C1AC1F3613435EB32D67BCB80A5FA5 ] nmwcdc C:\Windows\system32\drivers\ccdcmbox64.sys
20:30:18.0242 18176 nmwcdc - ok
20:30:18.0257 18176 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:30:18.0367 18176 Npfs - ok
20:30:18.0413 18176 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
20:30:18.0507 18176 nsi - ok
20:30:18.0554 18176 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:30:18.0647 18176 nsiproxy - ok
20:30:18.0725 18176 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:30:18.0835 18176 Ntfs - ok
20:30:18.0881 18176 [ A773AA47341A1FD16C6A9BA3C11D7DAA ] ntk_PowerDVD12 C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys
20:30:18.0913 18176 ntk_PowerDVD12 - ok
20:30:18.0928 18176 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
20:30:19.0037 18176 Null - ok
20:30:19.0443 18176 [ A8F3E9F102F46D01267056E03CEE6744 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:30:20.0083 18176 nvlddmkm - ok
20:30:20.0176 18176 [ 41C8AEC2CCDCCE52C12E6FD6B90E555F ] nvpciflt C:\Windows\system32\DRIVERS\nvpciflt.sys
20:30:20.0192 18176 nvpciflt - ok
20:30:20.0223 18176 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:30:20.0239 18176 nvraid - ok
20:30:20.0270 18176 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:30:20.0301 18176 nvstor - ok
20:30:20.0332 18176 [ 2E7735E9FDF8B76B38C87249BC4651B9 ] NVSvc C:\Windows\system32\nvvsvc.exe
20:30:20.0426 18176 NVSvc - ok
20:30:20.0519 18176 [ 3A54C8BEC8422871C843ADAB548E16A7 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
20:30:20.0629 18176 nvUpdatusService - ok
20:30:20.0660 18176 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:30:20.0675 18176 nv_agp - ok
20:30:20.0707 18176 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:30:20.0753 18176 ohci1394 - ok
20:30:20.0800 18176 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:30:20.0816 18176 ose - ok
20:30:21.0003 18176 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
20:30:21.0221 18176 osppsvc - ok
20:30:21.0268 18176 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:30:21.0346 18176 p2pimsvc - ok
20:30:21.0377 18176 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
20:30:21.0440 18176 p2psvc - ok
20:30:21.0487 18176 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
20:30:21.0533 18176 Parport - ok
20:30:21.0565 18176 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:30:21.0596 18176 partmgr - ok
20:30:21.0611 18176 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:30:21.0689 18176 PcaSvc - ok
20:30:21.0721 18176 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
20:30:21.0752 18176 pci - ok
20:30:21.0783 18176 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
20:30:21.0799 18176 pciide - ok
20:30:21.0830 18176 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
20:30:21.0861 18176 pcmcia - ok
20:30:21.0877 18176 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
20:30:21.0908 18176 pcw - ok
20:30:21.0955 18176 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:30:22.0064 18176 PEAUTH - ok
20:30:22.0173 18176 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
20:30:22.0220 18176 PerfHost - ok
20:30:22.0298 18176 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
20:30:22.0469 18176 pla - ok
20:30:22.0547 18176 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:30:22.0625 18176 PlugPlay - ok
20:30:22.0641 18176 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:30:22.0688 18176 PNRPAutoReg - ok
20:30:22.0719 18176 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:30:22.0750 18176 PNRPsvc - ok
20:30:22.0781 18176 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:30:22.0906 18176 PolicyAgent - ok
20:30:22.0953 18176 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
20:30:23.0078 18176 Power - ok
20:30:23.0125 18176 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:30:23.0234 18176 PptpMiniport - ok
20:30:23.0265 18176 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
20:30:23.0312 18176 Processor - ok
20:30:23.0359 18176 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
20:30:23.0437 18176 ProfSvc - ok
20:30:23.0437 18176 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:30:23.0468 18176 ProtectedStorage - ok
20:30:23.0499 18176 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:30:23.0608 18176 Psched - ok
20:30:23.0686 18176 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
20:30:23.0795 18176 ql2300 - ok
20:30:23.0811 18176 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
20:30:23.0842 18176 ql40xx - ok
20:30:23.0873 18176 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
20:30:23.0920 18176 QWAVE - ok
20:30:23.0936 18176 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:30:23.0998 18176 QWAVEdrv - ok
20:30:24.0029 18176 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:30:24.0123 18176 RasAcd - ok
20:30:24.0185 18176 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:30:24.0263 18176 RasAgileVpn - ok
20:30:24.0310 18176 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
20:30:24.0419 18176 RasAuto - ok
20:30:24.0451 18176 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:30:24.0575 18176 Rasl2tp - ok
20:30:24.0607 18176 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
20:30:24.0716 18176 RasMan - ok
20:30:24.0747 18176 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:30:24.0856 18176 RasPppoe - ok
20:30:24.0887 18176 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:30:24.0981 18176 RasSstp - ok
20:30:25.0012 18176 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:30:25.0121 18176 rdbss - ok
20:30:25.0168 18176 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys
20:30:25.0199 18176 rdpbus - ok
20:30:25.0215 18176 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:30:25.0324 18176 RDPCDD - ok
20:30:25.0340 18176 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:30:25.0433 18176 RDPENCDD - ok
20:30:25.0449 18176 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:30:25.0543 18176 RDPREFMP - ok
20:30:25.0589 18176 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:30:25.0652 18176 RDPWD - ok
20:30:25.0683 18176 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:30:25.0714 18176 rdyboost - ok
20:30:25.0745 18176 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:30:25.0839 18176 RemoteAccess - ok
20:30:25.0886 18176 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:30:25.0995 18176 RemoteRegistry - ok
20:30:26.0042 18176 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
20:30:26.0089 18176 RFCOMM - ok
20:30:26.0198 18176 [ A2FF4C5EC45A9F6051B9D591F364C3A8 ] RichVideo C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
20:30:26.0213 18176 RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:30:26.0213 18176 RichVideo - detected UnsignedFile.Multi.Generic (1)
20:30:26.0260 18176 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:30:26.0354 18176 RpcEptMapper - ok
20:30:26.0401 18176 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
20:30:26.0432 18176 RpcLocator - ok
20:30:26.0479 18176 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
20:30:26.0572 18176 RpcSs - ok
20:30:26.0619 18176 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:30:26.0697 18176 rspndr - ok
20:30:26.0713 18176 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
20:30:26.0744 18176 SamSs - ok
20:30:26.0759 18176 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:30:26.0791 18176 sbp2port - ok
20:30:26.0822 18176 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:30:26.0947 18176 SCardSvr - ok
20:30:26.0962 18176 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:30:27.0056 18176 scfilter - ok
20:30:27.0103 18176 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
20:30:27.0259 18176 Schedule - ok
20:30:27.0290 18176 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:30:27.0383 18176 SCPolicySvc - ok
20:30:27.0415 18176 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:30:27.0477 18176 SDRSVC - ok
20:30:27.0493 18176 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:30:27.0602 18176 secdrv - ok
20:30:27.0649 18176 [ F93643E1FC7D1059CE69CFE741F5658F ] secinitd C:\Windows\system32\d3dxof64.exe
20:30:27.0680 18176 secinitd ( UnsignedFile.Multi.Generic ) - warning
20:30:27.0680 18176 secinitd - detected UnsignedFile.Multi.Generic (1)
20:30:27.0711 18176 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
20:30:27.0820 18176 seclogon - ok
20:30:27.0851 18176 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
20:30:27.0961 18176 SENS - ok
20:30:27.0976 18176 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:30:28.0023 18176 SensrSvc - ok
20:30:28.0054 18176 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys
20:30:28.0101 18176 Serenum - ok
20:30:28.0132 18176 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys
20:30:28.0179 18176 Serial - ok
20:30:28.0210 18176 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
20:30:28.0241 18176 sermouse - ok
20:30:28.0288 18176 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
20:30:28.0397 18176 SessionEnv - ok
20:30:28.0413 18176 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:30:28.0475 18176 sffdisk - ok
20:30:28.0491 18176 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:30:28.0538 18176 sffp_mmc - ok
20:30:28.0569 18176 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:30:28.0600 18176 sffp_sd - ok
20:30:28.0616 18176 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
20:30:28.0663 18176 sfloppy - ok
20:30:28.0709 18176 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys
20:30:28.0772 18176 Sftfs - ok
20:30:28.0819 18176 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
20:30:28.0865 18176 sftlist - ok
20:30:28.0881 18176 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys
20:30:28.0912 18176 Sftplay - ok
20:30:28.0943 18176 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys
20:30:28.0975 18176 Sftredir - ok
20:30:28.0990 18176 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys
20:30:29.0006 18176 Sftvol - ok
20:30:29.0037 18176 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
20:30:29.0068 18176 sftvsa - ok
20:30:29.0099 18176 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:30:29.0209 18176 SharedAccess - ok
20:30:29.0255 18176 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:30:29.0365 18176 ShellHWDetection - ok
20:30:29.0396 18176 [ 1BC348CF6BAA90EC8E533EF6E6A69933 ] SiSGbeLH C:\Windows\system32\DRIVERS\SiSG664.sys
20:30:29.0443 18176 SiSGbeLH - ok
20:30:29.0489 18176 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
20:30:29.0521 18176 SiSRaid2 - ok
20:30:29.0536 18176 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
20:30:29.0567 18176 SiSRaid4 - ok
20:30:29.0567 18176 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:30:29.0677 18176 Smb - ok
20:30:29.0723 18176 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:30:29.0786 18176 SNMPTRAP - ok
20:30:29.0833 18176 [ 0416266CCBC2B95EAE2C6E0AA5D228FD ] Splashtop MDES C:\ASUS.SYS\SIONExportService.exe
20:30:29.0879 18176 Splashtop MDES - ok
20:30:29.0895 18176 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
20:30:29.0911 18176 spldr - ok
20:30:29.0957 18176 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
20:30:30.0035 18176 Spooler - ok
20:30:30.0145 18176 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
20:30:30.0379 18176 sppsvc - ok
20:30:30.0410 18176 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:30:30.0503 18176 sppuinotify - ok
20:30:30.0550 18176 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
20:30:30.0613 18176 srv - ok
20:30:30.0659 18176 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:30:30.0706 18176 srv2 - ok
20:30:30.0737 18176 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:30:30.0784 18176 srvnet - ok
20:30:30.0831 18176 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:30:30.0940 18176 SSDPSRV - ok
20:30:30.0956 18176 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:30:31.0065 18176 SstpSvc - ok
20:30:31.0127 18176 [ FE94191F59D5678CF2BC47959F4214FB ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
20:30:31.0159 18176 Stereo Service - ok
20:30:31.0190 18176 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
20:30:31.0221 18176 stexstor - ok
20:30:31.0283 18176 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
20:30:31.0361 18176 stisvc - ok
20:30:31.0377 18176 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
20:30:31.0408 18176 swenum - ok
20:30:31.0439 18176 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
20:30:31.0564 18176 swprv - ok
20:30:31.0658 18176 [ 7E8902F9929A5D9FFD0F545332CE0F10 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
20:30:31.0751 18176 SynTP - ok
20:30:31.0829 18176 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
20:30:31.0954 18176 SysMain - ok
20:30:31.0985 18176 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:30:32.0063 18176 TabletInputService - ok
20:30:32.0079 18176 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
20:30:32.0204 18176 TapiSrv - ok
20:30:32.0219 18176 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
20:30:32.0329 18176 TBS - ok
20:30:32.0438 18176 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:30:32.0563 18176 Tcpip - ok
20:30:32.0625 18176 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:30:32.0734 18176 TCPIP6 - ok
20:30:32.0781 18176 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:30:32.0812 18176 tcpipreg - ok
20:30:32.0843 18176 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:30:32.0906 18176 TDPIPE - ok
20:30:32.0937 18176 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:30:32.0968 18176 TDTCP - ok
20:30:32.0999 18176 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:30:33.0109 18176 tdx - ok
20:30:33.0124 18176 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
20:30:33.0155 18176 TermDD - ok
20:30:33.0202 18176 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
20:30:33.0343 18176 TermService - ok
20:30:33.0358 18176 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
20:30:33.0405 18176 Themes - ok
20:30:33.0421 18176 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
20:30:33.0514 18176 THREADORDER - ok
20:30:33.0530 18176 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
20:30:33.0639 18176 TrkWks - ok
20:30:33.0701 18176 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:30:33.0811 18176 TrustedInstaller - ok
20:30:33.0857 18176 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:30:33.0967 18176 tssecsrv - ok
20:30:33.0998 18176 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:30:34.0060 18176 TsUsbFlt - ok
20:30:34.0076 18176 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
20:30:34.0107 18176 TsUsbGD - ok
20:30:34.0138 18176 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:30:34.0232 18176 tunnel - ok
20:30:34.0294 18176 [ B355581A9DA34C92E2DBAFA410D2F829 ] TurboB C:\Windows\system32\DRIVERS\TurboB.sys
20:30:34.0325 18176 TurboB - ok
20:30:34.0372 18176 [ 6564E84B1522C12EA1C3A181ED03276F ] TurboBoost C:\Program Files\Intel\TurboBoost\TurboBoost.exe
20:30:34.0388 18176 TurboBoost - ok
20:30:34.0403 18176 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
20:30:34.0435 18176 uagp35 - ok
20:30:34.0466 18176 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:30:34.0591 18176 udfs - ok
20:30:34.0637 18176 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:30:34.0684 18176 UI0Detect - ok
20:30:34.0715 18176 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:30:34.0747 18176 uliagpkx - ok
20:30:34.0778 18176 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:30:34.0825 18176 umbus - ok
20:30:34.0840 18176 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
20:30:34.0887 18176 UmPass - ok
20:30:35.0059 18176 [ EB79C6C91A99930015EF29AE7FA802D1 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:30:35.0183 18176 UNS - ok
20:30:35.0230 18176 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
20:30:35.0355 18176 upnphost - ok
20:30:35.0402 18176 [ 4E93C8496359E97830C75AC36393654D ] upperdev C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys
20:30:35.0480 18176 upperdev - ok
20:30:35.0511 18176 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:30:35.0589 18176 usbccgp - ok
20:30:35.0636 18176 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:30:35.0683 18176 usbcir - ok
20:30:35.0698 18176 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
20:30:35.0729 18176 usbehci - ok
20:30:35.0776 18176 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:30:35.0807 18176 usbhub - ok
20:30:35.0839 18176 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:30:35.0885 18176 usbohci - ok
20:30:35.0917 18176 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:30:35.0979 18176 usbprint - ok
20:30:36.0010 18176 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:30:36.0073 18176 usbscan - ok
20:30:36.0119 18176 [ 4ACEE387FA8FD39F83564FCD2FC234F2 ] usbser C:\Windows\system32\drivers\usbser.sys
20:30:36.0182 18176 usbser - ok
20:30:36.0213 18176 [ 8844CB19A37B65E27049D4A7786726A9 ] UsbserFilt C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys
20:30:36.0275 18176 UsbserFilt - ok
20:30:36.0307 18176 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:30:36.0353 18176 USBSTOR - ok
20:30:36.0385 18176 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:30:36.0431 18176 usbuhci - ok
20:30:36.0494 18176 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
20:30:36.0541 18176 usbvideo - ok
20:30:36.0587 18176 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
20:30:36.0681 18176 UxSms - ok
20:30:36.0697 18176 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
20:30:36.0728 18176 VaultSvc - ok
20:30:36.0759 18176 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:30:36.0775 18176 vdrvroot - ok
20:30:36.0806 18176 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
20:30:36.0931 18176 vds - ok
20:30:36.0977 18176 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:30:37.0009 18176 vga - ok
20:30:37.0024 18176 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
20:30:37.0133 18176 VgaSave - ok
20:30:37.0165 18176 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:30:37.0196 18176 vhdmp - ok
20:30:37.0227 18176 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
20:30:37.0258 18176 viaide - ok
20:30:37.0274 18176 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:30:37.0289 18176 volmgr - ok
20:30:37.0321 18176 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:30:37.0367 18176 volmgrx - ok
20:30:37.0383 18176 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:30:37.0414 18176 volsnap - ok
20:30:37.0445 18176 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
20:30:37.0492 18176 vsmraid - ok
20:30:37.0555 18176 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
20:30:37.0726 18176 VSS - ok
20:30:37.0742 18176 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
20:30:37.0804 18176 vwifibus - ok
20:30:37.0820 18176 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
20:30:37.0882 18176 vwififlt - ok
20:30:37.0913 18176 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
20:30:38.0023 18176 W32Time - ok
20:30:38.0069 18176 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
20:30:38.0116 18176 WacomPen - ok
20:30:38.0147 18176 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:30:38.0257 18176 WANARP - ok
20:30:38.0257 18176 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:30:38.0350 18176 Wanarpv6 - ok
20:30:38.0413 18176 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
20:30:38.0537 18176 wbengine - ok
20:30:38.0569 18176 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:30:38.0647 18176 WbioSrvc - ok
20:30:38.0678 18176 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:30:38.0740 18176 wcncsvc - ok
20:30:38.0771 18176 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:30:38.0849 18176 WcsPlugInService - ok
20:30:38.0865 18176 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
20:30:38.0881 18176 Wd - ok
20:30:38.0943 18176 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:30:39.0005 18176 Wdf01000 - ok
20:30:39.0037 18176 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:30:39.0146 18176 WdiServiceHost - ok
20:30:39.0161 18176 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:30:39.0193 18176 WdiSystemHost - ok
20:30:39.0224 18176 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
20:30:39.0302 18176 WebClient - ok
20:30:39.0333 18176 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:30:39.0442 18176 Wecsvc - ok
20:30:39.0473 18176 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:30:39.0583 18176 wercplsupport - ok
20:30:39.0629 18176 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
20:30:39.0723 18176 WerSvc - ok
20:30:39.0770 18176 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:30:39.0863 18176 WfpLwf - ok
20:30:39.0910 18176 [ 52DED146E4797E6CCF94799E8E22BB2A ] WimFltr C:\Windows\system32\DRIVERS\wimfltr.sys
20:30:39.0941 18176 WimFltr - ok
20:30:39.0988 18176 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:30:40.0004 18176 WIMMount - ok
20:30:40.0035 18176 WinDefend - ok
20:30:40.0035 18176 WinHttpAutoProxySvc - ok
20:30:40.0097 18176 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:30:40.0191 18176 Winmgmt - ok
20:30:40.0285 18176 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
20:30:40.0472 18176 WinRM - ok
20:30:40.0534 18176 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
20:30:40.0565 18176 WinUsb - ok
20:30:40.0628 18176 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
20:30:40.0706 18176 Wlansvc - ok
20:30:40.0768 18176 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
20:30:40.0784 18176 wlcrasvc - ok
20:30:40.0924 18176 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:30:41.0033 18176 wlidsvc - ok
20:30:41.0065 18176 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
20:30:41.0111 18176 WmiAcpi - ok
20:30:41.0158 18176 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:30:41.0221 18176 wmiApSrv - ok
20:30:41.0252 18176 WMPNetworkSvc - ok
20:30:41.0283 18176 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:30:41.0330 18176 WPCSvc - ok
20:30:41.0345 18176 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:30:41.0423 18176 WPDBusEnum - ok
20:30:41.0455 18176 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:30:41.0548 18176 ws2ifsl - ok
20:30:41.0564 18176 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
20:30:41.0626 18176 wscsvc - ok
20:30:41.0642 18176 WSearch - ok
20:30:41.0735 18176 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
20:30:41.0891 18176 wuauserv - ok
20:30:41.0938 18176 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:30:41.0985 18176 WudfPf - ok
20:30:42.0032 18176 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:30:42.0079 18176 WUDFRd - ok
20:30:42.0110 18176 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:30:42.0157 18176 wudfsvc - ok
20:30:42.0188 18176 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
20:30:42.0250 18176 WwanSvc - ok
20:30:42.0391 18176 [ 6F610F00DC6B4489811EDCBC76D3EBA6 ] {73526619-C24F-470B-9BED-53D455FBB5C6} C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl
20:30:42.0422 18176 {73526619-C24F-470B-9BED-53D455FBB5C6} - ok
20:30:42.0437 18176 ================ Scan global ===============================
20:30:42.0469 18176 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:30:42.0500 18176 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
20:30:42.0531 18176 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
20:30:42.0562 18176 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:30:42.0593 18176 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:30:42.0609 18176 [Global] - ok
20:30:42.0609 18176 ================ Scan MBR ==================================
20:30:42.0625 18176 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:30:43.0046 18176 \Device\Harddisk0\DR0 - ok
20:30:43.0046 18176 ================ Scan VBR ==================================
20:30:43.0093 18176 [ 82C73B2981E7BB19C9C742E161526525 ] \Device\Harddisk0\DR0\Partition1
20:30:43.0108 18176 \Device\Harddisk0\DR0\Partition1 - ok
20:30:43.0124 18176 [ 9E8EC3F5B27C020D3BB5E91F59116F4B ] \Device\Harddisk0\DR0\Partition2
20:30:43.0124 18176 \Device\Harddisk0\DR0\Partition2 - ok
20:30:43.0139 18176 ============================================================
20:30:43.0139 18176 Scan finished
20:30:43.0139 18176 ============================================================
20:30:43.0155 18304 Detected object count: 4
20:30:43.0155 18304 Actual detected object count: 4
20:33:17.0985 18304 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
20:33:17.0985 18304 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:33:18.0001 18304 GFilterSvc ( UnsignedFile.Multi.Generic ) - skipped by user
20:33:18.0001 18304 GFilterSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:33:18.0001 18304 RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:33:18.0001 18304 RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:33:18.0001 18304 secinitd ( UnsignedFile.Multi.Generic ) - skipped by user
20:33:18.0001 18304 secinitd ( UnsignedFile.Multi.Generic ) - User select action: Skip
Esmeralda |
|
12.03.2013, 23:46
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.03.2013, 17:56
| #13 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus, hier das Log zu ComboFix: Code:
ATTFilter ComboFix 13-03-13.01 - Maria Wohlfarth 13.03.2013 17:15:32.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8096.6014 [GMT 1:00]
ausgeführt von:: c:\users\Aquaria.MariasRechner\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Aquaria.MariasRechner\4.0
c:\users\Aquaria.MariasRechner\Documents\~WRL1882.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-02-13 bis 2013-03-13 ))))))))))))))))))))))))))))))
.
.
2013-03-13 16:24 . 2013-03-13 16:24 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-03-12 08:21 . 2013-02-19 02:57 9162192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AD3A3B2B-C019-4045-9533-381CA11B0F80}\mpengine.dll
2013-03-05 21:57 . 2013-03-05 21:57 388096 ----a-r- c:\users\Maria Wohlfarth\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-03-05 21:57 . 2013-03-05 21:57 -------- d-----w- c:\program files (x86)\Trend Micro
2013-03-05 12:50 . 2013-03-05 12:50 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Local\Programs
2013-03-05 03:43 . 2011-10-07 09:49 2770944 ----a-w- c:\windows\system32\drivers\athrx.sys
2013-03-04 23:11 . 2013-03-04 23:11 -------- d-----w- c:\program files (x86)\ESET
2013-03-03 21:06 . 2013-03-03 21:06 -------- d-----w- c:\windows\system32\IO
2013-02-28 15:44 . 2013-02-28 15:45 -------- d-----w- c:\users\Aquaria.MariasRechner\.tfo4
2013-02-26 21:15 . 2013-02-26 21:15 -------- d-----w- c:\program files (x86)\DivX
2013-02-26 21:08 . 2013-02-26 21:08 -------- d-----w- c:\users\Aquaria.MariasRechner\AppData\Local\MediaServer
2013-02-26 21:05 . 2013-02-26 21:05 -------- d-----w- C:\MediaServer
2013-02-26 21:05 . 2013-02-26 21:05 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Local\MediaServer
2013-02-26 21:05 . 2013-02-26 21:05 -------- d-----w- c:\programdata\PDVD
2013-02-26 20:59 . 2013-02-26 20:59 -------- d-----w- c:\programdata\install_clap
2013-02-26 01:10 . 2013-02-26 01:29 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Roaming\Wise Disk Cleaner
2013-02-26 01:09 . 2013-02-26 01:09 -------- d-----w- c:\program files (x86)\Wise
2013-02-25 23:16 . 2013-02-25 23:16 -------- d-----w- c:\programdata\Babylon
2013-02-25 23:16 . 2013-02-25 23:16 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Roaming\Babylon
2013-02-25 23:16 . 2013-02-25 23:16 119808 ----a-w- c:\windows\system32\GFilterSvc.exe
2013-02-25 23:16 . 2011-05-13 12:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2013-02-25 23:16 . 2011-03-25 20:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2013-02-25 23:16 . 2013-02-25 23:16 118272 ----a-w- c:\windows\system32\d3dxof64.exe
2013-02-25 23:16 . 2013-02-25 23:16 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Roaming\DesktopIconForAmazon
2013-02-25 23:16 . 2013-02-25 23:16 -------- d-----w- c:\users\Maria Wohlfarth\AppData\Roaming\OCS
2013-02-15 22:31 . 2013-02-15 22:31 186432 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2013-02-15 22:31 . 2013-02-15 22:31 186432 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-02-14 02:03 . 2013-01-09 01:10 996352 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 02:03 . 2013-01-08 22:01 768000 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 02:00 . 2013-01-09 01:53 763424 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2013-02-13 10:27 . 2013-01-05 05:53 5553512 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-02-13 10:26 . 2013-01-05 05:00 3967848 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-02-13 10:26 . 2013-01-05 05:00 3913064 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-02-13 10:26 . 2013-01-04 03:26 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-13 10:26 . 2013-01-04 05:46 215040 ----a-w- c:\windows\system32\winsrv.dll
2013-02-13 10:26 . 2013-01-04 04:51 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-02-13 10:26 . 2013-01-04 02:47 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-02-13 10:26 . 2013-01-04 02:47 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-02-13 10:26 . 2013-01-04 02:47 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-02-13 10:26 . 2013-01-04 02:47 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-02-13 10:26 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-02-13 10:26 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-09 21:11 . 2011-12-02 21:14 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-02-27 22:07 . 2012-08-11 19:52 691568 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-02-27 22:07 . 2012-01-03 15:21 71024 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 02:08 . 2011-12-03 11:58 70004024 ----a-w- c:\windows\system32\MRT.exe
2013-01-17 00:28 . 2011-12-02 23:45 273840 ------w- c:\windows\system32\MpSigStub.exe
2013-01-04 04:43 . 2013-02-13 10:26 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-12-16 17:11 . 2012-12-22 11:46 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-22 11:46 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-22 11:46 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-22 11:46 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-14 15:49 . 2012-02-12 17:32 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F.lux"="c:\users\Maria Wohlfarth\Local Settings\Apps\F.lux\flux.exe" [2009-02-25 962560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]
"SonicMasterTray"="c:\program files (x86)\ASUS\SonicMaster\SonicMasterTray.exe" [2010-07-10 984400]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]
"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2010-11-24 222504]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-10-26 74752]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-02-06 385248]
"Philips Device Listener"="c:\program files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe" [2012-02-08 380416]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-10-05 505872]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe" [2012-10-05 374560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Z1"="c:\users\Aquaria.MariasRechner\Desktop\mbar-1.01.0.1021\mbar\mbar.exe" [2013-03-11 1363016]
.
c:\users\Maria Wohlfarth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Aquaria.MariasRechner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-4-13 548528]
FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2011-10-29 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 31232]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-09 25960]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-10-09 27800]
S2 {73526619-C24F-470B-9BED-53D455FBB5C6};Power Control [2013/02/26 22:05];c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [2012-10-04 14:57 147704]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2011-01-25 379520]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2013-02-06 400608]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-02-06 86752]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2013-02-06 565472]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe [2011-07-07 88704]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [2012-10-05 90640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [2012-10-05 78352]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [2012-10-05 295440]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-01-14 1839616]
S2 GFilterSvc;G-Filter Service;c:\windows\System32\GFilterSvc.exe [2013-02-25 119808]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [2012-06-20 83704]
S2 secinitd;Intelligenter WAN-Miniport KSecDD;c:\windows\system32\d3dxof64.exe [2013-02-25 118272]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Splashtop MDES;Splashtop Meta Data Export Service;c:\asus.sys\SIONExportService.exe [2011-05-10 338208]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-27 378472]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832]
S2 TurboBoost;Intel(R) Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2011-02-26 16768]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-06-02 128488]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 401896]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 76912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 15522931
*NewlyCreated* - ASWMBR
*Deregistered* - 15522931
*Deregistered* - aswMBR
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-11 22:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 416024]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.delta-search.com/?affID=119828&babsrc=HP_ss&mntrId=a06c3664000000000000742f68fa9c99
mStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\
FF - ExtSQL: !HIDDEN! 2013-02-26 00:16; firejump@firejump.net; c:\users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - a06c3664000000000000742f68fa9c99
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15761
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.00:17
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{73526619-C24F-470B-9BED-53D455FBB5C6}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-03-13 17:28:10
ComboFix-quarantined-files.txt 2013-03-13 16:28
.
Vor Suchlauf: 15 Verzeichnis(se), 191.209.304.064 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 193.224.151.040 Bytes frei
.
- - End Of File - - 0FE139D7BAAA960C746E556E1644A30D
Esmeralda |
|
13.03.2013, 21:32
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Im Anschluss: adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Danach eine Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.03.2013, 00:24
| #15 |
| | Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware Hallo Cosinus, mein Post erfolgt wegen der Überschreitung der erlaubten Zeichenanzahl durch die Logs in zwei Teilen. Hier erst mal das Log von JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.7.1 (03.12.2013:1)
OS: Windows 7 Home Premium x64
Ran by Maria Wohlfarth on 13.03.2013 at 22:57:50,80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-542383332-4153358020-2719540128-1001\software\microsoft\internet explorer\main\\Start Page
~~~ Registry Keys
Failed to delete: [Registry Key] hkey_local_machine\software\datamngr
Failed to delete: [Registry Key] hkey_local_machine\software\wow6432node\datamngr
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [File] C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\user.js
Successfully deleted: [File] C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\invalidprefs.js
Successfully deleted: [File] C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\searchplugins\delta.xml
Successfully deleted the following from C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\prefs.js
user_pref("extensions.delta.admin", false);
user_pref("extensions.delta.aflt", "babsst");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.autoRvrt", "false");
user_pref("extensions.delta.dfltLng", "en");
user_pref("extensions.delta.excTlbr", false);
user_pref("extensions.delta.id", "a06c3664000000000000742f68fa9c99");
user_pref("extensions.delta.instlDay", "15761");
user_pref("extensions.delta.instlRef", "sst");
user_pref("extensions.delta.newTab", false);
user_pref("extensions.delta.prdct", "delta");
user_pref("extensions.delta.prtnrId", "delta");
user_pref("extensions.delta.rvrt", "false");
user_pref("extensions.delta.smplGrp", "none");
user_pref("extensions.delta.tlbrId", "base");
user_pref("extensions.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.vrsn", "1.8.10.0");
user_pref("extensions.delta.vrsnTs", "1.8.10.00:17:06");
user_pref("extensions.delta.vrsni", "1.8.10.0");
Emptied folder: C:\Users\Maria Wohlfarth\AppData\Roaming\mozilla\firefox\profiles\zbbzeoyu.default\minidumps [14 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.03.2013 at 23:16:18,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dann habe ich AdwCleaner 2x durchlaufen lassen. Hier die Logs: Code:
ATTFilter # AdwCleaner v2.114 - Datei am 13/03/2013 um 23:26:19 erstellt
# Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Maria Wohlfarth - MARIASRECHNER
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Aquaria.MariasRechner\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
Gestoppt & Gelöscht : GFilterSvc
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\Aquaria.MariasRechner\AppData\Roaming\Mozilla\Firefox\Profiles\kammrivz.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Aquaria.MariasRechner\AppData\Roaming\Mozilla\Firefox\Profiles\kammrivz.default\bprotector_prefs.js
Ordner Gelöscht : C:\Users\Maria Wohlfarth\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\extensions\firejump@firejump.net
Ordner Gelöscht : C:\Users\Maria Wohlfarth\AppData\Roaming\OCS
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{206a7328-437f-4bd9-b53e-12bfee24d588}
Schlüssel Gelöscht : HKCU\Software\a6d88ab73aea45
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\extensions [firejump@firejump.net]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16470
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v10.0.2 (de)
Datei : C:\Users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Aquaria\AppData\Roaming\Mozilla\Firefox\Profiles\tggvfuim.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Aquaria.MariasRechner\AppData\Roaming\Mozilla\Firefox\Profiles\kammrivz.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\gg7hs1gl.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [364 octets] - [13/03/2013 23:25:04]
AdwCleaner[S2].txt - [2408 octets] - [13/03/2013 23:26:19]
########## EOF - \AdwCleaner[S2].txt - [2468 octets] ##########
Code:
ATTFilter # AdwCleaner v2.114 - Datei am 13/03/2013 um 23:34:21 erstellt
# Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Maria Wohlfarth - MARIASRECHNER
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Aquaria.MariasRechner\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16470
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v10.0.2 (de)
Datei : C:\Users\Maria Wohlfarth\AppData\Roaming\Mozilla\Firefox\Profiles\zbbzeoyu.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Aquaria\AppData\Roaming\Mozilla\Firefox\Profiles\tggvfuim.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Aquaria.MariasRechner\AppData\Roaming\Mozilla\Firefox\Profiles\kammrivz.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\gg7hs1gl.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [364 octets] - [13/03/2013 23:25:04]
AdwCleaner[S2].txt - [2531 octets] - [13/03/2013 23:26:19]
AdwCleaner[S3].txt - [1271 octets] - [13/03/2013 23:34:21]
########## EOF - \AdwCleaner[S3].txt - [1331 octets] ##########
|
|
| Themen zu Infektion durch Trojan.Agent.ED, EXP/2012-1723.GE, TR/PSW.Fareit.1142 und weitere Malware |
| antivirus, avira, betriebssystem windows 7, desktop, dllhost.exe, entfernen, escan, eudora, explorer, fehlermeldung, gfiltersvc.exe, home, infizierte, löschen, malware, ntdll.dll, problem, programme, prozess, prozesse, registry, services.exe, starten, suche, svchost.exe, taskhost.exe, trojan.agent.ed, warnung, windows, winlogon.exe, wmp, wuauclt.exe |
Linear-Darstellung
